As used in this chapter, "deidentified data" means data that cannot reasonably be used to infer information about, or otherwise be linked to, an identifiable consumer and that:

1. (1) is subject to:

   1. (A) administrative and technical measures to ensure that the data cannot be associated with a particular consumer;

   2. (B) public commitment by the holder of the data to:

      1. (i) maintain and use the data in deidentified form; and
      2. (ii) not attempt to reidentify the data; and
   3. (C) legally enforceable contractual obligations that prohibit any recipients of the data from attempting to reidentify the data; or
2. (2) meets requirements for deidentification of the data set forth in 45 CFR 164.514.

As added by P.L.233-2025, SEC.2.