; and (v) be provided to the Federal Trade Commission or to the attorney general of a State, or other authorized State officer, within 10 days of notification by the Commission or the attorney general of a State, or other authorized State officer where such person has presented to the controller allegations that a violation of this Act or any regulation issued under this Act has been committed by the controller. (C) Small business audit exemption The audit requirements described in this paragraph shall not apply to controllers who collect, store, process, sell, share, or otherwise use sensitive personal information relating to 5,000 or fewer individuals. (D) Non-sensitive personal information exemption The audit requirements set forth above shall not apply to controllers who do not collect, store, process, sell, share, or otherwise use sensitive personal information. (b) Exemptions (1) Necessary operations and security purposes Subsection (a) shall not apply to the processing, collecting, storing, sharing, selling of sensitive personal information for the following purposes: (A) Preventing or detecting fraud, identity theft, or criminal activity. (B) The use of such information to identify errors that impair functionality or otherwise enhancing or maintaining the availability of the services or information systems of the controller for authorized access and use. (C) Protecting the vital interests of the consumer or another natural person. (D) Responding in good faith to valid legal process or providing information as otherwise required or authorized by law. (E) Monitoring or enforcing agreements between the controller and an individual, including but not limited to, terms of service, terms of use, user agreements, or agreements con­cern­ing monitoring criminal activity. (F) Protecting the property, services, or information systems of the controller against unauthorized access or use. (G) Advancing a substantial public interest, including archival purposes, scientific or historical research, and public health, if