; (bb) closing accounts of the affected individual that may have been compromised by the data breach; and (cc) imposing credit freezes and obtaining credit monitoring services; and (ii) any revenue lost, or cost or consequential damage incurred, by the affected individual relating to the interruption of the ability of the affected individual to obtain credit. (B) Cause of action (i) In general An affected individual may bring an action in an appropriate district court of the United States against any person that negligently, knowingly, or willingly caused a data breach at a consumer reporting agency in which the sensitive personal information of the affected individual was lost, stolen, or accessed without authorization. (ii) Damages In a successful action brought by an affected individual under clause (i), the affected individual may recover— (I) the greater of— (aa) the actual loss to the affected individual with respect to the data breach described in that clause; or (bb) $1,000 in liquidated damages; (II) punitive damages, as the court may allow; and (III) the costs of the action, together with reasonable attorney’s fees, as determined by the court. (d) Review of compliance with standards for safeguarding customer information (1) Definition In this subsection, the term covered person has the meaning given the term in section 1002 of the Consumer Financial Protection Act of 2010 ( 12 U.S.C. 5481 ). (2) Examination The Bureau may examine any consumer reporting agency that is a covered person subject to supervision under section 1024 of the Consumer Financial Protection Act of 2010 ( 12 U.S.C. 5514 ) for compliance by that agency with the standards established by the Federal Trade Commission under section 501(b) of the Gramm-Leach-Bliley Act ( 15 U.S.C. 6801(b) ). (e) Protection of legal rights of consumers A consumer reporting agency may not take a covered action— (1) as a condition of providing any service or product to, or on behalf of, a consumer