breach (1) In general Subject to the provisions of this subsection, not later than 60 days after the date of a request by an individual who received notification under subsection (a)(1) and quarterly thereafter for 2 years, a covered entity required to provide notification under such subsection to such individual shall provide, or arrange for the provision of, to such individual at no cost to such individual, consumer credit reports from at least 1 major credit reporting agency. (2) Limitation Paragraph (1) shall not apply if the only personally identifiable information that is the subject of the breach of security is the individual's first name or initial and last name, or address, or phone number, in combination with a credit or debit card number, and any required security code. (3) Rulemaking Not later than 1 year after the date of enactment of this Act, the Commission shall prescribe the following: (A) Criteria for determining the circumstances under which a covered entity required to provide notification under subsection (a)(1) must provide or arrange for the provision of free consumer credit reports under this subsection. (B) A simple process under which a covered entity that is a small business concern or small nonprofit organization may request a full or a partial waiver or a modified or an alternative means of complying with this subsection if providing free consumer credit reports is not feasible due to excessive costs relative to the resources of such covered entity and relative to the level of harm, to affected individuals, caused by the breach of security. (4) Definitions In this subsection: (A) Small business concern The term small business concern has the meaning given such term under section 3 of the Small Business Act ( 15 U.S.C. 632 ). (B) Small nonprofit organization The term small nonprofit organization has the meaning the Commission shall give such term for purposes of this subsection. (f) Delay of notification authorized for national security and law enforcement purposes (1) In general If