if such carriers and nonprofit organizations were persons over which the Commission has authority pursuant to section 5(a)(2) of the Federal Trade Commission Act ( 15 U.S.C. 45(a)(2) ). (c) Rulemaking authority (1) Limitation In promulgating rules under this title, the Commission may not require the deployment or use of any specific products or technologies, including any specific computer software or hardware. (2) Administrative procedure The Commission shall promulgate regulations under this title in accordance with section 553 of title 5, United States Code. (d) Rule of construction Nothing in this title shall be construed to limit the authority of the Commission under any other provision of law. 153. Enforcement by Attorney General (a) In general The Attorney General may bring a civil action in the appropriate United States district court against any covered entity that engages in conduct constituting a violation of section 143. (b) Penalties (1) In general Upon proof of such conduct by a preponderance of the evidence, a covered entity shall be subject to a civil penalty of not more than $1,000 per individual whose personally identifiable information was or is reasonably believed to have been accessed or acquired as a result of the breach of security that is the basis of the violation, up to a maximum of $100,000 per day while such violation persists. (2) Limitations The total amount of the civil penalty assessed under this subsection against a covered entity for acts or omissions relating to a single breach of security shall not exceed $3,000,000, unless the conduct constituting a violation of subtitle D was reckless or repeated, in which case an additional civil penalty of up to $3,000,000 may be imposed. (3) Adjustment for inflation Beginning on the date that the Consumer Price Index is first published by the Bureau of Labor Statistics that is after 1 year after the date of enactment of this Act, and each year thereafter, the amounts specified in paragraphs (1) and (2) shall be increased by the percentage