; or (ii) if there is no such sale, subscription, or establishment, before the individual uses the product or service of the covered entity; and (B) regardless of the decision of the individual as to whether to provide opt-in approval to the covered entity. (b) Requirements for unexpected collection or use of personal information (1) In general In promulgating regulations under section 3, the Commission shall apply the requirements under paragraph (2) of this subsection to any collection or use of personal information of an individual by a covered entity other than collection or use that— (A) is necessary for the performance of a contract to which the individual is party; (B) consists of actions that an individual would consider necessary in order to provide a requested product or service; or (C) consists of actions taken at the request of the individual prior to entering into a contract to which the individual is party. (2) Requirements A covered entity that is subject to paragraph (1), with respect to any individual whose personal information the covered entity collects or uses as described in that paragraph— (A) shall provide the short-form notice developed under subsection (a)(1) to the individual in a manner that ensures that the individual reviews the notice and can provide opt-in approval under section 5; (B) shall notify the individual of any material change to the privacy practices or policies of the covered entity not later than the date on which the covered entity updates the short-form notice under subsection (a)(3); (C) may not collect any personal information of the individual not specified in the short-form notice most recently provided to the individual in accordance with subparagraph (A) unless the covered entity provides the individual with a new short-form notice consistent with that subparagraph at the point of collection of the additional information