; (C) has not, in combination with each subsidiary and affiliate of the service, maintained personal information of 250,000 or more individuals for 3 or more of the preceding 12 months; (D) has fewer than 200 employees; and (E) received less than $25,000,000 in gross revenue in the preceding 12-month period. (33) State The term State means each State of the United States, the District of Columbia, each commonwealth, territory, or possession of the United States, and each federally recognized Indian Tribe. (34) State attorney general The term State attorney general means, with respect to a State, the attorney general or chief law enforcement officer of the State, or another official or agency designated by the State to bring civil actions on behalf of the State or the residents of the State. (35) State privacy regulator The term State privacy regulator means an agency or instrumentality of a State that has the primary purpose of administering, implementing, or enforcing a privacy law or associated rules or regulations. (36) Third party The term third party means, with respect to a covered entity, a person— (A) to which such covered entity disclosed personal information; and (B) that is not— (i) such covered entity; (ii) a subsidiary or corporate affiliate of such covered entity