; protection (a) In general Except as provided in section 212, a covered entity shall, following the discovery of a security breach of sensitive personally identifiable information held by that covered entity or any third-party entity contracted to maintain or process data in electronic form containing sensitive personally identifiable information for that covered entity— (1) notify any resident of the United States whose sensitive personally identifiable information has been, or is reasonably believed to have been, accessed or acquired; and (2) provide 5 years of appropriate identity theft prevention and mitigation services, if any, to any individual notified under paragraph (1), upon request of the individual and at no cost to the individual, under which the individual shall not be— (A) automatically enrolled, without the consent of the individual, into a fee-based identity theft prevention and mitigation service at the end of the 5-year period