; and (3) if the personal information is to be transferred or sold to a third party, 14 days prior to that transfer or sale. (c) Contents Notice required under subsection (a) shall include the following: (1) The identity and the contact information of the covered entity. (2) The categories of personal information received. (3) The purposes for which the personal information was received. (4) The period for which the personal information will be retained. (5) The existence of the right to request from the covered entity access to all specific pieces of personal information under section 352(f). (6) The existence of the right of an individual to request erasure of all that individual’s personal information obtained by a covered entity under section 353. (7) The existence of the right of an individual to prohibit the transfer of that individual’s personal information to a third party under section 354. (8) Information regarding the right to lodge a complaint with the Commission under section 309(a) as described in section 357 regarding any violation of this subtitle. (d) Format Notice required under subsection (a) shall be provided in a concise and easily accessible form, using clear and plain language. (e) Cost Notice required under subsection (a) shall be provided at no cost to any individual with respect to whom a covered entity has received personal information. (f) Additional notice A covered entity shall not receive additional categories of personal information, process personal information for an additional purpose, or transfer personal information to an additional third party without providing such persons notice consistent with this section. 356. Voter’s right to prohibit targeting based on personal information (a) In general An individual shall have the right to prohibit a targeting service from using that individual's personal information to deliver targeted communications to that individual— (1) on behalf of a covered entity