information about information security incidents, threats, and vulnerabilities under this Act. 3. Exemptions from notification to individuals (a) Exemption for national security and law enforcement (1) In general Notwithstanding section 2, if the Director of the United States Secret Service or the Director of the Federal Bureau of Investigation determines that notification of the security breach required by such section could be expected to reveal sensitive sources and methods or similarly impede the ability of a Federal, State, or local law enforcement agency to conduct law enforcement investigations, or if the Director of the Federal Bureau of Investigation determines that notification of the security breach could be expected to cause damage to national security, such notification is not required. (2) Immunity No cause of action for which jurisdiction is based under section 1346(b) of title 28, United States Code, shall lie against any Federal law enforcement agency for acts relating to provision of an exemption from notification for law enforcement or national security purposes under this section. (b) Safe harbor (1) In general A business entity is exempt from the notification requirement under section 2, if the following requirements are met: (A) Risk assessment A risk assessment, in accordance with paragraph (3), is conducted by or on behalf of the business entity that concludes that there is no reasonable risk that a security breach has resulted in, or will result in, harm to the individuals whose sensitive personally identifiable information was subject to the security breach. (B) Notice to Commission Without unreasonable delay and not later than 30 days after the discovery of a security breach, unless extended by the Commission, the Director of the United States Secret Service, or the Director of the Federal Bureau of Investigation under section 2 (in which case, before the extended deadline), the business entity notifies the Commission, in writing, of— (i) the results of the risk assessment