or more of the following data elements: (I) An individual’s first and last name or first initial and last name. (II) A unique account identifier, including a financial account number or credit or debit card number, electronic identification number, user name, or routing code. (III) Any security code, access code, or password, or source code that could be used to generate such codes or passwords. (viii) Information generated or derived from the operation or use of an electronic communications device that is sufficient to identify the street name and name of the city or town in which the device is located. (ix) Any information regarding an individual’s medical history, mental or physical condition, medical treatment or diagnosis by a health care professional, or the provision of health care to the individual, including health information provided to a website or mobile application. (x) A health insurance policy number or subscriber identification number and any unique identifier used by a health insurer to identify the individual, or any information in an individual’s health insurance application and claims history, including any appeals records. (xi) Digitized or other electronic signature. (xii) Nonpublic communications or other user-created content such as emails, photographs, or videos. (xiii) Any record or information concerning payroll, income, financial accounts, mortgages, loans, lines of credit, utility bills, accumulated purchases, or any other information regarding financial assets, obligations, or spending habits. (xiv) Any additional element the Commission defines as personal information. (B) Modified definition by rulemaking The Commission may, by rule promulgated under section 553 of title 5, United States Code, modify the definition of personal information under subparagraph (A). (10) Public record information The term public record information means information about an individual which has been obtained originally from records of a Federal, State, or local government entity that are available for