A civil action may be instituted to recover actual damages resulting from the failure to disclose in a timely manner to a person that there has been a breach of the security system resulting in the disclosure of a person's personal information. La. R.S. § 51:3075 Acts 2005, No. 499, §1, eff. Jan. 1, 2006. Acts 2005, No. 499, §1, eff. 1/1/2006.