; (D) disgorgement or compensation for unjust enrichment; (E) payment of damages or other monetary relief; (F) public notification regarding the violation, including the costs of notification; (G) limits on the activities or functions of the covered entity; and (H) civil money penalties, as set forth more fully in subsection (f). (3) No exemplary or punitive damages Nothing in this subsection shall be construed as authorizing the imposition of exemplary or punitive damages. (e) Recovery of costs In any action brought by the Agency, a State attorney general, or any State regulator to enforce any Federal privacy law, the Agency, the State attorney general, or the State regulator may recover its costs in connection with prosecuting such action if the Agency, the State attorney general, or the State regulator is the prevailing party in the action. (f) Civil money penalty in court and administrative actions (1) In general Any person that violates, through any act or omission, any provision of Federal privacy law shall forfeit and pay a civil penalty pursuant to this subsection. (2) Penalty amounts (A) First tier For any violation of a law, rule, or final order or condition imposed in writing by the Agency, a civil penalty may not exceed $5,000 for each day during which such violation or failure to pay continues. (B) Second tier Notwithstanding subparagraph (A), for any person that recklessly engages in a violation of a Federal privacy law, a civil penalty may not exceed $25,000 for each day during which such violation continues. (C) Third tier Notwithstanding subparagraphs (A) and (B), for any person that knowingly violates a Federal privacy law, a civil penalty may not exceed $1,000,000 for each day during which such violation continues. (3) Mitigating factors In determining the amount of any penalty assessed under paragraph (2), the Agency or the court shall take into account the appropriateness of the penalty with respect to— (A) the size of financial resources and good faith of the person charged