; and (B) includes any entity that collects commercial credit data. (b) Requirements for reporting breaches (1) Applicable State law (A) In general Except as provided in paragraph (2), if nonpublic data of a small business concern that is collected or stored by a credit reporting company has been breached, the credit reporting company shall report the breach promptly and not later than as required under the law of the State in which the small business concern is located. (B) Locations in multiple States If a small business concern that is affected by a breach described in subparagraph (A) has locations in more than 1 State, for the purposes of that subparagraph, the law of the State that imposes the shortest period for the reporting of the breach shall apply. (2) Exception (A) In general If a small business concern that is affected by a breach described in paragraph (1)(A) is located in a State that does not have a law that imposes a set period for the reporting of the breach, the credit reporting company to which the requirement under that paragraph applies shall report the breach in the most expeditious manner practicable and without unreasonable delay. (B) Rule of construction regarding a law enforcement request For the purposes of subparagraph (A), a delay with respect to the reporting of a breach described in that subparagraph that is caused by a requirement to respond to a request submitted by a law enforcement agency shall be construed to be a reasonable delay. (c) Prohibition During the 180-day period beginning on the date on which a breach described in subsection (b)(1)(A) occurs, a credit reporting company may not charge a small business concern that is affected by that breach for providing the small business concern with the consumer report of the small business concern. (d) No preemption Nothing in this section shall preempt any State law with respect to credit reporting companies. . (b) GAO report (1) Definitions In this subsection— (A) the term credit reporting company — (i) has the meaning given