; (II) a common carrier subject to the Communications Act of 1934 ( 47 U.S.C. 151 et seq.) and Acts amendatory thereof and supplementary thereto; or (III) a nonprofit organization, including any organization that is not organized to carry on business for its own profit or that of its members. (B) Limitation An entity shall not be considered to be a covered entity with respect to personal data to the extent that the entity is a service provider with respect to such data. (5) De-identify The term de-identify means, with respect to personal data held by a covered entity or service provider, that the covered entity or service provider— (A) alters, anonymizes, or aggregates the data so that there is a reasonable basis for expecting that the data could not be linked (including by the entity or service provider) as a practical matter to a specific individual; (B) publicly commits to refrain from attempting to re-identify the data with a specific individual, and adopts controls to prevent such identification; and (C) causes the data to be covered by a contractual or other legally enforceable prohibition on each entity to which the covered entity or service provider discloses the data from attempting to use the data to identify a specific individual and requires the same of all onward disclosures. (6) Delete The term delete means to remove or destroy information such that the information is not able to be retrieved in the ordinary course of business. (7) Individual The term individual means a natural person residing in the United States. (8) Material change The term material change means a change to a policy or practice of a covered entity or service provider that— (A) relates to the collection or processing of personal data by the covered entity or service provider; (B) is likely to affect the conduct or decision of a reasonable individual with respect to any personal data of the individual that is subject to such policy or practice