; and (B) the first 2 times that an individual makes a verified request described in subparagraph (A) in any 12-month period, shall comply with such requests without any charge to the individual. (2) Manifestly unfounded and excessive requests If an individual submits a manifestly unfounded or frivolous request to exercise a right under subsection (b), (c), or (d), or an excessive number of requests under such subsections, the covered entity may— (A) charge a reasonable fee, taking into account the administrative costs of providing the personal data, communication, or taking the action requested by the individual; or (B) refuse to act on the request. (f) Verified request (1) In general A request to exercise a right described in this section shall only be considered a verified request if the covered entity verifies that the individual making the request is the individual whose personal data is the subject of the request. (2) Verification of identity (A) In general A covered entity shall make a reasonable effort to verify the identity of any individual who submits a request to exercise a right under this section. (B) Additional information If a covered entity cannot verify the identity of the individual submitting a request under this subsection, the covered entity— (i) may request that the individual provide such additional information as is necessary to confirm the identity of the individual; and (ii) shall only process additional information provided under clause (i) for the purpose of verifying the identity of the individual. (g) Declination of requests (1) In general A covered entity— (A) shall decline to act on a request under this section where, after undertaking a reasonable effort, the entity cannot verify that the individual making the request is the individual whose personal data is the subject of the request