; or (B) disclosing the personal information to another third party for any reason other than performing the specified service on behalf of the covered entity; and (2) the covered entity ensures that the third party effectively enforces the prohibitions described in paragraph (1), including by auditing the data security and data information practices of the third party not less frequently than once every 2 years. (b) Rule of construction Nothing in subsection (a) shall be construed to prevent the disclosure of personal information of an individual— (1) by a covered entity to a third party if necessary to comply with applicable law or a court-issued subpoena, warrant, or order; (2) by a covered entity to a third party that is reasonably necessary to— (A) address fraud, security, or technical issues; (B) protect the individual’s rights or property; or (C) protect individuals or the public from illegal activities as required or permitted by law; or (3) if the individual has specifically approved of the disclosure. 11. Use limitations (a) In general In promulgating regulations under section 3, the Commission shall prohibit a covered entity from using personal information for unreasonable purposes, including— (1) selling, leasing, trading, or otherwise profiting from an individual’s biometric information; (2) sharing, resharing, or otherwise disseminating an individual’s biometric information without first obtaining specific consent from the individual, unless— (A) the dissemination is required by State or Federal law or municipal ordinance; or (B) the dissemination is required pursuant to a valid warrant or subpoena issued by a court of competent jurisdiction