; and (ii) a telephone number by which an individual can, at no cost to such individual, learn whether that individual’s personal information is included in the breach of security. (3) Regulations and guidance (A) Regulations Not later than 1 year after the date of enactment of this Act, the Commission shall, by regulation under section 553 of title 5, United States Code, establish criteria for determining circumstances under which substitute notification may be provided under paragraph (2), including criteria for determining if notification under paragraph (1) is not feasible due to excessive costs to the person required to provide such notification relative to 5 the resources of such person. Such regulations may also identify other circumstances where substitute notification would be appropriate for any person, including circumstances under which the cost of providing notification exceeds the benefits to consumers. (B) Guidance In addition, the Commission shall provide and publish general guidance with respect to compliance with this subsection. Such guidance shall include— (i) a description of written or email notification that complies with the requirements of paragraph (1); and (ii) guidance on the content of substitute notification under paragraph (2), including the extent of notification to print and broadcast media that complies with the requirements of such paragraph. (e) Other obligations following breach (1) In general A person required to provide notification under subsection (a) shall, upon request of an individual whose personal information was included in the breach of security, provide or arrange for the provision of, to each such individual and at no cost to such individual— (A) consumer credit reports from at least one of the major consumer reporting agencies beginning not later than 30 days following the individual’s request and continuing on a quarterly basis for a period of 10 years thereafter