State enforcement

(a) In general In any case in which a State attorney general or a State privacy regulator has reason to believe that an interest of the residents of a State has been or is adversely affected by any covered entity that violates any provision of this Act, the State attorney general or State privacy regulator, as parens patriae, may bring a civil action on behalf of the residents of the State in an appropriate State court or an appropriate district court of the United States to— (1) enjoin further violation of such provision by the covered entity; (2) compel compliance with such provision; (3) obtain damages, civil penalties, restitution, or other compensation on behalf of the residents of the State; or (4) obtain reasonable attorney’s fees and other litigation costs reasonably incurred. (b) Rights of agency Before initiating a civil action under subsection (a), the State attorney general or State privacy regulator, as the case may be, shall notify the Secretary in writing of such civil action. Upon receiving such notice, the Secretary may— (1) intervene in such action; and (2) upon intervening— (A) be heard on all matters arising in such civil action; and (B) file petitions for appeal of a decision in such action. (c) Preemptive action by agency In any case in which a civil action is instituted by or on behalf of the Secretary for a violation of this Act, a State attorney general or State privacy regulator may not, during the pendency of such action, institute a civil action against any defendant named in the complaint in the action instituted by or on behalf of the Secretary for a violation that is alleged in such complaint. In a case brought by the Secretary that affects the interests of a State, the State attorney general or State privacy regulator may intervene as of right pursuant to the Federal Rules of Civil Procedure. (d) Preservation of State powers Except as provided in subsection (c), no provision of this Act shall be construed as altering, limiting, or affecting the authority of a State attorney general or State privacy regulator to— (1) bring an action or other regulatory proceeding arising solely under the laws in effect in that State; or (2) exercise the powers conferred on the State attorney general or State privacy regulator by the laws of the State, including the ability to conduct investigations, administer oaths or affirmations, or compel the attendance of witnesses or the production of documentary or other evidence. (e) Definition of Secretary In this section, the term Secretary means— (1) with respect to a violation of title I, the Secretary of Health and Human Services; and (2) with respect to a violation of title II, the Secretary of Labor.