; and (ii) is different from, or in addition to, the purpose for any collection or processing to which the individual previously consented in accordance with subsection (b). (C) Duty to exercise reasonable due diligence prior to reliance on covered entity representations For purposes of subparagraph (A), a covered entity that is a third party with respect to the personal data of an individual may reasonably rely on representations made by the covered entity from whom the third party received such data regarding the notice provided to, and the consent obtained from, such individual, provided that the third party has determined, after exercising reasonable due diligence, that the covered entity is credible. (3) Notice and consent obtained by service providers A service provider may provide notice to, and obtain consent from, an individual in accordance with subsection (b) on behalf of a covered entity. (b) Consent (1) In general (A) Implicit consent Except as provided in subparagraph (B), an individual shall be deemed to have consented to a request to collect or process the individual's personal data if the individual fails to decline the request after being provided with the notice described in paragraph (2) and a reasonable amount of time to respond to the request. (B) Express affirmative consent requirement (i) In general The express affirmative consent of an individual is required to collect or process the personal data of the individual if the collection or processing— (I) involves sensitive personal data of the individual; or (II) involves the disclosure of personal data to a third party for a purpose that is not described in subsection (c). (ii) Requirements for valid express affirmative consent For purposes of clause (i), the express affirmative consent of an individual to a request to collect or process the personal data of the individual— (I) shall be clearly, prominently, and unmistakably stated; (II) shall be provided in response to a request that includes the notice described in paragraph (2)