privacy framework that preempts, and occupies the field with respect to, the authority of any State or political subdivision of a State over the conduct or activities of covered entities covered by this Act (or under a law enumerated in subsection (c)) relating to the privacy or security of personal data, including consumer controls relating to personal data such as rights to access, correction, and deletion. (b) Express preemption of State law (1) In general Except as provided in paragraph (2), this Act shall supersede any provision of a law, rule, regulation, or other requirement of any State or political subdivision of a State to the extent that such provision relates to the privacy or security of personal data. (2) Preservation of State and local laws The provisions of this Act shall not be construed to preempt or supersede the applicability of any of the following laws of a State or political subdivision of a State to the extent that such law is not inconsistent with this Act: (A) Laws that address notification requirements in the event of a data breach. (B) Rules of criminal or civil procedure. (C) Laws that relate to the general standards of fraud or public safety. (D) Laws that address the privacy of any group of students (as defined in section 444(a) of the General Education Provisions Act ( 20 U.S.C. 1232g(a) ) (commonly referred to as the Family Educational Rights and Privacy Act of 1974 )). (E) Laws that address financial information held by financial institutions (as defined in section 509 of the Gramm-Leach-Bliley Act ( 15 U.S.C. 6809 )). (F) Laws that address protected health information held by covered entities and business associates (as such terms are defined for purposes of regulations promulgated under section 264(c) of the Health Insurance Portability and Accountability Act of 1996 ( 42 U.S.C. 1320d–2 note)). (G) Laws governing employment and employment-related data including data collected or used by an employer pursuant to an employer-employee relationship. (H) Laws protecting the right of