; (ii) each date on which the covered entity collected the personal information; (iii) the third parties to which the covered entity has disclosed or will disclose the personal information; and (iv) if possible, how long the personal information will be retained or stored, or if not possible, the criteria used for determining how long the personal information will be retained or stored. (B) Additional requirements A covered data broker shall provide the means for review under paragraph (1)— (i) at the request of an individual; (ii) after verifying the identity of the individual; (iii) not less than 1 time per year; (iv) at no cost to the individual