considers, by rule, a data broker outside the scope of this Act, such as a data broker who processes information collected by or on behalf of and received from or on behalf of a nonaffiliated third party concerning an individual who is a customer or an employee of that third party to enable that third party, directly or through parties acting on its behalf, to provide benefits for its employees or directly transact business with its customers. (3) Data broker The term data broker means a commercial entity that collects, assembles, or maintains personal information concerning an individual who is not a customer or an employee of that entity in order to sell the information or provide third party access to the information. (4) Non-public information The term non-public information means information about an individual that is— (A) of a private nature