Right of access, correction, and deletion

(a) Right of access (1) In general A regulated entity shall make available a reasonable mechanism by which an individual, upon a verified request, may access— (A) any personal reproductive or sexual health information relating to such individual that is retained by such regulated entity, including— (i) in the case of such information that such regulated entity collected from third parties, how and from which specific third parties such regulated entity collected such information; and (ii) such information that such regulated entity inferred about such individual; and (B) a list of the specific third parties to which such regulated entity has disclosed any personal reproductive or sexual health information relating to such individual. (2) Format A regulated entity shall make the information described in paragraph (1) available in both a human-readable format and a structured, interoperable, and machine-readable format. (b) Right of correction A regulated entity shall make available a reasonable mechanism by which an individual, upon a verified request, may direct the correction of any inaccurate personal reproductive or sexual health information relating to such individual that is retained by such regulated entity or the service providers of such regulated entity, including any such information that such regulated entity collected from a third party or inferred from other information retained by such regulated entity. (c) Right of deletion A regulated entity shall make available a reasonable mechanism by which an individual, upon a verified request, may direct the deletion of any personal reproductive or sexual health information relating to such individual that is retained by such regulated entity and the service providers of such regulated entity, including any such information that such regulated entity collected from a third party or inferred from other information retained by such regulated entity. (d) General provisions (1) Reasonable mechanism defined In this section, the term reasonable mechanism means, with respect to a regulated entity and a right under this section, a mechanism that— (A) is provided in the primary manner through which such regulated entity provides the goods or services of such regulated entity; (B) is easy to use and prominently available; and (C) includes an online means of exercising such right. (2) Timeline for complying with requests A regulated entity shall comply with a verified request received under this section without undue delay and not later than 15 days after the date on which the requesting individual submits the verified request. (3) Fees prohibited A regulated entity may not charge a fee to an individual for a request made under this section. (4) Rules of construction Nothing in this section shall be construed to require a regulated entity to— (A) take an action that would convert information that is not personal information into personal information; (B) collect or retain personal information that such regulated entity would otherwise not collect or retain; or (C) retain personal information longer than such regulated entity would otherwise retain such information.