Anyone who discloses an individual's nonpublic personal information maintained by a government agency is subject to civil action and penalties by the individual.
