; and (2) inform any service provider or third party to which the covered entity transferred such data of the corrected information. 105. Right to controls (a) Right to data portability A covered entity, upon the verified request of an individual, shall export the individual’s covered data, except for derived data, without licensing restrictions— (1) in a human-readable format that allows the individual to understand such covered data of the individual; and (2) in a structured, interoperable, and machine-readable format that includes all covered data or other information that the covered entity collected to the extent feasible. (b) Right To opt out of transfers (1) In general A covered entity— (A) shall not transfer an individual’s covered data to a third party if the individual objects to the transfer; and (B) shall allow an individual to object to the covered entity transferring covered data of the individual to a third party through a process established under the rule issued by the Commission pursuant to paragraph (2). (2) Rulemaking (A) In general Not later than 18 months after the date of enactment of this Act, the Commission shall issue a rule under section 553 of title 5, United States Code, establishing one or more acceptable processes for covered entities to follow in allowing individuals to opt out of transfers of covered data. (B) Requirements The processes established by the Commission pursuant to this subparagraph shall— (i) be centralized, to the extent feasible, to minimize the number of opt-out designations of a similar type that a consumer must make; (ii) include clear and conspicuous opt-out notices and consumer friendly mechanisms to allow an individual to opt out of transfers of covered data; (iii) allow an individual that objects to a transfer of covered data to view the status of such objection; (iv) allow an individual that objects to a transfer of covered data to change the status of such objection; (v) be privacy protective