; and (B) one additional medium of notification, if such covered entity has the personal information necessary to make a notification through such an additional medium without causing excessive financial burden for such covered entity. (d) Rule of construction This section shall not apply to a covered entity if a person uses personal information obtained from a data breach or data sharing abuse not involving such covered entity. III United States Digital Privacy Agency 301. Establishment (a) Agency established There is established an independent agency in the executive branch to be known as the United States Digital Privacy Agency , which shall implement and enforce this Act. (b) Director and deputy director (1) In general There is established the position of the Director, who shall serve as the head of the Agency. (2) Appointment Subject to paragraph (3), the Director shall be appointed by the President, by and with the advice and consent of the Senate. (3) Qualification The President shall nominate the Director from among individuals who are citizens of the United States. (4) Deputy director There is established the position of Deputy Director, who shall— (A) be appointed by the Director