; and (2) require or cause a person to disclose or circumvent the means described in paragraph (1) to the covered entity that would allow it to render the content intelligible. (f) Service providers safe harbor A service provider shall not be held liable for a violation of this section if such service provider is acting at the direction of and on behalf of a covered entity and has a reasonable belief that the covered entity’s directions are in compliance with this section. 207. Prohibition on discriminatory processing (a) Discrimination in economic opportunities A covered entity shall not process personal information or contents of communication for advertising, marketing, soliciting, offering, selling, leasing, licensing, renting, or otherwise commercially contracting for employment, finance, health care, credit, insurance, housing, or education opportunities in a manner that discriminates against or otherwise makes opportunities unavailable on the basis of an individual’s protected class status. (b) Public accommodations A covered entity shall not process personal information in a manner that segregates, discriminates in, or otherwise makes unavailable the goods, services, facilities, privileges, advantages, or accommodations of any place of public accommodation on the basis of the protected class status of an individual or a group of individuals. (c) Regulations The Director shall promulgate regulations to implement this section. 208. Requirements for notice and consent processes and privacy policies (a) Minimum threshold The Director shall establish minimum thresholds that covered entities must meet for the percentage of individuals who understand a notice or consent process or privacy policy required by this Act. In establishing such minimum thresholds, the Director shall— (1) vary required thresholds on types and scale of reasonably foreseeable privacy harms