including any necessary personal information, to determine whether an individual has directed the covered entity not to transfer that individual’s data to a third party. Any personal information retained pursuant to this section shall not be used for any other purpose, and shall be reviewable by the Commission. (e) Prohibition on transfer overseas (1) Offense It shall be unlawful for any covered entity to knowingly transfer outside of the United States any individual’s personal information, publicly available information, or anonymized information as defined in this subtitle. (2) Penalty Any person who violates paragraph (1) shall be fined under title 18, United States Code, imprisoned not more than 3 years, or both. 355. Notice of receipt of voter’s personal information (a) Notice A covered entity that receives any individual’s personal information from a third party shall inform such individual as to the scope and purpose of receiving such personal information. (b) Timing A covered entity shall provide notice required in subsection (a) to an individual within a reasonable period after receiving that individual’s personal information, but not later than— (1) except as provided in paragraphs (2) and (3), 30 days after receiving such information, or if personal information is received in an anonymized format then 30 days after the personal information is connected to an identifiable individual