; industry practices The requirements prescribed under paragraph (1) shall be consistent with guidance provided by the Commission and recognized industry practices for safety and security, including administrative, technical, and physical safeguards to secure the personal information of users. (4) Technologically neutral The Commission may not require a specific technological means of meeting a requirement under paragraph (1). (b) Other requirements In promulgating regulations under section 3, the Commission shall require a covered entity— (1) to make publicly available a description of the practices established by the covered entity under subsection (a) that details— (A) how the covered entity will address privacy and security risks associated with the development of new products and services; (B) the access that employees and contractors of the covered entity have to the personal information of an individual who uses a service or product of the covered entity; and (C) the internal policies of the covered entity for the use of the personal information described in subparagraph (B); (2) (A) to notify an individual if the covered entity determines that— (i) an unauthorized disclosure of the personal information of the individual has occurred; and (ii) harm is reasonably likely to occur; and (B) as part of the notification under subparagraph (A), to offer the individual— (i) the option to prohibit the covered entity from collecting, using, retaining, sharing, or selling the personal information of the individual; and (ii) the option to have the covered entity— (I) erase all personal information of the individual held by the covered entity; (II) cease sharing and selling the personal information of the individual; (III) provide the individual a copy of the personal information of the individual that the covered entity holds about the individual in a format consistent with section 6(a)(3); or (IV) close the individual’s account or otherwise terminate the individual’s relationship with the covered entity