prompt_front: You are given two reports by the government agency.



Question: Write a one-page summary of the report 1.

Report 1: The federal government owns roughly 640 million acres, more than a quarter of the land in the United States  These lands are heavily concentrated in 12 western states (including Alaska), where t he federal government owns roughly half of the overall land area  Four federal agencies—the National Park Service (NPS), Fish and Wildlife Service (FWS), and Bureau of Land Management (BLM), all in the Department of the Interior (DOI), and the U S  Forest Service (FS) in the Department of Agriculture—administer about 95% of those lands  No single law provides authority for these four agencies to acquire and/or disposal of lands  Rather, Congress provided various acquisition and disposal authorities through laws enacted over more than a century  This report describes the primary authorities of the four agencies  The extent to which each of the agencies has authority to acquire and dispose of land, and the nature of the authorities, varies considerably  Some of the agencies have relatively broad authority to acquire and/or dispose of land  Most notably, the BLM has relatively broad authority for both acquisitions and disposals  By contrast, the NPS has no general authority to acquire land to create new park units or to dispose of park lands  The extent of the acquisition and disposal authorities for the FS and the FWS are not nearly as broad as the BLM's but not nearly as restrictive as the NPS's  The FS authority to acquire lands is mostly limited to lands within or contiguous to the boundaries of a national forest  The agency has various authorities to dispose of land, but they are relatively constrained and infrequently used  The FWS has various authorities to acquire lands but no general authority to dispose of its lands  The acquisition authorities differ as to the circumstances in which they apply, and the disposal authorities likewise differ as to their purposes  Thus, where a specific acquisition or disposal by an agency is contemplated, the particular authority at issue should be consulted  In general, the acquisition authorities are designed to allow federal agencies to acquire lands that could be viewed as benefitting from federal management  Among other circumstances, acquisition might be authorized to bring inholdings or lands adjacent to federal lands into federal ownership to improve or simplify management of federal lands  Acquisitions also might be authorized to conserve species, protect natural and cultural resources, and increase opportunities for recreation  The disposal authorities generally are designed to allow federal agencies to dispose of land that is no longer required for a federal purpose, might be inefficient to manage, or might be chiefly valuable for another purpose  For instance, disposal might be authorized to allow lands to be used for agriculture, community development, mineral extraction, or educational purposes  Agencies also acquire and dispose of federal land in exchanges  Exchanges are not discussed separately in this report, as often the authorities to acquire and dispose of lands also apply to land exchange  However, there are provisions of law particularly applicable to exchanges  The exchange authorities for the NPS and the FWS are relatively narrow  The Federal Land Policy and Management Act of 1976 (FLPMA; 43 U S C  §§1701-1781) provides broader exchange authority and is the main authority governing exchanges by the BLM and the FS  Congress often faces questions on the adequacy of existing acquisition and disposal authorities; the nature, extent, and location of their use; the extent of federal land ownership overall; and the sources and levels of land acquisition funds, among other issues  The suitability of the acquisition and disposal authorities, and the extent and circumstances of their use by the agencies, forms the backdrop for congressional consideration of measures to establish, modify, or eliminate the use of authorities  With regard to the establishment of new authorities, for instance, some 115 th Congress proposals would authorize states to exchange land grant parcels for federal lands  Other measures would authorize the BLM and FS to convey small tracts to adjacent landowners and to govern the use of proceeds from these conveyances  Proposals to modify authorities include measures in the 115 th Congress to reauthorize and amend BLM authority to sell or exchange land under the Federal Land Transaction Facilitation Act (FLTFA; 43 U S C  §§2301 et seq ), as well as bills to amend the Small Tracts Act (16 U S C  §521e) regarding the type and value of FS lands that can be disposed of and the use of related proceeds  Among the provisions to eliminate the use of authorities are those to prevent the disposal of federal land under the General Mining Law of 1872, which have been contained in annual Interior appropriations laws since FY1995  In addition, Congress frequently considers legislation authorizing and governing the acquisition or disposal of specific parcels  For example, Title XXX of P L  113-291 contained various provisions to authorize the acquisition and/or disposal of land  Congress may consider such legislation to provide an agency with acquisition or disposal authority in a particular instance because it is lacking  In other cases, Congress directs a particular acquisition or disposal to facilitate the action  For instance, the legislation may seek to direct an acquisition based on Congress's assessment of public needs and priorities  It may expedite the process for acquiring a parcel of land, such as by limiting the assessments and evaluations that ordinarily would be required under law  The legislation also might authorize actions not ordinarily permitted, such as the conveyance of land at reduced or no cost rather than at fair market value  Congress also addresses acquisition and disposal policy in the context of deliberations on the role and goals of the federal government in owning and managing land generally  The extent to which the federal government should own land remains controversial  Many westerners contend that there is excessive federal influence over their lives and economies and that the federal government should divest itself of many lands  Many others support the policy of retaining lands in federal ownership on behalf of the public and sometimes advocate adding more lands to enhance protection  Recent Congresses considered diverse bills pertaining to the extent of federal land ownership  Among others, 115 th Congress measures would authorize or direct the Secretary of the Interior and the Secretary of Agriculture to offer to sell a certain percentage of land in each of several fiscal years  Other bills provide that where a land management agency acquires land, an equal number of acres is to be offered for sale  Another set of issues pertains to the sources and levels of funds for land acquisition  The principal financing mechanism for federal land acquisition is discretionary appropriations under the Land and Water Conservation Fund (LWCF)  Provisions of the Land and Water Conservation Fund Act of 1965 (LWCF Act; 54 U S C  §§200301 et seq ) had provided for $900 million in specified revenues to be deposited in the LWCF annually  These provisions expired September 30, 2018  Each year, Congress determines the level of appropriations from the LWCF for federal land acquisition  Total appropriations for land acquisition and the amount provided to each of the federal land management agencies have varied substantially since the program's origin in 1965  In the 115 th Congress, some measures propose permanent reauthorization of the LWCF and/or mandatory appropriations at the authorized level  Advocates of such bills typically seek stable, predictable funding to promote a strong federal role in acquiring and managing sensitive resources  Other measures would direct a portion of funding to particular purposes, such as acquisitions in areas with restricted access for fishing, hunting, and other types of recreation  Still other proposals would allow LWCF to be used for a broader array of purposes, including nonacquisition purposes, due to concerns about the extent of federal land ownership and the availability of funding for other federal activities  Additional sources of funding are available for some agencies or under certain authorities  For instance, the FWS has a mandatory source of funds for land acquisition through the Migratory Bird Conservation Fund, as discussed below  As another example, the BLM also has mandatory spending authorities that allow the agency to keep the proceeds of land sales and use these proceeds for subsequent acquisitions and other purposes  These authorities are discussed below  The application of mandatory spending authorities, including the uses of the proceeds, has been the subject of congressional debate  As noted above, various laws authorizing and governing specific land acquisitions have been enacted  In addition, the four federal land management agencies have different standing authorities for acquiring lands  In general, all four agencies are authorized to accept land as gifts and bequests  In addition, each generally is authorized to use eminent domain —taking private property, through condemnation, for public use—while compensating the landowner  However, this practice is controversial, and it is rarely used by the land management agencies  The primary land acquisition authorities are described below for each of the four federal land management agencies  In general, the agencies are presented in the order of the breadth of their authorities, with the NPS (the narrowest authorities) first and the BLM (the broadest authorities) last  The NPS does not have standing authority to acquire lands for new or existing units of the National Park System, except in limited circumstances  Rather, most units have been created by Congress, and the law creating a park unit typically includes specific authority for the NPS to acquire nonfederal inholdings within the identified boundaries of that park  The Secretary of the Interior is authorized to make certain boundary adjustments of park units for "proper preservation, protection, interpretation, or management" and to acquire the nonfederal lands within the adjusted boundary, under specified provisions and conditions (54 U S C  §100506(c))  Some of these conditions have been interpreted to apply particularly to boundary adjustments requiring land purchases, as opposed to those in which added lands are acquired by donation, transfer, or exchange  The President has authority to create national monuments on federal lands under the Antiquities Act of 1906 (54 U S C  §§320301 et seq )  In total, 158 monuments have been created by presidential proclamation  Most are managed by the NPS, but some are managed by the BLM and other agencies  Under law, the Secretary of the Interior and the NPS have responsibilities related to the potential acquisition of lands for the National Park System  Among other requirements, the Secretary is directed "to investigate, study, and continually monitor the welfare of" areas that could potentially be added to the system and to report to Congress on possible additions (54 U S C  §100507)  Furthermore, the general management plan for each unit is to include potential changes to the boundaries of the unit and the reasons for such changes (54 U S C  §100502)  The Secretary also is to conduct a "systematic and comprehensive review of certain aspects of the National Park System" and to submit a related report to Congress at least every three years (54 U S C  §100505(a)) that includes a list of all authorized but unacquired lands within the boundaries of park units and a priority listing of these unacquired parcels (54 U S C  §100505(c))  The Secretary of Agriculture has various authorities to acquire lands for the National Forest System (NFS)  The NFS consists of 284 units covering 232 4 million acres of federal and nonfederal land, including national forests, national grasslands, purchase units, land utilization projects, and other areas  Today, only an act of Congress can create new NFS units, but the Secretary may acquire lands within or contiguous to the proclaimed exterior boundaries of an NFS unit  The NFS contains substantial acreage of nonfederal lands within the proclaimed boundaries of the system, particularly in the east, where national forests were established after extensive settlement  NFS units in the Eastern and Southern Regions average about 46% nonfederal land within their boundaries, while Western Region NFS units average about 10%  The FS has very limited regulatory authority over the uses of the 39 5 million acres of nonfederal land within the NFS  The FS's primary land acquisition authority is the Weeks Act of 1911 (16 U S C  §515), which was used to acquire many of the lands that became the eastern national forests  The Weeks Act authority continues to be the agency's primary authority to acquire lands; however, acquisitions are now limited to lands within (or adjacent to) established NFS unit boundaries  The Weeks Act also authorizes the Secretary to modify the NFS unit boundary as needed to encompass new acquisitions  Other laws authorize the FS to acquire lands for the national forests, typically in specific areas or for specific purposes  For example, Section 205 of the Federal Land Policy and Management Act (FLPMA; P L  94-579 ) authorizes the acquisition of access corridors—including easements—to national forests across nonfederal lands (43 U S C  §1715(a))  Another example is the Act of August 3, 1956 (7 U S C  §428(a)), which authorizes the FS to acquire lands without any geographical limitations but does require a provision be made in a specific appropriation or other law  Another law authorizes proceeds from certain land sales or exchanges to be used for acquisitions, including for administrative sites and enhancement of recreational access  However, the acquisitions are limited to the state in which FS previously conveyed NFS land under specific disposal authorities, as discussed later in this report  Several other acquisition authorities apply to specific national forests, such as the Act of June 11, 1940, which authorizes the purchase of lands within the Angeles National Forest in California  In addition, the Secretary of Agriculture and the secretary of a military department that has lands within or adjacent to proclaimed NFS land may interchange lands, without reimbursement or transfer of funds  Many of the acquisition authorities also allow the FS to accept donations of land as specified  Within the NFS, the Secretary of Agriculture also is authorized to acquire privately owned lands within or adjacent to designated wilderness areas (16 U S C  §1134(c)), Wild and Scenic River corridors (16 U S C  §1277), and certain segments of designated National Trails (16 U S C  §1244), as specified by the law creating the trail  Lands may be added to the National Wildlife Refuge System (NWRS) in a number of ways, including through congressional and administrative actions and donations  A principal FWS land acquisition authority is the Migratory Bird Conservation Act of 1929 (MBCA; 16 U S C  §§715 et seq )  This act authorizes the Secretary of the Interior to recommend areas "necessary for the conservation of migratory birds" to the Migratory Bird Conservation Commission, after consulting with the relevant governor (or state agency) and appropriate local government officials (16 U S C  §715a and §715c)  In addition, the state in which the purchase is located must have consented to the acquisition by law (16 U S C  §715f and §715k-5)  The Secretary may then purchase or rent areas or interests therein approved by the commission and acquire by gift or devise any area or interest therein (16 U S C  §715d)  The MBCA authority is used frequently because of the availability of funding through the Migratory Bird Conservation Fund (MBCF, 16 U S C  §718d)  The MBCF is supported by multiple sources of funding, including three major sources: the sale of hunting and conservation stamps (commonly known as duck stamps); import duties on arms and ammunition; and a portion of certain refuge entrance fees  MBCF funds are permanently appropriated to the extent of receipts and, after paying certain administrative costs, may be used for the "location, ascertainment, and acquisition of suitable areas for migratory bird refuges    " (16 U S C  §718d(b))  The predictability of funding and permanent authority for use makes the MBCF, and thus the MBCA, particularly important for FWS land acquisition and unique among the four agencies  Other laws provide general authority to expand the NWRS, including the Fish and Wildlife Coordination Act of 1934 (16 U S C  §§661-667a), the Fish and Wildlife Act of 1956 (16 U S C  §§742a et seq ), and the Endangered Species Act of 1973 (16 U S C  §§1531-1544)  The National Wildlife Refuge System Administration Act of 1966 (16 U S C  §§668dd-668ee) authorizes the Secretary of the Interior to acquire land or interests therein through donated funds or exchange (16 U S C  §668dd(b))  Further, FLPMA authorizes the Secretary of the Interior to withdraw lands from the public domain for creating or adding to refuges (which would be an interagency transfer), although withdrawals exceeding 5,000 acres are subject to congressional approval (43 U S C  §1714(c))  In contrast to NPS and FS land acquisition, where the lands generally must be within the boundaries of established units, the FWS can acquire new lands to create a new refuge or to expand an existing one under the general FWS authorities cited above, as well as under certain other laws  Some national wildlife refuge (NWR) units have been created by specific acts of Congress, such as Protection Island NWR (WA) and Bayou Sauvage Urban NWR (LA) (16 U S C  §668dd note)  Units also can be created by executive order; for example, the Midway Atoll NWR was created by President Clinton in Executive Order 13022  The BLM has broad, general authority to acquire lands, principally under Section 205 of FLPMA  Specifically, the Secretary of the Interior is authorized to acquire, by purchase, exchange, donation, or use of eminent domain, lands or interests therein (43 U S C  §1715(a))  The BLM acquires land or interests in land, including inholdings, for a variety of reasons  These include to protect natural and cultural resources, to increase opportunities for public access and recreation, and to improve management of lands  As noted above, various laws directing the disposal of particular lands sometimes have been enacted  In addition, the four federal land management agencies have different standing authorities for disposing of lands  The specific disposal authorities are discussed below for each of the four agencies in the order of their apparent breadth, with the NPS (the narrowest authorities) first and the BLM (the broadest authorities) last  The NPS does not have general authority to dispose of National Park System lands  Units and lands of the Park System that were established by acts of Congress can be disposed of only by acts of Congress  Preservation of park units is a management goal and provisions of law limit the power of the Secretary of the Interior to dispose of land in changing park boundaries  Although the Secretary can, under specified conditions, make boundary changes that concurrently add and remove land within the boundary, minor boundary revisions solely to remove NPS acreage can be made only by Congress  Also, the Secretary can acquire by exchange lands that are adjacent to a boundary revision, but the Secretary cannot dispose of NPS land to do so (54 U S C  §100506(c))  Presidents have modified the boundaries of national monuments established by previous presidential proclamations, in some cases reducing the size of the monument  However, no president has terminated a monument established by proclamation  The FWS does not have general authority to dispose of its lands  With certain exceptions, wildlife refuge lands administered by the FWS can be disposed only by an act of Congress (16 U S C  §§668dd(a)(5) and (6))  For refuge lands reserved from the public domain, FLPMA prohibits the Secretary of the Interior from modifying or revoking any withdrawal which added lands to the NWRS (43 U S C  §1714(j))  For acquired lands, disposal is allowed only if: (1) the disposal is part of an authorized land exchange (16 U S C  §§668dd(a)(6) and (b)(3)); or (2) the Secretary determines the lands are no longer needed and the Migratory Bird Conservation Commission approves the disposal (16 U S C  §668dd(a)(5))  In the latter case, the disposal must recover the acquisition cost or be at the fair market value (whichever is higher), and the receipts must be deposited in the Migratory Bird Conservation Fund  The Secretary of Agriculture has numerous authorities to convey lands within proclaimed NFS boundaries out of federal ownership—through sale or exchange—although previous, broader authorities have been modified or revoked  Many of the authorities put constraints on land disposal, such as applying only to a specific geographical area or to the disposal of particular administrative properties or facilities  Many of the authorities are used in conjunction with FLPMA and other federal law and as such may place requirements on the sale or exchange of land  This includes obtaining at least fair market value for the sale of federal lands; requiring that nonfederal land exchanged for federal land be in the same state; and requiring exchanged lands to be of equal value, although value may be partially equalized with a cash payment (43 U S C  §1716)  The General Exchange Act of 1922 (16 U S C  §485) authorizes the exchange of NFS land or timber that was reserved from the public domain if the Secretary determines it will be in the public interest  The nonfederal land must be within the same state and within the exterior boundary of a national forest, and it must be chiefly valuable for national forest purposes, among other provisions  The Weeks Act of 1911 allows for similar exchanges for acquired NFS lands (16 U S C  §516)  The 1983 Small Tracts Act authorizes the Secretary to dispose of NFS land by sale or exchange, generally up to certain specified acreage limits  The disposal may be To improve management efficiencies where NFS lands are interspersed with nonfederal mineral rights owners, or if the Secretary determines the parcels to be inaccessible, physically isolated from other federal land, or to have lost national forest character (40 acres maximum); To relieve encroachments including due to erroneous surveys, or encroachments by a permanent habitable improvement if there is no evidence that the encroachment was intentional or due to negligence (10 acres maximum); To dispose of unneeded federal rights-of-way substantially surrounded by nonfederal lands (no specified acreage limitation); and If the parcel is used as a cemetery, landfill, or sewage plant pursuant to a special use authorization for the use and occupancy of NFS land (no specified acreage limitation) (16 U S C  §521e)  The conveyance must be determined to be in the public interest and the tracts may not be valued at more than $500,000  The land can be disposed of for cash, lands, interests in land (such as an easement), or any combination thereof for at least the value of the land being sold or exchanged (16 U S C  §521d) plus "all reasonable costs of administration, survey, and appraisal incidental to such conveyance" (16 U S C  §521f)  In some cases, the proceeds may be used for specified land acquisition purposes  The 1958 Townsites Act authorizes the Secretary to transfer up to 640 acres of NFS land adjacent to communities in Alaska or the 11 western states for townsites, if the "indigenous community objectives     outweigh the public objectives and values which would be served by maintaining such tract in Federal ownership" (16 U S C  §478a)  Public notice of the application for such transfer is required, and upon a "satisfactory showing of need," the Secretary may offer the land to a local governmental entity at "not less than the fair market value " The Education Land Grant Act, also known as the Sisk Act (16 U S C  §479a), authorizes the Secretary to transfer up to 80 acres of NFS land for a nominal cost upon written application of a public school district  It provides for reversion of the title to the federal government if the lands are not used for the educational purposes for which they were acquired  There are a few other specific authorities that allow for the disposal of NFS lands  For example, the 1911 Weeks Act authorizes the disposal of NFS lands that are "chiefly valuable for agriculture" but were acquired inadvertently or otherwise, if agricultural use will not injure the forests or streamflows and the lands are not needed for public purposes  The lands can be sold as homesteads in parcels of up to 80 acres (16 U S C  §519)  The Bankhead-Jones Farm Tenant Act of 1937 (7 U S C  §§1010-1012) also authorizes the disposal of lands acquired under its authority, although the FS has adopted regulations stating that the Bankhead-Jones lands comprising the national grasslands will be held permanently (36 C F R  §213 1(b))  The BLM can dispose of land under several authorities  They include (1) exchanges and sales under FLPMA, (2) sales or exchanges under the FLTFA, (3) transfers to other governmental units or nonprofit entities for public purposes, (4) patents under the General Mining Law of 1872, and (5) geographically limited sale authorities  With regard to exchanges under FLPMA, the exchanges must serve the public interest, and the federal and nonfederal lands in the exchange must be located in the same state and be of equal value (with cash equalization payments possible), among other requirements (43 U S C  §1716)  With regard to sales under FLPMA, the BLM is authorized to sell certain tracts of public land that are identified through the land-use planning process  Such tracts must meet specific criteria (43 U S C  §1713(a)): (1) such tract because of its location or other characteristics is difficult and uneconomic to manage as part of the public lands, and is not suitable for management by another Federal department or agency; or (2) such tract was acquired for a specific purpose and the tract is no longer required for that or any other Federal purpose; or (3) disposal of such tract will serve important public objectives, including but not limited to, expansion of communities and economic development, which cannot be achieved prudently or feasibly on land other than public land and which outweigh other public objectives and values, including, but not limited to, recreation and scenic values, which would be served by maintaining such tract in Federal ownership  The size of the tracts for sale is determined by "the land use capabilities and development requirements " Proposals to sell tracts of more than 2,500 acres first must be submitted to Congress and can be disapproved by Congress  Lands may not be sold at less than their fair market value  They generally must be sold through competitive bidding, although modified competition and noncompetitive sales are allowed  FLTFA provides for the sale or exchange of BLM lands identified for disposal under BLM land- use plans  The law create s a separate Treasury account for most of the proceeds (96%) from the sale or exchange, and it provide s for the use of those funds by the Secretary of the Interior and the Secretary of Agriculture  The Secretaries may acquire nonfederal lands, specifically inholdings , lands adjacent to federal lands that contain exceptional resources , and areas adjacent to inaccessible lands that are open to recreation  Up to 20% of the funds in the account may be used for administrative costs, and at least 80% of the funds for acquisition are to be in the state in which the funds are generated   The Recreation and Public Purposes Act (43 U S C  §869) authorizes the Secretary, upon application by a qualified applicant, to dispose of any public lands to a State, Territory, county, municipality, or other State, Territorial, or Federal instrumentality or political subdivision for any public purposes, or to a nonprofit corporation or nonprofit association for any recreational or any public purpose consistent with its articles of incorporation or other creating authority  The lands can be sold or leased, and the act specifies conditions, qualifications, and acreage limitations for transfer  The price of the land depends on the type of entity that will receive it, for instance, whether a state government or a nonprofit organization  The price also depends on the intended use of the land, with some sales and leases made at no cost  Although the BLM can dispose of lands through patents under the General Mining Law of 1872, since FY1995 a series of annual moratoria on issuing mineral patents has been enacted into law  These moratoria, contained in the annual Interior appropriations laws, have effectively prevented this means of federal land disposal  Specifically, the Mining Law allows access to and development of hardrock minerals on federal lands that have not been withdrawn from entry  With evidence of valuable minerals and sufficient developmental effort, the Mining Law allows mining claims to be patented, with full title (of surface and mineral rights) transferred to the claimant upon payment of the appropriate fee  Nonmineral lands used for associated milling or other processing operations can also be patented (30 U S C  §42)  Patented lands may be used for purposes other than mineral development  The BLM also has geographically limited land sale authorities  The program with the largest revenue stream has been the Southern Nevada Public Land Management Act of 1998, which allows the Secretary of the Interior to sell or exchange certain lands around Las Vegas  The BLM and the local government unit jointly decide on the lands to be offered for sale or exchange  In general, 85% of the proceeds are deposited into a special account, and are available to the Secretary of the Interior for land acquisition in Nevada and other purposes in the state, such as certain capital improvements and development of parks, trails, and natural areas  The other 15% of the proceeds are for state or local purposes, specifically the State of Nevada General Education Fund (5%) and the Southern Nevada Water Authority (10%)  Other provisions of law similarly provide for BLM land sales in particular areas (mostly in Nevada), with specific allocations of the proceeds  Further, the BLM continues to dispose of land in Alaska as required by law, such as through transfers to the state of Alaska and to Alaska native corporations  A total of about 150 million acres in Alaska will be transferred from federal to state and private ownership  


Report 2: Banks play a central role in the financial system by connecting borrowers to savers and allocating available funds across the economy  As a result, banking is vital to the U S  economy's health and growth  Nevertheless, banking is an inherently risky activity involving extending credit and undertaking liabilities  Therefore, banking can generate tremendous societal and economic benefits, but banking panics and failures can create devastating losses  Over time, a regulatory system designed to foster the benefits of banking while limiting risks has developed, and both banks and regulatio n have coevolved as market conditions have changed and different risks have emerged  For these reasons, Congress often considers policies related to the banking industry  The last decade has been a transformative period for banking  The 2007-2009 financial crisis threatened the total collapse of the financial system and the real economy  Many assert only huge and unprecedented government interventions staved off this collapse  Others argue that government interventions were unnecessary or potentially exacerbated the crisis  In addition, many argue the crisis revealed that the financial system was excessively risky and the regulatory regime governing the financial system had serious weaknesses  Policymakers responded to the perceived weaknesses in the pre-crisis financial regulatory regime by implementing numerous changes to financial regulation, including to bank regulation  Most notably, Congress passed the Dodd-Frank Wall Street Reform and Consumer Protection Act (Dodd-Frank Act; P L  111-203 ) in 2010 with the intention of strengthening regulation and addressing risks  In addition, U S  bank regulators have implemented changes under their existing authorities, many of which generally adhere to the Basel III Accords—an international framework for bank regulation agreed to by U S  and international bank regulators—that called for making certain bank regulations more stringent  In the ensuing years, some observers raised concerns that the potential benefits of those regulatory changes (e g , better-managed risks, increased consumer protection, greater systemic stability, potentially higher economic growth over the long term) were outweighed by the potential costs (e g , compliance costs incurred by banks, reduced credit availability for consumers and businesses, potentially slower economic growth)  In response to these concerns, Congress passed the Economic Growth, Regulatory Relief, and Consumer Protection Act (EGRRCP Act; P L  115-174 )  Among other things, the law modified certain (1) regulations facing small banks; (2) regulations facing banks large enough to be subjected to Dodd-Frank enhanced regulation but still below the size thresholds exceeded by the very largest banks; and (3) mortgage regulations facing lenders including banks  In addition, federal banking regulatory agencies—the Federal Reserve (the Fed), the Office of the Comptroller of the Currency (OCC), and the Federal Deposit Insurance Corporation (FDIC)—have proposed further changes in regulation  Implementing the regulatory changes prescribed in the aftermath of the crisis and made pursuant to the Dodd-Frank Act occurred over the course of years  In recent years—a period in which the leadership of the regulators has transferred from Obama Administration to Trump Administration appointees—the banking regulators have expressed the belief that, after having viewed the effects of the regulations, they now have the necessary information to determine which regulations may be ineffective or inefficient as currently implemented  Recently, these regulators have made of number of proposals with the aim of reducing regulatory burden  A key issue surrounding regulatory relief made pursuant to the EGRRCP Act and regulator-initiated changes is whether regulatory burden can be reduced without undermining the goals and effectiveness of the regulations  Meanwhile, market trends and economic conditions continue to affect the banking industry coincident with the implementation of new regulation  Some of the more notable conditions include the development of new technologies used in financial services (known as "fintech") and a rising interest rate environment following an extraordinarily long period of very low rates  This report provides a broad overview of selected banking-related issues, including issues related to "safety and soundness" regulation, consumer protection, community banks, large banks, what type of companies should be able to establish banks, and recent market and economic trends  This report is not an exhaustive look at all bank policy issues, nor is it a detailed examination of any one issue  Rather, it provides concise background and analyses of certain prominent issues that have been the subject of recent discussion and debate  In addition, this report provides a list of Congressional Research Service reports that examine specific issues  Banks face a number of regulations intended to increase the likelihood that banks are profitable without being excessively risky and prone to failures; decrease the likelihood that bank services are used to conceal the proceeds of criminal activities; and to protect banks and their customers' data from cyberattacks  This section provides background on these "safety and soundness" regulations and analyzes selected issues related to them, including prudential regulation related to capital requirements and the Volcker Rule (which restricts proprietary trading); requirements facing banks related to anti-money laundering laws, such as the Bank Secrecy Act (P L  91-508); and challenges related to cybersecurity  Bank failures can inflict large losses on stakeholders, including taxpayers via government "safety nets" such as deposit insurance and Federal Reserve lending facilities  Failures can cause systemic stress and sharp contraction in economic activity if they are large or widespread  To make such failures less likely—and to reduce losses when they do occur—regulators use prudential regulation designed to ensure banks are safely profitable and to reduce the likelihood of bank failure  In addition, banks are subject to regulations intended to reduce the prevalence of crime  Some of those are anti-money laundering measures aimed at stopping criminals from using the banking system to conduct or hide illegal operations  Others are cybersecurity regulations aimed at protecting banks and their customers from becoming victims of cybercrime, such as denial-of-service attacks or data theft  Banks profit in part because their assets are generally riskier, longer term, and more illiquid than their liabilities, which allows the banks to earn more interest on their assets than they pay on their liabilities  The practice is usually profitable, but does expose banks to risks that can potentially lead to failure  Failures can be reduced if (1) banks are better able to absorb losses or (2) they are less likely to experience unsustainably large losses  One tool regulators use to increase a bank's ability to absorb losses is to require banks to hold a minimum level of capital  Another tool regulators use to reduce the likelihood and size of potential losses is to prohibit banks from engaging in activities that could create excessive risks  For example, the Volcker Rule prohibits banks from engaging in proprietary trading —the buying and selling of securities that the bank itself owns with the aim of profiting from price changes  The EGRRCP Act mandated certain changes to these prudential regulations, and regulators have proposed changes under existing authorities  Regulators are to promulgate these changes through the rulemaking process in the coming months and years  In addition, whether policymakers have calibrated these regulations such that their benefits and costs are appropriately balanced is likely to be an area of ongoing debate  For these reasons, prudential regulation issues will likely continue to draw congressional attention  A bank's balance sheet is composed of assets, liabilities, and capital  Assets are largely the value of loans owed to the bank and securities owned by the bank  To make loans and buy securities, a bank secures funding by either issuing liabilities or raising capital  A bank's liabilities are largely the value of deposits and borrowings the bank owes savers and creditors  Capital is raised through various methods, including issuing equity to shareholders or special types of bonds that can be converted into equity  Banking is an inherently risky activity, because banks may suffer losses on assets but face rigid obligations on the liabilities owed to depositors and creditors  In contrast to liabilities, capital generally does not obligate the bank to repay or distribute a specified amount of money at a specified time  This characteristic means that, in the event a bank suffers losses, capital gives the bank the ability to absorb some amount of losses while meeting its obligations  Thus, banks can avoid failures if they hold sufficient capital  Banks are required to satisfy several requirements to ensure they hold enough capital  In the United States, these requirements are generally aligned with the Basel III standards developed as part of a nonbinding agreement between international bank regulators  In general, these are expressed as minimum ratios between certain balance sheet items that banks must maintain  A detailed examination of how these ratios are calculated and what levels must be met is beyond the scope of this report  This examination of policy issues only requires noting that capital ratios fall into one of two main types—a leverage ratio or a risk-weighted ratio  A leverage ratio treats all assets the same, requiring banks to hold the same amount of capital against assets regardless of how risky each asset is  A risk-weighted ratio assigns a risk weight—a percentage based on the riskiness of the asset that the asset value is multiplied by—to account for the fact that some assets are more likely to lose value than others  Riskier assets receive a higher risk weight, which requires banks to hold more capital to meet the ratio requirement  Whether the benefits of capital requirements (e g , increased bank and financial system stability) are generally outweighed by the potential costs (e g , reduced credit availability) is an issue subject to debate  Capital is typically a more expensive source of funding for banks than liabilities  Thus, requiring banks to hold higher levels of capital may make funding more expensive, and so banks may choose to reduce the amount of credit available  Some studies indicate this could slow economic growth  However, no economic consensus exists on this issue, because a more stable banking system with fewer crises and failures may lead to higher long-run economic growth  In addition, estimating the value of regulatory costs and benefits is subject to considerable uncertainty, due to difficulties and assumptions involved in complex economic modeling and estimation  Lack of consensus also surrounds questions over whether or under what circumstances risk-weighted ratios are necessary, effective, and efficient  Proponents of risk-based measures assert that it is important to use both risk-weighted and leverage ratios because each addresses weaknesses of the other  For example, riskier assets generally offer a greater rate of return to compensate the investor for bearing more risk  Without risk weighting, banks would have an incentive to hold riskier assets because the same amount of capital must be held against risky and safe assets  However, the use of risk-weighted ratios could be problematic for a number of reasons  Risk weights assigned to particular classes of assets could potentially be an inaccurate estimation of some assets' true risk, which could incent banks to misallocate available resources across asset classes  For example, banks held a high level of seemingly low-risk, mortgage-backed securities (MBSs) before the crisis, in part because those assets offered a higher rate of return than other assets with the same risk weight  MBSs then suffered unexpectedly large losses during the crisis  Another criticism is that the risk-weighted requirements involve "needless complexity" and their use is an example of regulatory micromanagement  The complexity could benefit the largest banks that have the resources to absorb the added regulatory cost compared with small banks that could find compliance costs more burdensome  (Small or "community" bank compliance issues will be covered in more detail in the " Regulatory Burden on Community Banks " section later in the report ) Section 201 of the EGRRCP Act is aimed at addressing concerns over the complexity of risk-weighted ratios and the costs they impose on community banks  This provision created an option for banks with less than $10 billion in assets to meet a higher leverage ratio—the Community Bank Leverage Ratio (CBLR)—in order to be exempt from having to meet the risk-based ratios described above  Bank regulators have issued a proposal to implement this provision wherein banks (1) below the threshold that (2) meet at least a 9% leverage ratio measure of equity and certain retained earnings to assets and (3) had limited off-balance sheet exposures and limited securities trading activity (among other requirements) would qualify for the exemption  The FDIC estimates that more than 80% of community banks will be eligible for the CBLR  However, this new optional exemption does not entirely settle the issue  One bank industry group has argued that 9% is set higher than is necessary, excluding deserving banks from the exemption  In addition, bills in the 115 th Congress, notably H R  10 , proposed a high-leverage-ratio option be available to banks regardless of size that would exempt qualifying banks from a wider range of prudential regulations  There are also specific policy issues relating to capital requirements for large banks, which are discussed in the " Regulator Proposals Related to Large Bank Capital Requirements " section below  Section 619 of Dodd-Frank—often referred to as the Volcker Rule—generally prohibits depository banks from engaging in proprietary trading or sponsoring a hedge fund or private equity fund  Proprietary trading refers to owning and trading securities for a bank's own portfolio with the aim of profiting from price changes  Put simply, if a bank is engaged in proprietary trading, it is itself an investor in stocks, bonds, and derivatives, which is commonly characterized as "playing the market" or "speculating " The rule includes exceptions for when bank trading is deemed appropriate—such as (1) when a bank is hedging against risks the bank has assumed as a part of its traditional business and (2) market-making (i e , buying available securities with the intention of quickly selling them to meet market demand)  Proprietary trading is an inherently risky activity, and banks have faced varying degrees of restrictions over engaging in this activity for a number of decades  Sections 16, 20, 21, and 32 of the Banking Act of 1933 (P L  73-66)—commonly referred to as the Glass-Steagall Act—generally prohibited certain deposit-taking banks from engaging in certain securities markets activities  Over time, regulator interpretation of Glass-Steagall and legislative changes expanded permissible activities for certain banks, allowing them to make certain securities investments and authorizing bank-holding companies to own depositories and securities firms within the same organization  The financial crisis increased debate over whether banks were engaging in unnecessarily risky activities  Ultimately, certain provisions in Dodd-Frank placed restrictions on permissible activities to reduce banks' riskiness, and the Volcker Rule was designed to prohibit proprietary trading by depository banking organizations  One of the Volcker Rule's proponents' main rationales for the separation of deposit-taking and certain securities investments is that when banks analyze and assume risks, they may be subject to moral hazard —the willingness to take on excessive risk due to some outside protection from losses  Deposits are an important source of bank funding and insured (up to a limit on each account) by the government  This arguably reduces depositors' incentive to monitor their banks' riskiness  Thus, a bank could potentially take on excessive risk without concern about losing this funding because, in the event of large losses that lead to failure, at least part of the losses will be borne by the FDIC's Deposit Insurance Fund (which is backed by the full faith and credit of the U S  government and so ultimately the taxpayer)  Thus, supporters of the Volcker Rule have characterized it as preventing banks from "gambling" in securities markets with taxpayer-backed deposits  However, critics of the Volcker Rule doubt its necessity and efficiency  In regard to necessity, they assert that proprietary trading at commercial banks did not play a substantive role in the financial crisis  They note the rule would not have prevented a number of the major events that played a direct role in the crisis—including failures or bailouts of large investment banks and insurers and losses on loans held by commercial banks  On this point, they also argue that proprietary trading risks are no greater than those posed by "traditional" banking activities, such as mortgage lending, and allowing banks to take on risks in different markets might diversify their risk profiles, making them less likely to fail  Debates relating to the efficiency of the Volcker Rule involve its complexity, compliance burden, and potential to lead banks to reduce their engagement in beneficial market activities  Recall that the Volcker Rule is not a ban on all trading, as banks are still allowed to trade to hedge risks or make markets  This poses practical supervisory problems  For example, how can regulators determine whether a broker-dealer is holding a security for market-making, as a hedge against another risk, or as a speculative investment? Differentiating among these motives creates the aforementioned complexity and compliance costs that could affect banks' trading behavior, and so could reduce financial market efficiency  Another criticism of the Volcker Rule in its original form was that it unnecessarily subjected all banks to the rule and their associated compliance costs  Critics of this aspect asserted that the vast majority of community banks are not involved in complex trading activity, but nevertheless must incur costs in evaluating the rule to ensure they are in compliance  Both Congress and regulators have recently taken actions in response to concerns over the complexity of the Volcker Rule and its compliance burden for small banks  Section 203 of the EGRRCP Act exempted banks with less than $10 billion in assets that fell below certain trading activity limits from the rule  Independent of that mandate, the agencies that implemented and enforced the Volcker Rule released and called for public comment on a proposal to simplify the rule in May 2018  Under the proposal, the agencies would clarify certain of the rule's definitions and criteria in an effort to reduce or eliminate uncertainties related to how certain trading activity can qualify for exemption  The proposal would also further tailor the compliance requirements facing banks based on the size of an institution's trading activity  Proponents of the Volcker Rule are generally wary of size-based exemptions  They contend that community banks typically do not face compliance obligations under the rule and do not face an excessive burden by being subject to it  They argue that community banks that are subject to compliance requirements can comply by having clear policies and procedures in place for review during the normal examination process  In addition, Volcker Rule supporters are generally critical of the regulators' proposal, asserting that the changes would undermine "the effective supervision and enforcement" of the rule  Anti-money laundering (AML) regulation refers to efforts to prevent criminal exploitation of financial systems to conceal the location, ownership, source, nature, or control of illicit proceeds  The U S  Department of the Treasury estimates domestic financial crime, excluding tax evasion, generates $300 billion in illicit proceeds that might involve money laundering  Despite robust AML efforts in the United States, the ability to counter money laundering effectively remains challenged by factors including (1) the diversity of illicit methods to move and store ill-gotten proceeds through the international financial system; (2) the introduction of new and emerging threats such as cyber-related financial crimes; (3) gaps in legal, regulatory, and enforcement regimes; and (4) the costs associated with financial institution compliance with global AML guidance and national laws  In the United States, the statutory foundation for domestic AML originated in 1970 with the Bank Secrecy Act (BSA; P L  91-508) and its major component, the Currency and Foreign Transaction Reporting Act  Amendments to the BSA and related provisions in the 1980s and 1990s expanded AML policy tools available to combat crime, particularly drug trafficking, and prevent criminals from laundering their illicitly derived profits  Key elements to the BSA/AML legal framework include requirements for customer identification, recordkeeping, reporting, and compliance programs intended to identify and prevent money laundering abuses  In general, banking regulators examine institutions for compliance with BSA/AML  When a regulator finds BSA violations or deficiencies in AML compliance programs, it may take informal or formal enforcement action, including possible civil fines  The BSA/AML policy framework is premised on banks and other covered financial entities filing a range of reports with the Department of the Treasury's Financial Crimes Enforcement Network (FinCEN), when their clients either engage in suspicious financial transactions, large cash transactions, or certain other transactions  For example, a bank generally must file a Suspicious Activity Report (SAR) if, among other reasons, it conducts a transaction of $5,000 or more that the bank suspects involves money laundering or other criminal activity  A bank must file a Currency Transaction Report (CTR) if it conducts a currency (i e , cash) transaction of $10,000 or more as to which it has the same suspicions  The accurate, timely, and complete reporting of such activity to FinCEN flags situations that may warrant further investigation for law enforcement  Whether this regulatory framework adequately hinders criminals from using the banking system to launder their criminal proceeds and whether it does so efficiently without unduly burdening banks are debated issues  One aspect of this debate is whether current reporting requirements are inefficient and overly costly to the banking industry  Some industry observers—including officials from the OCC—have indicated that they believe certain areas of the current framework could be reformed in a way that reduces compliance costs without unduly weakening the ability to prevent money laundering  In contrast, officials from other agencies involved in AML and law enforcement—including FinCEN and the FBI—have stressed the importance of the information gathered under the current reporting requirements in combating money laundering  Another area of concern involves beneficial owners —that is, the natural person(s) who own or control a legal entity, such as a corporation or limited liability company  When such entities are set up without physical operations or assets, they are often referred to as shell companies   Shell companies can be used to conceal beneficial ownership and facilitate anonymous financial transactions  In recent years, policymakers have become increasingly concerned regarding potential risks posed by shell companies whose beneficial ownership is not transparent  This is due in part to a series of leaks to the media regarding the use of shell companies to facilitate criminal activity (such as "the Panama Papers") and sustained multilateral criticism of current U S  practices by the Financial Action Task Force, an international standard-setting body  In May 2018, a new FinCEN regulation came into effect that increased the requirements for banks to conduct customer due diligence (CDD) and ascertain the identity of beneficial owners in certain cases  Central to the CDD rule is a requirement for financial institutions to establish and maintain procedures to identify and verify beneficial owners of a legal entity opening a new account  If Congress decides that reporting requirements facing banks are not appropriately calibrated, it could pass legislation amending those requirements  For example, Congress could change the CTR or SAR reporting threshold or index the threshold levels to inflation  Certain bills introduced in the 115 th Congress would have increased financial transparency and reporting requirements for beneficial owners in other nonbank fields, such as real estate, but could potentially indirectly impact the banking industry as well  Cybersecurity is a major concern of banks, other financial services providers, and federal regulators  In many ways, it is an important extension of physical security  For example, banks are concerned about both physical and electronic theft of money and other assets, and they do not want their businesses shut down by weather events or electronic denial-of-service attacks  Maintaining the confidentiality, security, and integrity of physical records and electronic data held by banks is critical to sustaining the level of trust that allows businesses and consumers to rely on the banking industry to supply services on which they depend  The federal government has increasingly recognized the importance of cybersecurity in the financial services industry, as evidenced by the inclusion of financial services in the government's list of critical infrastructure sectors  The basic authority that federal regulators use to establish cybersecurity standards emanates from the organic legislation that established the agencies and delineated the scope of their authority and functions  As previously discussed, federal banking regulators are required to promulgate safety and soundness standards for all federally insured depository institutions to protect the stability of the nation's banking system  Some of these standards pertain to cybersecurity issues, including information security, data breaches, and destruction or theft of business records  In addition, certain laws (at both the state and federal levels) have provisions related to cybersecurity of financial services that are often performed by banks, including the Dodd-Frank Act, the Gramm-Leach-Bliley Act of 1999 (GLBA; P L  106-102 ), and the Sarbanes-Oxley Act of 2002 ( P L  107-204 )  For example, Section 501 of GLBA imposes obligations on financial institutions to "respect the privacy of     [their] customers and to protect the security and confidentiality of those customers' nonpublic personal information " Federal banking regulators require the entities that they regulate to protect customer privacy of physical and electronic records as mandated by the privacy title of GLBA  Federal bank regulators also issue guidance in a variety of forms designed to help banks evaluate their risks and comply with cybersecurity regulations  Regulators bring adjudicatory enforcement actions on a case-by-case basis related to banks' violations of cybersecurity protocols  Banks often view these actions as signaling how an agency interprets aspects of its regulatory authority  For example, a number of recent consent orders issued by the FDIC have directed banks to perform assessments or audits of information technology programs and management to identify risks and ensure compliance with cybersecurity requirements  Thus, oversight of financial services and bank cybersecurity reflects a complex and sometimes overlapping array of state and federal laws, regulators, regulations, and guidance  However, whether this framework is effective and efficient, resulting in adequate protection against cyberattacks without imposing undue cost burdens on banks, is an open question  The occurrence of successful hacks of banks and other financial institutions, wherein huge amounts of individuals' personal information are stolen or compromised, highlights the importance of ensuring bank cybersecurity  For example, in 2014, JPMorgan Chase, the largest U S  bank, experienced a data breach that exposed financial records of 76 million households  However, no consensus exists on how best to reduce the occurrence of such incidents  Financial products can be complex and potentially difficult for consumers to fully understand  Consumers seeking loans or financial services could be vulnerable to deceptive or unfair practices  To reduce the occurrence of bad outcomes, laws and regulations have been put in place to protect consumers  This section provides background on consumer financial protection and the Bureau of Consumer Financial Protection's (CFPB) authority  The section also analyzes related issues, including whether the CFPB has used its authorities and regulations of banking institutions appropriately; concerns relating to the lack of consumer access to banking services; and whether the Community Reinvestment Act as currently implemented is effectively and efficiently meeting its goal of ensuring banks provide credit to the areas in which they operate  Banks are subject to consumer compliance regulation, intended to ensure that banks are in compliance with relevant consumer-protection and fair-lending laws  Federal laws and regulations in this area take a variety of approaches and address different areas of concern  Certain laws provide disclosure requirements intended to ensure consumers adequately understand the costs and other features and terms of financial products  Other laws prohibit unfair, deceptive, or abusive acts and practices  Fair lending laws prohibit discrimination in credit transactions based upon certain borrower characteristics, including sex, race, religion, or age, among others  The financial crisis raised concerns among policymakers that regulators' mandates lacked sufficient focus on consumer protection  In response, the Dodd-Frank Act established the CFPB with the single mandate to implement and enforce federal consumer financial law, while ensuring consumers can access financial products and services  The CFPB also seeks to ensure the markets for consumer financial services and products are fair, transparent, and competitive  For banks with more than $10 billion in assets, the CFPB is the primary regulator for consumer compliance, whereas safety and soundness regulation continues to be performed by the prudential regulator  As a regulator of larger banks, the CFPB has rulemaking, supervisory, and enforcement authorities  A large bank, therefore, has different regulators for consumer protection and safety and soundness  For banks with $10 billion or less in assets, the rulemaking, supervisory, and enforcement authorities for consumer protection are divided between the CFPB and a prudential regulator  The CFPB may issue rules that apply to smaller banks, but the prudential regulators maintain primary supervisory and enforcement authority for consumer protection  The CFPB has limited supervisory and enforcement powers over small banks  Consumer protection and fair lending compliance continue to be important issues for banks for numerous reasons  Noncompliance can result in regulators taking enforcement actions that may involve substantial penalties  In addition, even in the absence of enforcement actions, an institution faces reputational risks if it comes to be perceived as dealing badly with customers  For example, the CFPB maintains a consumer complaints database that makes public consumer complaints against individual companies readily available, potentially affecting prospective customers' decisions on which companies to use for financial services  The recent public reaction to and enforcement actions pertaining to Wells Fargo's unauthorized opening of customer accounts show the importance of strong consumer protection compliance  Recently, banks and other nonbank financial institutions that provide financial products to consumers (e g , mortgages, credit cards, and deposit accounts) have been affected by the implementation of new CFPB regulations  For example, banks and other lenders have begun to comply with major new mortgage rules such as the Ability-to-Repay and Qualified Mortgage Standards Rule (ATR/QM) and Truth in Lending Act/Real Estate Settlement Act Integrated Disclosure Rule (TRID)  The ATR/QM encourages lenders to gather more information on prospective borrowers than they otherwise might have in order to reduce the likelihood that a borrower would receive an inappropriate loan  TRID requires lenders to provide borrowers with certain information about the mortgages for which they are applying  In addition to these and other new regulations, the CFPB also provides information on its supervisory activities related to banks, such as instances where its examiners found that certain financial institutions misrepresented service fees associated with deposit and checking accounts  Compliance with these new rules has increased banks' operational costs, which some argue potentially leads to higher costs for consumers in certain markets or a reduction in the availability of credit  Others stress that CFPB's regulatory, supervisory, and enforcement efforts reduce the likelihood of consumer harm in financial markets  Debates about how best to achieve the appropriate balance between consumer protection, credit access, and industry costs are unlikely to be resolved easily, and thus may continue to be an area of congressional interest  The banking sector provides valuable financial services for households that allow them to save, make payments, and access credit  Safe and affordable financial services allow households to avoid financial hardship, build assets, and achieve financial security  However, many U S  households (often those with low incomes, lack of credit histories, or credit histories marked with missed debt payments) do not use banking services  According to the FDIC's National Survey of Unbanked and Underbanked Households, in 2017, 6 5% of households in the United States were unbanked (i e , did not have an account at an insured institution) and 18 7% of households were underbanked (i e , obtained financial products and services outside of the banking system in the past year)  Lack of bank access leads some households to rely on alternative financial service providers and consumer credit products outside of the formal banking sector, such as payday or auto title loans  According to an FDIC estimate, 12 9% of households had unmet demand for mainstream small-dollar credit  Certain observers believe that financial outcomes for the unbanked and underbanked would be improved if banks—which may be more likely to be a stable source of relatively inexpensive financial services relative to certain alternatives—were more active in meeting this demand  For this reason, prudential regulators, like the OCC and the FDIC, are currently exploring ways to encourage banks to offer small-dollar credit products to consumers, and other policymakers and observers will likely continue to explore ways to make banking more accessible to a greater portion of the population  The Community Reinvestment Act of 1977 (CRA; P L  95-128 ) addresses how banking institutions meet the credit needs of the areas they serve, notably in low- and moderate-income (LMI) neighborhoods  The federal prudential banking regulators (the Fed, the OCC, and the FDIC) conduct examinations to evaluate how banks are fulfilling the objectives of the CRA  The regulators issue CRA credits, or points, where banks engage in qualifying activities—such as mortgage, consumer, and business lending; community investments; and low-cost services that would benefit LMI areas and entities—that occur within an assigned assessment area   These credits are then used to issue each bank a performance rating, from Outstanding to Substantial Noncompliance  The CRA requires regulators to take these ratings into account when banks request to merge with other banking institutions or otherwise expand their operations into new areas  Whether regulations as currently implemented are effectively and efficiently meeting the CRA's goals has been the subject of debate  The banking industry and other observers assert that CRA regulations can be altered in a way that would reduce regulatory burden while still meeting the law's goals  Recently, the OCC and Treasury have made proposals to address those concerns  However, consumer and community advocates argue that efforts to provide relief to banks may potentially be at the expense of communities that the CRA is intended to help  Treasury made a number of recommendations to the bank regulators for changes to CRA regulations in a memorandum it sent to those agencies in April 2018  Regarding the need for modernization, the memorandum recommends revisiting the approach for determining banks' assessment areas, given that geographically defined areas arguably may not fully reflect the community served by a bank because of technology developments  Treasury also recommends establishing clearer standards for CRA-eligible activities that provide flexibility and expand the types of loans, investments, and services that are eligible for CRA credit  Regarding aspects of CRA compliance that may be unnecessarily burdensome, Treasury recommends increasing the timeliness of the CRA performance examination process  Regarding improving the outcomes that the CRA was intended to encourage, such as increasing the availability of credit to LMI neighborhoods, Treasury recommendations include incorporating performance incentives that might result in more efficient lending activities  In September 2018, the OCC published an advance notice of proposed rulemaking (ANPR) seeking public comment on 31 questions pertaining to issues to consider and possible changes to CRA regulation  The OCC's ANPR does not propose specific changes, but its content and the questions posed suggest that the OCC is exploring the possibility of adopting a quantitative metric-based approach to CRA performance evaluation, changing how assessment areas are defined, expanding CRA-qualifying activities, and reducing the complexity, ambiguity, and burden of the regulations on the bank industry  The OCC received more than 1,300 comment letters in response to the ANPR that were alternatively supportive or critical of the various possible alterations to CRA regulation  Although some banks hold a very large amount of assets, are complex, and operate on a national or international scale, the vast majority of U S  banks are relatively small, have simple business models, and operate within a local area  This section provides background on these simpler banks—often called community bank s —and analyzes issues related to them, including regulatory relief for community banks and the long-term decline in the number of community banks  Although there is no official definition of a community bank, policymakers and the public generally recognize that the vast majority of U S

ground_truth: The federal government owns roughly 640 million acres, heavily concentrated in 12 western states. Four agencies—the National Park Service (NPS), Fish and Wildlife Service (FWS), and Bureau of Land Management (BLM) in the Department of the Interior, and the U.S. Forest Service (FS) in the Department of Agriculture—administer about 95% of those lands. The extent to which each of these four federal agencies have authority to acquire and dispose of land varies considerably. The BLM has relatively broad authority for both acquisitions and disposals under the Federal Land Policy and Management Act of 1976 (FLPMA). The agency also has other authorities for disposing of land, including two laws that allow the agency to retain the proceeds for subsequent land acquisition, among other purposes, and a law that allows transfers to governmental units and other entities for public purposes. By contrast, the NPS has no general authority to acquire land to create new park units or to dispose of park lands. The FS authority to acquire lands is mostly limited to lands within or contiguous to the boundaries of a national forest. The agency has various authorities to dispose of land, but they are relatively constrained and infrequently used. The FWS has various authorities to acquire lands but no general authority to dispose of its lands. The agency frequently uses acquisition authority under the Migratory Bird Conservation Act of 1929 because of the availability of funding through the Migratory Bird Conservation Fund. The nature of the acquisition and disposal authorities of the four federal agencies also varies. In general, the acquisition authorities are designed to allow the four agencies to bring into federal ownership lands that many contend could benefit from federal management. Disposal authorities generally are designed to allow agencies to convey land that is no longer needed for a federal purpose or that might be chiefly valuable for another purpose. Some of the authorities specify particular circumstances where they can be used, such as the conveyance of FS land for educational purposes and the disposal of BLM land for recreation and public purposes. Congress often faces questions on the adequacy of existing acquisition and disposal authorities; the nature, extent, and location of their use; and the extent of federal land ownership overall. The current acquisition and disposal authorities form the backdrop for consideration of measures to establish, modify, or eliminate authorities, or to provide for the acquisition or disposal of particular lands. In some cases, Congress enacts bills to provide authority to acquire or dispose of particular parcels where no standing authority exists and, in other cases, to direct or facilitate land transactions. Congress also addresses acquisition and disposal policy in the context of debates on the role and goals of the federal government in owning and managing land generally, and it has considered broader measures to dispose of lands or to promote acquisition. Other issues for Congress pertain to the sources and levels of funds for land acquisition. The Land and Water Conservation Fund (LWCF) is the primary source of funding for land acquisition. Congress has considered diverse measures related to the LWCF, such as legislation to make LWCF funding permanent and bills to direct LWCF monies to additional, nonacquisition purposes. Additionally, the FWS has the Migratory Bird Conservation Fund, an account with mandatory spending authority supported by revenue from three sources. The BLM also has mandatory spending authorities that allow the proceeds from land sales to be used for land acquisition, among other purposes.

prompt_front: You are given two reports by the government agency.



Question: Write a one-page summary of the report 2.



Report 2:  banks differ substantially from a relatively small number of very large and complex banking organizations in a number of ways  Community banks tend to hold a relatively small amount of assets (although asset size alone need not be a determining factor); be more concentrated in core bank businesses of making loans and taking deposits and less involved in other, more complex activities; and operate within a smaller geographic area, making them generally more likely to practice relationship lending wherein loan officers and other bank employees have a longer standing and perhaps more personal relationship with borrowers  Therefore, community banks may serve as particularly important credit sources for local communities and underserved groups of which large banks may have little familiarity  In addition, relative to large banks, community banks generally have fewer employees, less resources to dedicate to regulatory compliance, and individually pose less of a systemic risk to the broader financial system  Congress often faces policy issue questions related to community banks  Community bank advocates often assert the tailoring of regulations currently in place does not adequately balance the benefits and costs of the regulations when applied to community banks  Concerns have also been raised about the three-decade decline in the number and market presence of these institutions, and the predominant cause of that decline is a matter of debate  In recent decades, community banks, under almost any common definition, have seen their numbers decline and their collective share of banking industry assets fall in the United States  Overall, the number of FDIC-insured institutions fell from a peak of 18,083 in 1986 to 5,477 in 2018  The number of institutions with less than $1 billion in assets fell from 17,514 to 4,704 during that time period, and the share of industry assets held by those banks fell from 37% to 7%  Meanwhile, the number of banks with more than $10 billion in assets rose from 38 to 138, and the share of total banking industry assets held by those banks increased from 28% to 84%  The decrease in the number of community banks occurred mainly through three methods: mergers, failures, and lack of new banks  Most of the decline in the number of institutions in the past 30 years was due to mergers, which averaged more than 400 a year from 1990 to 2016  Failures were minimal from 1999 to 2007, but played a larger role in the decline during the late 1980s and following the 2007-2009 financial crisis and subsequent recession  As economic conditions have improved, failures have declined, but the number of n ew r eporters —new chartered institutions providing information to the FDIC for the first time—has been extraordinarily small in recent years  For example, in the 1990s, an average of 130 new banks reported data to the FDIC per year  Through September 30, five new banks reported data to the FDIC in 2018  Observers have cited several possible causes for this industry consolidation  Some observers argue the decline indicates that the regulatory burden on community banks is too onerous, driving smaller banks to merge to create or join larger institutions, an argument covered in more detail in the following section, " Regulatory Burden on Community Banks  " However, mergers—the largest factor in consolidation—could occur for a variety of reasons  For example, a bank that is struggling financially may look to merge with a stronger bank to stay in business  Alternatively, a community bank that has been outperforming its peers may be bought by a larger bank that wants to benefit from its success  In addition, other fundamental changes besides regulatory burden in the banking system could be driving consolidation, making it difficult to isolate the effects of regulation  Through much of the 20 th century, federal and state laws restricted banks' ability to open new branches and banking across state lines was restricted  Thus, many more banks were needed to serve every community  Branching and banking across state lines was not substantially deregulated at the federal level until 1997 through the Riegle-Neal Interstate Banking and Branching Efficiency Act of 1994 ( P L  103-328 )  When these restrictions were relaxed, it became easier for community banks to consolidate or for mid-size and large banks to spread operations to other markets  In addition, there may be economies of scale, not only in compliance, but in the business of banking in general  Furthermore, the economies of scale may be growing over time, which would also drive industry consolidation  For example, information technology has become more important in banking (e g , cybersecurity and mobile banking), and certain information technology systems may be subject to economies of scale  Finally, the slow growth coming out of the most recent recession, and macroeconomic conditions more generally (such as low interest rates), may make it less appealing for new firms to enter the banking market  Community banks receive special regulatory consideration to minimize their regulatory burden  For example, many regulations—including a number of regulations implemented pursuant to the Dodd-Frank Act—include exemptions for community banks or are otherwise tailored to reduce compliance costs for community banks  Title I and Title II of the EGRRCP Act contained numerous provisions that provided new exemptions to community banks or raised the thresholds for existing exemptions, such as the Community Bank Leverage Ratio and Volcker Rule exemptions discussed above in the " Prudential Regulation " section  In addition, bank regulators are required to consider the effect of rules on community banks during the rulemaking process pursuant to provisions in the Regulatory Flexibility Act ( P L  96-354 ) and the Riegle Community Development and Regulatory Improvement Act ( P L  103-325 )  Supervision is also structured to pose less of a burden on small banks than larger banks, such as by requiring less-frequent bank examinations for certain small banks and less intensive reporting requirements  However, Congress often faces questions related to whether tailoring in general or tailoring provided in specific regulations is sufficient to ensure that an appropriate trade-off has been struck between the benefits and costs of regulations facing community banks  Advocates for further regulatory relief argue that certain realized benefits are likely to be relatively small, whereas certain realized costs are likely to be relatively large  One area where the benefits of regulation may be relatively small for community banks relative to large banks is regulations aimed at improving systemic stability, because community banks individually pose less of a risk to the financial system as a whole than a large, complex, interconnected bank  Many recent banking regulations were implemented at least in part in response to the systemic nature of the 2007-2009 crisis  Some community bank proponents argue that because small banks did not cause the crisis and pose less systemic risk, they need not be subject to new regulations made in response to the crisis  Opponents of these arguments note that systemic risk is only one of the goals of regulation, along with prudential regulation and consumer protection, and that community banks are exempted from many of the regulations aimed at systemic risk  They note that hundreds of small banks failed during and after the crisis, suggesting the prudential regulation in place prior to the crisis was not stringent enough  Another potential rationale for easing regulations on community banks would be if there are economies of scale to regulatory compliance costs, meaning that regulatory compliance costs may increase as bank size does but decrease as a percentage of overall costs or revenues  Put another way, as regulatory complexity increases, compliance may become relatively more costly for small institutions  Empirical evidence on whether compliance costs are subject to economies of scale is mixed, thus consider this illustrative example to show the logic behind the argument  Imagine a bank with $100 million in assets and 25 employees and a bank with $10 billion in assets and 1,250 employees each determine they must hire an extra employee to ensure compliance with new regulations  The relative burden is larger on the small institution that expands its workforce by 4% than on the large bank that expands by less than 0 1%  From a cost-benefit perspective, if regulatory compliance costs are subject to economies of scale, then the balance of costs and benefits of a particular regulation will differ depending on the size of the bank  For the same regulatory proposal, economies of scale could potentially result in costs outweighing benefits for smaller banks  Due to a lack of empirical evidence of the exact benefits and costs of each individual regulation at each individual bank (and even lack of consensus over which banks should qualify as community banks), debates over the appropriate level of tailoring of regulations is a debate over calibration involving qualitative assessments  Where should the lines be drawn? Should exemption thresholds be set high so that regulations apply only to the very largest, most complex banks? Should thresholds be set relatively low, so that only very small banks are exempt? At what point does a bank cease to have the characteristics associated with community banks? Often at issue in this debate are the so-called regional banks —banks that are larger and operate across a greater geographic market than the community banks but are also smaller and less complex than the largest, most complex organizations with hundreds of billions or trillions of dollars in assets  Should regulators provide regional banks the same exemptions as those provided to community banks? Policymakers, in the 116 th Congress, continue to face these and other questions concerning community banks  Along with the thousands of relatively small banks operating in the United States, there are a handful of banks with hundreds of billions of dollars of assets  The 2007-2009 financial crisis highlighted the problem of "too big to fail" (TBTF) financial institutions—the concept that the failure of a large financial firm could trigger financial instability, which in several cases prompted extraordinary federal assistance to prevent the failure of certain of these institutions  In response to the crisis, policymakers took a number of steps through the Dodd-Frank Act and the Basel III Accords to eliminate the TBTF problem, including subjecting the largest banks to enhanced prudential regulations, a new resolution regime to unwind these banks in the event of failure, and higher capital requirements  This section provides background on these large banks and examines issues related to them, including reductions in the application of enhanced prudential regulations facing certain large banks made pursuant to P L  115-174 and changes to capital requirements proposed by regulators that would reduce the amount of capital certain large banks would have to hold  As regulators implement these statutory changes and their proposed rules move forward, Congress faces questions about whether relaxing these regulations appropriately eases overly stringent requirements or unnecessarily increases the likelihood that large banks take on excessive risks  Some bank holding companies (BHCs) have hundreds of billions or trillions of dollars in assets and are deeply interconnected with other financial institutions  A bank may be so large that its leadership and market participants may believe that the government would save it if it became distressed  This belief could arise from the determination that the institution is so important to the country's financial system—and that its failure would be so costly to the economy and society—that the government would feel compelled to avoid that outcome  An institution of this size and complexity is said to be TBTF  In addition to fairness issues, economic theory suggests that expectations that a firm will not be allowed to fail creates moral hazard —if the creditors and counterparties of a TBTF firm believe that the government will protect them from losses, they have less incentive to monitor the firm's riskiness because they are shielded from the negative consequences of those risks  As a result, TBTF institutions may have incentives to be excessively risky, gain unfair advantages in the market for funding, and expose taxpayers to losses  Several market forces likely drive banks and other financial institutions to grow in size and complexity, thereby potentially increasing efficiency and improving financial and economic outcomes  For example, marginal costs can be reduced through economies of scale; risk can be diversified by spreading exposures over multiple business lines and geographic markets; and a greater array of financial products could be offered to customers allowing a bank to potentially attract new customers or strengthen relationships with existing ones  These market forces and the relaxation of certain interstate banking and branching regulations described in the " Reduction in Community Banks " section may have driven some banks to become very large and complex in the years preceding the crisis  At the end of 1997, two insured depository institutions held more than $250 billion in assets, and together accounted for about 9 3% of total industry assets  By the end of 2007, six banks held more than $250 billion in assets, accounting for 40 9% of industry assets  The trend has generally continued, and as of the third quarter of 2018, nine banks held more than $250 billion in assets, accounting for 49 5% of industry assets  Many assert that the worsening of the financial crisis in fall 2008 was a demonstration of TBTF-related problems  Large institutions had taken on risks that resulted in large losses, causing the institutions to come under threat of failure  In some cases, the U S  government took actions to stabilize the financial system and individual institutions  Wachovia and Washington Mutual were large institutions that were acquired by other institutions to avoid their failure during the crisis  Bank of America and Citigroup received extraordinary assistance through the Troubled Asset Relief Program (TARP) to address financial difficulties  Other large (and small) banks participated in emergency government programs offered by the Treasury (TARP), the Federal Reserve, and the FDIC  In response, the Dodd-Frank Act attempted to end TBTF through (1) a new regulatory regime to reduce the likelihood that large banks would fail; (2) a new resolution regime to make it easier to safely wind down large bank holding companies that are at risk of failing; and (3) new restrictions on regulators' use of emergency authority to prevent "bail outs" of failing large banks  In addition, the Federal Reserve imposed additional capital requirements on the largest banks that largely aligned with proposed standards set out by the Basel III Accords, with some exceptions  To make it less likely that large banks would fail, certain large banks are now subject to an enhanced prudential regulatory regime administered by the Federal Reserve  Under this regime, large banks are subject to more stringent safety and soundness standards than other banks  They must comply with higher capital and liquidity requirements, undergo stress tests, produce living wills and capital plans, and comply with counterparty limits and risk management requirements  To make it easier to wind down complex BHCs with nonbank subsidiaries, the Dodd-Frank Act created the Orderly Liquidation Authority (OLA), a resolution regime administered by the FDIC that is similar to how the FDIC resolves bank subsidiaries  This replaced the bankruptcy process, focused on the rights of creditors, with an administrative process, focused on financial stability, for winding down such firms  To date, OLA has never been used  The Dodd-Frank Act initially applied enhanced prudential regulation requirements to all BHCs with more than $50 billion in assets, although more stringent standards were limited to banks with more than $250 billion in assets or $10 billion in foreign exposure, and the most stringent standards were limited to U S  globally systemically important banks (G-SIBs), the eight most complex U S  banks  Subsequent to the enactment of Dodd-Frank, critics of the $50 billion asset threshold argued that many banks above that size are not systemically important and that Congress should raise the threshold  In particular, critics distinguished between regional banks (which tend to be at the lower end of the asset range and, some claim, have a traditional banking business model comparable to community banks) and Wall Street banks ( a term applied to the largest, most complex organizations that tend to have significant nonbank financial activities)  Opponents of raising the threshold disputed this characterization, arguing that some regional banks are involved in sophisticated activities, such as being swap dealers, and have large off-balance-sheet exposures  In response to concerns that the enhanced prudential regulation threshold was set too low, P L  115-174 exempted banks with between $50 billion and $100 billion in assets from enhanced prudential regulation, leaving them to be regulated in general like any other bank  Under the proposed rule implementing the P L  115-174 changes, the Fed has increased the tiering of enhanced regulation for banks with more than $100 billion in assets  The proposed rule would create four categories of banks based on size and complexity, and impose increasingly stringent requirements on each category  From most to least stringent, Category I would currently include the eight G-SIBs, Category II would include one bank, Category III would include four banks, and Category IV would include 11 banks  Compared with current policy, banks in all categories would face reduced regulatory requirements under this rule, other proposed rules, and forthcoming rules required by Section 402 of P L  115-174 , if finalized  In addition, P L  115-174 created new size-based exemptions from various regulations, increasing the tendency to subject larger banks to more stringent requirements than smaller banks  These changes include exemptions from the Volcker Rule and risk-weighted capital requirements for banks with less than $10 billion in assets (meeting certain criteria)  Proponents of the changes assert they provide necessary and targeted regulatory relief  Opponents argue they needlessly pare back important Dodd-Frank protections to the benefit of large and profitable banks  As discussed in the " Capital Requirements " section, all banks must hold enough capital to meet certain capital ratio requirements  Broadly, those requirements take two forms—risk-weighted requirements and unweighted leverage requirements  In addition, a small subset of very large and very complex banks also face additional capital ratio requirements implemented by the U S  federal bank regulators  The Federal Reserve has made two proposals to simplify and relax certain aspects of these additional requirements, and these proposals are subject to debate  All banks must hold additional high-quality capital on top of the minimum required levels—called the capital conservation buffer (CCB)—to avoid limitations on their capital distributions, such as dividend payments  In addition, certain large banks are subject to the Federal Reserve's stress tests, the results of which can lead to restrictions on the bank's capital distributions  Stress tests are intended to ensure that banks hold enough capital to withstand a hypothetical market stress scenario, but arguably have the effect of acting as additional capital requirements with which banks must comply  Advanced approaches banks must maintain a fixed minimum supplementary leverage ratio (SLR), an unweighted capital requirement that is more stringent than the leverage ratio facing smaller banks because it incorporates off-balance sheet exposures  A Congressional Research Service (CRS) analysis of large holding companies' regulatory filings indicates that, currently, 19 large and complex U S  bank or thrift holding companies are classified as advanced approaches banks  G-SIBs must meet fixed enhanced SLR (eSLR) requirements, which sets the SLR higher for these banks  In addition, the G-SIBs are subject to an additional risk-weighted capital surcharge (on top of other risk-weighted capital requirements that all banks must meet) of between 1% and 4 5% based on the systemic importance of the institution  Whether these requirements are appropriately calibrated is a debated issue  Proponents of recalibrating some of these capital requirements argue that those requirements set at a fixed number—including the CCB and eSLR—are inefficient, because they do not reflect varying levels of risk posed by individual banks  Recalibration proponents also argue that compiling with these requirements in addition to stress test requirements is unnecessarily burdensome for banks  Opponents of proposals to relax current capital requirements facing large and profitable banks assert that doing so needlessly pares back important safeguards against bank failures and systemic instability  In response to concerns that fixed requirements do not adequately account for risk differences between institutions, the Fed has issued two proposals for public comment that would link individual large banks' requirements with other risk measures  One proposal would make bank CCB requirements a function of their stress tests results, and the other proposal would link large banks' eSLR requirements with individual G-SIB systemic importance scores  The Fed estimates that the new CCB requirement would generally reduce the amount of capital large banks would have to hold, but that some G-SIBs would see their required capital levels increase  The Fed estimates that the new eSLR requirement would generally reduce the amount of capital held by G-SIB parent companies by $400 million and the amount held by insured depository subsidiaries by $121 billion  To legally operate as a bank and perform the relevant activities, an institution generally must have a charter granted by either the OCC at the federal level or a state-level authority  In addition, to engage in certain activities, the institution must have federal deposit insurance granted by the FDIC  Currently, these requirements raise a number of policy questions, including whether companies established primarily as financial technology companies should be able to receive a national bank charter, as has been offered by the OCC; and whether the application process and determinations made by the FDIC as they relate to institutions seeking a specific type of state charter, called an industrial loan company (ILC) charter, is overly restrictive  An institution that makes loans and takes deposits—the core activities of traditional commercial banking—must have a government issued charter  Numerous types of charters exist, including national bank charters; state bank charters; federal savings association charters, and state savings association charters (saving associations are also referred to as thrifts )  Each charter type determines what activities are permissible for the institution, what activities are restricted, and which agency will be the institution's primary federal regulator (see Table 1 )  One of the main rationales for this system is that it gives institutions with different business models and ownership arrangements the ability to choose a regulatory regime appropriately suited to the institution's business needs and risks  The differences between institution business models and the attendant regulations are numerous, varied, and beyond the scope of this report  The issues examined in this section arise from each charter's granting an institution the right to engage in certain banking related activities, and thus generating the potential benefits and risks of those activities  Broadly, these issues relate to questions over whether companies that differ from traditional banks should be allowed to engage in traditional banking activities given the types and magnitudes of benefits and risks the companies might present  Recent advances in technology, including the proliferation of available data and internet access, have altered the way financial activities are performed in many ways  These innovations in financial technology, or fintech, have created the opportunity for certain activities that have traditionally been the business of banks to instead be performed by technology-focused, nonbank companies  Lending and payment processing are prominent examples  This development has raised questions over how these fintech companies should be regulated, and the appropriate federal and state roles in that regulation  One possible, though contested, proposal for addressing a number of these questions would be to make an OCC national bank charter available to certain fintech companies  Many nonbank fintech companies performing bank-like activities are regulated largely at the state level  They may have to obtain lending licenses or register as money transmitters in every state they operate and may be subject to the consumer protection laws of that state, such as interest rate limits  Proponents of fintech companies argue that subjecting certain technology companies to 50 different state level regulatory regimes is unnecessarily burdensome and hinders companies that hope to achieve nationwide operations quickly using the internet  In addition, a degree of uncertainty surrounding the applicability of certain laws and regulations to certain fintech firms and activities has arisen  For example, whether federal preemption of state interest rate limits apply to loans made through a marketplace lender —that is, online-only lenders that exclusively use automated, algorithmic underwriting—but originated by a bank faces legal uncertainty due to certain court decisions, including Madden v Midlands   One possible avenue to ease the state-by-state regulatory burdens and resolve the uncertainties facing some fintech firms would be to allow those firms that perform bank-like activities to apply for and (provided they meet necessary requirements) to grant them national bank charters  First proposed in 2016 by then-Comptroller of the Currency Thomas Curry, and following subsequent examination of the issue and review of public comments, the OCC announced in July 2018 that it would consider "applications for special purpose bank charters from financial technology (fintech) companies that are engaged in the business of banking but do not take deposits " OCC argues that companies with such a charter would be explicitly subject to all laws and regulations (including those that preempt state law, a contentious issue addressed below) applicable to national banks  The OCC stated that fintech firms granted the charter "will be subject to the same high standards of safety and soundness and fairness that all federally chartered banks must meet," and also that the OCC "may need to account for differences in business models and activities, risks, and the inapplicability of certain laws resulting from the uninsured status of the bank " Thus, the argument goes, establishing a fintech charter would mean a new set of innovative companies would no longer face regulatory uncertainty and could safely and efficiently provide beneficial financial services, perhaps to populations and market-niches that banks with traditional cost structures do not find cost-effective to serve  Until the OCC actually grants such charters and fintech firms operate under the national bank regime for some amount of time, how well this policy fosters potential innovations and benefits while guarding against risks is the subject of debate  Proponents of the idea generally view the charter as a mechanism for freeing companies from what they assert is the unnecessarily onerous regulatory burden of being subject to numerous state regulatory regimes  They further argue that this would be achieved without overly relaxing regulations, as the companies would become subject to the OCC's national bank regulatory regime and its rulemaking, supervisory, and enforcement authorities  Opponents generally assert both that the OCC does not have the authority to charter these types of companies, as discussed below, and that doing so would inappropriately allow marketplace lenders to circumvent important state-level consumer protections  The OCC's assertion that it has the authority to grant such charters has been challenged  Shortly after the initial 2016 announcements that the OCC was examining the possibility of granting the charters, the Conference of State Bank Supervisors and the New York State Department of Financial Services sued the OCC to prevent it from issuing the charters on the grounds that it lacked the authority to do so  A federal district court dismissed the case after concluding that because the OCC had not yet issued charters to nonbanks, the plaintiffs (1) lacked standing to challenge the OCC's purported decision to move forward with chartering nonbanks, and (2) had alleged claims that were not ripe for adjudication  Subsequent to the OCC's July 2018 announcement, state regulators have again filed lawsuits  Industrial loan companies (ILCs) hold a particular type of charter offered by some states that generally allows ILCs to engage in certain banking activities  Depending on the state, those activities can include deposit-taking, but only if they are granted deposit insurance by the FDIC  Thus, ILCs that take deposits are state regulated with the FDIC acting as the primary federal regulator  Importantly, a parent company that owns an ILC that meets certain criteria is not necessarily considered a BHC for legal and regulatory purposes  This means ILC charters create an avenue for commercial firms (i e , companies not primarily focused on the financial industry, such as manufacturers, retailers, or possibly technology companies) to own a bank  Nonfinancial parent companies of ILCs generally are not subject to Fed supervision and other regulations pursuant to the Bank Holding Company Act of 1956 (P L  84-511)  A commercial firm may want to own a bank for a number of economic reasons  For example, an ILC can provide financing to the parent company's customers and clients and thus increase sales for the parent  In recent decades, household-name manufacturers have owned ILCs, including but not limited to General Motors, Toyota, Harley Davidson, and General Electric  However, while they can generate profits and potentially increase credit availability, ILCs pose a number of potential risks  The United States has historically adopted policies to generally separate commerce and banking, because allowing a single company to be involved in both activities could potentially result in a number of bad outcomes  A mixed organization's banking subsidiary could make decisions based on the interests of the larger organization, such as making overly risky loans to customers of a commerce subsidiary or providing funding to save a failing commerce subsidiary  Such conflicts of interest could threaten the safety and soundness of the bank  Relatedly, some have argued that having a federally insured bank within a commercial organization is an inappropriate expansion of federal banking safety nets (such as deposit insurance)  Certain observers, including community banks, have concerns over whether purely commercial or purely banking organizations would be able to compete with combined organizations that could potentially use economies of scale and funding advantages to exercise market power  These arguments played a prominent role in the public debate that was sparked when Walmart and Home Depot made unsuccessful efforts to secure an ILC charter between 2005 and 2008  Amid this debate, the FDIC imposed a moratorium in 2006 on the acceptance, approval, or denial of ILC applications for deposit insurance while the agency reexamined its policies related to these companies  That moratorium ended in January 2008  Subsequently, concerns over ILCs led Congress to mandate another moratorium (this one lasting three years, ending in July 2013) on granting new ILCs deposit insurance in the Dodd-Frank Act  No consensus has been reached on the magnitude of these risks and validity of the concerns surrounding deposit-taking ILCs  Recently, two financial technology companies, Square and SoFi, have applied for ILC charters and renewed debates over ILCs  Even though the moratoriums on granting ILCs deposit insurance have expired, the FDIC has not approved any new ILC applications since the 2013 expiration  However, since becoming FDIC chairman in June 2018, Jelena McWilliams has made statements indicating that under her leadership the FDIC will again consider ILC applications  Given the interest in and debate surrounding this charter type, policymakers will likely examine questions over the extent to which ILCs create innovative sources of credit and financial services subject to appropriate safeguards or inadvisably allow commercial organizations to act as banks with federal safety nets while exempting them from certain bank regulation and supervision  In addition to regulation issues, market and economic conditions and trends continually affect the banking industry  This section analyzes such trends that may affect banks, including migration of financial activity from banks into nonbanks or the "shadow banking" system; increasing capabilities and market presence of financial technology or fintech; and a higher interest rate environment following a long period of extraordinarily low rates  Credit intermediation is a core banking activity and involves transforming short-term, liquid, safe liabilities into relatively long-term, illiquid, higher-risk assets  In the context of traditional banking, credit intermediation is performed by taking deposits from savers and using them to fund loans to borrowers  Nonbank institutions can also perform similar credit intermediation to banks—sometimes called shadow banking —using certain instruments such as money market mutual funds, short-term debt instruments, and securitized pools of loans  When illiquid assets are funded by liquid liabilities, an otherwise-solvent bank or nonbank might experience difficulty meeting short-term obligations without having to sell assets, possibly at "fire sale" prices  If depositors or other funding providers feel their money is not safe with an institution, many of them may withdraw their funds at the same time  Such a "run" could cause an institution to fail  Long-established government programs mitigate liquidity- and run-risk in the banking industry  The Federal Reserve is authorized to act as a "lender of last resort" for a bank experiencing liquidity problems, and the FDIC insures depositors against losses  Banks are also subject to prudential regulation—as discussed in the " Prudential Regulation " section  However, nonbank intermediation is performed without the government safety nets available to banks or the prudential regulation required of them  The lack of an explicit government safety net in shadow banking means that taxpayers are less explicitly or directly exposed to risk, but it also means that shadow banking may be more vulnerable to a panic that could trigger a financial crisis  Some argue that the increased regulatory burden placed on banks in response to the financial crisis—such as the changes in bank regulation mandated by Dodd-Frank or agreed to in Basel III—could result in a decreased role for banks in credit intermediation and an increased role for relatively lightly regulated nonbanks  Many contend the financial crisis demonstrated how risks to deposit-like financial instruments in the shadow banking sector—such as money market mutual funds and repurchase agreements—can create or exacerbate systemic distress  Money market mutual funds are deposit-like instruments that are managed with the goal of never losing principal and that investors can convert to cash on demand  Institutions can also access deposit-like funding by borrowing through short-term funding markets—such as by issuing commercial paper and entering repurchase agreements  These instruments can be continually rolled over as long as funding providers have confidence in the borrowers' solvency  During the crisis, all these instruments—which investors had previously viewed as safe and unlikely to suffer losses—experienced run-like events as funding providers withdrew from markets  Moreover, nonbanks can take on exposure to long-term loans through investing in mortgage-backed securities (MBS) or other asset-backed securities (ABS)  During the crisis, as firms faced liquidity problems, the value of these assets decreased quickly, possibly in part as a result of fire sales  Since the crisis, many regulatory changes have been made related to certain money market, commercial paper, and repurchase agreement markets and practices  For example, in the United States, certain money market mutual funds now must have a floating net asset value   Among other benefits, this may signal to fund investors that a loss of principal is possible and thus reduce the likelihood that investors would "run" at the first sign of possible small losses  However, some observers are still concerned that shadow banking poses risks, because the funding of relatively long-term assets with relatively short-term liabilities will inherently introduce run-risk absent certain safeguards  As discussed above, f intech usually refers to technologies with the potential to alter the way certain financial services are performed  Banks are affected by technological developments in two ways: (1) they face choices over how much to invest in emerging technologies and to what extent they want to alter their business models in adopting technologies, and (2) they potentially face new competition from new technology-focused companies  Such technologies include online marketplace lending, crowdfunding, blockchain and distributed ledgers, and robo-advising, among many others  Certain financial innovations may create opportunities to improve social and economic outcomes, but there is also potential to create risks or unexpected financial losses  Potential benefits from fintech are greater efficiency in financial markets that creates lower prices and increased customer and small business access to financial services  These can be achieved if innovative technology replaces traditional processes that are outdated or inefficient  For example, automation may be able to replace employees, and digital technology can replace physical systems and infrastructure  Cost savings from removing inefficiencies may lead to reduced prices, making certain services affordable to new customers  Some customers who previously did not have access to services—due to such things as the lack of information about creditworthiness or geographic remoteness—could also potentially gain access  Increased accessibility may be especially beneficial to traditionally underserved groups, such as low-income, minority, and rural populations  Fintech could also create or increase risks  Many fintech products have only a brief history of operation, so it can be difficult to predict outcomes and assess risk  It is possible certain technologies may not in the end function as efficiently and accurately as intended  Also, the stated aim of a new technology is often to bring a product directly to consumers and eliminate a "middle-man " However, that middle-man could be an experienced financial institution or professional that can advise consumers on financial products and their risks  In these ways, fintech could increase the likelihood that consumers engage in a financial activity and take on risks that they do not fully understand  Policymakers debate whether (and which) innovations can be integrated into the financial system without additional regulatory or policy action  Technology in finance largely involves reducing the costs or time involved in providing existing products and services, and the existing regulatory structure was developed to address risks from these financial products and activities  Existing regulation may be able to accommodate new technologies while adequately protecting against risks  However, there are two other possibilities  One is that some regulations may be stifling beneficial innovation  Another is that existing regulation does not adequately address risks created by new technologies  Some observers argue that regulation could potentially impede the development and introduction of beneficial innovation  For example, companies incur costs to comply with regulations  In addition, companies are sometimes unsure how regulators will treat the innovation once it is brought to market  A potential solution being used in other countries is to establish a regulatory "sandbox" or "greenhouse" wherein companies that meet certain requirements work with regulators as products are brought to market under a less onerous regulatory framework  In the United States, the CFPB has recently introduced a sandbox wherein companies can experiment with disclosure forms  Some are concerned that existing regulations may not adequately address certain risks posed by new technologies  Regulatory arbitrage—conducting business in a way that circumvents unfavorable regulations—may be a concern in this area  Fintech potentially could provide an opportunity for companies to claim they are not subject to certain regulations because of a superficial difference between how they operate compared with traditional banks  Another group of issues posed by fintech relates to cybersecurity (for general issues related to cybersecurity, see the " Cybersecurity " section above)  As financial activity increasingly uses digital technology, sensitive data are generated  Data can be used to accurately assess risks and ensure customers receive the best products and services  However, data can be stolen and used inappropriately, and there are concerns over privacy issues  This raises questions over ownership and control of the data—including the rights of consumers and the responsibilities of companies in accessing and using data—and whether companies that use and collect data face appropriate cybersecurity requirements  The Federal Reserve's monetary policy response to the financial crisis, the ensuing recession, and subsequent slow economic growth was to keep interest rates unusually low for an extraordinarily long time  It accomplished this in part using unprecedented monetary policy tools such as quantitative easing —large-scale asset purchases that significantly increased the size of the Federal Reserve's balance sheet  Recently, as economic conditions improved, the Federal Reserve took steps to normalize monetary policy such as raising its target interest rate and reducing the size of its balance sheet  A rising interest rate environment—especially following an extended period of unusually low rates achieved with unprecedented monetary policy tools—is an issue for banks because they are exposed to interest rate risk   A portion of bank assets have fixed interest rates with long terms until maturity, such as mortgages, and the rates of return on these assets do not increase as current market rates do  However, many bank liabilities are short term, such as deposits, and can be repriced quickly  So although certain interest revenue being collected by banks is slow to rise, the interest costs paid out by banks can rise quickly  In addition to putting stress on net income, rising interest rates can cause the market value of fixed-rate assets to fall  Finally, banks incur an opportunity cost when resources are tied up in long-term assets with low interest rates rather than being used to make new loans at higher interest rates  The magnitude of interest rate risks should not be overstated, as rising rates can potentially increase bank profitability if they result in a greater difference between long-term rates banks receive and short-term rates they pay—referred to as net interest margin   However, thus far into the Federal Reserve interest rate normalization process, this has not materialized  During 2018, the difference between long-term rates and short-term rates has generally decreased (known as a flattening of the yield curve )  Whatever changes may occur to various interest rates in the coming months and years, banks and regulators typically recognize the importance of managing interest rate risk, carefully examine the composition of bank balance sheets, and plan for different interest rate change scenarios  While banks are well-practiced at interest rate risk management through normal economic and monetary policy cycles, managing bank risk through a period of interest rate growth could be more challenging because rates have been so low for so long and achieved through unprecedented monetary policy tools  Because rates have been low for so long, many loans made in different interest rate environments that preceded the crisis have matured  Meanwhile, all new loans made in the past 10 years were made in a low interest rate environment  This presents challenges to banks seeking to hold a mix of loans with different rates  In addition, because the Federal Reserve has used new monetary policy tools and grown its balance sheet to unprecedented levels, accurately controlling the pace of interest rate growth may be challenging  
Report 2:  Lastly, the CFPA applies only to "covered persons" or "service providers " The statute defines "covered persons" as persons who offer or provide a consumer financial product or service, and it defines "service providers" as those who provide a "material service" to a "covered person" in connection with offering or providing a consumer financial product or service  As some commentators have noted, the CFPB could follow in the FTC's footsteps and use its UDAAP authority to regulate data protection  However, the CFPB has generally been inactive in the data privacy and security space  Indeed, to date, it has brought only one such enforcement action, which involved allegations that an online payment platform, Dwolla, Inc , made deceptive statements regarding its data security practices and the safety of its online payments system  To the extent it does use its authority, the CFPB has some powerful procedural advantages in comparison with the FTC  In particular, the CFPB can enact rules identifying and prohibiting particular UDAAP violations through the standard APA rulemaking process, whereas the FTC must follow the more burdensome Magnuson-Moss rulemaking procedures  Regarding enforcement, the CFPA authorizes the CFPB to bring civil or administrative enforcement actions against entities engaging in UDAAPs  Unlike the FTC, the CFPB can seek civil penalties in all such enforcement actions, as well as equitable relief such as disgorgement or injunctions  However, as with the FTC Act, the CFPA does not provide a private right of action that would allow adversely affected individuals to sue companies violating the Act  The statute also does not impose any criminal penalties for UDAAP violations  Adding to the complex federal patchwork of data protection statutes are the laws of the fifty states  First and foremost, major regulators of privacy and data protection in the states include the courts, via tort and contract law  With respect to tort law, in addition to the "privacy" causes of action that developed at the state level during the early 20th century (discussed above), negligence and other state tort law claims serve as a means to regulate businesses that are injured from data security issues or otherwise fail to protect their customers from foreseeable harm  Contracts, implied contracts, and other commercial causes of action can also form important bulwarks for privacy  The common law, however, is not perfect: it is subject to variability from state to state, and within states, from judge to judge and jury to jury  In addition to the common law, most states have their own statutory framework which may affect data protection and the use of data by private entities  For example, many states have a consumer protection law, sometimes prohibiting unfair or deceptive practices, often referred to as "little FTC Acts " These laws, like the FTC Act, are increasingly being used to address privacy matters  In addition, each state has passed a data breach response law, requiring some form of response or imposing liability on companies in the event of a breach of their data security  While an examination of every state data security law is beyond the scope of this report, at least one state has undertaken a general and ambitious effort to regulate data security  Specifically, the California Consumer Privacy Act (CCPA), enacted in 2018, has captured significant attention  Unlike the federal patchwork provisions, neither the method of data collection nor the industry that the business operates in limits the potential application of the CCPA  Instead, the CCPA applies to any company that collects the personal information of Californians, is for-profit, does business in California, and satisfies a basic set of thresholds  Analysts have suggested that these thresholds are low enough that the law could reach a considerable number of even "relatively small" businesses with websites accessible in California  The CCPA also does not distinguish between the sources of the data that comes within its scope  Rather, the CCPA regulates all "personal information," which, by the CCPA's definition, covers nearly any information a business would collect from a consumer  The law does not require the presence of any individual identifier, such as a name or address, for data to fall within the meaning of personal information  Rather, the CCPA broadly defines personal information as "information that identifies, relates to, describes, or is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household " Following this definition, the CCPA provides some telling illustrations of what constitutes personal information, including any "electronic network activity [such as] browsing history, search history, and information regarding a consumer's interaction with an Internet Web site, application, or advertisement" and "inferences drawn from any of" this information  The CCPA provides consumers with three main "rights " The first of these is a " right to know " the information that businesses have collected or sold about them  This right requires that businesses must, in advance of any collection, "inform [by mail or electronically] consumers as to the categories of personal information to be collected and the purposes" to which the information will be put  Second, the CCPA provides consumers with the " right to opt out " of the sale of a consumer's information  Under the new law, businesses must inform consumers of this right, and if a consumer so affirmatively opts out, the business cannot again sell the consumer's information unless the consumer subsequently provides the business express authorization  Finally, the CCPA gives consumers the right, in certain circumstances, to request that a business delete any information collected about the consumer (i e , " right to delete ")  Under the law, a business that receives such a request must delete the information collected and direct its "service providers" to do the same  The primary means to enforce the CCPA are actions brought by the California Attorney General  According to the statute, businesses that fail to provide the protections required by the CCPA and fail to cure those violations within 30 days are liable for civil penalties of up to $7,500 per violation  Penalties or settlements collected under the CCPA are to be deposited with the newly created Consumer Privacy Fund, the funds for which are used only to offset costs incurred in connection with the administration of the CCPA  While the CCPA provides for a private cause of action, allowing for individual and class action lawsuits against businesses, this cause of action is only available in the case of a consumer whose "nonencrypted or nonredacted personal information" is subject to "unauthorized access and exfiltration, theft, or disclosure" as a result of a failure to "implement and maintain reasonable security procedures " Further, such actions can be brought only if a consumer provides a business with 30 days' written notice and provides the business with opportunity to cure the violation, unless the consumer suffered actual pecuniary damages  The statute does not specify how a business could "cure" a violation of this type  Consumers may obtain damages under this section of no less than $100 and no more than $750 "per incident," or actual damages, whichever is greater, as well as injunctive relief  Statements by some Members of Congress during Congressional hearings have already noted the CCPA's likely importance to future federal legislative efforts  Further, some outside commentators have argued explicitly that the CCPA should be preempted by a future federal law  These statements may be motivated by the likely fact that, if left intact, the California law could shape industry and consumer concerns both inside and outside California  First, the law is likely to be the "first in a long line of similar pieces of legislation," all of which may model themselves after the CCPA, or will have to respond to its impact  Second, even though the statute is the product of a single state, its broad jurisdictional reach would bring companies throughout the United States and from around the world into its sweep  These factors combined are likely to make the CCPA important to federal legislators  Furthermore, some of the provisions of the California law could form a model for future federal regulation—although along those lines, another potential model it has to compete with is Europe's GDPR  In addition to U S  states like California, some foreign nations have enacted comprehensive data protection legislation  The EU, in particular, has long applied a more wide-ranging data protection regulatory scheme  Whereas privacy principles in the U S  Constitution focus on government intrusions into private life and U S  data privacy statutes generally are sector-specific, European privacy regulations have generally concerned any entity's accumulation of large amounts of data  As a result, foundational EU treaties provide individuals with a general right to "protection of personal data" from all potential interferences  The objective of the EU's most recent data privacy legislation—the GDPR—is to safeguard this right to personal data protection, while ensuring that data moves freely within the EU  Beginning in the 1970s, individual European countries began enacting broad, omnibus national statutes concerning data protection, privacy, and information practices  Although these domestic laws shared certain features, their differing data privacy and protection standards occasionally impeded the free flow of information between European countries  As a consequence, the EU attempted to harmonize its various national privacy laws by adopting an EU-wide data privacy and protection initiative—the 1995 Directive on the Protection of Individuals with Regard to the Processing of Personal Data and on the Free Movement of Such Data (Data Protection Directive)  While the Data Protection Directive applied on an EU-wide basis, EU law authorized each member-nation to implement the directive's requirements into the country's national law  By 2012, the European Commission—the executive body of the EU —came to view differing implementations of the Data Protection Directive at the national level as problematic  The Commission concluded that a single regulation should be developed in order to eliminate the fragmentation and administrative burdens created by the directive-based system  The Commission also sought to bring EU law up to date with developments in technology and globalization that changed the way data is collected, accessed, and used  In pursuit of these goals, the EU developed and adopted the GDPR, which replaced the 1995 Data Protection Directive and went into effect on May 25, 2018  The GDPR regulates the processing of personal data that meet its territoriality requirements, discussed below  Processing includes collection, use, storage, organization, disclosure or any other operation or set of operations performed on personal data, unless an exception applies  Personal data is defined as any information relating to an identified or identifiable person, and it can include names, identification numbers, location data, IP addresses, cookies, and any other information through which an individual can be directly or indirectly identified  The GDPR applies different requirements for controllers and processors of personal data  In general, a controller determines the purposes and means of processing personal data, and a processor is responsible for processing data on behalf of a controller  From a territorial perspective, the GDPR applies to organizations that have an "establishment" in the EU and that process personal data in the context of the activities of that establishment  The GDPR does not define "establishment," but states that it "implies the effective and real exercise of activity through stable arrangements " In a pre-GDPR case, the Court of Justice of the European Union stated that the concept of establishment under the 1995 Data Protection Directive extended "to any real and effective activity—even a minimal one—exercised through stable arrangements " Entities that meet the establishment requirement are subject to the GDPR even if their data processing activities take place outside the EU  The GDPR also applies to non-EU-established entities that offer goods or services to individuals in the EU or monitor individuals' behavior in the EU  Because many businesses with an online presence offer goods and services to EU individuals, the GDPR applies to many businesses outside the EU  The GDPR lays out seven guiding principles for the processing of personal data  While these principles are not "hard and fast rules" themselves, they inform the interpretation of the GDPR and its more concrete requirements, discussed below  The GDPR requires data controllers and processors to have a lawful basis to process personal data  The regulation delineates six possible legal bases: (1) consent; (2) performance of contract; (3) compliance with a legal obligations; (4) protection of the "vital interests" (i e , the life) of the data subject or another individual; (5) tasks carried out in the public interest (e g , by a government entity); and (6) the "legitimate interests" of the controller or a third party, unless the fundamental rights and freedom of the data subject override those interests  Commentators describe the "legitimate interests" category as the most flexible and as the potential basis for a host of common activities, such as processing carried out in the normal course of business, provided that the processing is not unethical, unlawful, or otherwise illegitimate  When data processing is premised on consent, the consent must be freely given, specific, informed, and unambiguous, and it can be withdrawn at any time  Additional consent requirements and restrictions apply to especially sensitive data, such as children's information and data that reveals ethnic origins, political opinions, religious beliefs, union status, sexual orientation, health information, and criminal histories  The GDPR provides a series of rights to individuals and corresponding obligations for data controllers, unless an exception applies  The GDPR requires organizations to implement a range of measures designed to ensure and demonstrate that they are in compliance with the regulation  When proportionate in relation to the processing activities, such measures may include adopting and implementing data protection policies and taking a "data protection by design and default" approach whereby the organization implements compliance measures into all stages of data processing  Measures may also include the following: establishing GDPR-conforming contracts with data processors; maintaining records of processing activities; conducting impact assessments on personal data use that is likely to risk individual rights and freedoms; appointing a data protection officer; and adhering to relevant codes of conduct and compliance certification schemes  The GDPR also requires controllers and processors to implement technical and organizational measures to ensure a level of data security that is "appropriate to the risk" presented by the data processing  In implementing data security measures, organizations must consider the "state of the art, the costs of implementation," the nature, scope, and context, and purposes of processing, and the likelihood and potential severity of an infringement on individual rights if data security were to be violated  The GDPR does not impose a "one-size-fits-all" requirement for data security, and security measures that are "appropriate" (and therefore mandatory) will depend on the specific circumstances and risks  For example, a company with an extensive network system that holds a large amount of sensitive or confidential information presents greater risk, and therefore must install more rigorous data security protections than an entity that holds less data  When appropriate, organizations should consider encryption and pseudonymization —the processing of personal data such that the data can no longer be attributed to a specific individual  Security measures should ensure the confidentiality, integrity, and resilience of processing systems; be able to restore access to personal data in the event of an incident; and include a process for testing security effectiveness  In the event of a personal data breach, the GDPR requires controllers to notify the designated EU government authority "without undue delay" and no later than 72 hours after learning of the breach, unless the breach is "unlikely to result in a risk to the rights and freedoms of natural persons " For example, whereas a company must report the theft of a customer database that contains information that could be used for future identity fraud given the high level of risk to individuals, it may not need to report the loss of more innocuous data, such as a directory of staff office phone numbers  When notification to the government is required, the notification must describe the nature and likely consequences of the breach, identify measures to address the breach, and identify the employee responding to the incident  When data processors experience a breach, they must notify the controller without undue delay  In addition to governmental notification, controllers must notify the individuals whose data has been compromised if the breach is likely to result in a "high risk to the rights and freedoms" of individuals  The "high risk" threshold is higher than the threshold for notifying the government authority, but it could met in circumstances when individuals may need to take steps to protect themselves from the effects of a data breach  According to the United Kingdom's data protection regulatory authority, for example, a hospital that disclosed patient medical records as a result of a data breach may present a "high risk" to individuals, but a university that accidentally deleted, but was able to re-create, an alumni contact information database may not meet the mandatory individual reporting threshold  Notification to the individual must describe the breach in clear and plain language and contain at least the same information as provided in the governmental notifications  Notification to the individual is not required in the following cases: the controller implemented appropriate technical and organizational protection measures, such as encryption, that will render the data unintelligible; the controller took subsequent measures that will ensure that the high risk to individual rights and freedom are no longer likely to materialize; or individual notifications would involve disproportionate efforts, in which case the controller must provide public notice of the breach  Regardless of whether notification is required, controllers must document all data breaches so that government supervisory authorities can verify compliance at a later date  The EU has long regulated the transfer of data from EU member states to foreign countries, and the GDPR continues to restrict such international data transfers  Like the 1995 Data Protection Directive, the GDPR authorizes data transfer from within the EU to a non-EU country if the receiving country ensures an adequate level of protection for personal data  To meet this requirement, the non-EU country must offer a level of protection that is "essentially equivalent to that ensured" by the GDPR  If the European Commission previously made an adequacy decision under the Data Protection Directive's legal framework, that decision remains in force under the GDPR  U S  and EU officials previously developed a legal framework—the U S -EU Privacy Shield—for protecting transatlantic data flow into the United States  Under the Privacy Shield framework, U S -based organizations self-certify to the International Trade Administration in the Department of Commerce that they will comply with the framework's requirements for protecting personal data by complying with, among other provisions, notice requirements, data retention limits, security requirements, and data processing purpose principles  In 2016, the European Commission concluded that the Privacy Shield framework provided adequate protections under the Data Protection Directive  That adequacy determination continues to apply under the GDPR, although the European Commission annually reviews whether the Privacy Shield framework continues to provide an adequate level of protection  In the absence of an adequacy decision from the European Commission, the GDPR permits data transfers outside the EU when (1) the recipient of the data has itself established appropriate safeguards , and (2) effective legal remedies exist for individuals to enforce their data privacy and protection rights  Appropriate safeguards include: a legally binding agreement between public authorities or bodies; binding corporate rules; standard contract clauses adopted by the European Commission; and approved codes of conduct and certification mechanisms  U S  companies that do not participate in Privacy Shield often must rely on standard contract clauses to be able to receive data from the EU  The GDPR also identifies a list of circumstances in which data may be transferred outside the EU even without appropriate safeguards or an adequacy decision  These circumstances include, among other reasons, when: an individual has provided informed consent; transfer is necessary for the performance of certain contracts involving the data subject; or the transfer is necessary for important reasons of public interests  One of the most commented-upon aspects of the GDPR is its high ceiling for administrative fines  For the most serious infractions of the GDPR, regulatory bodies within individual EU countries may impose fines up to 20 million euro (approximately $22 million) or 4% of global revenue, whichever is higher, for certain violations of the GDPR  The GDPR also provides tools for individuals to enforce compliance with its terms  Individuals whose personal data is processed in a way that does not comport with the GDPR may lodge a complaint with regulatory authorities  Individuals also have the right to an "effective judicial remedy" (i e , to pursue a lawsuit) against the responsible data processor or controller, and individuals may obtain compensation for their damages from data processors or controllers  The GDPR may be relevant to the 116th Congress' consideration of data protection initiatives in several ways  Because the GDPR applies to U S  companies that offer goods and services to individuals in the EU, many U S  companies have developed new data protection practices in an effort to comply with its requirements  Other businesses reported that they withdrew from the European market rather than attempt to obtain compliance GDPR  For those companies that remained in the European market, some have stated that they will apply their GDPR-compliant practices on a company-wide basis rather than changing their model only when doing business in the EU  Consequently, the GDPR already directly impacts the data protection practices of some U S  companies  The GDPR also has served as a prototype for comprehensive data protection legislation in other governments  For example, commentators have described China's Personal Information Security Specification, which defines technical standards related to the collection, storage, use, transfer, and disclosure of personal information, as modeled on the GDPR  And the CCPA includes elements similar to the GDPR, such as an enumeration of individual rights related to data privacy  If this trend continues, GDPR-like data protection laws may become more commonplace internationally  Finally, some argue that Congress should consider enacting comprehensive federal data protection legislation similar to the GDPR  As discussed below, however, other observers and some officials in the Trump Administration have criticized the GDPR, describing the regulation as overly prescriptive and likely to result in negative unintended consequences  Regardless of the merits of these positions, the GDPR may remain a focal point of discussion in the debate over whether the United States should develop a more comprehensive data protection policy  Although some commentators argue that the federal government should supplement the current patchwork of federal data protection laws with more comprehensive legislation modeled on the CCPA or GDPR, some Trump Administration officials have criticized these legislative approaches and questioned whether they will improve data privacy outcomes  The Administration has argued that many comprehensive data privacy models have resulted in "long, legal, regulator-focused privacy policies and check boxes, which only help a very small number of users[ ]" Rather than pursuing a prescriptive model in which the government defines (or prescribes) data protection rules, the Trump Administration advocates for what it describes as an outcome-based approach whereby the government focuses on the "outcomes of organizational practices, rather than on dictating what those practices should be " In September 2018, the National Telecommunications and Information Administration (NTIA) in the Department of Commerce issued a request for public comments on the Trump Administration's efforts to develop an outcome-based approach to advancing consumer privacy that also protects prosperity and innovation  According to NTIA, changes in technology have led consumers to conclude that they are losing control over their personal information, while at the same time that foreign and state privacy laws have led to a fragmented regulatory landscape that disincentives innovation  Accordingly, NTIA is attempting to develop a set of "user-centric" privacy outcomes and goals that would underpin the protections that should be produced by any federal actions related to consumer privacy  NTIA's proposed policy focuses on a set of outcomes that the Trump Administration seeks to achieve: In addition to identifying desired outcomes, NTIA's request for public comments states that the Trump Administration is in the process of developing "high-level goals for Federal action" related to data privacy  NTIA's proposed privacy framework shares certain elements of prescriptive legal regimes like the GDPR and CCPA  Common features include a right to withdraw consent to certain uses of personal data; accountability for third-party vendors and servicers; and a right to access, amend, complete, correct, or delete personal data  But NTIA's request for public comments does not specifically describe how the Trump Administration intends to accomplish its outcomes and goals  Instead, it states that NTIA "understand[s] that there is considerable work to be done to achieve" the identified objectives  The comment period closed on November 9, 2018, and NTIA received input from more than 200 individuals and entities  The debate over whether Congress should consider federal legislation regulating data protection implicates numerous legal variables and options  "Data protection" itself is an expansive concept that melds the fields of data privacy (i e , how to control the collection, use, and dissemination of personal information) and data security (i e , how to protect personal information from unauthorized access or use and respond to such unauthorized access or use)  There is no single model for data protection legislation in existing federal, state, or foreign law  For example, some state laws focus solely on data security or address a particular security concern, such as data breach notifications  Other state laws isolate a single privacy-related issue, such as the transparency of data brokers—companies that aggregate and sell consumers' information, but that often do not have a direct commercial relationship with consumers  Recent data protection laws such as the CCPA and GDPR appear to indicate a trend toward combining data privacy and security into unified legislative initiatives  These unified data protection paradigms typically are structured on two related features: (1) an enumeration of statutory rights given to individuals related to their personal information and (2) the creation of legal duties imposed on the private entities that possess personal information  The specific list and nature of rights and duties differ depending on the legislation, and some have proposed to define new rights in federal legislation that do not have a clear analog in existing state or foreign law  Consequently, at present, there is no agreed-upon menu of data protection rights and obligations that could be included in federal legislation  Although data protection laws and proposals are constantly evolving, some frequently discussed legal rights include: the right to know what personal data is being collected, used, and disseminated, and how those activities are occurring; the right to control the use and dissemination of personal data, which may include the right to opt out or withhold consent to the collection or sharing of such data; the right to review personal data that has been collected and to delete or correct inaccurate information; the right to obtain a portable copy of personal data; the right to object to improper activities related to personal data; and the right to learn when a data breach occurs; Commonly discussed obligations for companies that collect, use, and disseminate personal data include rules defining: how data is collected from individuals; how companies use data internally; how data is disseminated or disclosed to third parties; what information companies must give individuals related to their data; how data is kept secure; when breaches of security must be reported; the accuracy of data; and reporting requirements to ensure accountability and compliance  Whether to enact federal data protection legislation that includes one or more of these rights and obligations has been the subject of a complex policy debate and multiple hearings in recent Congresses  Part of the legislative debate concerns how to enforce such rights and obligation and raises questions over the role of federal agencies, state attorneys general, and private citizen suits  In addition, some elements of the data protection proposals and models could implicate legal concerns and constitutional limitations  While the policy debate is outside the scope of this report, the following sections discuss legal considerations relevant to federal data protection proposals that the 116th Congress may choose to consider  These sections begin by analyzing legal issues related to the internal structure and definition of data protection-related rights and obligations and then move outward toward an examination of external legal constraints  A primary conceptual point of debate concerning data protection legislation is whether to utilize the so-called "prescriptive" method or an "outcome-based" approach to achieve a particular law's objectives  Under the prescriptive approach, the government defines data protection rules and requires regulated individuals and entities to comply with those rules  Both the GDPR and CCPA use a prescriptive approach, and some legislation proposed in the 116th Congress would use this method by delineating certain data protection requirements  The Trump Administration, however, has argued that a prescriptive approach can stymie innovation and result in compliance checklists without providing measurable privacy benefits  As an alternative methodology, the Administration advocated for what it described as an outcome-based approach whereby the government focuses on the outcomes of organizational practices, rather than defining the practices themselves  Some federal information technology laws, such as the Federal Information Security Management Act (FISMA), use an outcome-oriented approach to achieve federal objectives, although agency implementation of such laws may become prescriptive in nature  The Administration has not specified how it intends to achieve its desired data protection goals without prescribing data protection rules, but additional direction appears to be forthcoming, according to the NTIA's request for public comment  Another issue that may be considered in crafting federal data protection policy is how to define the contours of the data that the federal government proposes to protect or the specific entities or industries that it proposes to regulate  The patchwork of existing data protection statutes define protected information in a variety of ways, many of which depend on the context of the law  For example, HIPAA is limited to "protected health information" and GLBA governs "financial information" that is personally identifiable but not publicly available  By contrast, GDPR and CCPA regulate all "personal" information—a term defined in both laws as information that is associated with a particular individual or is capable of being associated with an individual  Some federal data proposals would apply a similar scope to those of the GDPR and CCPA  If enacted, such broad data protection laws have the potential to create multiple layers of federal data protection requirements: (1) general data protection requirements for "personal" information and (2) sector-specific requirements for data regulated by the existing "patchwork" of data protection laws  Other legislative proposals have sought to avoid dual layers of regulations by stating that the proposed data protection requirements would not apply to individuals or entities covered by certain existing federal privacy laws  Agency enforcement is another key issue to consider when crafting any future federal data protection legislation  As discussed, under the current patchwork of federal data protection laws, there are multiple federal agencies responsible for enforcing the myriad federal statutory protections, such as the FTC, CFPB, FCC, and HHS  Of these agencies, the FTC is often viewed—by industry representatives, privacy advocates, and FTC commissioners themselves —as the appropriate primary enforcer of any future national data protection legislation, given its significant privacy experience  There are, however, several relevant legal constraints on the FTC's enforcement authority  First, the FTC generally lacks the ability to issue fines for first-time offenses  In UDAP enforcement actions, the FTC may issue civil penalties only in certain limited circumstances, such as when a person violates a consent decree or a cease and desist order  Consequently, the FTC often enters into consent decrees addressing a broad range of conduct, such as a company's data security practices, seeking penalties for violations of those decrees  However, as the LabMD case discussed earlier in this report suggests, if the FTC imposes penalties based on imprecise legal standards provided in a rule or order, the Due Process Clause of the Fifth Amendment may constrain the agency's authority  Second, the plain text of the FTC Act deprives the FTC of jurisdiction over several categories of entities, including banks, common carriers, and nonprofits  Third, the FTC generally lacks authority to issue rules under the APA's notice-and-comment process that is typically used by agencies to issue regulations  Rather, the FTC must use a more burdensome—and, consequently, rarely used—process under the Magnuson-Moss Warranty Act  As some FTC Commissioners and commentators have noted, these legal limitations may be significant in determining the appropriate federal enforcement provisions in any national data security legislation  While Congress may not be able to legislate around constitutional constraints, future legislation could address some of these limitations—for instance, by allowing the FTC to seek penalties for first-time violations of rules, expanding its jurisdictions to include currently excluded entities, or providing the FTC notice-and-comment rulemaking authority under the APA  These current legal constraints on FTC authority may also be relevant in determining whether national legislation should allow private causes of action or enforcement authority for state attorneys general, as some commentators have suggested that private causes of action and enforcement by state attorneys general are essential supplements to FTC enforcement  Legislation involving privacy may propose to allow individuals to seek private remedy for violations in the courts  Congress may seek to establish a private right of action allowing a private plaintiff to bring an action against a third party based directly on that party's violation of a public statute  As it has done with many sector-specific privacy laws, Congress, in a data protection statute, could provide not only for this right, but also for specific remedies beyond compensatory damages, such as statutory damages or even treble damages for injured individuals  However, it may be very difficult to prove that someone has been harmed in a clear way by many of the violations that might occur under a hypothetical data protection and privacy regime  Victims of data breaches and other privacy violations, generally speaking, do not experience clear and immediate pecuniary or reputational harm  This obstacle might threaten not only a consumer's ability to obtain monetary relief, but also could run up against the limits of the federal courts' "judicial power" under Article III of the U S  Constitution  Article III extends the judicial power of the federal courts to only "cases" and "controversies " As part of that limitation, the Supreme Court has stated that courts may adjudicate a case only where a litigant possesses Article III standing  A party seeking relief from a federal court must establish standing  Specifically, the party must show that he has a genuine stake in the relief sought because he has personally suffered (or will suffer): (1) a concrete, particularized and actual or imminent injury; (2) that is traceable to the allegedly unlawful actions of the opposing party; and (3) that is redressable by a favorable judicial decision  These requirements, particularly the requirement of "imminence," form significant barriers for lawsuits based on data protection  Imminence, according to the Supreme Court in Clapper v  Amnesty International , requires that alleged injury be " certainly impending " to constitute injury-in-fact  Speculation and assumptions cannot be the basis of standing  This reasoning has caused courts to dismiss data breach claims where plaintiffs cannot show actual misuse of data, but can only speculate that future thieves may someday cause them direct harm  These requirements are constitutional in nature and apply regardless of whether a statute purports to give a party a right to sue  This constitutional requirement limits Congress' ability to use private rights of action as an enforcement mechanism for federal rights, as the recent Supreme Court case Spokeo, Inc  v  Robins illustrates  Spokeo involved a Federal Credit Reporting Act (FCRA) lawsuit brought by Thomas Robins against a website operator that allowed users to search for particular individuals and obtain personal information harvested from a variety of databases  Robins alleged that Spokeo's information about him was incorrect, in violation of the FCRA requirement that consumer reporting agencies "follow reasonable procedures to assure maximum possible accuracy" of consumer reports  As discussed earlier in this report, FCRA provides for a private right of action making any person who willfully fails to comply with its requirements liable to individuals for, among other remedies, statutory damages  The lower court understood that Robins did not specifically allege any actual damages he had suffered, such as the loss of money resulting from Spokeo's actions  Nonetheless, the court concluded that the plaintiff had standing to seek statutory damages because his injury was sufficiently particular to him—FCRA had created a statutory right for Robins and his personal interest was sufficient for standing  The Supreme Court disagreed with the lower court, however, explaining that the lower court had erred by eliding the difference between Article III's "concreteness" and "particularization" requirements  Specifically, the Court concluded that a plaintiff must demonstrate a concrete injury separate from a particularized injury, meaning that plaintiffs must show that their injury "actually exist[s] " While tangible injuries, like monetary loss, are typically concrete, a plaintiff with an "intangible injury" must show that it is "real" and not "abstract" in order to demonstrate concreteness  For example, the Spokeo Court suggested that the mere publication of an incorrect zip code, although it could violate FCRA, would not be a sufficiently concrete injury for standing purposes  As a result, the Court remanded the case to the lower court to determine if the injury alleged in the case was both particularized and concrete  Spokeo does not eliminate Congress' role in creating standing where it might not otherwise exist  The Supreme Court explained that the concreteness requirement is "grounded in historical practice" and, as a result, Congress' judgment on whether an intangible harm is sufficiently concrete can be "instructive " However, as Spokeo explained, Congress cannot elevate every privacy violation to the status of a concrete injury  Both before and after Spokeo , the lower courts have resolved standing disputes in lawsuits involving privacy and data protection, where parties argue about whether particular injuries are sufficiently concrete for purpose of Article III  Congress can possibly resolve some of these disputes by elevating some otherwise intangible injuries to concrete status  But Spokeo illustrates that there may be a residuum of harmless privacy violations for which Congress cannot provide a judicial remedy  Another legal issue Congress may need to consider with respect to any federal program involving data protection and privacy is how to structure the federal-state regime—that is, how to balance whatever federal program is enacted with the programs and policies in the states  Federal law, under the Supremacy Clause, has the power to preempt or displace state law  As discussed above, there are a host of different state privacy laws, and some states have begun to legislate aggressively in this area  The CCPA in particular represents a state law that is likely to have a national effect  Ultimately, unless Congress chooses to occupy the entire field of data protection law, it is likely that the state laws will end up continuing to have a role in this area  Further, given that the states are likely to continue to experiment with legislation, the CCPA being a prime example, it is likely that preemption will be a highly significant issue in the debate over future federal privacy legislation  As the Supreme Court has recently explained, preemption can take three forms: "conflict," "express," and "field " Conflict preemption requires any state laws that conflict with a valid federal law to be without effect  Conflict preemption can occur when it is impossible for a private party to simultaneously comply with both federal and state requirements, or when state law amounts to an obstacle to the accomplishment of the full purposes of Congress  Express preemption occurs when Congress expresses its intent in the text of the statute as to which state laws are displaced under the federal scheme  Finally, field preemption occurs when federal law occupies a 'field' of regulation "so comprehensively that it has left no room for supplementary state legislation " Ultimately, the preemptive scope of any federal data protection legislation will turn on the "purpose" of Congress and the specific language used to effectuate that purpose  If Congress seeks to adopt a relatively comprehensive system for data protection, perhaps the most obvious means to preempt a broad swath of state regulation would be to do so "expressly" within the text of the statute by including a specific preemption provision in the law  For example, several existing federal statutes expressly preempt all state law that "relate to" a particular subject matter  The Supreme Court has held that this "related to" language encompasses any state law with a "connection with, or reference to" the subject matter referenced  Similar language can be used to displace all state laws in the digital data privacy sphere to promote a more uniform scheme  Congress could alternatively take a more modest approach to state law  For example, Congress could enact a data protection framework that expressly preserves state laws in some ways and preempts them in others  A number of federal statutes preempt state laws that impose standards "different from" or "in addition to" federal standards, or allow the regulator in charge of the federal scheme some authority to approve certain state regulations  These approaches would generally leave intact state schemes parallel to or narrower than the federal scheme  For example, a statute could permit a state to provide for additional liability or different remedies for violation of a federal standard  Congress could do the same with federal data protection legislation, using statutory language to try to ensure the protection of the provisions of state law that it sought to preserve  Although legislation on data protection could take many forms, several approaches that would seek to regulate the collection, use, and dissemination of personal information online may have to confront possible limitations imposed by the First Amendment of the U S  Constitution  The First Amendment guarantees, among other rights, "freedom of speech " Scholars have split on how the First Amendment should be applied to proposed regulation in the data protection sphere  In one line of thinking, data constitutes speech, and regulation of this speech, even in the commercial context, should be viewed skeptically  Other scholars have argued that an expansive approach would limit the government's ability to regulate ordinary commercial activity, expanding the First Amendment beyond its proper role  This scholarly debate informs the discussion, but does not provide clear guidance on how to consider any particular proposed regulation  The Supreme Court has never interpreted the First Amendment as prohibiting all regulation of communication  Instead, when confronting a First Amendment challenge to a regulation, a court asks a series of questions in order to determine whether a particular law or rule runs afoul of the complicated thicket of case law that has developed in this area  The first question courts face when considering a First Amendment challenge is whether the challenged regulation involves speech or mere non-expressive conduct  As the Supreme Court has explained, simply because regulated activity involves "communication" does not mean that it comes within the ambit of the First Amendment  Where speech is merely a "component" of regulated activity, the government generally can regulate that activity without inviting First Amendment scrutiny  For example, "a law against treason…is violated by telling the enemy the Nation's defense secrets," but that does not bring the law within the ambit of First Amendment scrutiny  Assuming the regulation implicates speech rather than conduct, it typically must pass First Amendment scrutiny  However, not all regulations are subject to the same level of scrutiny  Rather, the Court has applied different tiers of scrutiny to different types of regulations  For example, the Court has long considered political and ideological speech at the "core" of the First Amendment—as a result, laws which implicate such speech generally are subject to strict scrutiny  Pursuant to this standard, the government must show that such laws are narrowly tailored to serve a compelling state interest  By contrast, the Court has historically applied less rigorous scrutiny to laws regulating "commercial speech " Commercial speech is subject to a lower level of scrutiny known as the Central Hudson test, which generally requires the government to show only that its interest is "substantial" and that the regulation "directly advances the governmental interest asserted" without being "more extensive than necessary to serve that interest " These principles have provided general guidance to lower courts in deciding cases that intersect with data protection, but implicit disagreements between these courts have repeatedly demonstrated the difficulty in striking the balance between First Amendment interests and data-protection regulation  For example, in 2001 in Trans Union Corp  v  FTC , the D C  Circuit upheld an FTC order that prohibited Trans Union from selling marketing lists containing the names and addresses of individuals  The court assumed that disclosing or using the marketing lists was speech, not conduct, but concluded that the FTC's restrictions on the sale of the marketing lists generally concerned "no public issue," and, as such, was subject to "reduced constitutional protection " The court derived its "no public issue" rule from the Supreme Court's case law on defamation, which generally views speech that is solely in the private interest of the speaker as being subject to lower First Amendment protection from defamation suits than speech regarding matters of a public concern  Applying this "reduced constitutional protection" to the context of Trans Union's marketing lists, the court determined that the regulations were appropriately tailored  While the Trans Union court did not cite to Central Hudson , other courts have gone on to apply similar reasoning to uphold data protection laws from constitutional challenge under the ambit of Central Hudson 's commercial speech test  In contrast with the relatively lenient approach applied to a privacy regulation in Trans Union , in U S  West v  FCC , the Tenth Circuit struck down FCC regulations on the use and disclosure of Consumer Proprietary Network Information (CPNI)  The regulations stated that telecommunications carriers could use or disclose CPNI only for the purpose of marketing products to customers if the customer opted in to this use  The court determined that these provisions regulated commercial speech because they limited the ability of carriers to engage in consumer marketing  Applying Central Hudson , the court held that although the government alleged a general interest in protecting consumer privacy, this interest was insufficient to justify the regulations  The panel ruled that the regulations did not materially advance a substantial state interest because the government failed to tie the regulations to specific and real harm, supported by evidence  The court also concluded that a narrower regulation, such as a consumer opt-out, could have served the same general purpose  After the Tenth Circuit's decision in U S  West , the FCC responded by making minor changes to its regulations, maintaining some elements of the opt-in procedure for the use of CPNI and reissuing them with a new record  After this reissuance, the D C  Circuit considered these modified-but-similar regulations in a 2009 case  In that case, the D C  Circuit upheld the regulations without attaching much significance to the FCC's changes, and apparently implicitly disagreeing with the Tenth Circuit about both the importance of the privacy interest at stake and whether the opt-in procedure was proportional to that interest  The Supreme Court's first major examination of the First Amendment in this context came in 2011  That year, the Court decided Sorrell v  IMS Health, Inc  , a case that is likely to be critical to understanding the limits of any future data protection legislation  In Sorrell , the Court considered the constitutionality of a Vermont law that restricted certain sales, disclosures, and uses of pharmacy records  Pharmaceutical manufacturers and data miners challenged this statute on the grounds that it prohibited them from using these records in marketing, thereby imposing what they viewed to be an unconstitutional restriction on their protected expression  Vermont first argued that its law should be upheld because the "sales, transfer, and use of prescriber-identifying information" was mere conduct and not speech  The Court explained that, as a general matter, "the creation and dissemination of information are speech within the meaning of the First Amendment," and thus there was "a strong argument that prescriber identifying information is speech for First Amendment purposes " Ultimately, however, the Court stopped short of fully embracing this conclusion, merely explaining that it did not matter whether the actual transfer of prescriber-identifying information was speech because the law nonetheless impermissibly sought to regulate the content of speech—the marketing that used that data, as well as the identities of speakers—by regulating an input to that speech  As the Court explained, the Vermont law was like "a law prohibiting trade magazines from purchasing or using ink " Second, Vermont argued that, even if it was regulating speech, its regulations passed the lower level of scrutiny applicable to commercial speech  The Court disagreed  The Court explained that the Vermont law enacted "content- and speaker-based restrictions on the sale, disclosure and use of prescriber identifying information" because it specifically targeted pharmaceutical manufacturers and prohibited certain types of pharmaceutical marketing  As the Court stated in a previous case, "[c]ontent-based regulations are presumptively invalid" because they "raise[] the specter that the Government may effectively drive certain ideas or viewpoints from the marketplace " Further, the Sorrell Court observed that the legislature's stated purpose was to diminish the effectiveness of marketing by certain drug manufacturers, in particular those that promoted brand-name drugs, suggesting to the Court that the Vermont law went "beyond mere content discrimination, to actual viewpoint discrimination " As a result, the Court concluded that some form of "heightened scrutiny" applied  Nevertheless, the Court reasoned that, even if Central Hudson 's less rigorous standard of scrutiny applied, the law failed to meet that standard because its justification in protecting physician privacy was not supported by the law's reach in allowing prescriber-identifying information's use "for any reason save" marketing purposes  Most of the lower courts outside the data protection and privacy context that have considered Sorrell have held that Sorrell 's reference to "heightened scrutiny" did not override the Central Hudson test in commercial speech cases, even where those cases include content- or speaker- based restrictions  Others, however, have held that content- and speaker-based restrictions must comport with something more rigorous than the traditional Central Hudson test, but it is not clear what this new standard requires or where it leads to a different outcome than Central Hudson   As a result, while Sorrell 's impact on privacy and data protection regulation has been considered by a few courts, no consensus exists on the impact it will have  However, a few commentators have observed that the case will likely have an important effect on the future of privacy regulation, if nothing else, by having all but concluded that First Amendment principles apply to the regulation of the collection, disclosure, and use of personally identifiable information as speech, not conduct  With respect to such future regulation, policymakers will likely want, at the minimum, to meet the Central Hudson requirement of ensuring that any restrictions on the creation, disclosure or use of information are justified by a substantial interest and that the regulations are no more extensive than necessary to further that interest  To illustrate, the Court in Sorrell identified HIPAA as a permissible "privacy" regulation because it allowed "the information's sale or disclosure in only a few narrow and well-justified circumstances " This dictum suggests that Congress is able to regulate in the data protection sphere as long as it avoids the pitfalls of the law in Sorrell   However, it may not always be easy to determine whether any given law involves speaker or content discrimination  In Sorrell itself, for instance, three dissenting Justices argued that the content and speaker discrimination that took place under the Vermont law was inevitable in any economic regulation  As a result, resolving these issues as data privacy legislation becomes more complex is likely to create new challenges for legislators  The current legal landscape governing data protection in the United States is complex and highly technical, but so too are the legal issues implicated by proposals to create unified federal data protection policy  Except in extreme incidents and cases of government access to personal data, the "right to privacy" that developed in the common law and constitutional doctrine provide few safeguards for the average internet user  Although Congress has enacted a number of laws designed to augment individual's data protection rights, the current patchwork of federal law generally is limited to specific industry participants, specific types of data, or data practices that are unfair or deceptive  This patchwork approach also extends to certain state laws  Seeking a more comprehensive data protection system, some governments—such as California and the EU—have enacted wide-ranging laws regulating many forms of personal data  Some argue that Congress should consider creating similar protections in federal law, but others have criticized the EU's and California's approach to data protection  Should the 116th Congress consider a comprehensive federal data protection program, its legislative proposals may involve numerous decision points and legal considerations  An initial decision point is the scope and nature of any legislative proposal  There are numerous data protection issues that could be addressed in any future legislation, and different possible approaches for addressing those issues (such as using a "prescriptive" or "outcome-based" approach)  Other decision points may include defining the scope of any protected information and determining the extent to which any future legislation should be enforced by a federal agency  Further, to the extent Congress wants to allow individuals to enforce data protection laws and seek remedies for the violations of such laws in court, it must account for Article III's standing requirements  Under the Supreme Court's 2016 Spokeo Inc  v  Robins decision, plaintiffs must experience more than a "bare procedural violation" of a federal privacy law to satisfy Article III and to sue to rectify a violation of that law  Federal preemption also raises complex legal questions—not only of whether to preempt state law, but what form of preemption Congress should employ  Finally, from a First Amendment perspective, Supreme Court jurisprudence suggests that while some "privacy" regulations are permissible, any federal law that restricts protected speech, particularly if it targets specific speakers or content, may be subject to more stringent review by a reviewing court 

ground_truth: Regulation of the banking industry has undergone substantial changes over the past decade. In response to the 2007-2009 financial crisis, many new bank regulations were implemented pursuant to the Dodd-Frank Wall Street Reform and Consumer Protection Act of 2010 (Dodd-Frank Act; P.L. 111-203) or under the existing authorities of bank regulators to address apparent weaknesses in the regulatory regime. While some observers view those changes as necessary and effective, others argued that certain regulations were unjustifiably burdensome. To address those concerns, the Economic Growth, Regulatory Relief, and Consumer Protection Act of 2018 (P.L. 115-174) relaxed certain regulations. Opponents of that legislation argue it unnecessarily pared back important safeguards, but proponents of deregulation argue additional pare backs are needed. Meanwhile, a variety of economic and technological trends continue to affect banks. As a result, the 116th Congress faces many issues related to banking, including the following: Safety and Soundness. Banks are subject to regulations designed to reduce the likelihood of bank failures. Examples include requirements to hold a certain amount of capital (which enables a bank to absorb losses without failing) and the so-called Volcker Rule (a ban on banks' proprietary trading). In addition, anti-money laundering requirements aim to reduce the likelihood banks will execute transactions involving criminal proceeds. Banks are also required to take steps to avoid becoming victims of cyberattacks. The extent to which these regulations (i) are effective, and (ii) appropriately balance benefits and costs is a matter of debate. Consumer Protection, Fair Lending, and Access to Banking. Certain laws are designed to protect consumers and ensure that lenders use fair lending practices. The Consumer Financial Protection Bureau has authorities to regulate for consumer protection. No consensus exists on whether current regulations strike an appropriate balance between protecting consumers while ensuring access to credit and justifiable compliance costs. In addition, whether Community Reinvestment Act regulations as currently implemented effectively and efficiently encourage banks to provide services in their areas of operation is an open question. Large Banks and "Too Big To Fail." Regulators also regulate for systemic risks, such as those associated with very large and complex financial institutions that may contribute to systemic instability. Dodd-Frank Act provisions include enhanced prudential regulation for certain large banks and changes to resolution processes in the event one fails. In addition, bank regulators imposed additional capital requirements on certain large, complex banks. Subsequently, some argued that certain of these additional regulations were too broadly applied and overly stringent. In response, Congress reduced the applicability of the Dodd-Frank measures and regulators have proposed changes to the capital rules. Whether relaxing these rules will provide needed relief to these banks or unnecessarily pare back important safeguards is a debated issue. Community Banks. The number of small or "community" banks has declined substantially in recent decades. No consensus exists on the degree to which regulatory burden, market forces, and the removal of regulatory barriers to interstate branching and banking are causing the decline. What Companies Should Be Eligible for Bank Charters. To operate legally as a bank, an institution must hold a charter granted by a state or federal government. Traditionally, these are held by companies generally focused on and led by people with experience in finance. However, recently companies with a focus on technology are interested in having legal status as a bank, either through a charter from the Office of the Comptroller of the Currency or a state-level industrial loan company charter. Policymakers disagree over whether allowing these companies to operate as banks would create appropriately regulated providers of financial services or inappropriately extend government-backed bank safety nets and disadvantage existing banks. Recent Market and Economic Trends. Changing economic forces also pose issues for the banking industry. Some observers argue that increases in regulation could drive certain financial activities into a relatively lightly regulated "shadow banking" sector. Innovative financial technology may alter the way certain financial services are delivered. If interest rates rise, it could create opportunities and risks. Such trends could have implications for how the financial system performs and influence debates over appropriate banking regulations.