; (B) can have personal information disclosed to it under section 204; (C) is, at the time of the self-certification, in compliance with all applicable requirements of this Act (including provisions a small business is otherwise exempt from complying with); (D) will continue to comply with all requirements of this Act; and (E) will only use such application programming interface or similar mechanism at the express request of an individual. (2) Denial of access (A) In general A covered entity may deny access to the application programming interface or similar mechanism required by subsection (b)(1)(B) if such covered entity has an objective, reasonable belief that the requesting covered entity has failed to meet the requirements for self-certification under paragraph (1). (B) Review In accordance with the procedures established under paragraph (3)(B), a covered entity the request of which is denied under subparagraph (A) may petition the Director for review of the denial. If the Director finds that such denial is unreasonable, the Director shall impose a penalty, to be established in such procedures, on the covered entity that denied the request. (3) Certification and review procedures The Director shall establish— (A) procedures for a covered entity to self-certify under paragraph (1); and (B) procedures for the review of petitions under paragraph (2)(B), including penalties for unreasonable denials. (d) Small businesses excluded This section does not apply to a small business. (e) Portable category defined In this section, the term portable category means a category of products and services established by the Director under subsection (a)(1)(A)— (1) for which the sum obtained by adding the number of users or estimated users of each product or service in such category is greater than 10,000,000; and (2) that— (A) has an estimated Herfindahl-Hirschman Index of 2,000 or greater; (B) has 3 or fewer covered entities offering products and services in such category