; or (B) a purpose to which the individual to whom the information relates has consented. (8) De- Identified (A) In general The term de-identified means information that cannot reasonably identify, relate to, describe, reference, be capable of being associated with, or be linked, directly or indirectly, to a particular individual or device, provided that a business that uses de-identified information— (i) has de-identified the personal information using best practices for the types of data the information contains; (ii) has implemented technical safeguards that prohibit re-identification of the individual with whom the information was linked; (iii) has implemented business processes that specifically prohibit re-identification of the information; (iv) has implemented business processes to prevent inadvertent release of de-identified information