; and (v) changes to personal information systems. (4) Submission of policies to the FTC The regulations promulgated under this subsection shall require each covered entity to submit its security policies to the Commission in conjunction with a notification of a breach of security under section 3 or upon request of the Commission. (5) Treatment of entities governed by other federal law Any covered entity who is in compliance with any other Federal law that requires such covered entity to maintain standards and safeguards for information security and protection of personal information that, taken as a whole and as the Commission shall determine in the rulemaking required under this subsection, requires covered entities to provide protections substantially similar to, or greater than, those required under this subsection, shall be deemed to be in compliance with this subsection. (b) Special requirements for information brokers (1) Post-breach audit For any information broker required to provide notification under section 3, the Commission may require the information broker to conduct independent audits of such practices (by an independent auditor who has not audited such information broker’s security practices during the preceding 5 years). (2) Accuracy of and individual access to personal information (A) Accuracy (i) In general Each information broker shall establish reasonable procedures to assure the maximum possible accuracy of the personal information the information broker collects, assembles, or maintains, and any other information the information broker collects, assembles, or maintains that specifically identifies an individual, other than information which merely identifies an individual’s name or address. (ii) Limited exception for fraud databases The requirement in clause (i) shall not prevent the collection or maintenance of information that may be inaccurate with respect to a particular individual when that information is being collected or maintained solely— (I) for the purpose of indicating whether