; and (2) shall not, unless the covered entity receives written authorization from the individual, re-collect or otherwise obtain any of the individual's personal information, except as provided under such subsections. (c) Limitation The requirement to delete personal information in subsection (b) does not apply to publicly available information as defined in this subtitle. (d) Records Notwithstanding subsections (a) and (b), a covered entity shall maintain such personal information as is necessary to maintain adequate records of a request to delete information under subsection (a) or to comply with section 352(e)(3) and section 354 of this subtitle. Any personal information retained consistent with this subsection shall not be processed for any other purpose, and shall be reviewable by the Commission. (e) Confirmation A covered entity shall provide confirmation to the individual requesting deletion of personal information under subsection (a) not later than 5 days following the deletion of the information. 354. Voter’s right to prohibit transfer (a) In general An individual shall have the right to direct a covered entity not to sell or otherwise transfer any of that individual’s personal information obtained by a covered entity to any third party. (b) Requirement A covered entity that receives a verifiable request from an individual not to transfer that individual’s personal information pursuant to subsection (a), shall not transfer that personal information directly or indirectly to a third party. (c) Notice A covered entity that seeks to sell or transfer an individual’s personal information to any third party shall provide notice as required under section 355(b)(3). (d) Records Notwithstanding section 353, a covered entity shall retain sufficient records, including any necessary personal information, to determine whether an individual has directed the covered entity not to transfer that individual’s data to a third party. Any personal information retained pursuant to this section shall not be used for any