RSA 651-F:7: Penalties.

I. Any person who purposely obtains, receives, uses, disseminates to an unauthorized individual, or retains any personally identifiable information on individuals in contravention of the provisions of this chapter shall be guilty of a felony and subject to a fine of $1,000 for each such violation. Prosecutions under this section shall be the responsibility of the attorney general.

II. An aggrieved individual may bring suit for civil penalties for up to $10,000 or actual damages, whichever is greater, for a violation of this section, but no action against the state shall exceed the limits to which the state has waived its sovereign immunity. The court may also award court costs and reasonable attorney's fees.