; and (iii) conditioning the participation of a child in a game, sweepstakes, or other contest on consenting to the processing of more covered information than is necessary for such child to participate. (B) Exceptions Nothing in subparagraph (A) shall prohibit a covered entity from processing covered information if necessary solely for purposes of— (i) detecting and preventing security incidents; (ii) preventing imminent danger to the personal safety of an individual or group of individuals; (iii) identifying and repairing errors that impair the functionality of the Internet website or online service; or (iv) complying with any Federal, State, or local law, rule, regulation, or other legal obligation, including civil, criminal, or regulatory inquiries, investigations, subpoenas, disclosures of information required by a court order or other properly executed compulsory process. (C) De-identified information Such regulations shall prohibit a covered entity that de-identifies information, and any third party with which the covered entity discloses such de-identified information, from re-identifying, or attempting to re-identify, any information that the covered entity has de-identified. Such regulations shall also require a covered entity to contractually prohibit any third party with which the covered entity discloses such de-identified information from re-identifying or attempting to re-identify such information. (7) Security Requirements (A) In general Such regulations shall require a covered entity to establish and implement reasonable security policies, practices, and procedures for the treatment and protection of covered information, taking into consideration— (i) the size, nature, scope, and complexity of the activities engaged in by such covered entity; (ii) the sensitivity of any covered information at issue; (iii) the state of the art in administrative, technical, and physical safeguards for protecting such information