Beginning on page 7, after line 7, strike all material through "violation." on page 8, line 3 and insert the following:

"(b)(i) If the commission determines on the basis of the hearing conducted pursuant to (a) of this subsection that a violation has occurred, the commission shall then determine if a consumer, class of consumers, business, class of businesses, controller or processor, or class of controllers or processors suffered injury as a result of the violation. "Injury" may include harm to competition, consumer privacy, or unfair business advantages as a result of a violation.

(ii) The commission may issue an order that may require the violator to do any or all of the following:

(A) Cease and desist the violation; or

(B) Pay an administrative fine of up to $2,500 for each violation, or up to $7,500 for each intentional violation and each violation involving the personal data of a child.

(iii) The commission may also refer the violation to the attorney general for enforcement of any order or injunction, or to obtain damages pursuant to the consumer protection act, chapter 19.86 RCW.

(iv) In addition to any other remedies provided by law, the commission's order issued pursuant to this subsection (5)(b) may be enforced in accordance with chapter 34.05 RCW.

(c) If the commission does not take an enforcement action that includes recovery of damages for injured consumers, businesses, or other persons or entities, and does not refer the violation to the attorney general, any injured consumer or entity may proceed with an action pursuant to chapter 19.86 RCW, including for remedies provided in RCW 19.86.090, for the injury or injuries to competition and privacy interests of individuals. The injured consumer or entity must provide 60 days' written notice prior to bringing an action, as may be required by rule of the commission or attorney general. If the commission or attorney general commences an enforcement action in that period, the injured consumer or entity may not proceed unless the action is not pursued.

(d)(i) After the commission issues a cease and desist order pursuant to (b) of this subsection, on its own initiative or upon the complaint of a consumer who initiated the complaint from which that order originated, the commission may determine whether or not a violator has complied with that order.

(ii) If the commission determines that the violator has not complied with that order and the consumer suffered actual damages due to noncompliance, the commission may issue additional enforcement orders and penalties.

(iii) The commission may also refer the violation and determination of noncompliance to the attorney general for enforcement.

(iv) If the commission or the attorney general does not take additional enforcement action with regard to continued violations, any injured person may bring a civil action under the consumer protection act, chapter 19.86 RCW, to obtain injunctive relief and for recovery of those actual damages, penalties, and reasonable attorneys' fees. The injured consumer or entity must provide 60 days' written notice prior to bringing an action, as may be required by rule of the commission or attorney general. If the commission or attorney general commences an enforcement action in that period, the injured consumer or entity may not proceed unless the action is not pursued."