; and (C) processes that prevent inadvertent release of de-identified information; and (2) prohibit a covered entity from making any attempt to reidentify the information. 8. Prohibition on take-it-or-leave-it A covered entity may not refuse to serve an individual who does not approve the collection, use, retention, sharing, or sale of the individual’s personal information for commercial purposes on the basis of that lack of approval (commonly known as a take-it-or-leave-it-offer ). 9. Prohibition on financial incentives (a) In general A covered entity may not offer an individual a program that relates the price of a product or service to the privacy protections afforded the individual, including by providing a discount or other incentive in exchange for the opt-in approval of the individual to the use and sharing of the individual’s personal information. (b) Rule of construction Nothing in subsection (a) shall be construed to prohibit the relation of price of a service or the level of service provided to an individual to the provision, by the individual, of financial information that is necessarily collected and used only for the purpose of initiating, rendering, billing for, or collecting payment for a service or product requested by the individual from the covered entity. (c) Exemptions The Commission may exempt a specific type of financial incentive offered by a particular covered entity from the prohibition under subsection (a) if the Commission determines that the type of financial incentive, as offered by that covered entity, is reasonable, just, and non-coercive. 10. Prohibition on disclosing information to third parties without proper assurances (a) In general A covered entity may not disclose the personal information of an individual to a third party under a written contract unless— (1) the contract prohibits the third party from— (A) using the personal information for any reason other than performing the specified service on behalf of the covered entity