; (iii) change to the manner in which the covered entity or service provider discloses personal data to third parties; and (iv) which, if any, changes are retroactive; and (B) shall not process (or, in the case of a material change to the privacy policy of a service provider that is directed by the covered entity, shall not direct the service provider to process) any sensitive personal data of an individual that was collected by the covered entity or service provider before the effective date of the material change in a manner that is inconsistent with the privacy policy that was applicable at the time such data was collected until the individual provides express affirmative consent to such processing. (2) Direct notice of material change to affected individuals A covered entity shall, if operationally and technically feasible, directly provide the notice of a material change required under paragraph (1)(A) to each affected individual, taking into account available technology and the nature of the relationship between the covered entity and the individual. (3) Public notice of material change Where directly providing the notice of a material change required under paragraph (1)(A) to each affected individual is impossible or demonstrably impracticable, a covered entity— (A) shall publish the notice in a reasonably prominent location