; or (B) the appropriate court has ordered such assessment and entered judgment in favor of the Agency, State attorney general, or State privacy regulator. 407. Referral for criminal proceedings If the Agency obtains evidence that any person, domestic or foreign, has engaged in conduct that may constitute a violation of Federal criminal law, the Agency shall transmit such evidence to the Attorney General of the United States, who may institute criminal proceedings under appropriate law. Nothing in this section affects any other authority of the Agency to disclose information. 408. Whistleblower enforcement (a) In general Any person who becomes aware, based on nonpublic information, that a covered entity has violated this Act may file a civil action for civil penalties, if prior to filing such action, the person files with the Director a written request for the Director to commence the action. The request shall include a clear and concise statement of the grounds for believing a cause of action exists. The person shall make the nonpublic information available to the Director upon request: (1) If the Director files suit within 90 days from receipt of the written request to commence the action, no other action may be brought unless the action brought by the Director is dismissed without prejudice. (2) If the Director does not file suit within 90 days from receipt of the written request to commence the action, the person requesting the action may proceed to file a civil action. (3) The time period within which a civil action shall be commenced shall be tolled from the date of receipt by the Director of the written request to either the date that the civil action is dismissed without prejudice, or for 150 days, whichever is later, but only for a civil action brought by the person who requested the Director to commence the action. (b) Allocation of civil penalties If a judgment is entered against the defendant or defendants in an action brought pursuant to this section, or the matter is settled, amounts received as