; (2) the purposes for and means by which the entity collects, processes, and stores the covered data; (3) the persons and entities to whom, and purposes for which, the covered entity discloses the covered data; and (4) a conspicuous, clear, and understandable means for individuals to access the methods necessary to exercise their rights under sections 4 and 5. 4. Required data practices (a) Regulations Not later than 1 year after the date of the enactment of this Act, the Commission shall promulgate regulations under section 553 of title 5, United States Code, that require covered entities to implement, practice, and maintain certain data procedures and processes that meet the following requirements: (1) Minimum data processing requirements Except as provided in subsection (b), require covered entities to meet all of the following requirements regarding the means by and purposes for which covered data is collected, processed, stored, and disclosed: (A) Reasonable (i) In general Except as provided in paragraph (3), covered data collection, processing, storage, and disclosure practices must meet a reasonable interest of the covered entity, including— (I) business, educational, and administrative operations that are relevant and appropriate to the context of the relationship between the covered entity and the individual linked to the covered data; (II) relevant and appropriate product and service development and enhancement; (III) preventing and detecting abuse, fraud, and other criminal activity; (IV) reasonable communications and marketing practices that follow best practices, rules, and ethical standards; (V) engaging in scientific, medical, or statistical research that follows commonly accepted ethical standards; or (VI) any other purpose for which the Commission considers to be reasonable. (ii) Considerations In promulgating regulations in accordance with this subparagraph, the Commission shall consider— (I) the role of impact assessments in determining the privacy risk for high risk processing