; or (iii) made an inquiry about the products or services of the business within the prior 90 days. (C) Exclusion The following activities conducted by a business, and the collection and sale or licensing of brokered personal information incidental to conducting these activities, do not qualify the business as a data broker: (i) Providing 411 directory assistance or directory information services, including name, address, and telephone number, on behalf of or as a function of a telecommunications carrier. (ii) Providing a consumer's publicly available information if the information is being used by the recipient as it relates to that consumer's business or profession. (iii) Providing publicly available information via real-time or near-real-time alert services for health or safety purposes. (iv) Providing or using information in a manner that is regulated under another Federal law, including the Fair Credit Reporting Act, the Gramm-Leach-Bliley Act, or the Health Insurance Portability and Accountability Act. (v) Providing data to a third party at the direction of the customer and with the customer’s consent. (D) Exclusion from sale For purposes of this paragraph, the term sells does not include a one-time or occasional sale of assets of a business as part of a transfer of control of those assets that is not part of the ordinary conduct of the business. (6) Data broker security breach (A) In general The term data broker security breach means an unauthorized acquisition or a reasonable belief of an unauthorized acquisition of more than one element of brokered personal information maintained by a data broker when the brokered personal information is not encrypted, redacted, or protected by another method that renders the information unreadable or unusable by an unauthorized data broker. (B) Exclusion The term data broker security breach does not include good faith but unauthorized acquisition of brokered personal information by an employee or agent of the data broker for a legitimate purpose of the data broker,