; or (II) collecting the financial obligation owed on the account, contract, or debt; (ii) any person acting under a court order, warrant, or subpoena; (iii) a Federal, State, or local government or an agent or assignee of a Federal, State, or local government; (iv) any person for the sole purpose of providing a credit monitoring or identity theft protection service to which the consumer has subscribed; (v) any person for the purpose of providing a consumer with a copy of the consumer report, credit score, or educational credit score of the consumer upon request by the consumer; (vi) any person or entity for insurance purposes, including use in setting or adjusting a rate, adjusting a claim, or underwriting; and (vii) any person acting under an authorization from a consumer to use the consumer report of the consumer for employment purposes; (5) the term data breach means the loss, theft, or other unauthorized access, other than access that is incidental to the scope of employment, of data containing sensitive personal information, in electronic or printed form, that results in the potential compromise of the confidentiality or integrity of the data; and (6) the term sensitive personal information means, with respect to an individual, information— (A) about the individual relating to the education, financial transactions, medical history, criminal history, or employment history of the individual; and (B) that can be used to distinguish or trace the identity of the individual, including the name, social security number, date and place of birth, mother’s maiden name, and biometric records of the individual. (b) Data breaches at consumer reporting agencies With respect to a data breach at a consumer reporting agency, the consumer reporting agency— (1) shall notify— (A) not later than 2 days after the date on which the consumer reporting agency discovers the data breach— (i) the Federal Trade Commission; (ii) the Bureau