Additional rights and exceptions

(a) In general The Director may, by rule and subject to notice and comment, establish procedural requirements and narrowly tailored exceptions governing the exercise of rights under this title, limited to the following: (1) Identity verification and authentication procedures. (2) Standardized formats and reasonable mechanisms for submitting and fulfilling requests. (3) Reasonable limits to prevent fraud, abuse, or excessive and duplicative requests. (4) Timelines and recordkeeping requirements consistent with this title. (5) Narrowly tailored exceptions necessary to prevent a legitimate risk to the privacy, security, or safety of another individual, or to protect free expression, consistent with section 110(b). (b) Limitations The Director may not create any new substantive right or broadly waive compliance with this title.