; or (4) to comply with a Federal criminal investigation request or order. (b) Genetic information defined In this section, the term genetic information has the meaning given such term in section 201 of the Genetic Information Nondiscrimination Act of 2008 ( 42 U.S.C. 2000ff ). (c) Service providers safe harbor A service provider shall not be held liable for a violation of this section if such service provider is acting at the direction of and on behalf of a covered entity and has a reasonable belief that is the covered entity’s directions are in compliance with this section. 210. Requirements for notice and consent processes and privacy policies (a) Minimum threshold The Director shall establish a minimum threshold that a covered entity must meet for the percentage of individuals who read and understand a notice or consent process or privacy policy required by this Act. In establishing such minimum thresholds, the Director shall take into account expectations of individuals, potential privacy harms, and individuals’ awareness of privacy harms. (b) Consent revocation A covered entity shall make available a reasonable mechanism by which an individual may revoke consent for any consent given under this Act. (c) Safe harbor (1) Approval procedures The Director shall develop procedures for analyzing and approving data submitted by a covered entity to establish that a notice and consent process or privacy policy of such covered entity meets the threshold established under subsection (a). (2) Presumption If a covered entity submits testing data to and receives an approval from the Director under paragraph (1) establishing that a notice or consent process or privacy policy of such covered entity meets the threshold established under subsection (a), such notice or consent process or privacy policy shall be presumed to have met such threshold. Such presumption may be rebutted by clear and convincing evidence. (3) Public availability of Approved processes and policies and associated testing data The Director shall make