The Attorney General may institute a civil action against a person who violates this part to recover for the State a civil penalty not exceeding $1,000 for each violation. For the purposes of this subsection, each prohibited disclosure or use of a credit card number, payment device number, or holder’s signature is an independent violation. The Attorney General may seek an injunction in a civil action to prohibit a person who has engaged or is engaged in a violation of this part from engaging in the violation.