Regulators may impose fines for violations, and individuals have a private right of action for any unauthorized disclosure of personal information as a result of failure to maintain reasonable security procedures.