; and (B) includes— (i) a subsidiary, affiliate, or other entity within the corporate organizational structure of a financial institution; (ii) a person representing or otherwise acting as agent for a financial institution; and (iii) a group or organization the membership of which is comprised entirely of financial institutions. (4) Exceptions The Secretary of the Treasury by rule shall establish exceptions to paragraph (2), including setting minimum standards for information that is ineligible for consideration as deidentified information. (b) Process A financial institution may determine that financial institution information is deidentified information only if— (1) a person with appropriate knowledge of and experience with generally accepted statistical and scientific principles and methods for rendering information not individually identifiable— (A) applying such principles and methods, determines that the risk is very small that the information could be used, alone or in combination with other reasonably available information, by an anticipated recipient to identify a person who is a subject of the information; and (B) documents the methods and results of the analysis that justify such determination; or (2) (A) appropriate identifiers of the person or of relatives, employers, or household members of the person, are removed; and (B) the financial institution does not have actual knowledge that the information could be used alone or in combination with other information to identify a person who is a subject of the information. (c) Reidentification A financial institution may assign a code or other means of record identification to allow information deidentified under this section to be reidentified by the financial institution, provided that— (1) the code or other means of record identification is not derived from or related to information about the person and is not otherwise capable of being translated so as to identify the person