; (iii) has implemented business processes that specifically prohibit re-identification of the information; (iv) has implemented business processes to prevent inadvertent release of de-identified information; and (v) makes no attempt to re-identify the information. (B) The Director may determine that a methodology of de-identifying personal information is insufficient for the purposes of this definition. (9) Director The term Director means the Director of the Agency. (10) Disclose The term disclose means, with respect to personal information or contents of communication, to sell, release, transfer, share, disseminate, make available, or otherwise cause to be communicated such information to a third party. (11) Individual The term individual means a natural person residing in the United States. (12) Maintain The term maintain means, with respect to personal information or contents of communication, to store, secure, or otherwise cause the retaining of such information, or taking actions necessary for such purposes. (13) Personal information (A) In general The term personal information means any information maintained by a covered entity that is linked or reasonably linkable to a specific individual or a specific device, including de-identified personal information and the means to behavioral personalization created for or linked to a specific individual. (B) Exclusions The term personal information does not include— (i) publicly available information related to an individual; or (ii) information derived or inferred from personal information, if the derived or inferred information is not linked or reasonably linkable to a specific individual. (14) Privacy harm The term privacy harm means adverse consequences or potential adverse consequences to an individual or society arising from the collection, processing, maintenance, or disclosure of personal information, including— (A) direct or indirect financial loss or economic harm; (B) physical harm