; or (4) the security breach involves primarily sensitive personally identifiable information of individuals known to the covered entity to be employees and contractors of the Federal Government involved in national security or law enforcement. (c) Department of Justice review of thresholds for notice The Attorney General, in consultation with the Secretary of Homeland Security, after notice and the opportunity for public comment, and in a manner consistent with this section, shall promulgate regulations, as necessary, under section 553 of title 5, United States Code, to adjust the thresholds for notice to law enforcement and national security authorities under subsection (a) and to facilitate the purposes of this section. (d) Timing The notice required under subsection (b) shall be provided as promptly as possible, but such notice must be provided not less than 48 hours before notice is provided to an individual pursuant to section 211, or not later than 7 days after the discovery of the events requiring notice, whichever occurs first. For each breach requiring notice under this subsection, a copy of the notice to individuals required under section 211 shall also be provided to the designated entity not later than the date on which the notice is provided to affected individuals. 218. Federal enforcement (a) In general The Attorney General and the Federal Trade Commission may enforce civil violations of this subtitle. (b) Civil actions by the Attorney General of the United States (1) In general The Attorney General may bring a civil action in the appropriate United States district court against any covered entity that engages in conduct constituting a violation of this subtitle and, upon proof of such conduct by a preponderance of the evidence, the covered entity shall be subject to a civil penalty in an amount not greater than the product of the number of violations of this subtitle and $16,500. Each failure to provide notification to an individual as required under this subtitle shall be treated as a separate