; (B) may decline to act on a request under this section where fulfilling the request would— (i) require the covered entity or a service provider of the covered entity to retain any personal data collected for a single, one-time transaction, if such personal data is not processed for additional purposes; (ii) be impossible or demonstrably impracticable, or require any steps or measures to re-identify, or otherwise alter or manipulate, information that is de-identified; (iii) be contrary to the legitimate interests of the covered entity or a service provider of the covered entity, such as completing a transaction, repairing func­tion­al­i­ty or errors, or performing a contract between the covered entity and the individual; (iv) impair the ability of the covered entity or a service provider of the covered entity to detect or respond to a security incident, provide a secure environment, or protect against malicious, deceptive, fraudulent, or illegal activity; (v) hinder compliance with a legal obligation or legally recognized privilege, such as a requirement to retain certain information, or the establishment, exercise, or defense of legal claims; (vi) interfere with research (conducted in accordance with section 3(c)(5)) when the deletion of the personal data is likely to render impossible or seriously impair such research; or (vii) create a legitimate risk to the privacy, security, safety, or other rights of the individual, an individual other than the requester, or the covered entity, based on a reasonable individualized determination by the covered entity; and (C) shall not be required to act on a request under this section if the covered entity is unable to fulfill the request because— (i) the covered entity requires the assistance of a service provider to fulfill the request