; or (B) the covered entity collects or processes the personal data in accordance with a permissible purpose described in subsection (c). (2) Application to third parties (A) In general A covered entity that is a third party with respect to the personal data of an individual may collect or process such personal data without directly obtaining the individual's consent as required under paragraph (1)(A) if— (i) the covered entity from whom the third party received the personal data of the individual involved— (I) has provided the individual with notice of— (aa) the fact that the covered entity would disclose the individual's personal data to the third party; and (bb) the purposes for which the third party will collect or process the personal data of the individual; and (II) the individual has consented to such disclosure and such collection or processing of the individual's personal data; or (ii) the third party collects or process the personal data in accordance with a permissible purpose described in subsection (c). (B) Notice and consent requirement for different or additional collection or processing A covered entity that is a third party with respect to the personal data of an individual shall obtain the consent of such individual in accordance with subsection (b) before collecting or processing such personal data if the specific purpose for such collection or processing— (i) is not a purpose described in paragraph (1), (2), (4), or (6) of subsection (c)