; (5) it is important for business entities that own, use, store, or license sensitive personally identifiable information to adopt reasonable policies and procedures to help ensure the security and privacy of sensitive personally identifiable information; and (6) individuals whose personal information has been compromised or who have been victims of identity theft should receive the necessary information and assistance to mitigate any potential damage. 3. Definitions In this Act, the following definitions shall apply: (1) Affiliate The term affiliate means persons related by common ownership or by corporate control. (2) Agency The term agency has the same meaning given such term in section 551 of title 5, United States Code. (3) Business entity The term business entity means any organization, corporation, trust, partnership, sole proprietorship, unincorporated association, or venture established to make a profit, or a nonprofit organization. (4) Consumer privacy and data security program The term consumer privacy and data security program means the program described in section 202(a). (5) Covered entity The term covered entity means any business entity, other than a service provider, that collects, uses, accesses, transmits, stores, or disposes of sensitive personally identifiable information. (6) Designated entity The term designated entity means the Federal Government entity designated by the Secretary of Homeland Security under section 217(a). (7) Encryption The term encryption — (A) means the protection of data in electronic form, in storage or in transit, using an encryption technology that has been generally accepted by experts in the field of information security that renders such data indecipherable in the absence of associated cryptographic keys necessary to enable decryption of such data