; or (ii) another clear and conspicuous mechanism by which the user may make such a deletion. (2) Deletion exceptions (A) In general A commercial data operator shall comply with a user directive to delete, in whole or in part, the data of the user except— (i) in cases where there is a legal obligation of the commercial data operator to maintain the data; (ii) for the establishment, exercise, or defense of legal claims; or (iii) if the data is necessary to detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, or assist in the prosecution of those responsible for such activity. (B) Retention A commercial data operator may not retain any more user data than is necessary to carry out an activity described in clauses (i) through (iii) of subparagraph (A). (3) Availability A commercial data operator shall ensure that all disclosures required under paragraph (1) are available to a user of the commercial data operator— (A) on and after the date on which the commercial data operator makes the identification