investigation, or national security activity, such notification or provision of identity theft prevention and mitigation service, as the case may be, shall be delayed upon written notice from a Federal law enforcement agency or intelligence agency to the covered entity that experienced the security breach. The notification from a Federal law enforcement agency or intelligence agency shall specify in writing the period of delay requested for law enforcement or national security purposes. (2) Extended delay If the notification or provision of identity theft prevention and mitigation service required under subsection (a) is delayed pursuant to paragraph (1), a covered entity shall give notice or identity theft prevention and mitigation service, as the case may be, 15 days after the day such law enforcement or national security delay was invoked unless a Federal law enforcement or intelligence agency provides written notification that further delay is necessary. (3) Law enforcement immunity No nonconstitutional cause of action shall lie in any court against any agency for acts relating to the delay of notification for law enforcement or national security purposes under this subtitle. (e) Limitations Notwithstanding any other obligation under this subtitle, this subtitle does not apply to the following: (1) Financial institutions Financial institutions— (A) subject to and in compliance with the data security requirements and standards under section 501(b) of the Gramm-Leach-Bliley Act ( 15 U.S.C. 6801(b) )