process or privacy policy shall be presumed to have met such threshold. Such presumption may be rebutted by clear and convincing evidence. (3) Public availability of Approved processes and policies and associated testing data The Director shall make publicly available online the notice and consent processes and privacy policies and associated testing data that the Director approves under paragraph (1). (4) Small business adoption of notice or consent process of another covered entity (A) In general If a small business adopts a notice or consent process of another covered entity that collects, processes, maintains, or discloses personal information in substantially the same way as such small business, if the process of such other covered entity has been approved under paragraph (1), the process of such small business shall receive the presumption under paragraph (2). (B) Ability to freely use Approved process A covered entity whose notice or consent process is approved under paragraph (1) shall permit a small business to freely use such process, or a derivative thereof, as described in subparagraph (A). (C) No published process In the case of a small business for which there is no approved notice or consent process published under paragraph (3) of a covered entity that collects, processes, maintains, or discloses personal information in substantially the same way as such small business, any requirement under this title for a notice or consent process to be objectively shown to meet the threshold established by the Director under subsection (a) shall not apply to such small business. Nothing in the preceding sentence exempts a small business from the requirement to use such notice or consent process or that such process be concise and clear. (D) Inapplicability to privacy policy Paragraph (4) does not apply with respect to a privacy policy. (5) Minor changes A covered entity may make minor changes in a notice or consent process or privacy policy approved under paragraph (1) and retain the presumption under