; and (B) store covered data only as long as is reasonably necessary to carry out the purposes for which the data was collected. (b) Exemptions Subsection (a) shall not apply if the limitations on the collection, processing, storage, or disclosure of covered data would— (1) inhibit detection or prevention of a security risk or incident; (2) risk the health, safety, or property of the covered entity or individual; or (3) prevent compliance with an applicable law (including regulations) or legal process. 5. Individual control over data use (a) Regulations Not later than 1 year after the date of the enactment of this Act, the Commission shall promulgate regulations under section 553 of title 5, United States Code, to require covered entities to provide conspicuous, understandable, clear, and free of charge method to— (1) upon the request of an individual, provide the individual with access to, or an accurate representation of, covered data linked to with the individual or the individual’s device stored by the covered entity; (2) upon the request of an individual, provide the individual with a means to dispute and resolve the accuracy or completeness of the covered data linked to the individual or the individual’s device stored by the entity; (3) upon the request of an individual, delete any covered data that the covered entity stores linked to the individual or the individual’s device