30-14-2817. Enforcement. (1) The attorney general has exclusive authority and may use the duties and powers provided by Title 30, chapter 14, parts 1 and 2, to enforce violations pursuant to this part.

(2) The attorney general shall post on the attorney general's website:

(a) information relating to:

(i) the responsibilities of a controller pursuant to this part;

(ii) the responsibilities of a processor pursuant to this part; and

(iii) a consumer's rights pursuant to this part; and

(b) an online mechanism through which a consumer may submit a complaint regarding consumer data privacy to the attorney general.

(3) (a) If the attorney general has reasonable cause to believe that a person has engaged in or is engaging in a violation of this part, the attorney general may issue a civil investigative demand pursuant to 30-14-113.

(b) As part of a civil investigative demand, the attorney general may request that a controller disclose any data protection assessment that is relevant to an investigation conducted by the attorney general. The attorney general may evaluate the data protection assessment for compliance with the requirements pursuant to this part.

(4) Actions brought by the department to enforce this part are subject to the statute of limitations pursuant to 27-2-231.

(5) Nothing in this part may be construed as providing the basis for or be subject to a private right of action for violations of this part or any other law.