; (ii) was collected specifically for the completion of such transaction or the performance of such contract; and (iii) would undermine the integrity of a legally significant transaction. (2) Limitations on requests for additional information to confirm identity A covered entity may not deny a request of an individual under paragraph (1)(A) on the basis of the refusal of such individual to provide additional personal information to such covered entity to confirm the identity of such individual— (A) if the identity of such individual can reasonably be confirmed using personal information of such individual that such covered entity (as of the time of the request) already maintains; or (B) if such individual has an existing relationship (as of the time of the request) with such covered entity, such individual has confirmed the identity of such individual to such covered entity in the same manner as for other transactions of a similar sensitivity. (c) Exemption for service providers This title does not apply to a service provider. (d) Exemption for privacy-Preserving computing Except for sections 101, 105, and 106, this title does not apply to personal information secured using privacy-preserving computing. (e) Timeline for complying with a request Without undue delay but not longer than 30 days after the request, a covered entity that receives a request under this title must— (1) comply with such request