; (II) the intent of the covered entity or service provider in committing the violation; (III) the size, complexity, and resources of the covered entity or service provider, including if it is a small business; (IV) reasonable expectations relating to privacy and security of personal data of individuals; (V) the degree to which the covered entity or service provider put in place appropriate controls or complied with the requirements of section 7, if applicable; (VI) whether the covered entity or service provider self-reported the violation to the Commission; and (VII) what, if any, efforts the covered entity or service provider has taken to mitigate any risk to the privacy and security of personal data of individuals created by the processing. (b) Enforcement by State attorneys general (1) Civil action In any case in which an attorney general of a State has reason to believe that an interest of the residents of that State has been or is threatened or adversely affected by the engagement of any covered entity or service provider in a practice that violates this Act or a regulation promulgated under this Act, the attorney general of the State may, as parens patriae, bring a civil action on behalf of the residents of the State in an appropriate district court of the United States to— (A) enjoin that practice; (B) enforce compliance with this Act or the regulation