(1) A civil action against a person who violates any provision of Part 2, Phishing and Pharming, may be filed by:
(a) an Internet service provider that is adversely affected by the violation;
(b) an owner of a webpage, computer server, or a trademark that is used without authorization in the violation; or
(c) the attorney general.
(2) A person permitted to bring a civil action under Subsection (1) may obtain either actual damages for a violation of this chapter or a civil penalty not to exceed $150,000 per violation of Part 2, Phishing and Pharming.
(3) A violation of Part 2, Phishing and Pharming, by a state-chartered or licensed financial institution is enforceable exclusively by the financial institution's primary state regulator.