; and (2) authorized by the individual when the individual granted consent for the transfer of the information to the third party. (c) Alternative means To terminate use of covered information In the rulemaking required by subsection (a), the Commission shall allow a covered entity to provide individuals an alternative means, in lieu of the access, consent, and correction requirements, of prohibiting a covered entity from use or transfer of that individual's covered information. (d) Service providers (1) In general The use of a service provider by a covered entity to receive covered information in performing services or functions on behalf of and under the instruction of the covered entity does not constitute an unauthorized use of such information by the covered entity if the covered entity and the service provider execute a contract that requires the service provider to collect, use, and store the information on behalf of the covered entity in a manner consistent with— (A) the requirements of this title; and (B) the policies and practices related to such information of the covered entity. (2) Transfers between service providers for a covered entity The disclosure by a service provider of covered information pursuant to a contract with a covered entity to another service provider in order to perform the same service or functions for that covered entity does not constitute an unauthorized use. (3) Liability remains with covered entity A covered entity remains responsible and liable for the protection of covered information that has been transferred to a service provider for processing, notwithstanding any agreement to the contrary between a covered entity and the service provider. C Rights relating to data minimization, constraints on distribution, and data integrity 131. Data minimization Each covered entity shall— (1) collect only as much covered information relating to an individual as is reasonably necessary— (A) to process or enforce a transaction or deliver a service requested by such individual