; and (2) take into account expectations of individuals, potential privacy harms, and individuals’ awareness of privacy harms. (b) Consent revocation A covered entity shall make available a reasonable mechanism by which an individual may revoke consent for any consent given under this Act. (c) Safe harbor (1) Approval procedures The Director shall develop procedures for analyzing and approving data submitted by a covered entity to establish that a notice and consent process or privacy policy of such covered entity meets the threshold established under subsection (a). (2) Presumption If a covered entity submits testing data to and receives an approval from the Director under paragraph (1) establishing that a notice or consent process or privacy policy of such covered entity meets the threshold established under subsection (a), such notice or consent process or privacy policy shall be presumed to have met such threshold. Such presumption may be rebutted by clear and convincing evidence. (3) Public availability of Approved processes and policies and associated testing data The Director shall make publicly available online the notice and consent processes and privacy policies and associated testing data that the Director approves under paragraph (1). (4) Small business adoption of notice or consent process of another covered entity (A) In general If a small business adopts a notice or consent process of another covered entity that collects, processes, maintains, or discloses personal information in substantially the same way as such small business, if the process of such other covered entity has been approved under paragraph (1), the process of such small business shall receive the presumption under paragraph (2). (B) Ability to freely use Approved process A covered entity whose notice or consent process is approved under paragraph (1) shall permit a small business to freely use such process, or a derivative thereof, as described in subparagraph (A). (C) No published process In the case of a small business for which