; and (ii) sends or receives such personal information over the internet or a similar communications network. (B) Exclusion The term covered entity does not include a natural person, except to the extent such person is engaged in a commercial activity that is more than de minimis. (8) Custodian The term custodian means the custodian or any deputy custodian designated by the Agency. (9) Data breach The term data breach means unauthorized access to or acquisition of personal information or contents of communications maintained by such covered entity. (10) Data-sharing abuse The term data-sharing abuse means processing, by a third party, of personal information or contents of communications disclosed by a covered entity to the third party, for any purpose other than— (A) a purpose specified by the covered entity to the third party at the time such personal information or contents of communications was disclosed; or (B) a purpose to which the individual to whom the information relates has consented. (11) De-identify (A) In general The term de-identify means, with respect to information, performing actions so that such information cannot reasonably identify, relate to, describe, reference, be capable of being associated with, or be linked, directly or indirectly, to a particular individual or device, but only to the extent that the covered entity that uses such information— (i) has performed such actions using best practices for the types of data such information contains; (ii) has implemented technical safeguards that prohibit re-identification of the individual with whom such information was linked; (iii) has implemented business processes that specifically prohibit re-identification of the information; (iv) has implemented business processes to prevent inadvertent release of such information