; (2) have a process to respond to non-frivolous inquiries from individuals regarding the collection, use, transfer, or storage of covered information relating to such individuals; and (3) describe the means of compliance of the covered entity with the requirements of this Act upon request from— (A) the Commission; or (B) an appropriate safe harbor program established under section 151. 113. Privacy by design Each covered entity shall, in a manner proportional to the size, type, and nature of the covered information that it collects, implement a comprehensive information privacy program by— (1) incorporating necessary development processes and practices throughout the product life cycle that are designed to safeguard the personally identifiable information that is covered information of individuals based on— (A) the reasonable expectations of such individuals regarding privacy; and (B) the relevant threats that need to be guarded against in meeting those expectations; and (2) maintaining appropriate management processes and practices throughout the data life cycle that are designed to ensure that information systems comply with— (A) the provisions of this title; (B) the privacy policies of a covered entity; and (C) the privacy preferences of individuals that are consistent with the consent choices and related mechanisms of individual participation as described in section 122. B Right to notice and individual participation 121. Transparent notice of practices and purposes (a) In general Not later than 60 days after the date of enactment of this Act, the Commission shall initiate a rulemaking proceeding to require each covered entity— (1) to provide accurate, clear, concise, and timely notice to individuals of— (A) the practices of the covered entity regarding the collection, use, transfer, and storage of covered information; and (B) the specific purposes of those practices; (2) to provide accurate, clear, concise, and timely notice to individuals before implementing a material change in such practices