; (iii) notification that the individual is entitled to receive, at no cost to such individual, consumer credit reports on a quarterly basis for a period of 5 years, or credit monitoring or other service that enables consumers to detect the misuse of their personal information for a period of 5 years, and instructions to the individual on requesting such reports or service from the covered entity; (iv) the toll-free contact telephone numbers and addresses for the major credit reporting agencies; and (v) a toll-free telephone number and Internet website address for the Commission whereby the individual may obtain information regarding identity theft. (B) Direct business relationship Regardless of whether the covered entity or a designated third party provides notification under this subsection, such notification shall identify the covered entity that has a direct business relationship with the individual. (5) Regulations for substitute notification Not later than 1 year after the date of enactment of this Act, the Commission shall, by regulation under section 553 of title 5, United States Code— (A) establish criteria for determining circumstances under which substitute notification may be provided in lieu of direct notification required by paragraph (1), including criteria for determining if notification under paragraph (1) is not feasible due to excessive costs to the covered entity required to provided such notification relative to the resources of such covered entity; and (B) establish the form and content of substitute notification. (d) Notification for law enforcement and other purposes A covered entity shall, as expeditiously as practicable and without unreasonable delay, but not later than 14 days following the discovery of a breach of security, provide notification of the breach to— (1) the Commission; (2) the Federal Bureau of Investigation; (3) the Secret Service; (4) for common carriers, the Federal Communications Commission; (5) the Consumer Financial Protection Bureau