If a consumer reporting agency violates the provisions of the Fair Credit Reporting and Identity Security Act, the affected consumer or the attorney general may bring a civil action against the consumer reporting agency for:
A. injunctive relief to prevent further violation of the Fair Credit Reporting and Identity Security Act;
B. any actual damages sustained by the consumer as a result of a violation of the Fair Credit Reporting and Identity Security Act;
C. a civil penalty in an amount not to exceed two thousand dollars ($2,000) for each violation of the security freeze or each violation of the provisions of Subsection D of Section 3 [ 56-3A-3 NMSA 1978] of this 2010 act; and
D. costs of the action and reasonable attorney fees.