; and (ii) guidance on the content of substitute notification under paragraph (2), including the extent of notification to print and broadcast media that complies with paragraph (2)(B)(iii). (e) Other obligations following breach (1) In general Not later than 60 days after the date of request by an individual who received notification under subsection (a)(1) and quarterly thereafter for 2 years, a covered entity required to provide notification under subsection (a)(1) shall provide, or arrange for the provision of, to the individual at no cost, consumer credit reports from at least 1 major credit reporting agency. (2) Limitation This subsection shall not apply if the only personal information that is the subject of the breach of security is the individual's first name or initial and last name, or address, or phone number, in combination with a credit or debit card number, and any required security code. (3) Rulemaking The Commission's rulemaking under subsection (d)(3) shall include— (A) determination of the circumstances under which a covered entity required to provide notification under subsection (a)(1) must provide or arrange for the provision of free consumer credit reports