; and (B) procedures for the review of petitions under paragraph (2)(B), including penalties for unreasonable denials. (d) Small businesses excluded This section does not apply to a small business. (e) Definitions In this section: (1) Portable category The term portable category means a category of products and services established by the Director under subsection (a)(1)(A)— (A) for which the sum obtained by adding the number of users or estimated users of each product or service in such category is greater than 10,000,000; and (B) that— (i) has an estimated Herfindahl-Hirschman Index of 2,000 or greater; (ii) the total number of covered entities offering products and services in such category is 3 or less; or (iii) the Director otherwise determines that a category would benefit from encouraging increased competition. (2) Users The term users means, with respect to a product or service, the monthly active users, subscribers, or customers (or a reasonable proxy or substitute therefor determined by the Director) of such product or service. 105. Right to human review of automated decisions For any decision by a covered entity based solely on automated processing of personal information of an individual, if such processing increases reasonably foreseeable significant privacy harms for such individual, such covered entity shall— (1) inform such individual of what personal information is or may be used for such decision; (2) make available a reasonable mechanism by which such individual may request human review of such decision; and (3) if such individual requests such a review, conduct such review within a reasonable amount of time after such request. 106. Right to individual autonomy (a) In general A covered entity shall not collect, process, maintain, or disclose an individual’s personal information to: (1) create, improve upon, or maintain; (2) process with; or (3) otherwise link an individual with