; and (ii) all log-in information associated with databases or data systems containing sensitive personally identifiable information, including both administrator and user log-in information. (C) Fraudulent or misleading information The risk assessment does not contain fraudulent or deliberately misleading information. (c) Financial fraud prevention exemption (1) In general A business entity is exempt from the notification requirement under section 2 if the business entity uses or participates in a security program that— (A) effectively blocks the use of the sensitive personally identifiable information to initiate unauthorized financial transactions before they are charged to the account of the individual