; and (B) as specified in the contract; (2) require by contract that such third party may not combine information that the covered entity has transferred to it, that relates to an individual, and that is not personally identifiable information with other information in order to identify such individual, unless the covered entity has obtained the opt-in consent of such individual for such combination and identification; and (3) before executing a contract with a third party— (A) assure through due diligence that the third party is a legitimate organization; and (B) in the case of a material violation of the contract, at a minimum notify the Commission of such violation. (b) Transfers to unreliable third parties prohibited A covered entity may not transfer covered information to a third party that the covered entity knows— (1) has intentionally or willfully violated a contract required by subsection (a); and (2) is reasonably likely to violate such contract. (c) Application of rules to third parties (1) In general Except as provided in paragraph (2), a third party that receives covered information from a covered entity shall be subject to the provisions of this Act as if it were a covered entity. (2) Exemption The Commission may, as it determines appropriate, exempt classes of third parties from liability under any provision of subtitle B if the Commission finds that— (A) such class of third parties cannot reasonably comply with such provision