; (B) such collection, processing, or transfer is necessary to carry out operational or administrative tasks in support of a purpose described in subsection (b) to which the individual has consented; or (C) the individual gives affirmative express consent to such collection, processing, or transfer. (b) Covered purposes The purposes described in this subsection are the following: (1) Collecting, processing, or transferring the covered data of an individual to track the spread, signs, or symptoms of COVID–19. (2) Collecting, processing, or transferring the covered data of an individual to measure compliance with social distancing guidelines or other requirements related to COVID–19 that are imposed on individuals under a Federal, State, or local government order. (3) Collecting, processing, or transferring the covered data of an individual to conduct contact tracing for COVID–19 cases. (c) Transparency (1) Privacy policy A covered entity that collects, processes, or transfers covered data for a purpose described in subsection (b) shall, not later than 14 days after the enactment of this Act, publish a privacy policy that— (A) is disclosed in a clear and conspicuous manner to an individual prior to or at the point of the collection of covered data for such a purpose from the individual; (B) is made available in a clear and conspicuous manner to the public; (C) includes whether, subject to the affirmative express consent requirement of subsection (a), the covered entity transfers covered data for such a purpose and the categories of recipients to whom the covered entity transfers covered data for such purpose; (D) includes a general description of the covered entity’s data retention practices for covered data used for a purpose described in subsection (b) and the purposes for such retention