(a) If a consumer-reporting agency negligently violates the security freeze by releasing credit information that has been placed under a security freeze, the affected consumer is entitled to:
(1) Notification within five business days following discovery or actual knowledge of the distribution of the information, including specificity as to the information distributed and the third-party recipient of the information.