32 CFR 312.11 - Penalties.
(a) An individual may bring a civil action against the OIG to correct or amend the record, or where there is a refusal to comply with an individual request or failure to maintain any records with accuracy, relevance, timeliness and completeness, so as to guarantee fairness, or failure to comply with any other provision of the Privacy Act. The court may order correction or amendment of records. The court may enjoin the OIG from withholding the records and order the production of the record.
(b) Where it is determined that the action was willful or intentional with respect to 5 U.S.C. 552a(g)(1) (C) or (D), the United States shall be liable for the actual damages sustained, but in no case less than the sum of $1,000 and the costs of the action with attorney fees.
(c) Criminal penalties may be imposed against an officer or employee of the OIG who discloses material, which he/she knows is prohibited from disclosure, or who willfully maintains a system of records without compliance with the notice requirements.
(d) Criminal penalties may be imposed against any person who knowingly and willfully requests or obtains any record concerning another individual from an agency under false pretenses.
(e) All of these offenses are misdemeanors with a fine not to exceed $5,000.