; (iii) allow an individual that objects to a transfer of covered data to view the status of such objection; (iv) allow an individual that objects to a transfer of covered data to change the status of such objection; (v) be privacy protective; and (vi) be informed by the Commission’s experience developing and implementing the National Do Not Call Registry. (c) Sensitive data A covered entity— (1) shall not process the sensitive covered data of an individual without the individual’s prior, affirmative express consent; (2) shall not transfer the sensitive covered data of an individual without the individual’s prior, affirmative express consent; (3) shall provide an individual with a consumer-friendly means to withdraw affirmative express consent to process the sensitive covered data of the individual; and (4) is not required to obtain prior, affirmative express consent to process or transfer publicly available information. 106. Right to data minimization A covered entity shall not process or transfer covered data beyond what is reasonably necessary, proportionate, and limited— (1) to carry out the specific processing purposes and transfers described in the privacy policy made available by the covered entity as required under section 102; (2) to carry out a specific processing purpose or transfer for which the covered entity has obtained affirmative express consent