; (B) the personal information to be disclosed; and (C) a concise and clear description of the business or commercial purpose for disclosing such personal information. (2) Additional requirements for sale of personal information (A) In general A covered entity may not intentionally sell personal information unless the covered entity— (i) obtains the consent required by paragraph (1) for disclosing such personal information; and (ii) provides the individual to whom such personal information relates with the identity of the specific third party to which such personal information will be disclosed. (B) Disclosing services Subparagraph (A) shall not apply to a covered entity in a case in which an individual is directing the covered entity to disclose the personal information of such individual for the sole purpose of procuring goods or services, or offers for goods or services, for such individual, if there is a reasonable mechanism for the individual to withdraw consent. (3) Requirement to include original purpose of collecting A covered entity may not intentionally disclose personal information without including the purpose for which the personal information was originally collected. (4) Exception for privacy-preserving computing Notwithstanding paragraph (1), consent is not required for disclosing (not including selling) personal information secured using privacy-preserving computing. (5) Exception for de-identified personal information Notwithstanding paragraph (1), consent is not required for disclosing (not including selling) de-identified personal information where the disclosed personal information is limited to the narrowest possible scope likely to yield the intended benefit and contractual obligations are in place that prohibit— (A) re-identification of the disclosed personal information