; and (B) shall not process personal data that was collected by the covered entity before the effective date of the material change in a manner that is inconsistent with the privacy policy that was applicable at the time such data was collected until after the notice has been so published for a period of time that is reasonably sufficient to give affected individuals the opportunity to exercise their rights with respect to their personal data. 5. Individual control (a) Privacy controls Each covered entity shall— (1) provide each individual whose personal data is collected or processed by the covered entity with a reasonably accessible, clear and conspicuous, and easy-to-use means to exercise the individual's rights established under this section with respect to such data; (2) if applicable, offer the means required under paragraph (1) through the same means that the individual routinely uses to interact with the covered entity; and (3) make the means required under paragraph (1) available at no additional cost to the individual. (b) Right To access (1) In general A covered entity shall, in response to a verified request from an individual— (A) confirm whether or not the covered entity has collected or processed the personal data of the individual; and (B) if the covered entity has collected or processed the personal data of the individual, provide, within a reasonable time after receiving the request, the individual with— (i) a copy, or an accurate representation, of the personal data pertaining to the individual collected and processed by the covered entity; and (ii) a list of the categories of third parties to which the covered entity has disclosed the personal data of the individual, if applicable. (2) Ease of access (A) Format The covered entity shall provide the information described in paragraph (1)(B) in an electronic format unless— (i) the individual requests to receive the information by other means