; and (D) if there are 500 or more individuals described in subparagraph (B) who reside in a State or other jurisdiction, prominent media outlets serving such State or other jurisdiction. (2) By third party (A) To covered entity A third party that collects, uses, accesses, transmits, stores, or disposes of unsecured sensitive personally identifiable information in electronic or digital form that is owned or licensed by a covered entity shall, following the discovery of a breach of such information, notify the covered entity of such breach. Such notification shall include the identification of each individual whose unsecured sensitive personally identifiable information has been, or is reasonably believed by the third party to have been, accessed, acquired, or disclosed during such breach and the information described in paragraphs (1), (2), and (4) of subsection (d) with respect to such breach. The covered entity shall make the notifications required by paragraph (1) with respect to such breach. (B) To FTC and FBI If there are 500 or more individuals described in subparagraph (A) with respect to a breach, the third party shall provide the notification required by such subparagraph to the Commission and the Federal Bureau of Investigation, as well as to the covered entity. Notification by the third party under this subparagraph does not relieve the covered entity of the requirement to notify the Commission and the Federal Bureau of Investigation under paragraph (1)(A). (b) Timeliness of notification (1) In general All notifications required under subsection (a) shall be made in the most expedient time possible and without unreasonable delay, but in no case later than 30 calendar days after the discovery of a breach by the covered entity involved (or by the third party involved in the case of a notification required under subsection (a)(2)(A)). (2) Expedited notification to FTC and FBI Notwithstanding paragraph (1), if there are 500 or more individuals to which a covered entity is required to provide notification