; (B) to provide a requested product or service; or (C) to take steps at the request of the individual prior to entering into a contract to which the individual is party; or (2) accessing the personal information of an individual later than 90 days after the latest date on which— (A) the covered entity concludes the performance of a contract to which the individual is party; (B) the covered entity concludes taking steps that an individual would consider necessary in order to provide a requested product or service, including steps to prevent fraud, ensure safety, or ensure compliance with the covered entity’s terms of service; or (C) the individual otherwise terminates his or her relationship with the covered entity. 13. Right to data security (a) Reasonable procedures (1) In general In promulgating regulations under section 3, the Commission shall require a covered entity to establish and maintain reasonable data security practices to protect the confidentiality, integrity, and availability of personal information. (2) Proportionality The requirements prescribed under paragraph (1) shall provide for security procedures that are proportional to the volume and nature of the personal information a covered entity collects. (3) Commission guidance