; (ii) is not a service provider used by the covered entity to receive personally identifiable information or sensitive personally identifiable information in performing services or functions on behalf of and under the instruction of the covered entity; and (iii) with respect to the collection of covered information of an individual, does not have an established business relationship with the individual and does not identify itself to the individual at the time of such collection in a clear and conspicuous manner that is visible to the individual. (B) Common brands The term third party may include, with respect to a covered entity, a person who operates under a common brand with the covered entity. (8) Unauthorized use (A) In general The term unauthorized use means the use of covered information by a covered entity or its service provider for any purpose not authorized by the individual to whom such information relates. (B) Exceptions Except as provided in subparagraph (C), the term unauthorized use does not include use of covered information relating to an individual by a covered entity or its service provider as follows: (i) To process and enforce a transaction or deliver a service requested by that individual. (ii) To operate the covered entity that is providing a transaction or delivering a service requested by that individual, such as inventory management, financial reporting and accounting, planning, and product or service improvement or forecasting. (iii) To prevent or detect fraud or to provide for a physically or virtually secure environment. (iv) To investigate a possible crime. (v) That is required by a provision of law or legal process. (vi) To market or advertise to an individual from a covered entity within the context of a covered entity's own Internet website, services, or products if the covered information used for such marketing or advertising was— (I) collected directly by the covered entity; or (II) shared with the covered entity— (aa) at the affirmative request of the individual