; or (ii) the covered entity— (I) de-identifies the personal information held by the covered entity; and (II) where possible, provides individuals with the choice to opt-out of the collection and use of the de-identified information of the individuals. (2) Reporting requirement If the Commission grants an exemption to a covered entity under paragraph (1), the Commission shall list the covered entity on the website of the Commission established under section 3(b)(3) and provide a brief justification for granting the exemption to the covered entity. 6. Right to access, correction, deletion, and data portability (a) In general In promulgating regulations under section 3, the Commission shall require a covered entity to— (1) upon request, provide confirmation to an individual who uses a product or service of the covered entity, or has established a subscription or account with the covered entity, as to whether the covered entity retains personal information pertaining to the individual; (2) if the covered entity retains the individual’s personal information, provide to the individual— (A) reasonable means to access the personal information; (B) a description of— (i) the personal information being retained; (ii) each date on which the covered entity collected the personal information; (iii) the third parties to which the covered entity has disclosed or will disclose the personal information; and (iv) if possible, how long the personal information will be retained or stored, or if not possible, the criteria used for determining how long the personal information will be retained or stored; and (C) notice of the right to correct and delete personal information; (3) provide the access to the personal information under paragraph (2)(A) in the form of a portable electronic table that— (A) is in a usable and searchable format; (B) allows the individual to transfer the personal information from one entity to another entity without hindrance