; and (iii) in the case of an applicable entity that is a service provider, representations the entity makes to covered entities to which the entity provides services; and (C) ensuring that the privacy controls of the applicable entity are adequately accessible to, and effective at safeguarding the expressed preferences of— (i) in the case of an applicable entity that is a covered entity, each individual whose personal data is collected or processed by the covered entity (excluding any personal data with respect to which the covered entity is a third party); and (ii) in the case of an applicable entity that is a service provider, each covered entity to which the entity provides services. (2) Considerations In implementing a comprehensive privacy program under paragraph (1), each applicable entity shall— (A) take into consideration, as applicable given the entity's role as a covered entity or service provider— (i) the relevant risks to the privacy and security of personal data against which the applicable entity must guard in meeting the expectations of individuals; (ii) the requirements under this Act; (iii) the size and complexity of the applicable entity; and (iv) the sensitivity and volume of the personal data that the applicable entity processes