The Attorney General has exclusive enforcement authority, with power to issue civil investigative demands (59.1-583). Before suing, the Attorney General gives 30 days' written notice; a controller or processor that cures and gives an express written statement of cure and no further violations avoids action. The 30-day cure right has no sunset in the current text. Continued violation or breach of the statement allows injunctions and civil penalties of up to 7,500 dollars per violation plus investigation expenses and attorney fees. There is no private right of action.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.