; and (3) allow permitted entities to submit— (A) one or more individual requests electronically for real-time machine-to-machine (or similar functionality) accurate responses; and (B) multiple requests electronically, such as those provided in a batch format, for accurate electronic responses within a reasonable period of time from submission, not to exceed 24 hours. (e) Certification required Before providing confirmation of fraud protection data to a permitted entity, the Commissioner shall ensure that the Commissioner has a certification from the permitted entity that is dated not more than 2 years before the date on which that confirmation is provided that includes the following declarations: (1) The entity is a permitted entity. (2) The entity is in compliance with this section. (3) The entity is, and will remain, in compliance with its privacy and data security requirements, as described in title V of the Gramm-Leach-Bliley Act ( 15 U.S.C. 6801 et seq.), with respect to information the entity receives from the Commissioner pursuant to this section. (4) The entity will retain sufficient records to demonstrate its compliance with its certification and this section for a period of not less than 2 years. (f) Consumer consent (1) In general Notwithstanding any other provision of law or regulation, a permitted entity may submit a request to the database or similar resource described in subsection (c) only— (A) pursuant to the written, including electronic, consent received by a permitted entity from the individual who is the subject of the request