; (B) the provision of the service or product requested by the individual requires the processing or transferring of the specific covered data of the individual and the covered data is strictly necessary to provide the service or product; and (C) an individual provides affirmative express consent to such specific limitations. 110. Limitations and applicability (a) Verification of requests (1) In general A covered entity shall not permit an individual to exercise a right described in sections 102 through 105(a) if— (A) the covered entity cannot reasonably verify that the individual making the request to exercise the right is the individual whose covered data is the subject of the request or an individual authorized to make such a request on the individual’s behalf