; and (E) changes to sensitive personally identifiable information systems. (f) Consumer notice Not less frequently than once every calendar year, a covered entity shall provide, upon request of a United States resident and at no cost to that individual, notice to that individual of what sensitive personally identifiable information of that individual is maintained or shared by the covered entity. (g) Consumer opt-Out (1) Definitions In this subsection, the terms consumer and file have the meanings given the terms in section 603 of the Fair Credit Reporting Act ( 15 U.S.C. 1681a ). (2) Credit freeze Upon the request of a consumer, a covered entity that is a consumer reporting agency that compiles or maintains a file on the consumer and has received appropriate proof of the identity of the requester shall place or lift a credit freeze in the file of the consumer without charge to the consumer. (h) Rulemaking Not later than 1 year after the date of enactment of this Act, the Federal Trade Commission shall issue regulations in accordance with section 553 of title 5, United States Code, to implement subsections (a) through (g). (i) Implementation timeline Not later than 1 year after the date on which the Federal Trade Commission issues the final regulations required under subsection (h), a covered entity subject to the provisions of this subtitle shall implement a consumer privacy and data security program pursuant to this subtitle. 203. Federal enforcement (a) In general The Attorney General and the Federal Trade Commission may enforce civil violations of section 201 or 202. (b) Civil actions by the Attorney General of the United States (1) In general The Attorney General may bring a civil action in the appropriate United States district court against any covered entity that engages in conduct constituting a violation of this subtitle and, upon proof of such conduct by a preponderance of the evidence, such covered entity shall be subject to a civil penalty in an amount that is not greater than the product of the