; or (2) process or transfer covered data in a manner that violates any provision of this Act. (b) Definitions (1) Deceptive data practice The term deceptive data practice means an act or practice involving the processing or transfer of covered data in a manner that constitutes a deceptive act or practice in violation of section 5(a)(1) of the Federal Trade Commission Act ( 15 U.S.C. 45(a)(1) ). (2) Harmful data practice The term harmful data practice means the processing or transfer of covered data in a manner that causes or is likely to cause any of the following: (A) Financial, physical, or reputational injury to an individual. (B) Physical or other offensive intrusion upon the solitude or seclusion of an individual or the individual’s private affairs or concerns, where such intrusion would be offensive to a reasonable person. (C) Other substantial injury to an individual. 102. Right to access and transparency (a) Right To access A covered entity, upon the verified request of an individual, shall provide the individual, in a human-readable format that a reasonable individual can understand, with— (1) a copy or accurate representation of the covered data of the individual processed or transferred by the covered entity; and (2) the name of any third party to whom covered data of the individual has been transferred by the covered entity and a description of the purpose for which the entity transferred such data to such third party. (b) Right to transparency A covered entity shall make publicly and persistently available, in a conspicuous and readily accessible manner, a privacy policy that provides a detailed and accurate representation of the entity’s data processing and data transfer activities. Such privacy policy shall include, at a minimum— (1) the identity and the contact information of the covered entity, including the contact information for the covered entity’s representative for privacy and data security inquiries