; or (E) other additional specific categories of operational purposes that the Commission may define by rule, issued in accordance with section 553 of title 5, United States Code. (d) Limiting the retention of sensitive personal data A covered entity shall delete or de-identify sensitive personal data, and shall direct its service providers to delete or de-identify sensitive personal data, after the data is no longer reasonably necessary to accomplish the intended purposes permitted by this section, unless such deletion or de-identification is impossible or demonstrably impracticable. (e) Bankruptcy If a covered entity or service provider commences a case under title 11 of the United States Code, and the case or any proceeding under the case is expected to lead to the disclosure of the personal data of any individual, the covered entity or service provider shall, in a reasonable amount of time before the disclosure, provide each individual whose personal data is subject to the disclosure with— (1) a notice of the proposed disclosure, including— (A) the name of each third party to which the personal data will be disclosed; and (B) a description of the policies and practices relating to personal data of each such third party; and (2) the opportunity to— (A) deny consent, or withdraw previously given consent, to the disclosure of the personal data; or (B) request that the covered entity or service provider delete or de-identify the personal data. 4. Right to know (a) In general A covered entity shall make publicly available, in a clear and prominent location and in easy-to-understand language, a privacy policy that includes— (1) a clear and specific description of the entity's policies and practices with respect to personal data; (2) a clear and specific description of the rights of individuals with respect to their personal data (including the rights described in section 5) and information on how to exercise those rights