; and (II) process any deletion request associated with a match between such hashed registries and the records of the data broker. (ii) FTC guidance Not later than 6 months after the effective date of the regulations promulgated under subparagraph (A), the Commission shall publish guidance on the process and standards to which a data broker must adhere in carrying out clause (i). (2) Deletion (A) Information deletion (i) In general Subject to clause (ii), not later than 31 days after accessing the hashed registries described in paragraph (1)(B)(iv), a data broker and any associated legal entity shall delete all personal information in its possession related to the individual making the request and discontinue the collection of personal information related to such individual. Immediately following the deletion, the data broker shall send an affirmative representation to the Commission with the number of records deleted pursuant to each match with a value in the hashed registries. (ii) Exclusions In carrying out clause (i), a data broker may retain, where required, the following information: (I) Any personal information that is processed or maintained solely as part of human subjects research conducted in compliance with any legal requirements for the protection of human subjects. (II) Any personal information necessary to comply with a warrant, subpoena, court order, rule, or other applicable law. (III) Any information necessary for an activity described in subsection (f)(3)(B), provided that the retained information is used solely for any such activity. (iii) Use of information Any personal information excluded under clause (ii) may only be used for the purpose described in the applicable subclause of clause (ii), and may not be used for any other purpose, including marketing purposes. (B) Annual report Each data broker registered under subsection (a) shall submit to the Commission, on an annual basis, a report on the completion rate with respect to the completion of deletion requests under subparagraph (A). (C)