; and (B) is subject to technical and organizational measures to ensure that the personal data is not attributed to a specific individual. (11) Privacy officer The term privacy officer means an individual designated by a covered entity or service provider under section 7(b)(1) to be the privacy officer of the covered entity. (12) Processing The term processing means any operation or set of operations performed on personal data, including the analysis, organization, structuring, retaining, using, disclosing, transmitting, sharing, transferring, selling, licensing, or otherwise handling of personal data. (13) Publicly available information (A) In general The term publicly available information means any information that a covered entity or service provider has a reasonable basis to believe is lawfully made available to the general public from— (i) a Federal, State, or local government record; (ii) widely distributed media; or (iii) a disclosure to the general public that is made voluntarily by an individual, or required to be made by a Federal, State, or local law. (B) Reasonable basis to believe For purposes of subparagraph (A), reasonable bases for believing that information is lawfully made available to the general public shall include a written determination by a covered entity or service provider that the information is of a type that is lawfully made available to the general public. (14) Sensitive personal data The term sensitive personal data means personal data that is— (A) a unique, government-issued identifier, such as a social security number, passport number, driver’s license number, or taxpayer identification number; (B) a user name or email address in combination with a password or security question and answer that would permit access to an online account; (C) biometric information of an individual