(II) A unique account identifier, including a financial account number or credit or debit card number, electronic identification number, user name, or routing code. (III) Any security code, access code, or password, or source code that could be used to generate such codes or passwords. (B) Modified definition by rulemaking The Commission may, by rule prescribed in accordance with section 553 of title 5, United States Code, amend the definition of sensitive personally identifiable information to the extent that such amendment will accomplish the purposes of this Act. In amending the definition, the Commission may determine— (i) that any particular combinations of information are sensitive personally identifiable information