(a) If a consumer-reporting agency negligently violates the security freeze by releasing credit information that has been placed under a security freeze, the affected consumer is entitled to:

(1) Notification within five business days following discovery or actual knowledge of the distribution of the information, including specificity as to the information distributed and the third-party recipient of the information.

(2) File a complaint with the Federal Trade Commission or the office of the Attorney General of West Virginia.

(3) File a civil action against the consumer-reporting agency seeking:

(A) Injunctive relief to prevent or restrain further violation of the security freeze;

(B) Actual damages sustained or not more than $1,000, whichever is greater; and

(C) Reasonable expenses, court costs, investigative costs and attorney's fees.

(4) Each violation of the security freeze is a separate incident for purposes of imposing penalties under this section.

(b) If a consumer-reporting agency willfully violates the security freeze by releasing credit information that has been placed under a security freeze, the affected consumer is entitled to:

(1) Notification within five business days following discovery or actual knowledge of the distribution of the information, including specificity as to the information distributed and the third-party recipient of the information.

(2) File a complaint with the Federal Trade Commission or the office of the Attorney General of West Virginia.

(3) File a civil action against the consumer-reporting agency seeking:

(A) Injunctive relief to prevent or restrain further violation of the security freeze;

(B) Actual damages sustained or not more than $5,000, whichever is greater; and

(C) Reasonable expenses, court costs, investigative costs and attorney's fees.

(4) Each violation of the security freeze is a separate incident for purposes of imposing penalties under this section.