to the breach notification entity. If the Commission determines that additional time is necessary, the Commission may extend the time period for notification for additional periods of up to 30 days each. Any such extension shall be provided in writing. 7. Notification for law enforcement and other purposes (a) Notification to law enforcement and national security authorities Any business entity shall notify the breach notification entity, and the breach notification entity shall promptly notify and provide that information to the United States Secret Service, the Federal Bureau of Investigation, and the Commission for civil law enforcement purposes, and shall make it available as appropriate to other Federal agencies for law enforcement, national security, or computer security purposes, if— (1) the number of individuals whose sensitive personally identifiable information was, or is reasonably believed to have been, accessed or acquired by an unauthorized person exceeds 5,000