; (ii) a financial account number or credit or debit card number in combination with any security code, access code, or password that is required for an individual to obtain credit, withdraw funds, or engage in a financial transaction; or (iii) an individual’s first and last name or first initial and last name in combination with— (I) a driver’s license number, a passport number, or an alien registration number, or other similar number issued on a government document used to verify identity; (II) unique biometric data such as a finger print, voice print, retina or iris image, or any other unique physical representation; (III) a unique account identifier, electronic identification number, user name, or routing code in combination with any associated security code, access code, or password that is required for an individual to obtain money, goods, services, or any other thing of value; or (IV) two of the following: (aa) Home address or telephone number. (bb) Mother’s maiden name, if identified as such. (cc) Month, day, and year of birth. (B) Modified definition by rulemaking If the Commission determines that the definition under subparagraph (A) is not reasonably sufficient to protect individuals from identity theft, fraud, or other unlawful conduct, the Commission by rule promulgated under section 553 of title 5, United States Code, may modify the definition of personal information under subparagraph (A) to the extent the modification will not unreasonably impede interstate commerce. 7. Effect on other laws (a) Preemption of state information security laws (1) Covered entities under section 5(a) With respect to a covered entity subject to the Act under section 5(a), this Act supersedes any provision of a statute, regulation, or rule of a State or political subdivision of a State that expressly— (A) requires information security practices and treatment of data containing personal information, as defined in section 6, similar to any of those required under section 2