; or (IV) close the individual’s account or otherwise terminate the individual’s relationship with the covered entity; and (3) not less frequently than once every 2 years— (A) to audit the privacy and security practices in place that protect the confidentiality, integrity, and availability of personal information held by the covered entity; or (B) if the Commission determines it appropriate based on the volume and nature of the personal information collected by the covered entity, to— (i) have an independent third-party auditor conduct the audit described in subparagraph (A); and (ii) make the results of the audit available to the Commission upon completion. 14. Privacy and security officer In promulgating regulations under section 3, the Commission shall require a covered entity to— (1) designate not less than 1 employee of the covered entity to coordinate the efforts to comply with and carry out the responsibilities of the covered entity under this Act, including any request or challenge related to personal information