; (2) a list of the third parties, subsidiaries, and corporate affiliates, to which such covered entity has disclosed and from which such covered entity has, at any time on or after the effective date of this Act, obtained the personal information of such individual; (3) a concise and clear description of the business or commercial purposes of such covered entity— (A) for collecting, processing, or maintaining the personal information of such individual; and (B) for disclosing to a third party the personal information of such individual; and (4) a list of automated decision-making processes that an individual has a right to request human review of under section 105 with a concise and clear description of the implications and intended effects of each such process. (b) Exception for publicly accessible information A covered entity that makes available information required in subsection (a) shall be considered in compliance with such requirements if the covered entity provides an individual with instructions on how to access a public posting of such information, including in a privacy policy, if the instructions are easy and do not require payment. (c) Small businesses excluded Subsection (a)(3) does not apply to a small business. 102. Right of correction (a) Dispute by individual A covered entity shall make available a reasonable mechanism by which an individual may dispute the accuracy or completeness of personal information linked to such individual that is maintained by such covered entity if such information is processed in any way, by such covered entity, a third party of such covered entity, or a service provider of such covered entity that may increase reasonably foreseeable significant privacy harms. (b) Correction by covered entity A covered entity receiving a dispute under subsection (a) shall— (1) correct or complete (as the case may be) the disputed information and notify such individual that the correction or completion has been made