; and (ii) include— (I) the personal data being processed; (II) whether personal data will be processed for purposes of targeted advertisements or monetization; and (III) the period of retention of the personal data expressed in exact dates. (3) Rulemaking The Commission shall promulgate rules specifying requirements for the privacy policies required by this subsection, including rules regarding the online and offline accessibility, time of availability, and contents of the policies. (4) Standardized short-form privacy policy The Commission shall establish a standardized short-form privacy policy that complies with paragraph (2)(B) and any associated rules promulgated by the Commission. B Data security reform 2421. Data security safeguards (a) In general A covered entity shall ensure appropriate security of personal data, including protection against unauthorized or unlawful processing and against accidental loss, destruction, or damage, using reasonable technical, physical, and organizational safeguards and using reasonably designed technological systems to protect persons exposed by their interactions with the covered entity. (b) Information security program (1) In general As part of the duty to ensure appropriate security of personal data under subsection (a), a covered entity shall establish and implement, and thereafter maintain, a comprehensive information security program (referred to in this subsection as the Information Security Program ) that is designed to protect the security, confidentiality, and integrity of personal data. (2) Requirements To satisfy the requirement under paragraph (1), a covered entity shall, at a minimum— (A) document in writing the content, implementation, and maintenance of the Information Security Program; (B) designate 1 or more qualified employees to coordinate and be responsible for the Information Security Program