; and (B) the subcontractor is subject (pursuant to an agreement between the service provider and the subcontractor) to the same requirements and obligations as the service provider with respect to the collection and processing of the personal data. (5) Considerations In determining whether a service provider has acted reasonably in complying with this subsection, the Commission shall take into account— (A) the size, complexity, and resources of the service provider and whether the service provider is a small business