; and (B) file petitions for appeal of a decision in such action. (c) Preemptive action by agency If the Agency institutes a civil action for violation of any provision of this Act or a rule or order prescribed under this Act, no State attorney general or State privacy regulator may bring a civil action against any defendant named in the complaint of the Agency for a violation of such provision that is alleged in such complaint. 405. Private rights of action (a) Injunctive relief A person who is aggrieved by a violation of this Act may bring a civil action for declaratory or injunctive relief in any court of competent jurisdiction in any State or in an appropriate district court. (b) Civil action for damages Except for claims under rule 23 of the Federal Rules of Civil Procedure or a similar judicial procedure authorizing an action to be brought by 1 or more representatives, a person who is aggrieved by a violation of this Act may bring a civil action for damages in any court of competent jurisdiction in any State or in an appropriate district court. (c) Nonprofit collective representation An individual shall have the right to appoint a nonprofit organization (as described in section 501(c)(3) of the Internal Revenue Code of 1986 and exempt from taxation under section 501(a) of such Code) which has been properly constituted in accordance with the law, has statutory objectives which are in the public interest, and is active in the field of the protection of individual rights and freedoms with regard to the protection of privacy and information security to lodge the complaint on behalf of such individual to exercise the rights referred to in this Act on behalf of such individual. (1) A nonprofit may represent a class of aggrieved individuals. (2) A prevailing nonprofit shall receive reasonable compensation for expenses, including attorneys’ fees. (3) Individuals shall receive an equally divided share of the total damages. (d) State Appointment A State may provide that any body, organization, or association referred