; and (E) changes to sensitive personally identifiable information systems. (f) Implementation timeline Not later than 1 year after the date of enactment of this Act, a covered entity subject to the provisions of this subtitle shall implement a consumer privacy and data security program pursuant to this subtitle. 203. Federal enforcement (a) In general The Attorney General and the Federal Trade Commission may enforce civil violations of section 201 or 202. (b) Civil actions by the Attorney General of the United States (1) In general The Attorney General may bring a civil action in the appropriate United States district court against any covered entity that engages in conduct constituting a violation of this subtitle and, upon proof of such conduct by a preponderance of the evidence, such covered entity shall be subject to a civil penalty in an amount that is not greater than the product of the number of individuals whose sensitive personally identifiable information was placed at risk as a result of the violation and $16,500. (2) Penalty limitation Notwithstanding any other provision of law, the total amount of the civil penalty assessed against a covered entity for conduct involving the same or related acts or omissions that results in a violation of this subtitle may not exceed $5,000,000, unless such conduct is found to be willful or intentional. (3) Determinations The determination of whether a violation of a provision of this subtitle has occurred, and if so, the amount of the penalty to be imposed, if any, shall be made by the court sitting as the finder of fact. The determination of whether a violation of a provision of this subtitle was willful or intentional, and if so, the amount of the additional penalty to be imposed, if any, shall be made by the court sitting as the finder of fact. (4) Additional penalty limit If a court determines under paragraph (3) that a violation of a provision of this subtitle was willful or intentional and imposes an additional penalty, the court may not impose an additional