; and (B) to the extent that the collection or processing— (i) is on the behalf of, and at the direction of, such covered entity; or (ii) is permitted under section 3(c). (16) Small business The term small business means any covered entity or service provider that— (A) for the most recent 6-month period— (i) employs not more than 500 employees; and (ii) maintains less than $50,000,000 in average gross receipts for the previous 3 years; and (B) collects or processes on an annual basis— (i) the personal data of fewer than 1,000,000 individuals; or (ii) the sensitive personal data of fewer than 100,000 individuals. (17) Third party (A) In general The term third party means a covered entity that receives third party personal data from an unaffiliated covered entity, but only with respect to such third party personal data. (B) Third party personal data For purposes of subparagraph (A), the term third party personal data means personal data that a covered entity discloses to another unaffiliated covered entity and such disclosure— (i) is not directed by the individual to whom the personal data relates; and (ii) is not necessary to complete a transaction or fulfill a request made by the individual to whom such data relates. (18) Unaffiliated The term unaffiliated means, with respect to two or more entities, that the entities do not share interrelated operations, common management, centralized control of labor relations, or common ownership or financial control. 3. Collection and processing of personal data (a) Requirements (1) In general Except as provided in paragraphs (2) and (3), a covered entity shall not collect or process personal data of an individual unless— (A) the individual has consented explicitly or implicitly to such collection or processing for a specific purpose, in accordance with subsection (b)