; and (B) not later than 10 days after the date of discovery of the events requiring notice. (2) Notice under subsection (d) shall be delivered as promptly as possible, but not later than 1 business day after the date that the designated entity receives notice of a breach of security from a covered entity. 5. Application and enforcement (a) General application The requirements of sections 2 and 3 shall apply to— (1) those persons, partnerships, or corporations over which the Commission has authority under section 5(a)(2) of the Federal Trade Commission Act ( 15 U.S.C. 45(a)(2) ); and (2) notwithstanding sections 4 and 5(a)(2) of the Federal Trade Commission Act ( 15 U.S.C. 44 and 45(a)(2)), any nonprofit organization, including any organization described in section 501(c) of the Internal Revenue Code of 1986 that is exempt from taxation under section 501(a) of the Internal Revenue Code of 1986. (b) Opt-In for certain other entities (1) In general Notwithstanding sections 4 and 5(a)(2) of the Federal Trade Commission Act ( 15 U.S.C. 44 and 45(a)(2)), the requirements of section 3 shall apply to any other covered entity not included under subsection (a) that enters into an agreement with the Commission under which that covered entity would be subject to section 3 with respect to any acts or omissions that occur while the agreement is in effect and that may constitute a violation of section 3, if— (A) not less than 30 days prior to entering into the agreement with the covered entity, the Commission publishes notice in the Federal Register of the Commission's intent to enter into the agreement; and (B) not later than 14 business days after entering into the agreement with the covered entity, the Commission publishes in the Federal Register— (i) notice of the agreement; (ii) the identity of each person covered by the agreement