; and (B) a service that enables consumers to control access to their personal information and credit reports, beginning not later than 60 days following the individual’s request and continuing for a period of not less than 10 years thereafter. (2) Limitation This subsection shall not apply if the only personal information which has been the subject of the breach of security is the individual’s first name or initial and last name, address, or phone number, in combination with a credit or debit card number and any required security code. (f) Exemption (1) General exemption A covered entity shall be exempt from the requirements under this section if the data containing personal information that was, or is reasonably believed to have been, acquired or accessed by an unauthorized person, or used for an unauthorized purpose, is unusable, unreadable, or indecipherable because of security technologies or methodologies generally accepted by experts in the field of information security at the time the breach of security occurred. This exemption does not apply with regard to the use of encryption technology generally accepted by experts in the field of information security at the time the breach of security occurred if any cryptographic keys necessary to enable decryption of such data are also accessed or acquired without authorization. (2) FTC guidance Not later than 1 year after the date of enactment of this Act, the Commission shall issue guidance regarding the application of the exemption in paragraph (1). (g) Website notification of federal trade commission If the Commission, upon receiving notification of any breach of security that is reported to the Commission under subsection (d)(1), finds that notification of such a breach of security via the Commission’s Internet website would be in the public interest, the Commission shall place such a notification in a clear and conspicuous location on its Internet website. (h) Website notification of state attorneys general If a State attorney general, upon receiving