; and (ii) the number of individuals whose personal information is affected by the violation. (B) Continuing violations In the case of a violation through continuing failure to comply with a provision of this Act or a rule or order prescribed under this Act, each day of continuance of such failure shall be treated as a separate violation for purposes of subparagraph (A). (3) Mitigating factors In determining the amount of any penalty assessed under paragraph (2), the court or the Agency shall take into account the appropriateness of the penalty with respect to— (A) the size of financial resources and good faith of the person charged; (B) the gravity of the violation; (C) the severity of the privacy harms (including both actual and potential harms) to individuals; (D) any disparate impact of the privacy harms (including both actual and potential harms) on protected classes; (E) the history of previous violations; and (F) such other matters as justice may require. (4) Authority to modify or remit penalty The Agency, State attorney general, or State privacy regulator may compromise, modify, or remit any penalty which may be assessed or has already been assessed under paragraph (2). The amount of such penalty, when finally determined, shall be exclusive of any sums owed by the person to the United States in connection with the costs of the proceeding, and may be deducted from any sums owing by the United States to the person charged. (5) Notice and hearing No civil penalty may be assessed under this subsection with respect to a violation of any provision of this Act or a rule or order issued pursuant to this Act, unless— (A) the Agency, State attorney general, or State privacy regulator gives notice and an opportunity for a hearing to the person accused of the violation