prompt_front: You are given two reports by the government agency.



Question: Write a one-page summary of the report 1.

Report 1: For over a decade, each of VA’s 170 medical centers used VHA’s legacy MSPV program to order medical supplies, such as bandages and scalpels  Many of those items were purchased using the Federal Supply Schedules, which provided medical centers with a great deal of flexibility  However, as we reported in 2016, this legacy program prevented VHA from standardizing items used across its medical centers and affected its ability to leverage its buying power to achieve greater cost avoidance  Standardization is a process of narrowing the range of items purchased to meet a given need, such as buying 10 varieties of bandages instead of 100, in order to improve buying power, simplify supply chain management, and provide clinical consistency  In part because of the legacy MSPV program’s limited standardization, VHA decided to transition to a new iteration, called MSPV-NG  The transition to MSPV-NG has been a major effort, involving the MSPV- NG program office, stakeholders from the VHA’s Procurement and Logistics Office and VA’s Strategic Acquisition Center (SAC)—a VA-wide contracting organization—and logistics and clinical personnel at every medical center  The program also includes hundreds of new contracts with individual supply vendors and a new set of prime vendor contracts to distribute the supplies  VA’s goals for the MSPV-NG program include (1) standardizing requirements for supply items for greater clinical consistency; (2) demonstrating cost avoidance by leveraging VA’s substantial buying power when making competitive awards; (3) achieving greater efficiency in ordering and supply chain management, including a metric of ordering 40 percent of medical centers’ supplies from the MSPV-NG formulary; and (4) involving clinicians in requirements development to ensure uniform clinical review of medical supplies  VHA launched the MSPV-NG program in December 2016, but allowed a 4-month transition period  After April 2017, medical centers could no longer use the legacy program  MSPV-NG now restricts ordering to a narrow formulary  VHA policy requires medical centers to use MSPV- NG—as opposed to other means such as open market purchase card transactions—when purchasing items that are available in the formulary  Leading hospital networks we spoke with have similar goals to VA in managing their supply chains, including clinical standardization and reduced costs  These hospital networks reported they analyze their spending to identify items purchased most frequently, and which ones would be the best candidates to standardize first to yield cost savings  The hospitals’ supply chain managers reported establishing consensus with clinicians through early and frequent collaboration, understanding that clinician involvement is critical to the success of any effort to standardize their medical supply chain  By following these practices, these hospital networks have reported they have achieved significant cost savings in some cases, and the potential for improved patient care, while maintaining buy-in from their clinicians  VHA’s implementation of the MSPV-NG program—from its initial work to identify a list of supply requirements in early 2015, through its roll-out of the formulary to medical centers in December 2016—was not executed in line with leading practices  Specifically, VHA lacked a documented program strategy, leadership stability, and workforce capacity for the transition that, if in place, could have facilitated buy-in for the change throughout the organization  Further, the initial requirements development process and tight time frames contributed to ineffective contracting processes  As a result, VHA developed an initial formulary that did not meet the needs of the medical centers and has yet to achieve utilization and cost avoidance goals  VA made some changes in the second phase of requirements development to address deficiencies identified in the initial roll out  Key among these was to increase the level of clinical involvement, that is, to obtain input from the doctors and nurses at VA’s individual medical facilities  Despite changes aimed at improving implementation, the agency continues to face challenges that prevent the program from fully achieving its goals  VA did not document a clear overall strategy for the MSPV-NG program at the start and has not done so to date  About 6 months after our initial requests for a strategy or plan, a VHA official provided us with an October 2015 plan focusing on the mechanics of establishing the MSPV-NG formulary  However, this plan was used only within the VHA Procurement and Logistics Office and had not been approved by VHA or VA leadership  Leading practices for organizational transformation state that agencies must have well-documented plans and strategies for major initiatives (such as MSPV-NG) and communicate them clearly and consistently to all involved—which included VHA headquarters, the SAC, and all 170 medical centers  Without such a strategy, VA could not reasonably ensure that all stakeholders understood VHA’s approach for MSPV-NG and worked together in a coordinated manner to achieve program goals  In our November 2017 report, we recommended that the Director of the MSPV-NG program office should, with input from SAC, develop, document, and communicate to stakeholders an overarching strategy for the program, including how the program office will prioritize categories of supplies for future phases of requirement development and contracting  VA agreed with this recommendation and reported it would have a strategy in place by December 2017  Leadership instability and workforce challenges also made it difficult for VA to execute its transition to MSPV-NG  Our work has shown that leadership buy-in is necessary to ensure that major programs like MSPV- NG have the resources and support they need to execute their missions  Due to a combination of budget and hiring constraints, and lack of prioritization within VA, the MSPV-NG program office has never been fully staffed and has experienced instability in its leadership  As of January 2017, 24 of the office’s 40 positions were filled, and program office officials stated that this lack of staff affected their ability to implement certain aspects of the program within the planned time frames  In addition, since the inception of MSPV-NG, the program office has had four directors, two of whom were acting and two of whom were fulfilling the director position while performing other collateral duties  For instance, one of the acting MSPV-NG program office directors was on detail from a regional health network to fulfill the position, but had to abruptly leave and return to her prior position due to a federal hiring freeze  In our November 2017 report, we recommended that VHA prioritize the hiring of a MSPV- NG program director on a permanent basis  VA agreed with this recommendation and indicated a vacancy announcement will be posted by the end of 2017  The MSPV-NG program office initially developed requirements for items to be included in the formulary based almost exclusively on prior supply purchases, with limited clinician involvement  The program office concluded in its October 2015 formulary plan that relying on data from previous clinician purchases would be a good representation of medical centers’ needs and that clinician input would not be required for identifying which items to include in the initial formulary  Further, rather than standardizing purchases of specific categories of supplies—such as bandages or scalpels—program officials told us they identified medical and surgical items on which VA had spent $16,000 or more annually and ordered at least 12 times per year, and made those items the basis for the formulary  Officials said this analysis initially yielded a list of about 18,000 items, which the program office further refined to about 6,000 items by removing duplicate items or those that were not considered consumable commodities, such as medical equipment  This approach to requirements development stood in sharp contrast to those of the leading hospital networks we met with, which rely heavily on clinician input to help drive the standardization process and focus on individual categories of supplies that provide the best opportunities for cost savings  Based on the requirements developed by the program office, SAC began to issue competitive solicitations for the 6,000 items on the initial formulary in June 2015  Medical supply companies had responded to about 30 percent of the solicitations as of January 2016  As a result, according to SAC officials, they conducted outreach and some of these companies responded that VHA’s requirements did not appear to be based on clinical input and instead consisted of manufacturer-specific requirements that favored particular products instead of broader descriptions  Furthermore, SAC did not solicit large groups of related items, but rather issued separate solicitations for small groups of supply items—consisting of three or fewer items  This is contrary to industry practices of soliciting large groups of related supplies together  Therefore, according to SAC officials, some medical supply companies told them that submitting responses to SAC’s solicitations required more time and resources than they were willing to commit  By its April 2016 deadline for having 6,000 items on the formulary, SAC had been working on the effort for over a year and had established competitive agreements for about 200 items, representing about 3 percent of the planned items  Without contracts for the items on the formulary in place, VA delayed the launch of the MSPV-NG program until December 2016 and SAC began establishing non-competitive agreements in the last few months before the launch of MSPV-NG  As shown in figure 1, these non-competitive agreements accounted for approximately 79 percent of the items on the January 2017 version of the formulary  While this approach enabled the MSPV-NG program office to establish the formulary more quickly, it did so at the expense of one of the primary goals of the MSPV-NG program—leveraging VA’s buying power to obtain cost avoidance through competition  Once VA’s MSPV-NG initial formulary was established in December 2016, each medical center was charged with implementing it  According to logistics officials we spoke with at selected medical centers, they had varying levels of success due, in part, to incomplete guidance from the program office  Without clear guidance, many medical centers reported they were unable to find direct matches or substitutes on the MSPV-NG formulary for a substantial number of items they routinely used, which negatively impacted utilization rates for the initial formulary  In our November 2017 report, we recommended that the Director of the MSPV- NG program office provide complete guidance to medical centers for matching equivalent supply items  VA agreed with this recommendation and indicated it would provide this guidance to medical centers by December 2017  According to SAC, as of June 2017, only about a third of the items on the initial version of the formulary were being ordered in any significant quantity by medical centers, indicating that many items on the formulary were not those that are needed by medical centers  Senior VHA acquisition officials attributed this mismatch to shortcomings in their initial requirements development process as well as with VA’s purchase data  VA had set a target that medical centers would order 40 percent of their supplies from the MSPV-NG formulary, but utilization rates were below this target with a nationwide average utilization rate across medical centers of about 24 percent as of May 2017  Specifically, Chief Supply Chain Officers—who are responsible for managing the ordering and stocking of medical supplies at six selected medical centers—told us that many items they needed were not included in the MSPV-NG formulary  As such, we found that these six medical centers generally fell below VA’s stated utilization target  As shown in figure 2, among the six selected medical centers we reviewed, one met the target, while the remaining five were below 25 percent utilization  Instead of fully using MSPV-NG, the selected medical centers are purchasing many items through other means, such as purchase cards or new contracts awarded by their local contracting office, in part, because they said the formulary does not meet their needs  These approaches run counter to the goals of the MSPV-NG program and contribute to VA not making the best use of taxpayer dollars  Greater utilization of MSPV-NG is essential to VA achieving the cost avoidance goal of $150 million for its supply chain transformation effort  Under the legacy MSPV program, the National Acquisition Center tracked cost avoidance achieved by comparing prices for competitively-awarded MSPV supply contracts with prices available elsewhere  However, VHA officials stated that they are not currently tracking cost avoidance related specifically to MSPV-NG  In our November 2017 report, we recommended that the VHA Chief Procurement and Logistics Officer, in coordination with SAC, should calculate cost avoidance achieved by MSPV-NG on an ongoing basis  VA agreed with this recommendation and reported it would develop a new metric to measure cost avoidance by June 2018  In Phase 2 of MSPV-NG, the program office has taken some steps to incorporate greater clinical involvement in subsequent requirements development, but both its requirements development and SAC’s contracting efforts have been hampered by staffing and schedule constraints  In the fall of 2016, the program office began to establish panels of clinicians to serve on MSPV-NG integrated product teams (IPT) assigned to the task of developing updated requirements for the second phase of the formulary  Program officials said they had difficulty recruiting clinicians to participate  We found that slightly more than half (20 of the 38) of the IPTs had begun their work to review items and develop updated requirements by the time the MSPV-NG program launched in December 2016  Staff on the IPTs had to complete their responsibilities by the end of March 2017 while simultaneously managing their regular workload as physicians, surgeons, or nurses  By early March 2017, the IPTs still had about 4,200 items to review  Faced with meeting this unrealistic time frame, the MSPV-NG program office had 9 IPT members travel to one location—with an additional 10 members participating virtually—to meet for 5 days to review the remaining items  Members told us that this time pressure limited the extent to which they were able to pursue the goal of standardizing supplies, and that their review ended up being more of a data validation exercise than a standardization review  VHA ultimately met this compressed timeline, but in a rushed manner that limited the impact of clinician involvement  In our November 2017 report, we recommended that the VHA Chief Procurement and Logistics Officer use input from national clinical program offices to prioritize its requirements development and standardization efforts beyond Phase 2 to focus on supply categories that offer the best opportunity for standardization and cost avoidance  VA agreed with this recommendation and stated it is in the process of finalizing guidance that will detail the importance of involving the national clinical program offices in MSPV-NG requirements development and standardization efforts  The SAC plans to replace the existing Phase 1 non-competitive agreements with competitive awards based on the Phase 2 requirements generated by the IPTs, but it may not be able to keep up with expiring agreements due to an unrealistic schedule  Because they were made on a non-competitive basis, the Phase 1 agreements were established for a period of 1 year  In order to keep the full formulary available, the SAC director said the staff must award 200 to 250 contracts before the Phase 1 agreements expire later this year  SAC officials acknowledged that it is unlikely that they will be able to award the contracts by the time the existing agreements expire  According to SAC officials, they are in the process of hiring more staff to deal with the increased workload  Further, the SAC division director told us that they canceled all outstanding Phase 2 solicitations in September 2017 due to low response rates, protests from service-disabled veteran-owned small businesses, and changes in overall MSPV-NG strategy  In our November 2017 report, we recommended that the MSPV-NG program office and SAC should establish a plan for how to mitigate the potential risk of gaps in contract coverage while SAC is still working to make competitive Phase 2 awards, which could include prioritizing supply categories that are most likely to yield cost avoidance  VA agreed with this recommendation and indicated it has developed a plan to mitigate the risk of gaps in contract coverage with short- and mid-term procurement strategies to ensure continued provision of medical and surgical supplies to VHA facilities  The department also stated that it plans to replace the current MSPV-NG contract and formulary process with a new approach where the prime vendor would develop the formulary  However, VA will likely face challenges in this new approach until it fully addresses the existing shortcomings in the MSPV-NG program  Chairman Roe, Ranking Member Walz, and Members of the Committee, this concludes my prepared statement  I would be pleased to respond to any questions that you may have at this time  If you or your staff have any questions about this statement, please contact Shelby S  Oakley at 202-512-4841 or OakleyS@gao gov  In addition, contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this statement  Individuals who made key contributions to the report on which this testimony is based are Lisa Gardner, Assistant Director; Emily Bond; Matthew T  Crosby; Lorraine Ettaro; Michael Grogan; Jeff Hartnett; Katherine Lenane; Teague Lyons; Roxanna Sun; and Colleen Taylor  This is a work of the U S  government and is not subject to copyright protection in the United States  The published product may be reproduced and distributed in its entirety without further permission from GAO  However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately 


Report 2: To varying extents, Internet content providers—also called “edge providers”—and Internet service providers collect, use, and share information from their customers to enable their services, support advertising, and for other purposes  Many companies describe these and other privacy-related practices in privacy policies, to which consumers may be required to consent in order to use the service  Consumers access such services through a variety of devices, including mobile phones and tablets, computers, and other devices connected to the Internet by wired or wireless means  A nationwide survey that the U S  Census Bureau conducted for NTIA in 2017 found that 78 percent of Americans ages 3 and older used the Internet  Another nationwide survey that the Pew Research Center conducted in 2018 found that 69 percent of American adults reported that they use some kind of social media platform such as Facebook  No comprehensive federal privacy law governs the collection, use, and sale or other disclosure of personal information by private-sector companies in the United States  Rather, the federal privacy framework for private-sector companies is comprised partly of a set of tailored laws that govern the use and protection of personal information for specific purposes, in certain situations, or by certain sectors or types of entities  These laws include the Fair Credit Reporting Act, which protects the security and confidentiality of personal information collected or used to help make decisions about individuals’ eligibility for such products as credit or for insurance or employment; the Gramm-Leach-Bliley Act, which protects nonpublic personal information that individuals provide to financial institutions or that such institutions maintain; and the Health Insurance Portability and Accountability Act which establishes a set of national standards for the protection of certain health information  In addition, as detailed in this report, FTC addresses consumer concerns about Internet privacy using its broad authority to protect consumers from unfair and deceptive trade practices  We have reported on a variety of Internet privacy concerns in recent years that include the collection and use of data such as people’s Internet browsing histories, purchases, locations, and travel routes, including: Internet of things: In 2017, we found that as new and more devices become connected, they increase not only the opportunities for security and privacy breaches, but also the scale and scope of any resulting consequences  Vehicle data privacy: We found in 2017 that most selected automakers reported limiting their data collection, use, and sharing, but their written notices did not clearly identify data sharing and use practices  Information resellers: In a 2013 report on companies that collect and resell information on individuals, we found that no overarching federal privacy law governs the collection and sale of personal information among private-sector companies, including information resellers  We found that gaps exist in the federal privacy framework, which does not fully address changes in technology and the marketplace  Among the issues we noted were the potential need for changes to privacy controls for web tracking, mobile devices, and other technologies  We recommended that Congress consider strengthening the consumer privacy framework to reflect the effects of changes in technology and the marketplace  Such legislation has not been enacted to date  Mobile device location data: In 2012, we found that, according to privacy advocates, consumers are generally unaware of how their location data are shared with and used by third parties  We recommended that FTC consider issuing guidance establishing FTC’s views regarding mobile companies’ appropriate actions to protect location data privacy  FTC implemented that recommendation in 2013  To guide their privacy practices, many organizations and governments have used the Fair Information Practice Principles  As noted above, these principles—which are not limited to Internet privacy—address the collection and use of personal information, data quality and security, and transparency, among other things, and have served as the basis for many of the privacy recommendations federal agencies have made  The Organisation for Economic Co-Operation and Development developed a version of these principles in 1980 that has been widely adopted and was updated in 2013  In 2000, FTC recommended that Congress enact a consumer Internet privacy statute that would require companies to comply with broad and flexible definitions of the principles, and an FTC commissioner said in a 2014 speech that they are a solid framework and are flexible and effective  While they are principles, not legal requirements, they provide a possible approach for balancing the need for privacy with other interests  Table 1 provides more detailed information about the principles  FTC is primarily a law enforcement agency that, among other responsibilities, currently has the lead in overseeing Internet privacy at the federal level  Specifically, it addresses consumer concerns about Internet privacy, both for Internet service providers and content providers, using its general authority under section 5 of the FTC Act  Section 5, as amended in 1938, prohibits “unfair or deceptive acts or practices in or affecting commerce ” Although the FTC Act generally empowers FTC to take enforcement action, it prohibits FTC from taking action against common carriers such as telecommunication services, airlines, and railroads under certain circumstances  FTC also does not have jurisdiction over banks, credit unions, or savings and loans institutions  Even though the FTC Act does not speak in explicit terms about protecting consumer privacy, the Act authorizes such protection to the extent it involves practices FTC defines as unfair or deceptive  According to FTC, an act or practice is “unfair” if it causes, or is likely to cause, substantial injury not reasonably avoidable by consumers and not outweighed by countervailing benefits to consumers or competition as a result of the practice  FTC has used this “unfairness” authority to address situations where a company has allegedly failed to properly protect consumers’ data  According to FTC, a representation or omission is “deceptive” if it is material and is likely to mislead consumers acting reasonably under the circumstances  For example, the omission of terms in an advertisement would need to be material and likely to mislead consumers in order to be deceptive  FTC applies this “deceptive” authority to address deceptions or violations of written privacy policies and representations concerning data security  FTC’s Bureau of Consumer Protection investigates Internet privacy complaints from various sources, including consumers, other agencies, Congress, and industry, and also initiates investigations on its own  If the bureau has reason to believe that an entity is engaging in an unfair or deceptive practice, it may forward an enforcement recommendation to the commission  The commission then determines whether to pursue an enforcement action, which can include the following: litigating commission-filed administrative complaints before an FTC administrative law judge; filing and litigating complaints in federal district court seeking preliminary and permanent injunctions, monetary redress for consumers or other equitable relief; or referring complaints seeking civil penalties for violations of rules authorizing such penalties or for violations of administrative orders to the Department of Justice (DOJ) and assisting DOJ in litigating those cases (if DOJ does not take action, FTC can pursue the action on its own)  FTC’s Internet privacy enforcement cases may be settled without the imposition of civil penalties  Instead, FTC typically enters into settlement agreements requiring companies to take actions such as: implementing reasonable privacy and security programs; being subject to long-term monitoring of compliance with the settlements by outside entities; providing monetary redress to consumers; forfeiting any money gained from the unfair or deceptive conduct; deleting illegally obtained consumer information; and providing transparency and choice mechanisms to consumers  If a company violates an FTC final consent order, the agency can then request civil monetary penalties in court for the violations  In addition, as discussed below, FTC can seek to impose civil monetary penalties directly for violations of certain privacy statutes and regulations such as the statute pertaining to the Internet privacy of children and its implementing regulations  Although FTC can levy civil penalties up to $41,484 per violation, per day, against an entity that violates a trade regulation rule under the FTC Act, it has not promulgated trade regulation rules under section 5 specific to privacy  Although FTC has not implemented its section 5 authority by issuing regulations regarding Internet privacy, it has issued regulations to implement other statutory authorities  Likewise, other federal agencies use regulations to implement the statutes they are charged with administering  The process by which federal agencies typically develop and issue regulations is spelled out in the Administrative Procedure Act (APA)  Section 553 of the APA establishes procedures and requirements for what is known as “informal” rulemaking, also known as notice-and- comment rulemaking  Among other things, section 553 generally requires agencies to publish a notice of proposed rulemaking in the Federal Register  After giving interested persons an opportunity to comment on the proposal by providing “data, views, or arguments,” the statute then requires the agency to publish the final rule in the Federal Register  Regulations may be enforced in various ways, for example, by seeking civil penalties for non-compliance  FTC has authority to seek civil penalties, for example, when a company knowingly violates a regulation or, as discussed below, a final consent order  In contrast to the APA section 553 rulemaking process, the rulemaking process that FTC generally must follow to issue rules under the FTC Act is spelled out in the Magnuson-Moss Warranty Act amendments to the FTC Act (Magnuson-Moss)  The Magnuson-Moss amendments— enacted in 1975 partly in response to industry opposition to FTC’s trade regulations, and amended in 1980—require additional rulemaking steps beyond APA section 553  For example, Magnuson-Moss requires FTC to publish an advance notice of proposed rulemaking in addition to the notice of proposed rulemaking required by the APA, and to offer interested parties the opportunity for an informal hearing involving oral testimony  FTC has not promulgated any regulations using the Magnuson-Moss procedures since 1980; according to FTC staff, the additional steps required under Magnuson-Moss add time and complexity to the rulemaking process  The Children’s Online Privacy Protection Act (COPPA), enacted in 1998, governs the online collection of personal information from children under the age of 13 by operators of websites or online services, including mobile applications  COPPA required FTC to issue and enforce regulations concerning children’s online privacy and directed FTC to promulgate these regulations using the APA section 553 notice-and- comment rulemaking process  COPPA contained a number of specific requirements that FTC was directed to implement by regulation, such as requiring websites to post a complete privacy policy, to notify parents directly about their information collection practices, and to obtain verifiable parental consent before collecting personal information from their children or sharing it with others  The commission’s original COPPA regulations became effective on April 21, 2000, and amended COPPA regulations took effect on July 1, 2013  According to an FTC staff member, COPPA and FTC’s implementing regulations reflect various principles that are similar to the Fair Information Practice Principles  FCC regulates the telecommunications industry pursuant to the Communications Act of 1934, as amended (Communications Act)  FCC follows the APA section 553 notice-and-comment rulemaking process to promulgate regulations implementing the Communications Act  FCC also has an enforcement bureau that pursues violations of its regulations and the Communications Act  The Communications Act establishes separate definitions for “information services” and “telecommunications services” and treats these two types of services differently  Specifically, information services are subject to less regulation by FCC than telecommunications services under the Communications Act  However, FTC is prohibited from regulating telecommunications carriers (a provider of telecommunications services) under the common carrier exemption  Prior to 2015, Internet services were considered information services under the Communications Act, and thus FTC was not prohibited from considering the privacy practices of Internet service providers under its FTC Act authority to protect consumers from unfair and deceptive practices  This changed in 2015 when FCC classified broadband as a telecommunications service, which meant that broadband Internet service providers were considered telecommunications carriers and FCC asserted primary oversight over them  As a result of the reclassification, FTC no longer had jurisdiction over Internet service providers  Once FCC had asserted primary oversight over Internet service providers, FCC promulgated privacy regulations specific to them  However, before the privacy regulations went into effect, Congress repealed them under the Congressional Review Act  In December 2017, FCC reclassified broadband as an information service—reverting Internet service providers’ classification to what it had been prior to 2015  When that reclassification became effective in June 2018, jurisdiction of Internet privacy for Internet service providers was effectively transferred from FCC back to FTC  As a result, FCC currently has limited Internet privacy oversight responsibilities, as shown in figure 1  Perspectives on the benefits of and concerns about the collection and use of consumers’ data from the Internet varied somewhat across stakeholder groups  Various stakeholders we interviewed—including those from academia, industry, and government—said that there should be a balance between the freedom of companies to collect and use consumers’ data needed to provide services and the necessity to protect consumers’ privacy  In general, industry stakeholders highlighted the benefits of data collection and use, such as facilitating innovation, while consumer advocacy groups and other stakeholders emphasized concerns about consumers’ loss of control over their data and their lack of understanding of how companies collect and use their information  Additionally, surveys and other literature that we reviewed on Internet privacy highlighted concerns among consumers  The key benefits of information collection were identified as: Enables certain services  According to two industry stakeholders, the collection and use of consumer data from the Internet enable content providers to provide services  These stakeholders said that sometimes a content provider must collect and use information from consumers to provide the service  For example, a mapping service must collect and use consumers’ current location to provide them with up-to-date directions  Provides low-cost or free services  A representative from a content provider said that revenue from targeted advertising helps allow some content providers’ services to be offered to consumers at little or no charge  Instead of charging a subscription fee, a social media company may be able to provide free service because it uses information that it collects from consumers to target advertisements to users on a customized, user-by-user basis  These ads are targeted to users based on interests they express through their use of social media, among other things  According to a representative from an Internet search engine, using consumer data for targeted advertising may be relatively less important for some kinds of content providers, such as search engines  This company representative said that search engines may use keywords entered for a particular Internet search to provide advertisements relevant to the search  For example, a search for “car insurance” can offer the consumer advertisements from car insurance companies without any additional data from the consumer other than the search’s keywords  Supports innovation and customization  According to some stakeholders, the collection and use of data also benefit consumers through other means such as providing innovative products or customized services  According to a representative from a content provider, the collection of personal information, with consent, for commercial purposes can at times have benefits  The representative said, for example, that collection of images containing identifiable information, like faces, can help in the development of new technologies such as object and facial recognition  According to two content providers, consumers may also benefit from customized services and content  For example, according to a representative from a travel-related company, that company can collect information about a consumer to suggest travel itineraries and suggestions for activities  Additionally, representatives from a consumer advocacy group and a content provider stated that direct-marketing approaches are enabled through data collection  Such marketing approaches allow consumers to receive advertisements that are uniquely tailored to their interests  For example, a consumer that a content provider has identified as being a hiker may receive advertisements for hiking boots  Despite these benefits, public opinion surveys have shown concerns about the collection and use of consumers’ information on the Internet  For instance, recent analyses based on surveys by the Pew Research Center and NTIA showed that the public lacks trust in Internet privacy, a concern that may limit economic activities  NTIA’s survey results show that privacy concerns may lead to lower levels of economic productivity as people decline to make financial transactions on the Internet  According to the NTIA analysis, in 2017, 24 percent of American households surveyed avoided making financial transactions on the Internet due to privacy or security concerns  Consumers NTIA surveyed indicated that their specific concerns were identity theft, credit card or banking fraud, data collection by online services, loss of control over personal information, data collection by government, and threats to personal safety  Stakeholders we interviewed elaborated on some of these concerns: Public disclosure and data breaches  Some stakeholders, including representatives from content providers, said that personal information from the Internet can be publicly disclosed, including through data breaches  An academic and a former FCC commissioner told us that such disclosures are becoming more frequent  Various consumer advocacy groups and state governments continue to report data breaches  This personal information can include financial information such as credit card information, the disclosure of which can result in financial harm to the consumer  It can also include other kinds of sensitive information such as political views or medical conditions, the disclosure of which can cause non-financial harms such as embarrassment or harassment  According to public reports, the 2017 breach of consumer information from Equifax, a credit-reporting agency, resulted in the disclosure of 143 million American consumers’ sensitive information  According to NTIA’s 2017 survey, 45 percent of households surveyed reported major concerns about credit card fraud  Regarding non-financial information, in a recent case FTC alleged that an Internet-based company publicly disclosed patients’ sensitive medical information without their knowledge after patients submitted what they thought were confidential reviews of physicians  According to FTC, these reviews were then publicly posted on the company’s website  Financial and other harms  Stakeholders identified both potential financial and non-financial harms associated with misuse of personal information from the Internet  A former FTC acting chair has said that privacy and data-security incidents can cause injuries that do not only involve financial loss and that it may be difficult to measure this type of non-financial injury  In a February 2018 speech, this former acting FTC chair cited a case that the agency filed involving the misuse of personal information from the Internet that resulted in people losing jobs or job opportunities or being threatened, stalked, and harassed  The acting chair said that in another case, there was evidence that several people committed suicide after their names and other data were disclosed  The commission can, by bringing suit in district court, obtain an order compelling content providers to provide monetary relief to consumers if a data disclosure results in financial harm to a consumer  However, an academic noted that many data disclosures of sensitive information cannot be financially redressed; information can indefinitely persist on the Internet once it is disclosed  Consumers’ lack of understanding  A range of stakeholders we interviewed, including those from industry, said that consumers lack an understanding of how their data are collected and used  Some stakeholders said content providers are insufficiently transparent about how they collect and use data  For instance, content providers’ privacy policies, according to various stakeholders, may contain technical language that is difficult for typical consumers to understand, may be located in a difficult-to-access or inconspicuous part of the content provider’s website, or may be lengthy to the point where it becomes prohibitively difficult for a consumer to set aside enough time to read  Furthermore, according to an academic, companies may have an incentive to intentionally obscure their privacy practices, since clarity could put the companies at a competitive disadvantage  The academic also stated that different privacy policies may apply to different parts of a consumer’s experience on a single website  For example, the academic described how a website may have contracts with third-party vendors for specific services included on the website that consumers use, such as an online shopping cart’s features  The privacy policy for the website and the third-party shopping cart can be separate and unrelated to each other, and consumers may not be aware of this since these policies may never appear to consumers or be hard to obtain  A representative from a consumer advocacy group also mentioned that consumers may be unaware that companies track consumers’ Internet activity in order to target those consumers with customized prices  An academic said that these practices may disproportionately affect people with low computer literacy, as they may not be aware of tracking or know of ways to counteract it  In 2015, we found that the lack of computer and Internet skills is one of the primary barriers people face in using the Internet and that this is a particular problem for certain demographic segments who may lack exposure to or knowledge about computers, such as those of age 65 and older and those with low levels of income and education  Consumer lack of control  Some academics and consumer advocacy groups also identified a lack of control as a concern with respect to Internet privacy—consumers have little or no control over how their information is collected, used, and shared  In a 2015 survey conducted by Pew Research Center, 65 percent of respondents said it is very important to be in control of what information is collected about them  However, according to an academic and a consumer advocacy group we interviewed, privacy policies offer consumers little or no bargaining power, and consumers may be forced to either accept the terms of the policy as written or not use the application or service at all  Furthermore, we recently reported that sometimes consumers’ information is used for purposes that are altogether separate from what those consumers originally anticipated  For example, FTC alleged in an enforcement action that in 2009 and 2010, a company told consumers that it would track the websites they visited in order to provide them with personalized offers, when in fact the company was also transmitting credit card information it collected through such tracking to third parties  The company settled with FTC  We also recently reported on how devices that comprise the Internet of Things pose privacy concerns for consumers, including that information collected by such Internet-connected devices can be used in ways to which the consumer was not given the option to opt out  As discussed above, stakeholders described various types of harm that could result from Internet privacy violations  Regardless of whether violations involve financial or other types of harm, a challenging factor in providing Internet privacy oversight is identifying the responsible parties  A former federal government official with experience in privacy issues said that it frequently is difficult to identify which Internet entity in the chain is ultimately responsible for a privacy-related harm  For example, if a consumer is harmed by the theft of his or her Social Security number, it can be difficult to determine which entity is responsible if multiple entities have suffered data breaches of information systems that contained the Social Security number  In addition to the challenges in identifying responsible parties, the federal government has faced challenges in providing Internet privacy oversight  Our prior work has found that such efforts lack clearly defined roles, goals and performance measures, and that gaps exist in the current privacy framework  We found that during the last decade, FTC filed 101 Internet privacy enforcement actions for practices that the agency alleged were unfair, deceptive, a violation of COPPA, a violation of a settlement agreement, or a combination of those reasons  Most of these actions pertained to first-time violations of the FTC Act for which FTC does not have the authority to levy civil penalties  In those cases where a party violated an FTC regulation or settlement agreement, however, FTC does have the authority to impose civil penalties  The 101 cases—filed between July 1, 2008 and June 30, 2018—involved a variety of products, services, and industries that collect and use personal information from the Internet  During the years for which we examined full-year data, the number of enforcement actions taken per year ranged from 5 in 2010 and 2016 to 23 in 2015  For example, in recent years, FTC took enforcement action against the following entities for alleged conduct that the agency contended violated section 5 or COPPA: a toy manufacturer for collecting personal information from children online without providing direct notice and obtaining their parents’ consent; a computer manufacturer for pre-loading laptops with software that compromised security protections in order to deliver ads to consumers; a mobile ride-hailing business for misrepresenting the extent to which it monitored its employees’ access to personal information about users; a television manufacturer for installing software on its televisions to collect viewing data on 11 million consumers without their knowledge or consent and providing the viewing data to third parties; and a mobile advertising network for deceptively tracking the locations of hundreds of millions of consumers, including children, without their knowledge or consent, to serve them geographically targeted advertising  Of the 101 actions filed during the 10-year period, 51 involved Internet content providers, 21 involved software developers, 12 involved the sale of information or its use in advertising, 5 involved manufacturers, 1 involved an Internet service provider, and 11 involved a variety of different products, such as those provided by rent-to-own companies or certification services  In nearly all 101 cases, companies settled with FTC, which required the companies to make changes in their policies or practices as part of the settlement  FTC levied civil penalties against two of those companies for violating their settlement agreements  Also during this 10-year period, FTC levied civil penalties against 15 companies (a total of $12 7 million) for alleged violations of the COPPA regulations  The COPPA civil penalties ranged from $50,000 to $4 million and the average amount was $847,333  FTC can also seek to compel companies to provide monetary relief to those they have harmed  During this time period, FTC levied civil penalties against companies for violations of consent decrees or ordered monetary relief to consumers from companies for a total of $136 1 million  These payment orders ranged from $200,000 to $104 5 million and the average amount was $17 million  In the majority of these 101 enforcement actions that FTC settled, FTC alleged that companies engaged in practices that were deceptive  Examples of the charges FTC brought include: “Deceptive practices” cases (61 cases): In 2016, FTC alleged that Turn, Inc , an Internet advertising company, continued to track the Internet activities of consumers for targeted advertising purposes after the company had made representations that it would stop doing so  According to FTC, the company led consumers to believe they could turn off such tracking when in fact they were unable to do so  “Unfair practices” cases (4 cases): In 2014, FTC alleged that LeapLab, a data broker, knowingly provided scammers with hundreds of thousands of consumers’ sensitive personal information, including Social Security and bank account numbers  “Unfair and deceptive” practices cases (19 cases): In 2015, FTC alleged that Equiliv Investments, a software developer, lured consumers into downloading its “rewards” application, saying it would be free of malware, when the application’s main purpose was actually to load the consumers’ mobile phones with malicious software to mine virtual currencies for the developer  COPPA and COPPA regulations cases (6 cases): In 2011, FTC alleged that Broken Thumbs Apps, a software developer, had collected information from Internet applications that the developer specifically targeted toward children under the age of 13  FTC’s complaint stated that the company had, among other things, failed to provide notice of what information it collected and how it was used and also had failed to inform parents of these practices and receive their consent as COPPA required  Violation of settlement agreement cases (2 cases): In 2012, Google agreed to pay a $22 5 million civil penalty to settle FTC charges that it misrepresented to users of Apple’s Safari Internet browser that Google would not place tracking cookies or provide targeted ads to those users, violating an earlier settlement agreement between the company and FTC  In 14 of the 101 cases, FTC required companies to be audited by outside entities to monitor compliance with the terms of the settlement  The audit period ranged from 5 years to 20 years, with an average of 17 5 years  As noted above, 2 of the 101 cases involved a violation of FTC settlement agreements  In addition, in March 2018, FTC announced that it is investigating whether Facebook’s privacy practices violate a 2012 Facebook settlement agreement with FTC  In the case that resulted in the 2012 settlement, FTC charged Facebook with deceiving consumers by telling them they could keep their information private, but then allowing it to be shared and made public  Appendix II contains more detailed information about the 101 cases  As stated earlier, in 2015, FCC classified broadband Internet service as a telecommunications service, placing primary oversight of broadband Internet service providers’ privacy practices under FCC’s jurisdiction instead of FTC’s jurisdiction  In 2016, FCC filed a privacy enforcement action against a mobile Internet service provider, alleging, in part, violation of section 222 of the Communications Act and FCC’s Open Internet Transparency Rule  Section 222 requires telecommunications carriers to protect the confidentiality of customers’ proprietary information  In that case, FCC fined Verizon Wireless $1 4 million for failing to disclose that it was inserting “unique identifier headers,” also called “perma- cookies” or “super cookies” (mobile web tracking cookies that users cannot remove), into customers’ Internet traffic over its wireless network  Although the settlement was finalized during the 2015-2017 period when FCC had asserted jurisdiction over the privacy practices of Internet providers, the Verizon Wireless practices occurred prior to the classification of Internet service providers as telecommunications carriers  The investigation therefore did not rely upon FCC’s subsequent assertion of authority over Internet service providers’ privacy practices  In October 2016, after FCC had reclassified broadband as a telecommunications service, the commission issued Internet service provider privacy regulations, asserting its authority under section 222 of the Communications Act  In April 2017, however, Congress repealed these regulations under the Congressional Review Act before they took effect  In December 2017, FCC then reversed its 2015 classification of broadband, and oversight of broadband Internet service providers’ privacy practices reverted to FTC once the decision took effect in June 2018  In explaining the December 2017 decision, FCC’s new chair said that FTC’s privacy oversight approach regarding Internet service providers—using its authority to protect consumers against unfair, deceptive, and anti- competitive practices—had worked well in the past and that this action would “put the nation’s most experienced privacy cop back on the beat ” Under FCC’s new legal approach, it no longer asserts jurisdiction to take enforcement action against Internet service providers for privacy-related matters, including mobile Internet service providers  As part of FTC’s resumption of Internet service provider oversight, FCC and FTC entered into a memorandum of understanding in December 2017 spelling out their roles and responsibilities regarding oversight of these companies  FTC staff said that they regularly communicate with FCC and have an agreement to share Internet privacy complaints  As previously discussed, no federal statute comprehensively and specifically governs Internet privacy across all sectors  FTC oversees some aspects of Internet privacy by using its FTC Act section 5 authority to protect consumers from unfair and deceptive practices  FTC also uses its specific COPPA authority to police the collection and use of personal information from children by online services  Some industry representatives said that FTC’s enforcement has been effective because the agency has expertise and experience in privacy issues and has the flexibility to take enforcement action on a case-by-case basis  In addition, a content provider said that FTC has taken enforcement actions against companies of various sizes in different sectors and has a powerful tool by being able to require companies to be audited by outside entities for up to 20 years  Industry stakeholders we interviewed generally said that “direct enforcement” of a statute is preferable to promulgating and enforcing regulations implementing that statute (which constitutes enforcement of the statute as well)  These stakeholders noted several key concerns they believe exist with regulatory versus statutory enforcement of Internet privacy: Regulations can stifle innovation  Two industry stakeholders said that regulations can hinder companies’ ability to innovate  For example, representatives from an Internet service provider said that innovation can stop during the rulemaking process as the industry waits for the regulation to be finalized  Regulations may create loopholes  Representatives from an Internet industry group and a content provider said that regulations can also contain loopholes that can be legally exploited because imprecise language in a regulation may allow a company to legally engage in an action that was originally unforeseen by the regulator  Regulations can become obsolete  Several industry stakeholders said regulations also may become obsolete quickly because the Internet industry is rapidly changing  An Internet industry representative noted that there can be large shifts in the Internet industry from year to year, while it often takes an agency much longer than a year to adopt a rule  Industry stakeholders said the flexibility of FTC’s approach allows FTC to adapt continuously to changing market conditions  Rulemakings can be lengthy  FCC officials said that in some cases, rulemakings can take a long time, especially when the issues are complex and there is no statutory deadline  Our previous work on rulemaking found that length of time required for the development and issuance of final rules varied both within and among agencies  Additionally, while some stakeholders suggested that regulations can clarify acceptable practices, other stakeholders, including from industry and academia, said that enforcement actions can send a similar message  According to both a representative from a content provider and an academic, enforcement actions such as settlement agreements, for example, establish precedents that companies can follow, similar to the way that case law developed by courts provides guidance for companies  Although some industry representatives we interviewed said that FTC’s use of settlement agreements provides companies with guidance, certain trade associations took a different position in a recent case brought before the U S  Court of Appeals for the Third Circuit, FTC v  Wyndham Worldwide Corp  799 F 3d 236 (3d Cir  2015)  However, the court did not agree with the associations’ arguments  The case involved an enforcement action against Wyndham Worldwide Corporation where FTC alleged that data security failures led to three data breaches at the company in less than 2 years  The court considered whether FTC could bring an enforcement case involving cybersecurity using FTC’s section 5 “unfair practices” authority and, if so, whether Wyndham had “fair notice” that its specific cybersecurity practices could be deemed “unfair ” A group of companies and the U S  Chamber of Commerce wrote a friend- of-the-court brief supporting Wyndham, criticizing FTC’s “regulation- through-settlements” approach  The companies argued this approach subjects businesses to “vague, unknowable, and constantly changing data-security standards” and businesses often are unaware of the standards to which they are held until after they receive a notice of investigation from FTC, at which point they must settle or expend considerable resources fighting the agency  Potential Limits on Federal Trade Commission (FTC) Remedies A recently decided federal appeals court case illustrates potential limits on the remedies that FTC can order in an “unfair practices” enforcement proceeding  In this 2018 case, LabMD, Inc  v  FTC, 891 F 3d 1286 (11th Cir  2018), the U S  Court of Appeals for the Eleventh Circuit found that FTC could not direct a medical laboratory to create and implement wholesale data-security protective measures as a remedy to the laboratory’s alleged unfair practices  FTC had filed a complaint against LabMD under section 5 of the FTC Act for allegedly committing an unfair act or practice by failing to provide reasonable and appropriate security for personal information on its computer networks  The commission found that LabMD’s inadequate security constituted an unfair act or practice and ordered LabMD to take various actions, including establishing and maintaining a reasonable and comprehensive information security program  On appeal, the Eleventh Circuit ruled that FTC’s order exceeded its authority because it did not prohibit a specific act or practice but instead, mandated a complete overhaul of the company’s data-security program  FTC had argued that the FTC Act gives it broad discretion to prevent unfair or deceptive acts or practices that injure the general public and that FTC had spelled out standards for LabMD to craft a reasonable security program  The court ruled, however, that such a general approach would make it difficult for a reviewing court to determine if LabMD had complied with the order, in the event of a future FTC challenge  company can reasonably foresee that a court could construe its conduct as falling within the meaning of the statute ” A majority of non-industry stakeholders we interviewed identified limitations in the current Internet privacy oversight approach because they view regulations in conjunction with enforcement as being more effective  These stakeholders include all of the former FTC commissioners we interviewed, three of the four former FCC commissioners we interviewed, and representatives from consumer advocacy groups we interviewed  In addition, a former FCC commissioner said that the current Internet privacy oversight approach is limited in part because he viewed regulations applying equally to all players in the Internet ecosystem in conjunction with enforcement as being more effective  A representative from a consumer advocacy group also said that regulations in conjunction with enforcement are essential for effective privacy protection  Some of these stakeholders noted key ways that they believe Internet privacy regulations can provide clarity to industry and consumers, as well as fairness and flexibility in enforcement: Regulations can provide clarity  An Internet industry group representative said that various companies have favorable views of regulations because they can provide clear expectations about what actions are permissible  Similarly, a former congressional staff member with expertise on privacy issues said that some companies have favorable views of regulations because the regulations often provide clearer expectations about what the companies can do  FCC officials said that with respect to telephone privacy provisions of the Communications Act, the telephone industry wanted rules because it sought greater clarity about what it should be doing, what constituted a violation, how to comply, and what behaviors were acceptable  Regulations may promote fairness  Some other stakeholders discussed the ability of regulations to provide fairness  For example, a former federal enforcement official described regulations as creating a fair and consistent oversight regime across the entire industry in a way that case-by-case enforcement actions do not  Another former federal enforcement official said that regulations give companies fair notice of what actions may be violations and thus help those companies avoid surprising or unexpected enforcement  Regulations can be flexible  An academic said that by targeting behaviors and not specific technologies, regulations can be written in such a way that they do not become obsolete  An academic also said that regulations based on broad performance-standards principles can avoid being overly prescriptive  FCC officials also noted that regulations can be amended to adapt to changes in technology often faster than new laws can be enacted  Furthermore, regulations determined to be obsolete can be repealed  FTC staff told us that the agency systematically reviews all of its regulations every 10 years, even though it is only legally required to review its most significant ones, and that the number of FTC regulations has decreased because the agency determined prior ones were obsolete  The Regulatory Flexibility Act requires federal agencies to analyze the effect of their regulations on small entities  Regulations can be a deterrent  FCC officials said that rules can have a deterrent effect on bad practices in the industry or have a role in mitigating the negative effects of bad practices after they occur  They said, for example, that the practice of pretexting (improperly obtaining people’s telephone records) was greatly curtailed by an FCC regulation prohibiting such practices  They also said that rules can foreclose arguments by companies claiming that because no rule was in place, they had no reasonable notice or awareness that they should behave in a particular way  Consumer advocacy groups and other stakeholders, including some former FTC and FCC commissioners, had concerns about the efficacy of an enforcement approach such as FTC’s approach to Internet privacy oversight, which focuses on enforcing a statute rather than implementing regulations  They said that FTC’s enforcement approach limits the ability of the agency to affect companies’ behavior, and that any enforcement activity occurs after the violation, undesirable behavior, harm, or illegal action has already occurred  A former federal enforcement official also said that regulations can prevent companies from engaging in bad practices in the first instance and thus have a preventive effect  A former FCC commissioner said that by the nature of a direct statutory- enforcement approach (as opposed to rulemaking), an agency would only address a harm after it has occurred  As discussed above, for example, data often cannot be removed from the Internet because copies of the data can exist among many bad actors, and it can be difficult to identify the entity responsible for unwanted disclosures  Therefore, it may be more important to avoid such Internet privacy harms from occurring in the first place  Another former FCC commissioner told us that Internet privacy oversight should be returned to FCC because it has APA section 553 notice-and-comment rulemaking authority and considerable enforcement experience  Representatives from consumer advocacy groups said that FTC’s enforcement action has been insufficient because it investigates only a small portion of actual Internet-privacy violations or takes action regarding only the most egregious or outrageous cases that it can win  FTC has also stated in its strategic plan that it focuses on investigating and litigating cases that cause or are likely to cause substantial injury to consumers and that by focusing on practices that are actually harming or likely to harm consumers, FTC can best use its limited resources  Representatives from an Internet association said that FTC’s Internet- privacy enforcement actions should focus on concrete harms  An FTC staff member from the Division of Privacy and Identity Protection said that the agency has been effective with the limited enforcement resources it has available  Furthermore, the staff member said the agency uses no formal written criteria or template to assess individual cases but considers the size and scale of a company’s effect on consumer privacy when deciding whether to take enforcement action  However, a former FTC commissioner told us that the agency needs more resources to effectively oversee Internet privacy  We asked stakeholders whether it was clear under what circumstances FTC will take Internet privacy enforcement action  In response, some stakeholders said that FTC’s enforcement priorities are reflected in its settlement agreements, which provide information that is similar to a body of case law  Individual commissioners also may issue statements explaining their decisions  Two stakeholders also said that FTC’s closing letters, which the agency sends to companies and posts on its website when it closes an investigation without taking enforcement action, may explain its decisions  Other stakeholders said that more guidance would be helpful to provide additional clarity on how the agency uses its Internet privacy enforcement authority  FTC staff and other stakeholders also said that FTC has provided useful Internet privacy guidance  For example, in 2015, FTC published guidance for businesses on complying with COPPA  Various stakeholders we interviewed said that opportunities exist for enhancing Internet privacy oversight  A key component of FTC’s mission, as specified by the FTC Act, is to protect consumers against unfair and deceptive practices  As discussed earlier, some stakeholders believe that FTC’s reliance on its unfair and deceptive practices authority to address Internet privacy issues has limitations  In addition, although the Fair Information Practice Principles provide internationally recognized principles for protecting the privacy and security of personal information, they are not legal requirements and FTC cannot rely on them to define what constitutes unfair and deceptive practices related to privacy and data security  We stated in our 2013 information resellers report that the current U S  privacy framework is not always aligned with the Fair Information Practice Principles and that these principles provide a framework for balancing the need for privacy with other interests  We found that there are limited privacy protections under federal law for consumer data used for marketing purposes  We said that although the Fair Information Practice Principles call for restraint in the collection and use of personal information, the scope of protections provided under current law has been narrow in relation to: (1) individuals’ ability to access, control, and correct their personal data; (2) collection methods and sources and types of consumer information collected; and (3) new technologies, such as tracking of web activity and the use of mobile devices  Although we recommended in that report that Congress consider strengthening the consumer privacy framework to reflect the effects of changes in technology and the marketplace, this matter for congressional consideration was not specific to Internet privacy or to the oversight authorities of any particular agency or agencies  As noted above, various stakeholders expressed concern about the ability of consumers to control their data and understand how that data are used  These concerns suggest that companies are not always following the Fair Information Practice Principles, such as that companies’ data practices should be transparent, allow consumers the right to access and edit their data, and limit the collection of data to the extent feasible  Those stakeholders who believe that FTC’s current authority and enforcement approach is unduly limited identified three main actions that could better protect Internet privacy: (1) enactment of an overarching federal privacy statute to establish general requirements governing Internet privacy practices of all sectors; (2) APA section 553 notice-and- comment rulemaking authority; and (3) civil penalty authority for any violation of a statutory or regulatory requirement, rather than allowing penalties only for violations of settlement agreements or consent decrees that themselves seek redress for a statutory or regulatory violation  Stakeholders from a variety of perspectives—including from academia, industry, consumer advocacy groups, and former FTC and FCC commissioners—told us that a privacy statute could enhance Internet privacy oversight by, for example, clearly articulating to consumers, industry, and privacy enforcers what behaviors are prohibited, among other things  In addition, a former FCC commissioner said that a new privacy statute could enhance Internet privacy oversight by creating uniform standards for all players in the Internet ecosystem that is focused on the consumer rather than the regulatory legacy of the companies involved (regulations that apply to specific types of companies based on what they are or used to be, such as telecommunications carriers, cable companies, broadcasters, and mobile wireless providers)  The former FCC commissioner said that as companies, technologies, and markets change, there is a question about whether existing law should be modernized  In 2015, FTC staff recommended that Congress enact broad-based legislation that is flexible and technology-neutral, while also providing clear rules of the road for companies about such issues as how to provide choices to consumers about data collection and use practices  Some stakeholders suggested that such a framework could either designate an existing agency as responsible for privacy oversight (such as FTC) or create a new privacy-oriented agency  A representative from a consumer advocacy group mentioned that the European Union, for example, has established the European Data Protection Supervisor, an independent data protection authority, to monitor and ensure the protection of personal data and privacy  Similarly, in Canada, the Office of the Privacy Commissioner, an independent body that reports directly to the Parliament, was established to protect and promote individuals’ privacy rights  Some stakeholders also stated that the absence of a comprehensive Internet privacy statute affects FTC’s enforcement  For example, a former federal enforcement official said that FTC is limited in how it can use its authority to take action against companies’ unfair and deceptive trade practices for problematic Internet privacy practices  Similarly, another former federal enforcement official said that FTC is limited in how and against whom it can use its unfair and deceptive practices authority noting, for example, that it cannot pursue Internet privacy enforcement over exempted industries such as common carriers  In addition, a former FCC commissioner said that it is more difficult for FTC to take effective action because its enforcement comes only after a complaint and after an often lengthy review process  The former FCC commissioner also said that without “ex ante” rules (rules that define prohibited activity before it has occurred), there inevitably will be delay, confusion, and lack of knowledge about what is and is not acceptable behavior  In addition, some stakeholders—including a representative from a consumer group, a former federal enforcement official, and a former FCC commissioner—said FTC’s section 5 “unfair or deceptive practices” authority may not enable it to fully protect consumers’ Internet privacy because it can be difficult for FTC to establish that Internet privacy practices are legally “unfair ” For example, under section 5, FTC has charged companies with committing a “deceptive” practice if their privacy policies said they would not collect or use consumers’ personal information but then did so  However, a former congressional staff member said that companies often write broad and vague policy statements, making it difficult for FTC to charge companies with committing deceptive practices  Instead, according to a representative from a consumer advocacy group, FTC would have to show the companies’ actions were “unfair,” which, according to the representative, is legally difficult to establish  We found in our 2017 report on vehicle data privacy that most automakers’ written privacy notices used vague language  Similarly, we found in our 2012 report on mobile device location data that although companies’ policies stated that they shared location data with third parties, they were sometimes vague about which types of companies these were and why they were sharing the data  Some stakeholders said that FTC relies more heavily on its authority to take enforcement action against deceptive trade practices compared with the agency’s unfair trade practices authority  This was confirmed in our analysis of FTC’s Internet privacy enforcement actions discussed previously  However, a representative from a consumer advocacy group said that FTC’s ability to take such action is limited practically to instances where a company violates its own privacy policy—companies generally can collect and use data in any way they want if they include language in their policies asserting their intent to do so  According to a former FCC commissioner, a privacy statute could clarify the situations in which FTC could take enforcement action  Various stakeholders said that there are advantages to overseeing Internet privacy with a statute that provides APA section 553 notice-and- comment rulemaking authority  As discussed above, that provision lays out the basic process by which so-called informal agency rulemaking shall be conducted, namely, publication of proposed regulations in the Federal Register; an opportunity for public comment (written and possibly oral submission of data and views); and publication of final regulations in the Federal Register with an explanation of the rules’ basis and purpose  Also as noted above, Congress imposed additional rulemaking steps on FTC in the Magnuson-Moss Act when FTC is promulgating rules under section 5 of the FTC Act  These additional steps include providing the public and certain congressional committees with advance notice of proposed rulemaking (in addition to notice of proposed rulemaking)  FTC’s rulemaking under Magnuson-Moss also calls for, among other things, oral hearings, if requested, presided over by an independent hearing officer, and preparation of a staff report after the conclusion of public hearings, giving the public the opportunity to comment on the report  Finally, Congress made it easier for the public to appeal FTC’s Magnuson-Moss rules by making the agency meet a higher standard when the rules are challenged in court  FTC staff said that these additional steps add time and complexity to the rulemaking process  In congressional testimony in 2010, the then-Director of FTC’s Bureau of Consumer Protection said that “if Congress enacts privacy legislation, the commission agrees that such legislation should provide APA rulemaking authority to the commission ” According to FTC, this testimony was voted on and approved by the commissioners and, therefore, constituted the commission’s official position at the time  Moreover, according to stakeholders, in many cases regulations can be used to implement statutes  Officials from other consumer and worker protection agencies we interviewed described their enforcement authorities and approaches  For example, officials from the CFPB and the FDA, both of which use APA section 553 notice-and-comment rulemaking, said that their rulemaking authority assists in their oversight approaches and works together with enforcement actions  OSHA officials said that the standards that the agency promulgates under its authority specify what employers are required to do to reduce safety and health risks to workers  Such standards lay out the workplace conditions that must be maintained by employers and require that employers implement certain practices, operations, or processes that ensure worker protections  EEOC officials said that regulations are used to guide investigations that establish whether enforcement action is appropriate  CPSC officials said that the agency conducts consumer protection not only by establishing and enforcing mandatory regulations, but also through collaborative actions such as educating industry, developing consensus voluntary safety standards, removing defective products from the marketplace through voluntary corrective actions, and litigating when necessary  In addition, in contrast to FTC’s approach, FCC has APA section 553 notice-and-comment rulemaking authority and has issued regulations implementing section 222 of the Communications Act using that rulemaking authority to protect the privacy of telephone users  Some stakeholders suggested that FTC’s current ability to levy civil penalties could also be enhanced  Currently, FTC can levy civil penalties against companies for violating certain regulations, such as COPPA regulations, or if the company violates the terms of a settlement agreement already in place  According to most former FTC commissioners and some other stakeholders we interviewed, FTC should be able to levy fines for initial violations of section 5 of the FTC Act  An academic told us that the power of an agency to levy a fine is a tangible way to hold industries accountable  Another academic noted, however, that fines may be relatively less effective in industries where there is limited competition because the costs of those fines may be more effectively passed on to consumers in the form of higher prices for services  In addition, some stakeholders said that payments required by FTC orders are not large enough to act as a deterrent and that companies may consider them to be a cost of doing business  There is a growing debate about the federal government’s role in overseeing Internet privacy  In a July 2018 congressional hearing, FTC’s new chair testified that the FTC Act cannot address all privacy and data- security concerns in the marketplace  The chair said, for example, that FTC’s lack of civil penalty authority for violations of the FTC Act reduces its deterrent capability  He also noted the agency lacks authority over non-profits and over common carrier activity, even though those entities and activities often have serious implications for consumer privacy and data security  In November 2018, FTC’s chair testified before Congress and urged Congress to consider enacting privacy legislation that would be enforced by FTC  A majority of the commission has indicated support for APA rulemaking and civil penalty authority for privacy  FTC also held hearings in September, November, and December 2018 to advance the discussion around privacy issues, among other topics, and FTC plans to hold an additional hearing on data security and consumer privacy in February 2019  In a Federal Register notice, FTC announced that it is interested in the benefits and costs of various state, federal and international privacy laws and regulations, including the potential conflicts among those standards  FTC also indicated that it is particularly interested in the efficacy of the commission’s use of its current authority and the identification of any additional tools or authorities the commission may need to adequately deter unfair and deceptive conduct related to privacy and data security  Also in July 2018, an NTIA official announced that NTIA, in coordination with the Commerce Department’s International Trade Administration and National Institute of Standards and Technology, had recently started holding stakeholder meetings to identify common ground and formulate core, high-level principles on data privacy  Regarding the development of the Administration’s approach to consumer privacy, in September 2018, NTIA requested comments on ways to advance consumer privacy while protecting prosperity and innovation  Our 2009 report on a framework for assessing proposals for modernizing the financial regulatory system similarly found that regulators should have the authority to carry out and enforce their statutory missions  We further said that a regulatory system should be flexible and forward looking, allowing regulators to readily adapt to market innovations and changes, including identifying and acting on emerging risks in a timely way without hindering innovation  These factors are useful considerations as the federal government explores how it can better oversee privacy and data security  Having sufficient and appropriate authorities and providing flexibility to address a rapidly evolving Internet environment could better ensure that the federal government can protect consumers’ privacy  Recent developments regarding Internet privacy suggest that this is an appropriate time for Congress to consider comprehensive Internet privacy legislation  Although FTC has been addressing Internet privacy through its unfair and deceptive practices authority, among other statutes, and other agencies have been addressing this issue using industry-specific statutes, there is no comprehensive federal privacy statute with specific standards  Debate over such a statute could provide a vehicle for consideration of the Fair Information Practice Principles, which are intended to balance privacy concerns with the need for using consumers’ data  Such a law could also empower a specific agency or agencies to provide oversight through means such as APA section 553 rulemaking, civil penalties for first time violations of a statute, and other enforcement tools  Comprehensive legislation addressing Internet privacy that establishes specific standards and includes APA notice-and-comment rulemaking and first-time violation civil penalty authorities could help enhance the federal government’s ability to protect consumer privacy, provide more certainty in the marketplace as companies innovate and develop new products using consumer data, and provide better assurance to consumers that their privacy will be protected  Congress should consider developing comprehensive legislation on Internet privacy that would enhance consumer protections and provide flexibility to address a rapidly evolving Internet environment  Issues that should be considered include: which agency or agencies should oversee Internet privacy; what authorities an agency or agencies should have to oversee Internet privacy, including notice-and-comment rulemaking authority and first-time violation civil penalty authority; and how to balance consumers’ need for Internet privacy with industry’s ability to provide services and innovate  We provided a draft of this report to FTC, FCC, and the Department of Commerce for their review and comment  FTC and FCC provided technical comments, which we incorporated as appropriate  The Department of Commerce indicated that it did not have comments  As agreed with your office, unless you publicly announce the contents of this report earlier, we plan no further distribution until 30 days from the report date  At that time, we will send copies to the FTC chair, the FCC chair, the Secretary of Commerce, and interested congressional committees  In addition, the report will be available at no charge on the GAO website at http://www gao gov  If you or members of your staff have any questions about this report, please contact Alicia Puente Cackley at (202) 512-8678 or cackleya@gao gov or Mark Goldstein at (202) 512-2834 or goldsteinm@gao gov  Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report  Major contributors to this report are listed in appendix III  For this review, we interviewed staff from agencies with roles in Internet privacy; officials from other consumer- and worker-protection agencies; stakeholders from consumer advocacy groups, industry groups, Internet service providers, and Internet content providers; academics; and former government officials  To obtain a variety of perspectives, we selected Internet service providers that represented different industry sectors and Internet content providers that provide a variety of information and social media services  Academic stakeholders were selected because of their expertise in privacy, consumer protection, and regulatory issues  We also interviewed former Federal Trade Commission (FTC) and Federal Communications Commission (FCC) commissioners who served during the Barack Obama and George W  Bush administrations and are from different political parties  Consumer Financial Protection Bureau (CFPB) Consumer Product Safety Commission (CPSC) Department of Commerce, National Telecommunications and Information Administration (NTIA) Equal Employment Opportunity Commission (EEOC) Federal Communications Commission (FCC) Federal Trade Commission (FTC) Food and Drug Administration (FDA) Occupational Safety and Health Administration (OSHA) The following table identifies 101 Federal Trade Commission (FTC) Internet privacy enforcement actions filed between July 1, 2008 and June 30, 2018 in which the agency alleged a violation of either the Federal Trade Commission Act (FTC Act) or the Children’s Online Privacy Protection Act (COPPA) and implementing COPPA regulations and subsequently entered into a settlement agreement with the target entity  Although some of these cases may involve both Internet data privacy and security issues, this table does not include cases that involved data security issues only  In addition to the contact names above, Andrew Huddleston, Assistant Director; Kay Kuhlman, Assistant Director; Bob Homan, Analyst-in- Charge; Melissa Bodeau; John de Ferrari; Camilo Flores; Erica Miles; Josh Ormond; and Sean Standley made significant contributions to this report 

ground_truth: VA spends hundreds of millions of dollars annually on medical supplies to meet the health care needs of about 7 million veterans. To provide a more efficient, cost-effective way for its medical centers to order supplies, the VA established the MSPV-NG program. The program's goals include involving clinicians in requirements development, leveraging buying power when making competitive awards, and consolidating supplies used across medical centers. VA began developing requirements in early 2015 and launched the program in December 2016. This testimony summarizes key information contained in GAO's November 2017 report, GAO-18-34 . Specifically, it addresses the extent to which VA's implementation of MSPV-NG has been effective in meeting program goals. GAO analyzed VA's requirements development and contracting processes, and identified key supply chain practices cited by four leading hospital networks. GAO also met with contracting and clinical officials at six medical centers, selected based on high dollar contract obligations in fiscal years 2014-2016 and geographic representation. The Department of Veterans Affairs (VA) established the Medical Surgical Prime Vendor-Next Generation (MSPV-NG) program to provide an efficient, cost-effective way for its facilities to order supplies, but its initial implementation did not have an overarching strategy, stable leadership, and workforce capacity that could have facilitated medical center buy-in for the change. VA also developed requirements for a broad range of MSPV-NG items with limited clinical input. Further, starting in June 2015, VA planned to award competitive contracts, but instead, 79 percent of the items available for purchase under MSPV-NG were added through non-competitive agreements. (See figure). As a result, the program did not meet the needs of medical centers, and usage remained below VA's 40 percent target. (See figure.) VA has taken steps to address some deficiencies and is developing a new approach to the program. However, VA will likely continue to face challenges in meeting its goals until it fully addresses these existing shortcomings. GAO made 10 recommendations in its November 2017 report, including that VA develop an overarching strategy, expand clinician input in requirements development, and establish a plan for awarding future competitive contracts. VA agreed with GAO's recommendations.

prompt_front: You are given two reports by the government agency.



Question: Write a one-page summary of the report 2.

Report 1: The Small Business Administration (SBA) currently administers several types of programs to support small businesses, including loan guaranty and venture capital programs to enhance small businesses' access to capital; contracting programs to increase small businesses' opportunities in federal contracting; direct loan programs for businesses, homeowners, and renters to aid in their recovery from natural disasters; and small business management and technical assistance training programs to assist in business formation and expansion  Congressional interest in these programs has increased in recent years, primarily because small businesses are viewed as a means to stimulate economic activity and create jobs  Many Members of Congress also regularly receive constituent inquiries about the SBA's programs  This report examines appropriations for the SBA (new budget authority, minus rescissions and sequestration) over time, focusing on developments and trends since FY2000  This report also provides total available funding (which includes carryover from the prior fiscal year, carryover into the next fiscal year, account transfers, rescissions, and sequestration) and, for comparative purposes, actual and anticipated expenditures for the SBA's entrepreneurial development noncredit programs  SBA appropriations, as a whole, have varied significantly from year to year since FY2000 and across all three major SBA spending categories: appropriations for disaster assistance, business loan credit subsidies, and "other programs," a spending category that includes appropriations for salaries and expenses, business loan administration, the Office of Inspector General, the Office of Advocacy, and entrepreneurial development noncredit programs  The variation in appropriations for disaster assistance since FY2000 is largely due to supplemental appropriations provided to address disaster needs arising from the impact of major hurricanes  Business loan credit subsidies represent the net present value of cash flows to and from the SBA over the life of the agency's loan portfolios  For guaranteed loans, the net present value of cash flows is affected by several factors, but it is primarily the difference between the cost of purchasing loans that have defaulted and the revenue generated from fees and collateral liquidation  For direct (Microloan) lending, it is primarily the cost of offering below-market interest rates to Microloan intermediaries  The variation in appropriations for SBA business loan credit subsidies since FY2000 is primarily due to the impact of changing economic conditions on the SBA's guaranteed loan portfolios  During good economic times, revenue from SBA fees and collateral liquidation is typically sufficient to cover the SBA's cost of purchasing guaranteed loans that have defaulted  During and immediately following economic slowdowns, however, revenue from SBA fees and collateral liquidation is typically insufficient to cover the SBA's cost of purchasing guaranteed loans that have defaulted  The shortfall occurs because the SBA's cost of purchasing guaranteed loans tends to increase when the economy slows (primarily because guaranteed loans are more likely to default during and immediately following recessions) and revenue from loan liquidation tends to be constrained during slow economic times (primarily because commercial real estate values typically fall during and immediately following recessions)  As a result, additional appropriations are needed to cover these expenses, which are guaranteed by the "full faith and credit of the United States " Since FY2000, the variation in appropriations for the other programs spending category is attributable primarily to congressional response to changing economic conditions  As the report will discuss, appropriations for this spending category have generally increased at a pace that exceeds inflation  In addition, Congress approved significant, temporary increases in appropriations for SBA programs in the other programs spending category in FY2009 and FY2010  It approved these temporary increases primarily as a means to enhance small businesses' access to capital, which had become constrained during and immediately following the Great Recession (December 2007 to June 2009)  The SBA's appropriations for FY1954 through FY1999 are provided in the Appendix   As shown in Table 1 , the SBA's appropriations have varied significantly since FY2000, ranging from a high of $2 359 billion in FY2018 to a low of $571 8 million in FY2007  Much of this volatility is due to significant variation in appropriations for disaster assistance, which ranged from a high of $1 7 billion in FY2006 to a low of $0 in FY2009  This variation is attributable primarily to supplemental appropriations provided to address disaster needs arising from the impact of major hurricanes, such as Hurricanes Katrina, Sandy, Harvey, Irma, and Maria  In addition, as shown in Table 1 , appropriations for business loan credit subsidies have varied significantly since FY2000, ranging from a high of $319 7 million in FY2013 ($337 3 million before sequestration and rescission) to a low of $1 3 million in FY2006 and FY2007  As mentioned previously, the variation in appropriations for business loan credit subsidies results primarily from the impact of changing economic conditions on the SBA's loan portfolios  During good economic times, revenue from fees and collateral liquidation is typically sufficient to cover the costs of purchasing defaulted loans  During and immediately following recessions, revenue from fees and collateral liquidation is typically not sufficient to cover those costs  As shown in Table 1 , appropriations for the all other programs category have also varied since FY2000, ranging from a high of $1 6253 billion in FY2010 to a low of $455 6 million in FY2007  Much of this variation resulted from significant, temporary increases in appropriations for the SBA's other programs in FY2009 ($724 0 million) and FY2010 ($962 5 million)  These additional appropriations were approved primarily as a means to enhance small businesses' access to capital, which had become constrained during and immediately following the Great Recession  As mentioned previously, from FY2000 to FY2019, appropriations for the SBA's other programs spending category, as a whole, have exceeded the rate of inflation  For comparative purposes, Table 1 also presents the SBA's total available funds  As indicated in the table, the SBA's carryovers and account transfers tend to reduce variation in its budget from one fiscal year to the next  Much of this "evening out" process is due to disaster assistance appropriations, which are provided in one fiscal year and then typically spent over several fiscal years  The following section examines appropriations and total available funding for FY2000-FY2019 for the five main components of the SBA's other programs spending category: (1) salaries and expenses, (2) business loan administration, (3) the Office of Inspector General (OIG), (4) the Office of Advocacy (Advocacy), and (5) entrepreneurial development (ED) noncredit programs  The SBA's salaries and expenses account currently provides funding for the following: office operating budgets, which are used by program and administrative offices for daily operations, such as travel, supplies, and contracted services; agency-wide costs, such as rent and telecommunications, which are managed centrally; employee compensation and benefits, which are also managed centrally; and reimbursable expenses for programs for which the SBA receives reimbursable budget authority from other federal government agencies  Several adjustments were made to the SBA's reported appropriations for its salaries and expenses account to enable meaningful comparisons over time  For example, prior to FY2014, appropriations for the SBA's ED programs were included in the salaries and expenses account  They now have their own, separate appropriations account  Therefore, to allow for meaningful comparisons with current appropriations, Table 2 lists and deducts the reported appropriations for ED programs prior to FY2014 from the reported appropriations for salaries and expenses  In addition, the SBA previously included appropriations for congressional initiatives (earmarks) under the salaries and expenses account  Therefore, to allow for meaningful comparisons with current appropriations and focus the comparison on administrative expenses, appropriations for earmarks are deducted from the reported appropriations for salaries and expenses  Prior to FY2012, Advocacy was funded through the salaries and expenses' executive direction subaccount  Advocacy now has its own, separate appropriations account  To allow for meaningful comparisons with current appropriations, Table 2 lists Advocacy's funding provided through the salaries and expenses' executive direction subaccount prior to FY2012 and deducts that amount from the reported appropriation s for salaries and expenses   As discussed in greater detail below (see "Office of Advocacy"), data concerning Advocacy's funding provided through the salaries and expenses' executive direction subaccount are not available for FY2006-FY2010  However, in FY2003, FY2004, and FY2005, Advocacy's funding provided through the salaries and expenses' executive direction subaccount was 79% of its reported total cost  The estimates provided in the table for FY2006-FY2010 were derived by multiplying Advocacy's total program cost reported for each of those fiscal years by 79%  As shown in Table 2 , the SBA's appropriations for salaries and expenses have varied from year to year, with increases in some years and decreases in others  Overall, appropriations for the SBA's salaries and expenses have increased from $176 490 million in FY2000 to $267 500 million in FY2019  This increase has exceeded the rate of inflation  The SBA has statutory authorization to transfer appropriations from the business loan administration account into the salaries and expenses account  As evidenced by the amounts listed in the total available funds column in the table, the SBA exercised that authority in every fiscal year from FY2000 to FY2018 (and is expected to do so again in FY2019), transferring the entire appropriation for business loan administration into the salaries and expenses account in each of those fiscal years  Appropriations for the SBA's business loan administration account have varied since FY2000, increasing in some years and decreasing in others (see Table 3 )  Overall, appropriations for SBA business loan administration increased from $129 million in FY2000 to $155 150 million in FY2019  The program's recommended appropriations have not kept pace with inflation  As evidenced by the $0 0 balance in the total funds available column for the business loan administration account, the SBA has routinely transferred all business loan administration appropriations to the salaries and expenses account  The combined appropriations for SBA salaries and expenses and business loan administration increased from $305 490 million in FY2000 to $422 650 million in FY2019  This increase has not kept pace with inflation  According to the SBA, the OIG's mission is to "provide independent, objective oversight to improve the integrity, accountability, and performance of the SBA and its programs for the benefit of the American people " The office was created within the SBA by the Inspector General Act of 1978 ( P L  95-452 , as amended)  The inspector general, who is nominated by the President and confirmed by the Senate, directs the office  The Inspector General Act provides the OIG with the following responsibilities: promote economy, efficiency, and effectiveness in the management of SBA programs and supporting operations; conduct and supervise audits, investigations, and reviews relating to the SBA's programs and support operations; detect and prevent fraud, waste, and abuse; review existing and proposed legislation and regulations and make appropriate recommendations; maintain effective working relationships with other governmental agencies and nongovernmental entities regarding the inspector general's mandated duties; keep the SBA administrator and Congress informed of serious problems and recommend corrective actions and implementation measures; comply with the comptroller general's audit standards; avoid duplication of Government Accountability Office activities; and report violations of federal criminal law to the U S  attorney general  As shown in Table 4 , the OIG's appropriations have increased from $11 405 million in FY2000 to $21 900 million in FY2019  This increase has exceeded the rate of inflation  The OIG typically receives a transfer of appropriations from the disaster assistance account for auditing expenses  It was also provided additional appropriations in FY2006, FY2013, and FY2018 for expenses related to the review of SBA disaster loans following major hurricanes (e g , Hurricanes Katrina, Rita, and Wilma in 2005, Hurricane Sandy in 2012, and Hurricanes Harvey, Irma, and Maria in 2018) and in FY2009 to conduct reviews and audits of $730 million provided to the SBA by P L  111-5 , the American Recovery and Reinvestment Act of 2009  The SBA indicates that its Office of Advocacy is "an independent voice for small business within the federal government " The chief counsel for Advocacy, who is nominated by the President and confirmed by the Senate, directs the office  Advocacy's mission is to "encourage policies that support the development and growth of American small businesses" by intervening early in federal agencies' regulatory development processes on proposals that affect small businesses and providing Regulatory Flexibility Act compliance training to federal agency policymakers and regulatory development officials; producing research to inform policymakers and other stakeholders on the impact of federal regulatory burdens on small businesses, document the vital role of small businesses in the economy, and explore and explain the wide variety of issues of concern to the small business community; and fostering two-way communication between federal agencies and the small business community  As shown in Table 5 , Advocacy's funding has increased from $5 620 million in FY2000 to $9 120 million in FY2019  This increase has exceeded the rate of inflation  P L  111-240 , the Small Business Jobs Act of 2010, enhanced Advocacy's independence by ending the practice of funding Advocacy through the SBA's salaries and expenses' executive direction subaccount  Instead, P L  111-240 requires the President to provide a separate statement of the appropriations request for Advocacy, "which shall be designated in a separate account in the General Fund of the Treasury " The act also requires the SBA administrator to provide Advocacy with "appropriate and adequate office space at central and field office locations, together with such equipment, operating budget, and communications facilities and services as may be necessary, and     necessary maintenance services for such offices and the equipment and facilities located in such offices " In addition, Congress has provided Advocacy its own, separate appropriations amount since FY2012  As mentioned previously, prior to FY2012, the SBA reported Advocacy's total program cost, which includes funding provided through the salaries and expenses' executive direction subaccount, agency-wide overhead costs (rent, telecommunications, etc ), and other support costs (e g , management and administrative support, including human resources support)  From FY2000 to FY2005, the SBA provided relatively detailed information concerning Advocacy's budget, including the amount of funding Advocacy received through the salaries and expenses' executive direction subaccount  Also, Advocacy's FY2013 congressional budget justification document included the amount of funding Advocacy received through the salaries and expenses' executive direction subaccount in FY2011  However, those data are not available for FY2006-FY2010, and it was therefore necessary to estimate Advocacy's funding from the salaries and expenses' executive direction subaccount for those years  The estimates provided in the table were derived by multiplying Advocacy's total program cost for each of those fiscal years by 79%, which was the proportion of Advocacy's total program costs provided from the salaries and expenses' executive direction subaccount in FY2003, FY2004, and FY2005  The SBA's entrepreneurial development (ED) noncredit programs provide a variety of management and training services to small businesses  Congress provides appropriations for eight management and technical assistance training programs: Small Business Development Centers, the Microloan Technical Assistance Program, Women Business Centers, SCORE, the Program for Investment in Microentrepreneurs (PRIME), Veterans Programs (including Veterans Business Outreach Centers, Boots to Business, Boots to Business: Reboot, Veteran Women Igniting the Spirit of Entrepreneurship [VWISE], and Entrepreneurship Bootcamp for Veterans with Disabilities), the 7(j) Technical Assistance Program, and the Native American Outreach Program; two relatively long-standing nontraining programs: the National Women's Business Council and HUBZone administration; three initiatives: the Entrepreneurial Development Initiative (Clusters), the Entrepreneurship Education Initiative, and Growth Accelerators; and the Step Trade and Export Promotion (STEP) Pilot Grant program  Initially, the SBA provided its own management and technical assistance training programs  Over time, however, the SBA has increasingly relied on third parties to provide that training  The SBA reports that more than 1 million aspiring entrepreneurs and small business owners receive training from an SBA-supported resource partner each year  Congress specifies appropriations in appropriations acts for the Small Business Development Center (SBDC) program, the Microloan Technical Assistance program, and the STEP program


Report 2:  Congress provides an overall appropriation for the SBA's ED programs and recommends appropriations for the SBA's other ED programs, typically in the conference agreement or "Explanatory Statement" accompanying the appropriations act  As a result, the following tables refer to appropriations for the SBDC and Microloan Technical Assistance programs and recommended appropriations for other ED programs  Although not legally binding, the SBA has traditionally adhered to these recommended funding amounts  SBDCs provide free or low-cost assistance to small businesses using programs customized to local conditions  SBDCs support small business in marketing and business strategy, finance, technology transfer, government contracting, management, manufacturing, engineering, sales, accounting, exporting, and other topics  They are funded by grants from the SBA and matching funds  There are 63 lead SBDC service centers, at least one in each state (with four in Texas and six in California), the District of Columbia, Puerto Rico, the Virgin Islands, Guam, and American Samoa  These lead SBDC service centers manage more than 900 SBDC outreach locations  As shown in Table 6 , appropriations for SBDCs have increased from $84 179 million in FY2000 to $131 000 million in FY2019  This increase has exceeded the rate of inflation  In addition, as shown in the table, SBDCs received an additional $50 million in temporary funding in FY2010, which was spent over two fiscal years  The SBA reports actual and anticipated expenditures for its ED programs in its annual budget justification document  SBDC expenditures in FY2000-FY2018 and anticipated SBDC expenditures in FY2019 are presented in the table's last column for comparative purposes  The SBA's Microloan lending program is designed to address the perceived disadvantages faced by women, low-income, veteran, and minority entrepreneurs and business owners in gaining access to capital for starting or expanding their business (see P L  102-140 , the Departments of Commerce, Justice, and State, the Judiciary, and Related Agencies Appropriations Act, 1992)  Under the Microloan program, the SBA provides direct loans to qualified nonprofit intermediary Microloan lenders who, in turn, provide "microloans" of up to $50,000 to small business owners, entrepreneurs, and nonprofit child care centers  The SBA's Microloan Technical Assistance program is part of the SBA's Microloan program but receives a separate appropriation  It provides grants to Microloan intermediaries to offer management and technical training assistance to Microloan program borrowers and prospective borrowers  There are currently 147 active Microloan intermediaries, serving 49 states, the District of Columbia, and Puerto Rico  As shown in Table 7 , the Microloan Technical Assistance program's appropriations have varied over the years  Overall, Microloan Technical Assistance Program appropriations have increased from $23 112 million in FY2000 to $31 000 million in FY2019  This increase has been less than the rate of inflation  Microloan Technical Assistance expenditures in FY2000-FY2018 and anticipated Microloan Technical Assistance expenditures in FY2019 are presented in the table's last column for comparative purposes  Women Business Centers (WBCs) provide financial, management, and marketing assistance to small businesses, including start-up businesses, owned and controlled by women  Since its inception, the program has targeted the needs of socially and economically disadvantaged women (see P L  100-533 , the Women's Business Ownership Act of 1988)  Currently, there are 121 WBCs located throughout most of the United States and the territories  As shown in Table 8 , WBC's recommended appropriations have increased from $8 966 million in FY2000 to $18 500 million in FY2019  This increase has exceeded the rate of inflation  WBC expenditures in FY2000-FY2018 and anticipated WBC expenditures in FY2019 are presented in the table's last column for comparative purposes  The SBA provides financial assistance to SCORE (formerly the Service Corps of Retired Executives) to provide in-person mentoring and online training to small business owners and prospective owners  SCORE's 320 chapters and more than 800 branch offices are located throughout the United States and partner with more than 11,000 volunteer counselors, who are working or retired business owners, executives and corporate leaders, to provide management and training assistance to small businesses "at no charge or at very low cost " As shown in Table 9 , SCORE's recommended appropriations have increased from $3 487 million in FY2000 to $11 700 in FY2019  This increase has exceeded the rate of inflation  SCORE expenditures in FY2000-FY2018 and anticipated SCORE expenditures in FY2019 are presented in the table's last column for comparative purposes  The Program for Investment in Microentrepreneurs (PRIME) provides grants to nonprofit microenterprise development organizations or programs that have "a demonstrated record of delivering microenterprise services to disadvantaged entrepreneurs; an intermediary; a microenterprise development organization or program that is accountable to a local community, working in conjunction with a state or local government or Indian tribe; or an Indian tribe acting on its own, if the Indian tribe can certify that no private organization or program referred to in this paragraph exists within its jurisdiction " As shown in Table 10 , PRIME's recommended appropriations have varied, starting at $14 964 million in FY2001 (the program's first recommended appropriation) and falling to $2 million in FY2006 and FY2007  PRIME has received $5 0 million since FY2015  PRIME expenditures in FY2001-FY2018 and anticipated PRIME expenditures in FY2019 are presented in the table's last column for comparative purposes  The Obama Administration argued that PRIME overlaps and duplicates the SBA's Microloan Technical Assistance program and recommended in its FY2012-FY2017 budget requests that PRIME receive no appropriations  As shown in the table, in FY2013, the Obama Administration eliminated PRIME's appropriation as part of the SBA's sequestration process  The Trump Administration recommended in its FY2018 and FY2019 budget requests that the PRIME program receive no appropriations  The SBA's Office of Veterans Business Development (OVBD) administers several management and training programs to assist veteran-owned businesses, including the Entrepreneurship Bootcamp for Veterans with Disabilities Consortium of Universities, which provides "experiential training in entrepreneurship and small business management to post-9/11 veterans with disabilities" at eight universities; the Veteran Women Igniting the Spirit of Entrepreneurship (V-WISE) program, which is administered through a cooperative agreement with Syracuse University, offers women veterans a 15-day, online course focused on entrepreneurship skills and the "language of business," followed by a 3-day conference (offered twice a year at varying locations) in which participants "are exposed to successful entrepreneurs and CEOs of Fortune 500 companies and leaders in government" and participate in courses on business planning, marketing, accounting and finance, operations and production, human resources, and work-life balance; the Operation Endure and Grow Program, which is administered through a cooperative agreement with Syracuse University, offers an eight-week online training program "focused on the fundamentals of launching and/or growing a small business" and is available to National Guard and reservists and their family members; the Boots to Business program (started in 2012), which is "an elective track within the Department of Defense's revised Training Assistance Program called Transition Goals, Plans, Success (Transition GPS) and has three parts: the Entrepreneurship Track Overview—a 10-minute introductory video shown during the mandatory five-day Transition GPS course which introduces entrepreneurship as a post-service career option; Introduction to Entrepreneurship—a two-day classroom course on entrepreneurship and business fundamentals offered as one of the three Transition GPS elective tracks; and Foundations of Entrepreneurship—an eight-week, instructor-led online course that offers in-depth instruction on the elements of a business plan and tips and techniques for starting a business"; the Boots to Business Reboot program (started in 2014), which assists veterans who have already transitioned to civilian life; and the Veterans Business Outreach Centers (VBOC) program, which provides veterans and their spouses management and technical assistance training at 15 locations, including assistance with the Boots to Business program, the development and maintenance of a five-year business plan, and referrals to other SBA resource partners when appropriate for additional training or mentoring services  Prior to FY2016, Congress recommended appropriations for VBOCs and, in FY2014 and FY2015, for the Boots to Business initiative ($7 0 million in FY2014 and $7 5 million in FY2015)  Funding for the OVBD's other veterans assistance programs were provided through the SBA's salaries and expenses account  Starting in FY2016, Congress has recommended appropriations for OVBD's programs as a whole: $12 3 million in FY2016, FY2017, and FY2018, and $12 7 million in FY2019  This increase has not kept pace with inflation  OVBD expenditures in FY2015-FY2018 and anticipated OVBD expenditures in FY2019 are presented in the table's last column for comparative purposes  Recommended appropriations for VBOCs from FY2000-FY2015 are presented in Table 12 for historical comparisons  As the data indicate, recommended appropriations for VBOCs increased from $0 613 million in FY2000 to $3 000 million in FY2015  This increase has exceeded the rate of inflation  OVBD expenditures in FY2000-FY2015 are presented in the table's last column for comparative purposes  The SBA's 7(j) Technical Assistance Program provides "a wide variety of management and technical assistance to eligible individuals or concerns to meet their specific needs, including: (a) counseling and training in the areas of financing, management, accounting, bookkeeping, marketing, and operation of small business concerns; and (b) the identification and development of new business opportunities " Eligible individuals and businesses include "8(a) certified firms, small disadvantaged businesses, businesses operating in areas of high unemployment, or low income or firms owned by low income individuals " As shown in Table 13 , recommended appropriations for the 7(j) Technical Assistance Program have varied since FY2000, with increases in some years and decreases in others  Overall, the SBA's 7(j) Technical Assistance Program's recommended appropriations have decreased from $3 584 million in FY2000 to $2 800 million in FY2019  7(j) Technical Assistance Program expenditures in FY2000-FY2018 and anticipated 7(j) Technical Assistance Program expenditures in FY2019 are presented in the table's last column for comparative purposes  The SBA's Native American Outreach (NAO) program provides management and technical educational assistance to American Indians, Alaska natives, native Hawaiians, and "the indigenous people of Guam and American Samoa … to promote entity-owned and individual 8(a) certification, government contracting, entrepreneurial education, and capital access " The program's management and technical assistance services are available to members of these groups living in most areas of the nation  As shown in Table 14 , the NAO program's recommended appropriations have varied somewhat since FY2003 (the first year it received recommended appropriations), ranging from $1 0 million to $2 0 million  The program's recommended appropriations have not kept pace with inflation  NAO program expenditures in FY2003-FY2018 and anticipated NAO expenditures in FY2019 are presented in the table's last column for comparative purposes  The National Women's Business Council (NWBC) is a bipartisan federal advisory council created to serve as an independent source of advice and counsel to the President, Congress, and the SBA on economic issues of importance to women business owners  The council's mission "is to promote bold initiatives, policies, and programs designed to support women's business enterprises at all stages of development in the public and private sector marketplaces—from start-up to success to significance " As shown in Table 15 , the recommended appropriation for the NWBC has increased from $0 598 million in FY2000 to $1 500 million in FY2019  This increase has exceeded the rate of inflation  NWBC expenditures in FY2000-FY2018 and NWBC anticipated expenditures in FY2019 are presented in the table's last column for comparative purposes  The HUBZone program helps small businesses located in designated Historically Underutilized Business Zones (HUBZones) to compete for federal contracts  Federal agencies may award contracts directly to HUBZone-certified small businesses through a sole-source contract, limit contact competitions to HUBZone-certified firms through a contract set-aside, or provide HUBZone-certified firms a price evaluation preference in full and open competitions  The HUBZone program was initially funded through the SBA's salary and expenses account  As shown in Table 16 , Congress started recommending an appropriation for the program in FY2004  This recommended appropriation remained relatively stable until FY2015, when it increased to $3 0 million  With this increase, the HUBZone program's recommended appropriations have exceeded inflation  The HUBZone program's expenditures in FY2000-FY2018 and the HUBZone program's anticipated expenditures in FY2019 are presented in the table's last column for comparative purposes  The SBA reports that "regional innovation clusters are on-the-ground collaborations between business, research, education, financing and government institutions that work to develop and grow a particular industry or related set of industries in a particular geographic region " The SBA has supported regional innovative clusters since FY2009, and the initiative has received recommended appropriations from Congress since FY2010  As shown in Table 17 , funding for the Entrepreneurial Development Initiative (Regional Innovation Clusters) has been reduced from a recommended appropriation of $10 0 million in FY2010 to $5 0 million in FY2019  The table's last column indicates that the SBA's expenditures for the initiative have often been less than the amount appropriated  The Trump Administration recommended in its FY2018 and FY2019 budget requests that the Entrepreneurial Development Initiative receive no appropriations  The SBA's Entrepreneurship Education initiative offers high‐growth small businesses in underserved communities "a seven‐month executive leader education series" consisting of "more than 100 hours of specialized training, technical resources, a professional networking system, and other resources to strengthen their business model and promote economic development within urban communities " At the conclusion of the training, "participants produce a three‐year strategic growth action plan with benchmarks and performance targets that help them access the necessary support and resources to move forward for the next stage of business growth " As shown in Table 18 , the Entrepreneurship Education initiative received its first recommended appropriation from Congress in FY2014 ($5 0 million), $7 0 million in FY2015, $10 0 million in FY2016, FY2017, and FY2018, and $3 5 million in FY2019  The SBA describes growth accelerators as "organizations that help entrepreneurs start and scale their businesses " Growth accelerators are typically run by experienced entrepreneurs and help small businesses access seed capital and mentors  The SBA claims that growth accelerators "help accelerate a startup company's path towards success with targeted advice on revenue growth, employee growth, sourcing outside funding and avoiding pitfalls " As shown in Table 19 , the Growth Accelerator initiative received its first recommended appropriation from Congress in FY2014 ($2 5 million), $4 0 million in FY2015, $1 0 million in FY2016, FY2017, and FY2018, and $2 million in FY2019  It provides $50,000 matching grants each year to universities and private sector accelerators "to support the development of accelerators and their support of startups in parts of the country where there are fewer conventional sources of access to capital (i e , venture capital and other investors) " The Trump Administration recommended in its FY2018 and FY2019 budget requests that the Growth Accelerator Initiative receive no appropriations 

ground_truth: In April 2018, Facebook disclosed that a Cambridge University researcher may have improperly shared the data of up to 87 million of its users with a political consulting firm. This disclosure followed other recent incidents involving the misuse of consumers' personal information from the Internet, which is used by about three-quarters of Americans. GAO was asked to review federal oversight of Internet privacy. This report addresses, among other objectives: (1) how FTC and FCC have overseen consumers' Internet privacy and (2) selected stakeholders' views on the strengths and limitations of how Internet privacy currently is overseen and how, if it all, this approach could be enhanced. GAO evaluated FTC and FCC Internet privacy enforcement actions and authorities and interviewed representatives from industry, consumer advocacy groups, and academia; FTC and FCC staff; former FTC and FCC commissioners; and officials from other federal oversight agencies. Industry stakeholders were selected to represent different sectors, and academics were selected because of their expertise in privacy, consumer protection, and regulatory issues. The United States does not have a comprehensive Internet privacy law governing the collection, use, and sale or other disclosure of consumers' personal information. At the federal level, the Federal Trade Commission (FTC) currently has the lead in overseeing Internet privacy, using its statutory authority under the FTC Act to protect consumers from unfair and deceptive trade practices. However, to date FTC has not issued regulations for Internet privacy other than those protecting financial privacy and the Internet privacy of children, which were required by law. For FTC Act violations, FTC may promulgate regulations but is required to use procedures that differ from traditional notice-and-comment processes and that FTC staff said add time and complexity. In the last decade, FTC has filed 101 enforcement actions regarding Internet privacy; nearly all actions resulted in settlement agreements requiring action by the companies. In most of these cases, FTC did not levy civil penalties because it lacked such authority for those particular violations. The Federal Communications Commission (FCC) has had a limited role in overseeing Internet privacy. From 2015 to 2017, FCC asserted jurisdiction over the privacy practices of Internet service providers. In 2016, FCC promulgated privacy rules for Internet service providers that Congress later repealed. FTC resumed privacy oversight of Internet service providers in June 2018. Stakeholders GAO interviewed had varied views on the current Internet privacy enforcement approach and how it could be enhanced. Most Internet industry stakeholders said they favored FTC's current approach—direct enforcement of its unfair and deceptive practices statutory authority, rather than promulgating and enforcing regulations implementing that authority. These stakeholders said that the current approach allows for flexibility and that regulations could hinder innovation. Other stakeholders, including consumer advocates and most former FTC and FCC commissioners GAO interviewed, favored having FTC issue and enforce regulations. Some stakeholders said a new data-protection agency was needed to oversee consumer privacy. Stakeholders identified three main areas in which Internet privacy oversight could be enhanced: Statute . Some stakeholders told GAO that an overarching Internet privacy statute could enhance consumer protection by clearly articulating to consumers, industry, and agencies what behaviors are prohibited. Rulemaking . Some stakeholders said that regulations can provide clarity, enforcement fairness, and flexibility. Officials from two other consumer protection agencies said their rulemaking authority assists in their oversight efforts and works together with enforcement actions. Civil penalty authority. Some stakeholders said FTC's Internet privacy enforcement could be more effective with authority to levy civil penalties for first-time violations of the FTC Act. Comprehensive Internet privacy legislation that establishes specific standards and includes traditional notice-and-comment rulemaking and broader civil penalty authority could enhance the federal government's ability to protect consumer privacy. Congress should consider developing comprehensive legislation on Internet privacy that would enhance consumer protections and provide flexibility to address a rapidly evolving Internet environment. Issues that should be considered include what authorities agencies should have in order to oversee Internet privacy, including appropriate rulemaking authority.