; and (B) is 1,000 words or less. (2) Report on use of information required If a user allows a commercial data operator to sell the covered data of the user, the commercial data operator shall provide the user with an annual report regarding the types of third parties with whom data has been shared. The report shall include a description of what information has been shared, for what purpose information is shared, and a list of each third party that receives data. (i) Data security and breach notification A covered entity shall notify each user in a timely manner of any data breach with respect to the information of the user and provide any remedy to compensate the user for the breach of their information, including a credit protection service, fraud alert, and credit monitoring through credit reporting agencies. (j) Enforcement (1) Enforcement by the Federal Trade Commission (A) Unfair or deceptive acts or practices A violation of this section shall be treated as a violation of a regulation under section 18(a)(1)(B) of the Federal Trade Commission Act ( 15 U.S.C. 57a(a)(1)(B) ) regarding unfair or deceptive acts or practices. (B) Powers of Commission The Commission shall enforce this section in the same manner, by the same means, and with the same jurisdiction, powers, and duties as though all applicable terms and provisions of the Federal Trade Commission Act ( 15 U.S.C. 41 et seq. ) were incorporated into and made a part of this Act. Any person who violates this section shall be subject to the penalties and entitled to the privileges and immunities provided in the Federal Trade Commission Act. (2) Effect on other laws Nothing in this section shall be construed in any way to limit the authority of the Commission under any other provision of law or to limit the application of any Federal or State law. (3) Enforcement by State attorneys general (A) In general If the chief law enforcement officer of a State, or an official or agency designated by a State, has reason to believe that any person has violated or is