; or (ii) was disclosed to the employer by a third party. (G) Preventing prospective abuses of a service by an individual whose account has been previously terminated. (H) Routing a communication through a communications network or resolving the location of a host or client on a communications network. (I) Providing transparency in advertising or origination of user-generated content. (2) Re-identification Where compliance with this title would require the re-identification of de-identified personal information, and the covered entity does not already maintain the information necessary for such re-identification, the covered entity shall be exempt from such compliance, except for requirements under section 106. (3) Disclosing A covered entity relying on an exemption under paragraph (1) with respect to personal information shall disclose in the privacy policy maintained by such entity under section 211— (A) the reason for which such information is collected, processed, maintained, or disclosed; and (B) a description of the rights provided by this title that are not available with respect to such personal information by reason of such exemption. (b) Exceptions for particular requests (1) In general A covered entity may deny the request of an individual under this title if— (A) such covered entity cannot confirm the identity of such individual; (B) such covered entity determines that granting the request of such individual would create a legitimate risk to the privacy, security, safety, or other rights of another individual; (C) such covered entity determines that granting the request of such individual would create a legitimate risk to free expression; or (D) the personal information requested to be corrected under section 102 or deleted under section 103— (i) is necessary to the completion of a transaction initiated before such request was made or the performance of a contract entered into before such request was made