Section 3B. Any holder, as that term is defined in chapter sixty-six A, which violates any provision of said chapter sixty-six A, shall be liable to any individual who suffers any damage as a result of such violations, and the individual damaged may bring an action against such holder to recover any damages sustained. Notwithstanding any liability for actual damages as may be shown, such holder shall be liable for exemplary damages of not less than one hundred dollars for each violation together with such costs and reasonable attorney's fees as may be incurred in said action.

Any holder which violates or proposes to violate any of the provisions of chapter sixty-six A shall be subject to an action for injunction, declaratory judgment, or mandamus issued by any court of competent jurisdiction. The court may make such order or judgment as may be necessary to prevent any holder from employing practices which violate chapter sixty-six A. Actions for injunction or mandamus under this section may be prosecuted by an individual or by the attorney general in the name of the commonwealth upon his own complaint or upon the complaint of any individual.

An action to enforce any liability created under chapter sixty-six A, may be brought in any court of competent jurisdiction within three years from the date in which the liability arises; provided, however, that where a defendant had materially or willfully misused any personal data required to be disclosed to a data subject according to the provisions of chapter sixty-six A, and said personal data so misused is material to the establishment of the defendant's liability to the data subject, the action may be brought at any time within three years after such misuse is discovered.