; (3) upon the request of an individual, delete any covered data that the covered entity stores linked to the individual or the individual’s device; and (4) when technically feasible, upon the request of an individual, allow the individual to transmit or transfer covered data linked to the individual or the individual’s device that is maintained by the entity to the individual in a format that is standardized and interoperable. (b) Pseudonymous data If the covered data that an individual has requested processed under subsection (a) is pseudonymous data, a covered entity may decline the request if processing the request is not technically feasible. (c) Timeliness of requests In fulfilling any requests made by the individual under subsection (a) the covered entity shall act in as timely a manner as is reasonably possible. (d) Access to same service A covered entity shall not discriminate against an individual because of any action the individual took under their rights described in subsection (a), including— (1) denying goods or services to the individual; (2) charging, or advertising, different prices or rates for goods or services; or (3) providing different quality of goods or services. (e) Consideration The Commission shall allow a covered entity, by contract, to provide relevant obligations to the individual under subsection (a) on behalf of a third party service provider that collects, processes, stores, or discloses covered data only on behalf of the covered entity. 6. Information security standards (a) Required data security practices (1) Regulations Not later than 1 year after the date of enactment of this Act, the Commission shall promulgate regulations under section 553 of title 5, United States Code, to require covered entities to establish and implement policies and procedures regarding information security practices for the treatment and protection of covered data taking into consideration— (A) the level of identifiability of the covered data and the associated privacy risk