; (ii) employee data; and (iii) public records. (9) Covered entity (A) In general The term covered entity means any entity or person that— (i) is subject to the Federal Trade Commission Act ( 15 U.S.C. 41 et seq.); and (ii) processes or transfers covered data. (B) Inclusion of commonly controlled and commonly branded entities Such term includes any entity or person that controls, is controlled by, is under common control with, or shares common branding with a covered entity. (C) Exclusion of small business Such term does not include a small business. (10) De-identified data Term de-identified data means information that cannot reasonably be used to infer information about, or otherwise be linked to, an individual, a household, or a device used by an individual or household, provided that the entity— (A) takes reasonable measures to ensure that the information cannot be reidentified, or associated with, an individual, a household, or a device used by an individual or household; (B) publicly commits in a conspicuous manner— (i) to process and transfer the information in a de-identified form; and (ii) not to attempt to reidentify or associate the information with any individual, household, or device used by an individual or household