; (B) is likely to affect the conduct or decision of a reasonable individual with respect to any personal data of the individual that is subject to such policy or practice; and (C) in the case of a service provider, is made at the direction of the covered entity on whose behalf the service provider is performing a service or function. (9) Personal data (A) In general The term personal data means information that identifies or is linked or reasonably linkable to a specific individual. (B) Linked or reasonably linkable (i) In general For purposes of subparagraph (A), information held by a covered entity or service provider is linked or reasonably linkable to a specific individual if it can be used on its own or in combination with other information held by, or readily accessible to, the covered entity or service provider to identify the individual. (ii) Application to device-level identifiers A persistent identifier that is used to identify a specific individual over time and across services and platforms, including a customer number held in a cookie, a static Internet Protocol (IP) address, a processor or device serial number, or another unique device identifier, shall be considered information that is linked or reasonably linkable to the individual for purposes of subparagraph (A). (C) Exclusion The term personal data does not include— (i) de-identified data; (ii) data that has been rendered unreadable or indecipherable; (iii) information about employees or employment status collected or used by an employer pursuant to an employer-employee relationship, including information related to prospective employees and relevant application materials; (iv) publicly available information; (v) data that has undergone pseu­do­ny­mi­za­tion