; and (B) the Commission shall promptly review the platform's decision and determine whether the qualified researcher has violated the privacy and cybersecurity safeguards established for the qualified research project. (c) Notice to platform users The Commission shall issue regulations requiring that platforms, through posting of notices or other appropriate means, keep users informed of their privacy protections and the information that the platform is required to share with qualified researchers under this Act. (d) Safe harbor No cause of action under State or Federal law arising solely from the release of qualified data and information to qualified researchers in furtherance of a qualified research project may be brought against any platform that complies with the Act. (e) Right of review If a platform fails to provide all of the qualified data and information required under the terms of a qualified research project to the qualified researcher conducting the project, the qualified researcher or the researcher's affiliated university or non-profit organization may bring an action in district court for injunctive relief or petition the Commission to bring an enforcement action against the platform. (f) Security Nothing in this Act shall be construed to restrict a platform’s ability to: (1) Take immediate steps to protect an interest that is essential for the life or physical safety of a natural person. (2) Respond to security incidents, identity theft, fraud, harassment, malicious or deceptive activities, or illegal activity, preserve the integrity of security of systems, or investigate or report those responsible for such actions. 5. Obligations and immunity for qualified researchers (a) Scope of permitted use of qualified data and information Each qualified researcher who accesses qualified data and information shall use the qualified data and information— (1) only for the purposes of conducting research authorized under the terms of the qualified research project involved