; or (B) unauthorized access, destruction, use, modification, or disclosure of such personal information. (2) Notice Whenever a covered data broker determines that personal information of an individual that is collected, assembled, or maintained by the covered data broker has been lost or the subject of an unauthorized access, destruction, use, modification, or disclosure, the covered data broker shall notify such individual of such loss, access, destruction, use, modification, or disclosure. (h) Persons regulated by the Fair Credit Reporting Act A covered data broker shall be considered to be in compliance with subsections (a) through (f) of this section with respect to information that is subject to the Fair Credit Reporting Act ( 15 U.S.C. 1681 et seq.) if the covered data broker is in compliance with sections 609, 610, and 611 of that Act ( 15 U.S.C. 1681g , 1681h, 1681i). 5. Regulations (a) In general Not later than 1 year after the date of the enactment of this Act, the Commission shall promulgate regulations under section 553 of title 5, United States Code, to carry out this Act. (b) Elements The regulations promulgated under subsection (a) shall include the following: (1) Such exceptions the Commission considers appropriate to promulgate under section 2(2)(B). (2) The period of review required under section 4(b)(3). (3) Such exceptions as the Commission considers appropriate to promulgate under section 4(b)(4). (4) The period of correction required under section 4(c)(3). (5) The model form required by section 4(d)(2). (6) Requirements for auditing under paragraph (1) of section 4(f) and such exceptions under paragraph (2) of such section as the Commission considers appropriate. (7) Establishment of a centralized Internet website for the benefit of consumers that— (A) lists the covered data brokers that are subject to a requirement of section 4