unauthorized data broker. (B) Exclusion The term data broker security breach does not include good faith but unauthorized acquisition of brokered personal information by an employee or agent of the data broker for a legitimate purpose of the data broker, provided that the brokered personal information is not used for a purpose unrelated to the data broker’s business or subject to further unauthorized disclosure. (C) Application In determining whether brokered personal information has been acquired or is reasonably believed to have been acquired by a data broker without valid authorization, a data broker may consider the following factors, among others: (i) Indications that the brokered personal information is in the physical possession and control of a person without valid authorization, such as a lost or stolen computer or other device containing brokered personal information. (ii) Indications that the brokered personal information has been downloaded or copied. (iii) Indications that the brokered personal information was used by an unauthorized data broker, such as fraudulent accounts opened or instances of identity theft reported. (iv) That the brokered personal information has been made public. (7) Personal information The term personal information means information which is related to any identified or identifiable person. (8) State The term State means any State of the United States, the District of Columbia, the Commonwealth of Puerto Rico, Guam, American Samoa, the Commonwealth of Northern Mariana Islands, and the United States Virgin Islands.