(a) A person, whether acting on behalf of the manager or a provider, who obtains, discloses, or uses, or attempts to obtain, disclose, or use identifiable data for a purpose other than aggregation in the Baltimore City Youth Data Hub is guilty of a misdemeanor and on conviction is subject to imprisonment not exceeding 1 year or a fine not exceeding $1,000 or both.

(b) A person, whether acting on behalf of the manager or a provider, is civilly liable to an individual for actual damages, including attorney's fees and litigation costs, that the court considers appropriate if the court finds by clear and convincing evidence that the person committed a violation of any provision of this title that caused any damage to the individual.