; (B) a driver’s license number of the individual; (C) a passport number of the individual; (D) an alien registration number or other government-issued unique identification number of the individual; (E) unique biometric data, such as a faceprint, a fingerprint, a voice print, an iris image, or any other unique physical representation of the individual; (F) the first and last name of the individual, or the first initial of the first name and the last name of the individual, in combination with any information that relates to— (i) the past, present, or future physical or mental health or condition of the individual; or (ii) the provision of health care to, or a diagnosis of, the individual; (G) (i) a financial account number, debit card number, or credit card number of the individual; or (ii) any passcode required to access an account described in clause (i); and (H) such additional information, as determined by the Director. 3. Cybersecurity standards and FTC authority (a) Establishment There is established in the Commission an Office of Cybersecurity, which shall be headed by a Director, who shall be a career appointee. (b) Duties The Office— (1) shall— (A) supervise covered consumer reporting agencies with respect to data security; (B) promulgate regulations, through notice and comment rulemaking that complies with section 553 of title 5, United States Code, for effective data security for covered consumer reporting agencies, including requirements for a covered consumer reporting agency to— (i) provide the Commission with descriptions of technical and organizational security measures of the consumer reporting agency, including— (I) system and network security measures, including— (aa) asset management, including— (AA) an inventory of devices of the covered consumer reporting agency that are authorized to access data maintained by the covered consumer reporting agency