What is the statutory penalty for violation of the CCPA where there is no private right of action?