; (B) the data retention and deidentification practices of the processor; and (C) if the controller offers the ability to review, correct, or delete information derived from facial recognition technology, the process to accomplish such actions. (2) Processor requirement If the processor and controller are not the same entity, the processor shall make easily accessible to controllers the information required under paragraph (1). (3) Conditioning service on consent prohibited If the use of facial recognition technology is not necessary for a service, no controller may— (A) condition the service on consent by an end user to waive privacy rights; or (B) terminate or refuse the service as a direct consequence of refusal by the end user to provide affirmative consent to the covered entity. (c) Review A controller, and the processor if applicable, shall employ meaningful human review prior to making any final decision based on the output of facial recognition technology if the final decision— (1) may result in a reasonably foreseeable and material physical or financial harm to an end user; or (2) may be unexpected or highly offensive to a reasonable end user. (d) Application programming interface A covered entity that makes a facial recognition technology available as an online service shall make available an application programming interface to enable at least 1 third party that is legitimately engaged in independent testing to conduct reasonable tests of the facial recognition technology for accuracy and bias. (e) Exceptions (1) In general Except as provided in paragraph (2), subsections (a)(1) and (b) shall not apply to controllers that use— (A) an application that— (i) is a product or service designed for personal file management or photo or video sorting or storage if the facial recognition technology is not used for unique personal identification of a specific individual; (ii) involves identification of public figures for journalistic media created for public interest