for which the covered entity collects such data. (F) A clear and concise statement describing the extent to which an individual may exercise control over the collecting, retaining, using, and disclosing of health data by the covered entity, and the steps an individual must take to implement such controls. (G) A clear and concise statement describing the efforts of the covered entity to protect health data from unauthorized disclosure. 3. Unfair and deceptive acts and practices relating to location data (a) Prohibition on sale from data brokers It shall be unlawful for a data broker to sell, resell, license, trade, transfer, share, or otherwise provide or make available location data (including data volunteered by an individual, medical center-derived data, data from a wearable fitness tracker, data from web browsing history, or any other source determined appropriate by the Commission). (b) Prohibition on sale to data brokers It shall be unlawful for any person to sell, resell, license, trade, transfer, share, or otherwise provide or make available location data (including data volunteered by an individual, medical center-derived data, data from a wearable fitness tracker, data from web browsing history, or any other source determined appropriate by the Commission) to a data broker. 4. Right of access and deletion (a) Right of access (1) In general A covered entity shall make available a reasonable mechanism by which an individual, upon verified request, may access— (A) any health data or location data relating to such individual that is retained by such covered entity, including— (i) in the case of such data that the covered entity collected from any third party, how and from which specific third party the covered entity collected such data