; and (III) which does not constitute a material change in use or practice from what could have reasonably been expected. (C) Savings A use of covered information regarding an individual by a covered entity or its service provider may only be excluded under subparagraph (B) from the definition of unauthorized use under subparagraph (A) if the use is reasonable and consistent with the practices and purposes described in the notice given the individual in accordance with section 121(a)(1). (9) Unique identifier information The term unique identifier information means a unique persistent identifier associated with an individual or a networked device, including a customer number held in a cookie, a user identification, a processor serial number, or a device serial number. (b) Modified definition by rulemaking If the Commission determines that a term defined in any of paragraphs (3) through (8) is not reasonably sufficient to protect an individual from unfair or deceptive acts or practices, the Commission may by rule modify such definition as the Commission considers appropriate to protect such individual from an unfair or deceptive act or practice to the extent that the Commission determines will not unreasonably impede interstate commerce. A Right to security and accountability 111. Security (a) Rulemaking required Not later than 180 days after the date of enactment of this Act, the Commission shall initiate a rulemaking proceeding to require each covered entity to carry out security measures to protect the covered information it collects and maintains. (b) Proportion The requirements prescribed under subsection (a) shall provide for security measures that are proportional to the size, type, nature, and sensitivity of the covered information a covered entity collects. (c) Consistency The requirements prescribed under subsection (a) shall be consistent with guidance provided by the Commission and recognized industry practices for safety and security on the day before the date of enactment of this Act. (d)