; (B) allow the option of data to be obtained by category that is accessible under section 101; (C) include a publicly available, fully functional test version for development purposes; and (D) be of similar quality to mechanisms used internally by the covered entity. (c) Requirements for access to Application programming interface (1) Access A covered entity shall provide access to the application programming interface or similar mechanism required by subsection (b)(1)(B) upon the request of another covered entity if the requesting covered entity has self-certified, using the procedures established by the Director under paragraph (3)(A), that such requesting covered entity— (A) is a covered entity; (B) can have personal information disclosed to it under section 205 of this Act; (C) is, at the time of the self-certification, in compliance with all requirements of this Act (including provisions a small business is otherwise exempt from complying with); (D) will continue to comply with all requirements of this Act; and (E) will only use such application programming interface or similar mechanism at the express request of an individual. (2) Denial of access (A) In general A covered entity may deny access to the application programming interface or similar mechanism required by subsection (b)(1)(B) if such covered entity has an objective, reasonable belief that the requesting covered entity has failed to meet the requirements for self-certification under paragraph (1). (B) Review In accordance with the procedures established under paragraph (3)(B), a covered entity the request of which is denied under subparagraph (A) may petition the Director for review of the denial. If the Director finds that such denial is unreasonable, the Director may impose a penalty, to be established in such procedures, on the covered entity that denied the request. (3) Certification and review procedures The Director shall establish— (A) procedures for a covered entity to self-certify under paragraph (1)