Sec. 3. As used in this chapter, "deidentified data" means data that cannot reasonably be used to infer information about, or otherwise be linked to, an identifiable consumer and that:
(1) is subject to:
(A) administrative and technical measures to ensure that the data cannot be associated with a particular consumer;
(B) public commitment by the holder of the data to:
(i) maintain and use the data in deidentified form; and
(ii) not attempt to reidentify the data; and
(C) legally enforceable contractual obligations that prohibit any recipients of the data from attempting to reidentify the data; or
(2) meets requirements for deidentification of the data set forth in 45 CFR 164.514.