; and (B) (i) is used to assign a unique, persistent identifier; or (ii) is used for the unique personal identification of a specific individual. (6) Facial recognition data The term facial recognition data means any unique attribute or feature of the face of an end user that is used by facial recognition technology to assign a unique, persistent identifier or for the unique personal identification of a specific individual. (7) Process The term process means any operation that is performed on facial recognition data, including collection, creation, generation, recording, organization, structuring, storage, adaptation, alteration, retrieval, consultation, use, disclosure, transfer, dissemination or otherwise making available, combination, erasure, or destruction. (8) Processor The term processor means a covered entity that processes facial recognition data on behalf of a controller. (9) Security application The term security application means loss prevention and any other application intended to detect or prevent criminal activity, including shoplifting and fraud. (10) Unaffiliated third party The term unaffiliated third party means any person other than— (A) a user of a product or service of a covered entity; (B) an employee of a covered entity; (C) a person under common control or ownership with a covered entity; or (D) a person to whom— (i) an end user directed a covered entity to disclose information derived from facial recognition technology; or (ii) information derived from facial recognition technology was disclosed with the affirmative consent of an end user. 3. Prohibited conduct (a) In general Except as provided in subsection (e), it shall be unlawful for a controller to knowingly— (1) use facial recognition technology to collect facial recognition data, unless the controller— (A) obtains from an end user affirmative consent in accordance with subsection (b)