; or (6) the covered entity processes or will process the data subject to the request for a specific purpose described in subsection (d) of this section, and complying with the request would prevent the covered entity from using such data for such specific purpose. (d) Exceptions to affirmative express consent (1) In general A covered entity may process or transfer covered data without the individual’s affirmative express consent for any of the following purposes, provided that the processing or transfer is reasonably necessary, proportionate, and limited to such purpose: (A) To complete a transaction or fulfill an order or service specifically requested by an individual, such as billing, shipping, or accounting. (B) To perform system maintenance, debug systems, or repair errors to ensure the functionality of a product or service provided by the covered entity. (C) To detect or respond to a security incident, provide a secure environment, or maintain the safety of a product or service. (D) To protect against malicious, deceptive, fraudulent, or illegal activity. (E) To comply with a legal obligation or the establishment, exercise, or defense of legal claims. (F) To prevent an individual from suffering harm where the covered entity believes in good faith that the individual is in danger of suffering death or serious physical injury. (G) To effectuate a product recall pursuant to Federal or State law. (H) To conduct scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws and is approved, monitored, and governed by an institutional review board or a similar oversight entity that meets standards promulgated by the Commission pursuant to section 553 of title 5, United States Code. (2) Biometric information Not later than 1 year after the date of enactment of this Act, the Commission shall promulgate regulations pursuant to section 553 of title 5, United States Code, identifying privacy protective requirements for the processing of biometric