a financial account number or credit or debit card number, electronic identification number, user name, or routing code. (viii) Information generated or derived from the operation or use of an electronic communications device that is sufficient to identify the street name and name of the city or town in which the device is located. (ix) Any information regarding an individual’s medical history, mental or physical condition, medical treatment or diagnosis by a health care professional, or the provision of health care to the individual, including health information provided to a website or mobile application. (x) A health insurance policy number or subscriber identification number and any unique identifier used by a health insurer to identify the individual, or any information in an individual’s health insurance application and claims history, including any appeals records. (xi) Digitized or other electronic signature. (xii) Nonpublic communications or other user-created content such as emails, photographs, or videos. (xiii) Any record or information concerning payroll, income, financial accounts, mortgages, loans, lines of credit, utility bills, accumulated purchases, or any other information regarding financial assets, obligations, or spending habits. (xiv) Any additional element the Commission defines as personal information. (B) Modified definition by rulemaking The Commission may, by rule promulgated under section 553 of title 5, United States Code, modify the definition of personal information under subparagraph (A). (7) State The term State means each of the several States, the District of Columbia, the Commonwealth of Puerto Rico, Guam, American Samoa, the United States Virgin Islands, the Commonwealth of the Northern Mariana Islands, any other territory or possession of the United States, and each federally recognized Indian tribe. 6. Effect on other laws (a) Preemption of State data security and breach notification laws No State or political subdivision thereof shall have any authority to establish or