; (B) the gravity of the violation or failure to pay; (C) the severity of the risks to or losses of the individual or group of individuals affected by the violation; (D) the history of previous violations; and (E) such other matters as justice may require. (4) Authority to modify or remit penalty The Agency may compromise, modify, or remit any penalty which may be assessed or had already been assessed under paragraph (2). The amount of such penalty, when finally determined, shall be exclusive of any sums owed by the covered entity to the United States in connection with the costs of the proceeding, and may be deducted from any sums owing by the United States to the covered entity charged. (5) Notice and hearing No civil penalty may be assessed under this subsection with respect to a violation of any Federal privacy law, unless— (A) the Agency gives notice and an opportunity for a hearing to the person accused of the violation