; and (B) one additional medium of notification, if such covered entity has the personal information necessary to make a notification through such an additional medium without causing excessive financial burden for such covered entity. (d) Rule of construction This section shall not apply to a covered entity if a person uses personal information obtained from a data breach or data-sharing abuse not involving such covered entity. III Digital Privacy Agency 301. Establishment; Director and Deputy Director (a) Agency established There is established an independent agency in the executive branch to be known as the Digital Privacy Agency , which shall implement and enforce this Act. (b) Director (1) In general There is established the position of the Director, who shall serve as the head of the Agency. (2) Appointment Subject to paragraph (3), the Director shall be appointed by the President, by and with the advice and consent of the Senate. (3) Qualification The President shall nominate the Director who, by reason of professional background and experience, is especially qualified to lead the Agency based on their knowledge and expertise in— (A) privacy; (B) information security; (C) technology