; (B) such collection, use, or disclosure is necessary and for the sole purpose of— (i) protecting against malicious, deceptive, fraudulent, or illegal activity; or (ii) detecting, responding to, or preventing information security incidents or threats; or (C) the covered organization is compelled to do so by a legal obligation. (2) Revocation (A) In general A covered organization shall provide an effective mechanism for an individual to revoke consent after it is given. (B) Effect After an individual revokes consent, the covered organization shall cease collecting, using, or disclosing the individual’s emergency health data as soon as practicable, but in no case later than 15 days after the receipt of the individual’s revocation of consent. (C) Destruction Not later than 30 days after the receipt of an individual’s revocation of consent, a covered organization shall destroy or render not linkable that individuals emergency health data under the same procedures in subsection (f). (e) Notice A covered organization that collects, uses, or discloses emergency health data shall provide to an individual a privacy policy that— (1) is disclosed in a clear and conspicuous manner, in the language in which the individual typically interacts with the covered organization, prior to or at the point of the collection of emergency health data; (2) describes how and for what purposes the covered organization collects, uses, and discloses emergency health data, including the categories of recipients to whom it discloses data and the purpose of disclosure for each category; (3) describes the covered organization’s data retention and data security policies and practices for emergency health data