; or (B) is widely available to the general public, including information from— (i) a telephone book or online directory; (ii) video, internet, or audio content; or (iii) the news media or a website that is available to the general public on an unrestricted basis (for purposes of this subclause a website is not restricted solely because there is a fee or log-in requirement associated with accessing the website). (19) Service provider The term service provider means, with respect to a set of covered data, an entity that processes or transfers such covered data for the purpose of performing one or more services or functions on behalf of, and at the direction of, a covered entity to which it is not related. (20) Transfer The term transfer means to disclose, release, share, disseminate, or otherwise make available covered data by any means. 3. Privacy of covered data (a) In general During the COVID–19 public health emergency, it shall be unlawful for a covered entity to collect, process, or transfer the covered data of an individual for a purpose described in subsection (b) unless— (1) the covered entity provides the individual with prior notice of the purpose for such collection, processing, or transfer; (2) the individual has given affirmative express consent to such collection, processing, or transfer; and (3) the covered entity publicly commits not to collect, process, or transfer such covered data for a purpose other than the purpose described in subsection (b) to which the individual consented unless— (A) such collection, processing, or transfer is necessary to comply with the provisions of this Act or other applicable laws; (B) such collection, processing, or transfer is necessary to carry out operational or administrative tasks in support of a purpose described in subsection (b) to which the individual has consented