; or (ii) access to sensitive personally identifiable information that is for an unauthorized purpose, or in excess of authorization. (B) Exclusion The term security breach does not include any lawfully authorized investigative, protective, or intelligence activity of a law enforcement agency of the United States, a State, or a political subdivision of a State, or of an element of the intelligence community (as defined in section 3(4) of the National Security Act of 1947 ( 50 U.S.C. 3003(4) )). (4) Sensitive personally identifiable information (A) In general The term sensitive personally identifiable information means any information or compilation of information, in electronic or digital form, that includes one or more of the following: (i) An individual’s first and last name or first initial and last name in combination with any two of the following data elements: (I) Home address or telephone number. (II) Mother’s maiden name. (III) Month, day, and year of birth. (ii) A Social Security number (but not including only the last four digits of a Social Security number), driver’s license number, passport number, or alien registration number or other Government-issued unique identification number. (iii) Unique biometric data such as a finger print, voice print, a retina or iris image, or any other unique physical representation. (iv) A unique account identifier, including a financial account number or credit or debit card number, electronic identification number, user name, or routing code. (v) A user name or electronic mail address, in combination with a password or security question and answer that would permit access to an online account. (vi) Any combination of the following data elements: (I) An individual’s first and last name or first initial and last name. (II) A unique account identifier, including a financial account number or credit or debit card number, electronic identification number, user name, or routing code. (III) Any security code, access code, or password, or source code that could be used to