; (iii) the acts the covered entity, or the agent of the covered entity, has taken to protect personal information from further breach of security; (iv) a telephone number, website, and email address that the individual may use, at no cost to such individual, to contact the covered entity, or agent of the covered entity, to inquire about the breach of security or the information the covered entity maintained about that individual; (v) in the case of an individual that is entitled to receive services under subsection (e), notification that the individual is entitled to receive such services; (vi) the toll-free contact telephone numbers and addresses for the major consumer reporting agencies; and (vii) a toll-free telephone number and Internet website address for the Commission whereby the individual may obtain information regarding identity theft. (B) Direct business relationship The notification required under subsection (a) shall identify the covered entity that has a direct business relationship with the individual, if applicable, as well as the entity that experienced the breach of security. (5) Regulations for substitute notification Not later than 1 year after the date of enactment of this Act, the Commission shall, by regulation under section 553 of title 5, United States Code— (A) establish criteria for determining circumstances under which substitute notification may be provided in lieu of direct notification required by paragraph (1), including criteria for determining if notification under paragraph (1) is not feasible due to excessive costs to the covered entity required to provide such notification relative to the resources of such covered entity; and (B) establish the form and content of substitute notification. (d) Notification for law enforcement and other purposes A covered entity shall, as expeditiously as practicable and without unreasonable delay, but not later than 5 days following the discovery of a breach of security, provide notification of the breach to— (1) the Commission