; (B) may not disclose or sell individual identifying data to, or share individual identifying data with, any other person unless that person enters into a contract with the online service provider that imposes on the person the same duties of care, loyalty, and confidentiality toward the applicable end user as are imposed on the online service provider under this subsection; and (C) shall take reasonable steps to ensure that the practices of any person to whom the online service provider discloses or sells, or with whom the online service provider shares, individual identifying data fulfill the duties of care, loyalty, and confidentiality assumed by the person under the contract described in subparagraph (B), including by auditing, on a regular basis, the data security and data information practices of any such person. (c) Expansion of duty To inform regarding breaches The Commission may promulgate regulations under section 553 of title 5, United States Code, to apply the breach notification requirement under subsection (b)(1)(B) with respect to specific categories of individual identifying data other than sensitive data, as the Commission determines necessary. (d) Exceptions (1) Regulations The Commission may promulgate regulations under section 553 of title 5, United States Code, to exempt categories of online service providers from the requirement under subsection (a). (2) Considerations In promulgating regulations under paragraph (1), the Commission shall consider, among other factors— (A) the privacy risks posed by the use of individual identifying data by an online service provider based on— (i) the size of the provider; (ii) the complexity of the offerings of the provider; (iii) the nature and scope of the activities of the provider; and (iv) the sensitivity of the consumer information handled by the provider