You are given two reports by the government agency.  

Report 1:
Cross-border data flows underlie today's globally connected world and are essential to conducting international trade and commerce. Data flows enable companies to transmit information for online communication, track global supply chains, share research, and provide cross-border services. One study estimates that digital commerce relying on data flows drives 22% of global economic output, and that global GDP will increase by another $2 trillion by 2020 due to advances in emerging technologies. However, while cross-border data flows increase productivity and enable innovation, they also raise concerns around the security and privacy of the information being transmitted. Cross-border data flows are central to trade and trade negotiations as organizations rely on the transmission of information to use cloud services, and to send nonpersonal corporate data as well as personal data to partners, subsidiaries, and customers. U.S. policymakers are considering various policy options to address online privacy, some of which could affect cross-border data flows. For example, new consumer rights to control their personal data may impact how companies can use such data. To enable international data flows and trade, the United States has aimed to eliminate trade barriers and establish enforceable international rules and best practices that allow policymakers to achieve public policy objectives, including promoting online security and privacy. Building consensus for international rules and norms on data flows and privacy has become increasingly important as recent incidents have heightened the public's awareness of the risk of personal data stored online. For example, the 2018 Cambridge Analytica scandal drew attention because the firm reportedly acquired and used data on more than 87 million Facebook accounts in an effort to influence voters in the 2016 U.S. presidential election and the UK referendum on continued European Union (EU) membership ("Brexit"). In addition, security concerns have been raised about data breaches, such as those that exposed the personal data of half a million Google users or 500 million Marriot hotel customers. Organizations value consumers' personal online data for a variety of reasons. For example, companies may seek to facilitate business transactions, analyze marketing information, detect disease patterns from medical histories, discover fraudulent payments, improve proprietary algorithms, or develop competitive innovations. Some analysts compare data to oil or gold, but unlike those valuable substances, data can be reused, analyzed, shared, and combined with other information; it is not a scarce resource. However, personal data is considered personal private property. Individuals often want to control who accesses their data and how it is used. Experts suggest that data may therefore be considered both a benefit and a liability that organizations hold. Data has value, but an organization takes on risk by collecting personal data; they become responsible for protecting users' privacy and not misusing the information. Data privacy concerns may become more urgent as the amount of online information organizations access and collect, and the level of global data flows, continue to expand. Countries vary in their policies and laws on these issues. The United States has traditionally supported open data flows and has regulated privacy at a sectoral level to cover data, such as health records, rather than create a comprehensive policy. U.S. trade policy has sought to balance the goals of consumer privacy, security, and open commerce, including eliminating trade barriers and opening markets. Other countries are developing data privacy policies that affect international trade as some governments or groups seek to limit data flows outside of an organization or across national borders for a number of reasons. Blocking international data flows may impede the ability of a firm to do business or of an individual to conduct a transaction, creating a form of trade protectionism. Research demonstrates not only the economic gains from digital trade and international data flows, but also the real economic costs of restrictions on such flows. For many policymakers, the crux of the issue is: How can governments protect individual privacy in the least trade-restrictive way possible? The question is similar to concerns raised about ensuring cybersecurity while allowing the free flow of data. In recent years, Congress has examined multiple issues related to cross-border data flows and online privacy. In the 115 th Congress, congressional committees held hearings on these topics, introduced multiple bills, and conducted oversight over federal laws on related issues such as data breach notification. Members are introducing new bills and holding hearings in the 116 th Congress. Congress may consider the proposed U.S.-Mexico-Canada Agreement (USMCA) and examine the digital trade chapter as an example of how to address the issues through trade agreements. In most circumstances, a consumer expects both privacy and security when conducting an online transaction. However, users' expectations and values may vary and there is no globally accepted standard or definition of data privacy in the online world. In addressing online privacy, Congress may need to define personal data and differentiate between sensitive and nonsensitive personal data. In general, data privacy can be defined by an individual's ability to prevent access to personally identifiable information (PII). According to the U.S. Office of Management and Budget (OMB) guidance to federal agencies, PII refers to information that can be used to distinguish or trace an individual's identity, either alone or when combined with other information that is linked or linkable to a specific individual. Since electronic data can be readily shared and combined, some data not traditionally considered PII may have become more sensitive. For example, the OMB definition does not specifically mention data on location tracking, purchase history, o r preferences, but these digital data points can be tracked by a device such as a mobile phone or laptop that an individual carries or logs into. The EU definition of PII attempts to capture the breadth of data available in the online world: "personal data" means any information relating to an identified or identifiable natural person ('data subject'); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person. Policymakers may consider differentiating between sensitive and nonsensitive personal data. For example, sensitive personal data could include ethnic origin, political or religious affiliation, biometric data, health data, sexual orientation, precise geolocation data, etc. "Cross-border data flows" refers to the movement or transfer of information between computer servers across national borders. Cross-border data flows are part of, and integral to, digital trade and facilitate the movement of goods, services, people, and finance. A 2017 analysis estimated that global flows of goods, services, finance, and people increased world gross domestic product (GDP) by at least 10% in the past decade, adding $8 trillion between 2005 and 2015. Effective and sustainable digital trade relies on data flows that permit commerce and communication but that also ensure privacy and security, protect intellectual property, and build trust and confidence. Impeding cross-border data flows, including through some privacy regulations, may decrease efficiency and reduce other benefits of digital trade, resulting in the fracturing, or so-called balkanization, of the internet. In addressing online privacy, some policymakers focus on limiting access to online information by restricting the flow of data beyond a country's borders. Such limits may also act as protectionist measures. Online privacy policies may create barriers to digital trade, or damage trust in the underlying digital economy. For example, measures to limit cross-border data flows could block companies from using cloud computing to aggregate and analyze global data, or from gaining economies of scale, constrain e-commerce by limiting international online payments, hinder global supply chains seeking to use blockchain to track products or manage supply chains, customs documentation, or electronic payments, impede the trading of crypto-currency, or limit the use of advanced technology like artificial intelligence. According to the World Trade Organization (WTO), one of the most significant overall impacts of the growth of digital technologies is in transforming international trade. Technology can lower the costs of trade, change the types of goods and services that are traded, and may even change the factors defining a country's comparative advantage. The extent of the impact of digital technologies on trade, however, depends in large part on open cross-border data flows. One study of U.S. companies found that data localization rules (i.e., requiring organizations to store data on local servers) were the most-cited digital trade barrier. Some governments advocate privacy or security policies that require data localization and limit cross-border data flows. However, many industry stakeholders argue that blocking cross-border data flows and storing data domestically does not make such data more secure or private. Many experts argue that policymakers should limit cross-border data flows in the least trade-restrictive manner possible and also ensure security and privacy. These objectives are not easily reconciled. Moreover, although an overlap exists between data protection and privacy, the two are not equivalent. Cybersecurity measures are essential to protect data (e.g., against intrusions or theft by hackers). However, they may not be sufficient to protect privacy. For example, if an organization shares user data with a third party, it may be doing so securely, but not in a way that protects users' privacy or aligns with consumer expectations. Similarly, breach notification requirements are not the same as proactive privacy protection measures. At the same time, policies that protect a consumer's privacy can align with security policies. Laws can limit law enforcement's access to information except in certain circumstances. Keeping user information anonymous may enable firms to analyze data while protecting individuals' identities. Some see an inherent conflict between online security, privacy, and trade; others believe that policies protecting all three can be coherent and consistent. The U.S. government has traditionally sought to balance these objectives. Some stakeholders note, however, that current U.S. policy has been inadequate in protecting online privacy and that change is needed. In some cases in the past, Congress has acted to address privacy concerns in particular sectors; for example, the Health Insurance Portability and Accountability Act (HIPAA) of 1996 led to health privacy standards regulations. The Trump Administration has begun an effort to devise an overarching data privacy policy (see " Defining the U.S. Approach ") and many Members of Congress are also considering possible approaches. There are no comprehensive multilateral rules specifically about privacy or cross-border data flows. However, the United States and other countries have begun to address these issues in negotiating new and updated trade agreements, and through international economic forums and organizations such as the Asia-Pacific Economic Cooperation (APEC) forum and the Organisation for Economic Co-operation and Development (OECD). The World Trade Organization (WTO) General Agreement on Trade in Services (GATS) entered into force in January 1995, predating the current reach of the internet and the explosive growth of global data flows. Many digital products and services that did not exist when the agreements were negotiated are not covered. On the other hand, privacy is explicitly addressed within GATS as an exception to allow countries to take measures that do not conform with the agreement in order to protect "the privacy of individuals in relation to the processing and dissemination of personal data and the protection of confidentiality of individual records and accounts," as long as those measures are not arbitrary or a disguised trade restriction. Efforts to update the multilateral agreement and discussions for new digital trade rules under the WTO Electronic Commerce Work Program stalled in 2017. Given the lack of progress on multilateral rules, some have suggested that the WTO should identify best practices or guidelines for digital trade rules that could lay the foundation for a future multilateral WTO agreement. In December 2017, a group of more than 70 WTO members, including the United States, agreed to "initiate exploratory work together toward future WTO negotiations on trade-related aspects of electronic commerce." Overall U.S. objectives include allowing the free flow of information for international trade and cross-border data flows, "subject to reasonable safeguards like the protection of consumer data when it is exported," but do not specifically address privacy. The group formally launched the e-commerce initiative in January 2019. The official joint statement lists the United States and EU as participants, and also several developing countries such as China and Brazil. India stated it will not join, preferring to maintain its flexibility to favor domestic firms, limit foreign market access, and raise revenue in the future. The statement did not define the scope of any potential agreement. After the meeting, the EU noted data localization measures among the potential new rules to be discussed when negotiations officially launch in March 2019. The U.S. Trade Representative's (USTR's) statement emphasized the need for a high-standard agreement that includes enforceable obligations. Although some experts note that harmonization or mutual recognition is unlikely given divergent legal systems, privacy regimes, and norms of the parties, a common system of rules to allow for cross-border data flows while ensuring privacy protection is reportedly under discussion. Personal privacy has received increasing focus with the growth of digital trade encouraging global cooperation. The United States has contributed to developing international guidelines or principles related to privacy and cross-border data flows, although none are legally binding. The OECD 1980 Privacy Guidelines established the first international set of privacy principles emphasizing data protection as a condition for the free flow of personal data across borders. These OECD guidelines were intended to assist countries with drawing up national data privacy policies. The guidelines were updated in 2013, focusing on national level implementation based on a risk management approach and improving interoperability between national privacy strategies. The updated guidelines identify specific principles for countries to take into account in establishing national policies. The guidelines are to be reviewed and updated again in 2019. Building on the OECD principles and prior G-20 work, the 2018 G-20 Digital Economy Ministerial Declaration identified principles to "facilitate an inclusive and whole-of-government approach to the use of information and communication technology (ICT) and assist governments in reshaping their capacities and strategies, while respecting the applicable frameworks of different countries, including with regards to privacy and data protection." Japan is to host the 2019 G-20 and plans to focus on data governance, offering a forum to address potential global standards on privacy and cross-border data flows. APEC is a regional forum for economic cooperation whose initiatives on privacy and cross-border data flows have influenced members' domestic policies. APEC's 21 members, including the United States, agreed to the 2005 APEC Privacy Framework , based on the OECD guidelines. The framework identifies a set of principles and implementation guidelines to provide members with a flexible approach to regulate privacy at a national level. Once the OECD publishes updated guidelines in 2019, APEC members may revise the framework and principles to reflect the updated guidelines. The APEC Cross-Border Privacy Rules (CBPR), endorsed by APEC Leaders in 2011, is a privacy code of conduct, based on the framework. The CBPR system establishes a set of principles for governments and businesses to follow to protect personal data and allow for cross-border data flows between CBPR members. They aim to balance information privacy with business needs and commercial interests, and facilitate digital trade to spur economic growth in the region. Rather than creating a new set of international regulations, the APEC framework and CBPR system identify best practices that each APEC member can tailor to its domestic legal system and allow for interoperability between countries. The scope and implementation mechanisms under CBPR can vary according to each member country's laws and regulations, providing flexibility for governments to design national privacy approaches. To become a member of the CBPR, a government must 1. Be a member of APEC; 2. Establish a regulator with authority to sign the Cross-Border Privacy Enforcement Arrangement (CPEA); 3. Map national laws to the published APEC guidelines, which set baseline standards; and 4. Establish an accountability agent empowered to audit and review a company's practices, and enforce privacy rules and laws. If a government joins the CBPR system, every domestic organization is not required to also join; however, becoming a member of CBPR may benefit an organization engaged in international trade by indicating to customers and partners that the organization values and protects data privacy. With certified enrollment in CBPR, organizations can transfer personal information between participating economies (e.g., Mexico to Singapore) and be assured of compliance with the legal regimes in both places. To become a CBPR member, an individual organization must develop and implement data privacy policies consistent with the APEC Privacy Framework and complete a questionnaire. The third party accountability agent is responsible for assessing an organization's application, ongoing monitoring of compliance, investigating any complaints, and taking enforcement actions as necessary. Domestic enforcement authorities in each member country serve as a backstop for dispute resolution if an accountability agent cannot resolve a particular issue. All CBPR member governments must join the CPEA to ensure cooperation and collaboration between the designated national enforcement authorities. In the United States, the Federal Trade Commission (FTC) is the regulator and enforcement authority. TrustArc is the only accountability agent, but many expect the U.S. Department of Commerce to recognize additional agents soon. As of this writing, TrustArc lists about 20 U.S. firms that are APEC CBPR certified. The CBPR grows in significance as the number of participating economies and organizations increases. The U.S. ambassador to APEC aims to have "as many APEC economies as possible as soon as possible to join the system." Currently, the United States, Japan, Mexico, Canada, South Korea, Singapore, Taiwan, and Australia are CBPR members; the Philippines is in the process of joining. Russia, on the other hand, stated it has no plans to join. Although APEC initiatives are regionally focused, they can provide a basis to scale up to larger global efforts because they reflect economies at different stages of development and include industry participation. Due to its voluntary nature, APEC has served as a testbed for identifying best practices, standards, and principles and for creating frameworks that can lead to binding commitments in plurilateral or larger multilateral agreements (see " Data Flows and Privacy in U.S. Trade Agreements "). Expanding CBPR beyond APEC could represent the next step toward consistent international rules and disciplines on data flows and privacy. Countries vary in their privacy policies and laws, reflecting differing priorities, cultures, and legal structures. According to one index, China is the most restrictive digital trade country among 64 countries surveyed, followed by Russia, India, Indonesia, and Vietnam (see Figure 1 ). The United States ranks 22 in the index, less restrictive than Brazil or France but more restrictive than Canada or Australia. The relatively high U.S. score largely reflects financial sector restrictions. The "restrictions on data" category covers data policies such as privacy and security measures; this category is included in the composite index. Looking specifically at the 64 countries' data policies, Russia is the most restrictive country, followed by Turkey and China. Russia's policies include data localization, retention, and transfer requirements, among others. Turkey's comprehensive Data Protection Law also establishes requirements in these areas. In contrast, the United States ranks 50 for data policy restrictions. Two of the top U.S. trading partners (the EU and China) have established their data policies from different perspectives. The EU's policies are driven by privacy concerns; China's policies are based on security justifications. Both are setting examples that other countries, especially those with (or seeking) closer trading ties to China or the EU, are emulating; thus, these policies have affected U.S. firms seeking to do business in those other countries as well. The EU considers the privacy of communications and the protection of personal data to be fundamental human rights, which are codified in EU law. Differences between the United States and EU in their approaches to data protection and data privacy laws have long been sticking points in U.S.-EU economic and security relations. The EU and United States negotiated the U.S.-EU Privacy Shield to allow for the transatlantic transfer of personal data by certified organizations. The bilateral agreement established a voluntary program with commitments and obligations for companies, limitations on law enforcement access, and transparency requirements. U.S. companies that participate in the program must still comply with all of the obligations under EU law (see below) if they process personal data of EU persons. The Privacy Shield is overseen and enforced by EU federal and U.S. agencies, including the Department of Commerce and the FTC, and is reviewed by both parties annually. The EU's General Data Protection Regulation (GDPR), effective May 2018, establishes rules for EU members, with extraterritorial implications. The GDPR is a comprehensive privacy regime that builds on previous EU data protection rules. It grants new rights to individuals to control personal data and creates specific new data protection requirements. The GDPR applies to (1) all businesses and organizations with an EU establishment that process (i.e., perform operations on) personal data of individuals in the EU, regardless of where the actual processing of the data takes place; and (2) entities outside the EU that offer goods or services (for payment or for free) to individuals in the EU or monitor the behavior of individuals in the EU. While the GDPR is directly applicable at the EU member state level, individual countries are responsible for establishing some national-level rules and policies as well as enforcement authorities, and some are still in the process of doing so. As a result, some U.S. stakeholders have voiced concerns about a lack of clarity and inadequate country compliance guidelines. Many U.S. firms doing business in the EU have made and are making changes to comply with the GDPR, such as revising and clarifying user terms of agreement and asking for explicit consent. For some U.S. companies, it may be easier and cheaper to apply GDPR protections to all users worldwide rather than to maintain different policies for different users. Large firms may have the resources to hire consultants and lawyers to guide implementation and compliance; it may be harder and costlier for small and mid-sized enterprises to comply, possibly deterring them from entering the EU market and creating a de facto trade barrier. Since the GDPR went into effect on May 25, 2018, some U.S. businesses, including some newspaper websites and digital advertising firms, have opted to exit the EU market given the complexities of complying with the GDPR and the threat of potential enforcement actions. European Data Protection Authorities (DPAs) have received a range of GDPR complaints and initiated several GDPR enforcement actions in the fall of 2018. In January 2019, the French DPA issued the largest penalty to date for a data privacy breach. The agency imposed a €50 million (approximately $57 million) fine on Google for the "lack of transparency" regarding how the search engine processes user data. Analysts contend that the high fine may set a benchmark and signal for future enforcement, raising concerns among some firms doing business in the EU. Under the GDPR, a few options exist to transfer personal data in or out of the EU and ensure that privacy is maintained. 1. An organization may use specific Binding Corporate Rules (BCRs) or Model Contracts approved by the EU; 2. An organization may comply with domestic privacy regimes of a country that has obtained a mutual adequacy decision from the EU, which means that the EU has deemed that a country's laws and regulations provide an adequate level of data protection; currently, fewer than 15 jurisdictions are deemed adequate by the EU; or 3. A U.S.-based organization may enroll in the bilateral U.S.-EU Privacy Shield program for transatlantic transfer of personal data. The GDPR legal text seems to envision a fourth way, such as a certification scheme to transfer data, that the EU has yet to elaborate. A certification option(s) could create a less burdensome means of compliance for U.S. and other non-EU organizations to transfer personal data to or from the EU in the future. This could be an opportunity for the United States to work with the EU on creating a common system, perhaps even setting a global standard. Some experts contend that the GDPR may effectively set new global data privacy standards, since many companies and organizations are striving for GDPR compliance to avoid being shut out of the EU market, fined, or otherwise penalized, or in case other countries introduce rules that imitate the GDPR. The EU is actively promoting the GDPR and some countries, such as Argentina, are imitating all or parts of the GDPR in their own privacy regulatory and legislative efforts or as part of broader trade negotiations with the EU. In general, the EU does not include cross-border data flows or privacy in free trade agreements. However, alongside trade negotiations with Japan, the EU and Japan agreed to recognize each other's data protection systems as "equivalent," allowing for the free flow of data between the EU and Japan and serving as a first step in adopting an adequacy decision. Under the agreement, Japan committed to implementing additional measures to address the handling of the personal data of EU persons on top of Japan's own privacy regime. China's trade and internet policies reflect state direction and industrial policy, limiting the free flow of information and individual privacy. For example, the requirement for all internet traffic to pass through a national firewall can impede the cross-border transmission of data. China's 2015 counterterrorism law requires telecommunications operators and internet service providers to provide assistance to the government, which could include sharing individuals' data. Citing national security concerns, China's Internet Sovereignty policies, Cybersecurity Law, and Personal Information Security Specification impose strict requirements on companies, such as storing data domestically; limiting the ability to access, use, or transfer data internationally; and mandating security assessments that provide Chinese authorities access to proprietary information. In 2014, China announced a new social credit system, a centralized big-data-enabled system for monitoring and shaping businesses' and citizens' behavior that serves as a self-enforcing regulatory mechanism. According to the government, China aims to make individuals more "sincere" and "trustworthy," while obtaining reliable data on the creditworthiness of businesses and individuals. An individual's score would determine the level of government services and opportunities he or she could receive. China seeks to have all its citizens subject to the social credit system by 2020, forcing some U.S. businesses who do business in China, such as airlines, to participate. As of 2018, multiple government agencies and financial institutions contribute data to the platform. Pilot projects are underway in some provinces to apply various rewards and punishments in response to data collected. The lack of control an individual may have and the exposure of what some consider private data is controversial among observers in and out of China. Some countries, such as Vietnam, are following China's approach in creating cybersecurity policies that limit data flows and require local data storage and possible access by government authorities. Some U.S. firms and other multinational companies are considering exiting the Vietnamese market rather than complying, while some analysts suggest that Vietnam's law may not be in compliance with its recent commitments in trade agreements (see below). India has also cited security as the rationale for its draft Personal Data Protection Bill, which would establish broad data localization requirements and limit cross-border transfer of some data. Unlike the EU, these countries do not specify mechanisms to allow for cross-border data flows. U.S. officials have raised concerns with both Vietnam's and India's localization requirements. The EU's emphasis on privacy protection and China's focus on national security (and the countries that emulate their policies) have led these countries to create data-focused policies that restrict international trade and commerce. The United States has traditionally sought a balanced approach between trade, privacy, and security. U.S. data flow policy priorities are articulated in USTR's Digital 2 Dozen report, first developed under the Obama Administration, and the White House's 2017 National Security Strategy. Both Administrations emphasize the need for protection of privacy, the free flow of data across borders, and an interoperable internet. These documents establish the U.S. position that the free flow of data is not inconsistent with privacy protection. Recent free trade agreements translate the U.S. position into binding international commitments. The United States has taken a data-specific approach to regulating data privacy, with laws protecting specific information, such as healthcare or financial data. The FTC enforces consumer protection laws and requires that consumers be notified of and consent to how their data will be used, but the FTC does not have the mandate or resources to enforce broad online privacy protections. There is growing interest among some Members of Congress and in the Administration for a more holistic U.S. data privacy policy. The United States has played an important role in international discussions on privacy and data flows, such as in the OECD, G-20, and APEC, and has included provisions on these subjects in recent free trade agreements. Congress noted the importance of digital trade and the internet as a trading platform in setting the current U.S. trade negotiating objectives in the June 2015 Trade Promotion Authority (TPA) legislation ( P.L. 114-26 ). TPA includes a specific principal U.S. trade negotiating objective on "digital trade in goods and services and cross-border data flows." According to TPA, a trade agreement should ensure that governments "refrain from implementing trade-related measures that impede digital trade in goods and services, restrict cross-border data flows, or require local storage or processing of data." However, TPA also recognizes that sometimes measures are necessary to achieve legitimate policy objectives and aims for such regulations to be the least trade restrictive, nondiscriminatory, and transparent. Comprehensive and Progressive Agreement for Trans‐Pacific Partnership (CPTPP /TPP-11 ) . The CPTPP is a recently concluded trade agreement among 11 Asia-Pacific countries. The CPTPP is based on the proposed Trans-Pacific Partnership (TPP) agreement negotiated by the Obama Administration and from which President Trump withdrew the United States in January 2017. The electronic commerce chapter in TPP, left unchanged in CPTPP, contains the strongest binding trade agreement commitments on digital trade in force globally. CPTPP includes provisions on cross-border data flows and personal information protection. The text specifically states that the parties "shall allow the cross-border transfer of information." The agreement allows restrictive measures for legitimate public policy purposes if they are not discriminatory or disguised trade barriers. The agreement also prohibits localization requirements for computing facilities, with similar exceptions. On privacy, the CPTPP requires parties to have a legal framework in place to protect personal information and to have consumer protection laws that cover online commerce. It encourages interoperability between data privacy regimes and encourages cooperation between consumer protection authorities. United States-Mexico-Canada Agreement (USMCA). The released text for the proposed USMCA aims to revise and update the trilateral North American Free Trade Agreement (NAFTA), and illustrates the Trump Administration's approach. The USMCA chapter 19 on digital trade includes articles on consumer protection, personal information protection, cross-border transfer of information by electronic means, and cybersecurity, among other topics. Building on the TPP, the agreement seeks to balance the legitimate objectives by requiring parties to have a legal framework to protect personal information, have consumer protection laws for online commercial activities, and not prohibit or restrict cross-border transfer of information. While the agreement does not prescribe specific rules or measures that a party must take to protect privacy, it goes further than the TPP (or CPTPP) provisions and provides guidance to inform a country's privacy regime. In particular, the USMCA explicitly refers to the APEC Privacy Framework and OECD Guidelines as relevant and identifies key principles. In general, the proposed USMCA requires that parties not restrict cross-border data flows. Governments are allowed to do so to achieve a legitimate public policy objective (e.g., privacy, national security), provided the measure is not arbitrary, discriminatory, a disguised trade barrier, or greater than necessary to achieve the particular objective. In this way, the parties seek to balance the free flow of data for commerce and communication with protecting privacy and security. The agreement specifically states that the parties may take different legal approaches to protect personal data and also recognizes APEC CBPR as a "valid mechanism to facilitate cross-border information transfer while protecting personal information." The agreement aims to increase cooperation between the United States, Mexico, and Canada on a number of digital trade issues, including exchanging information on personal information protection and enforcement experiences; strengthening collaboration on cybersecurity issues; and promoting the APEC CBPR and global interoperability of national privacy regimes. The governments also commit to encourage private-sector self-regulation models and promote cooperation to enforce privacy laws. While the agreement is only between three parties, the provisions are written broadly to encompass global efforts. Some stakeholders look at USMCA as the basis for potential future trade agreements (such as with the UK). Cross-border data flows will likely be a key issue in future U.S.-EU trade negotiations. The United States has articulated a clear position on data privacy in trade agreements; however, there is no single U.S. data privacy policy. Nevertheless, the Trump Administration is seeking to define an overarching U.S. policy on data privacy. The Trump Administration's ongoing three-track process is being managed by the Department of Commerce (Commerce) in consultation with the White House. Different bureaus in Commerce are tasked with different aspects of the process, as follows. 1. The National Institutes of Standards and Technology (NIST) is developing a privacy framework. Similar to its cybersecurity framework, NIST aims to create a voluntary framework as a tool for organizations to adopt to identify, assess, manage, and communicate about privacy risks. By classifying specific privacy outcomes and potential approaches, the framework is intended to enable organizations to create and adapt privacy strategies, innovate, and manage privacy risks within diverse environments. As part of its transparent approach, NIST is currently consulting with public- and private-sector stakeholders through various forms of outreach to collect feedback and aims to have a draft framework before the end of 2019. 2. The National Telecommunications and Information Administration (NTIA) is developing a set of privacy principles to guide a domestic legal and policy approach. The NITA sought public comment on a proposed set of "user-centric privacy outcomes" and a set of high-level goals. 3. The International Trade Administration (ITA) engages with foreign governments and international organizations such as APEC. ITA is focusing on the international interoperability aspects of potential U.S. privacy policy. ITA's role is to ensure that the NIST and NTIA approaches are consistent with U.S. international policy objectives, including TPA, and principles, such as the OECD framework and APEC CBPRs. Like the EU and China, Commerce is seeking input through a public- and private-sector consultation process. However, unlike the EU or China, Commerce is expecting to create a voluntary privacy framework. Some observers question whether the Commerce approach is sufficient to result in strong privacy protections if it is not backed up by congressional action and federal legislation. Some suggest that Congress could lead a whole-of-government approach through new federal legislation. In the 115 th Congress, then-House Committee on Energy and Commerce Ranking Member Frank Pallone, Jr. requested that the Government Accountability Office (GAO) examine issues related to federal oversight of internet privacy. The January 2019 GAO report concluded that now is "an appropriate time for Congress to consider comprehensive Internet privacy." GAO stated that "Congress should consider developing comprehensive legislation on Internet privacy that would enhance consumer protections and provide flexibility to address a rapidly evolving Internet environment. Issues that should be considered include what authorities agencies should have in order to oversee Internet privacy, including appropriate rulemaking authority." Recognizing the importance of protecting open data flows amid growing concerns about online privacy, some stakeholders seek to influence U.S. policies on these issues. In addition to submitting comments in response to NTIA and NIST requests and participating in their forums, multiple organizations issued their own sets of principles or guidelines, some referencing the EU GDPR. The U.S. Chamber of Commerce has also published model privacy legislation for Congress to consider. Though they vary in emphasis, these proposals share common themes: transparency on what data is being collected and how it is being used; user control, including the ability to opt out of sharing at least some information and to access and correct personal data collected; data security measures, like data breach notification requirements; and enforcement by the FTC; FTC commissioners also voiced support for the agency as the appropriate federal enforcer for consumer privacy. But these groups also differ in some areas, such as whether, or to what extent, to include certain aspects included in the GDPR, such as the right to deletion (so-called "right to be forgotten"), requirements for data minimization, or extraterritorial reach. There is not consensus on whether the FTC should be given rule-making authority or additional resources, the enforcement role of states, or if an independent data protection commission is needed similar to EU DPAs. Consistent with U.S. trade policy, industry groups generally point out the need to be flexible, encourage private-sector innovation, establish sector- and technology-neutral rules, create international interoperability between privacy regimes, and facilitate cross-border data flows. Private-sector stakeholders generally want to avoid what they regard as overregulation or high compliance burdens. These groups emphasize risk management and a harm-based approach, which they state keeps an organization's costs proportional to the consumer harm prevented. On the other hand, some consumer advocates point to a need for baseline obligations to protect against discrimination, disinformation, or other harm. In general, consumer advocates believe that any comprehensive federal privacy policy should complement, and not supplant, sector-specific privacy legislation or state-level legislation. Finding a global consensus on how to balance open data flows and privacy protection may be key to maintaining trust in the digital environment and advancing international trade. One study found that over 120 countries have laws related to personal data protection. Divergent national privacy approaches raise the costs of doing business and make it harder for governments to collaborate and share data, whether for scientific research, defense, or law enforcement. A system for global interoperability in a least trade-restrictive and nondiscriminatory way between different national systems could help minimize costs and allow entities in different jurisdictions with varying online privacy regimes to share data via cross-border data flows. Such a system could help avoid fragmentation of the internet between European, Chinese, and American spheres, a danger that some analysts have warned against. For example, Figure 2 suggests the potential of an interoperability system that allows data to flow freely between GDPR- and CBPR-certified economies. The OECD guidelines, G-20 principles, APEC CBPR, CPTPP, and USMCA provisions demonstrate an evolving understanding on how to balance cross-border data flows, security, and privacy, to create interoperable policies that can be tailored by countries and avoid fragmentation or the potential exclusion of other countries or regulatory systems. The various trade agreements and initiatives with differing sets of parties may ultimately pave the way for a broader multilateral understanding and eventually lead to more enforceable binding commitments founded on the key WTO principles of nondiscrimination, least trade restrictiveness, and transparency. Congress may consider the trade-related aspects of data flows in trade agreements, including through close examination of these provisions during the congressional debate and consideration of legislation to implement the proposed USMCA. Issues include whether the agreements make progress in meeting TPA's related trade negotiating objectives and if the provisions strike the appropriate balance among public policy objectives. In addition, USTR's specific trade negotiating objectives for future agreements with the EU and Japan include establishing rules to protect cross-border data flows. These future trade negotiations present challenges and provide opportunities for Congress to further engage USTR on the issues and to conduct oversight. Congress may further consider how best to achieve broader consensus on data flows and privacy at the global level. Congress could, for example, conduct additional oversight of current best practice approaches (e.g., OECD, APEC) or ongoing negotiations in the WTO on e-commerce to create rules through plurilateral or multilateral agreements. Congress may consider endorsing certain of these efforts to influence international discussions and the engagement of other countries. Congress may want to examine the potential challenges and implications of building a system of interoperability between APEC, CBPR, and the EU GDPR. Related issues are the extent to which the EU is establishing its system as a potential de facto global approach through its trade agreements and other mechanisms, and how U.S. and other trade agreements may ultimately provide approaches that could be adopted more globally. Congress may seek to better understand the economic impact of data flows and privacy regimes in other countries related to U.S. access to other markets and the extent to which barriers are being put in place that may discriminate against U.S. exporters. Congress may examine the lack of reciprocal treatment and limits on U.S. firms' access to some foreign markets. Congress may consider the implications of not having a comprehensive national data privacy policy. Will the EU GDPR and China cybersecurity policies become the global norms that other countries follow in the absence of a clear U.S. alternative? Congress may enact comprehensive privacy legislation. In considering such action, Congress could investigate and conduct oversight of the Administration's ongoing privacy efforts, including requesting briefings and updates on the NTIA, NIST, and ITA initiatives to provide congressional feedback and direction and ensure they are aligned with U.S. trade objectives. Congress may also seek input from other federal agencies. In deliberating a comprehensive U.S. policy on personal data privacy, Congress may review the GAO report's findings and conclusions. Congress may also weigh several factors, including: How can U.S. trade and domestic policy achieve the appropriate balance to encourage cross-border commerce, economic growth, and innovation, while safeguarding individual privacy and national security? How would a new privacy regime affect U.S. consumers and businesses, including large multinationals who must comply with different national privacy regimes and small- and medium-sized enterprises with limited resources and technology expertise? Do U.S. agencies have the needed tools to accurately assess the size and scope of cross-border data flows to help analyze the economic impact of different privacy policies, or measure the costs of trade barriers? How should an evolving U.S. privacy regime align with U.S. trade policy objectives and evolving international standards, such as the OECD Guidelines for privacy and cybersecurity, and should U.S. policymakers prioritize interoperability with other international privacy frameworks to avoid further fragmentation of global markets and so-called balkanization of the internet? In addition, there are a host of other policy considerations not directly related to trade.

 

 Report 2:
The federal government supports the development of airport infrastructure in three different ways. First, the Airport Improvement Program (AIP) provides federal grants to airports for planning and development, mainly of capital projects related to aircraft operations such as runways and taxiways. Second, Congress has authorized airports to assess a local passenger facility charge (PFC) on each boarding passenger, subject to specific federal approval. PFC revenues can be used for a broader range of projects than AIP funds, including "landside" projects such as passenger terminals and ground access improvements. Third, federal law grants investors preferential income tax treatment on interest income from bonds issued by state and local governments for airport improvements (subject to compliance with federal rules). Airports may also draw on state and local funds and on operating revenues, such as lease payments and landing fees. A federal role in airport infrastructure first developed during World War II. Prior to the war, airports were a local or private responsibility, with federal support limited to the tax exclusion of municipal bond interest. National defense needs led to the first major federal support for airport construction. After the war, the Federal Airport Act of 1946 (P.L. 79-377) continued federal a id, although at lower levels than during the war years. Initially, much of this spending supported conversion of military airports to civilian use. In the 1960s, substantial funding also was used to upgrade and extend runways for use by commercial jets. In 1970, Congress responded to increasing congestion, both in the air and on the ground at U.S. airports, by passing two laws. The first, the Airport and Airway Development Act, established the forerunner programs of AIP: the Airport Development Aid Program and the Planning Grant Program. The second, the Airport and Airway Revenue Act of 1970, dealt with the revenue side of airport development, establishing the Airport and Airway Trust Fund (AATF, also referred to as the Aviation Trust Fund, and in this report, the trust fund). The Airport and Airway Improvement Act of 1982 ( P.L. 97-248 ; the 1982 Act) created the current AIP and reactivated the trust fund. For a more detailed legislative history of AIP, see Appendix A of this report. Eight years later, amid concerns that the existing sources of funds for airport development would be insufficient to meet national airport needs, the Aviation Safety and Capacity Expansion Act of 1990 (Title IX of the Omnibus Budget Reconciliation Act of 1990, P.L. 101-508 ) allowed the Secretary of Transportation to authorize public agencies that control commercial airports to impose a passenger facility charge on each paying passenger boarding an aircraft at their airports. Different airports use different combinations of AIP funding, PFCs, tax-exempt bonds, state and local grants, and airport revenues to finance particular projects. Small airports are more likely to be dependent on AIP grants than large or medium-sized airports. Larger airports are much more likely to issue tax-exempt bonds or finance capital projects with the proceeds of PFCs. Each of these funding sources places various legislative, regulatory, or contractual constraints on airports that use it. The availability and conditions of one source of funding may also influence the availability and terms of other funding sources. In a 2015 study, the U.S. Government Accountability Office (GAO) found that airport-generated net income financed about 38% of airports' capital spending, AIP 33%, PFCs 18%, capital contributions by airport sponsor (often a state or municipality) or by other sources such as an airline or tenant 6%, and state grants nearly 5%. AIP provides federal grants to airports for airport development and planning. Participants range from very large publicly owned commercial airports to small general aviation airports that may be privately owned but are available for public use. AIP funding is usually limited to construction of improvements related to aircraft operations, such as runways and taxiways. Commercial revenue-producing facilities are generally not eligible for AIP funding, nor are operating costs. The structure of AIP funds distribution reflects congressional priorities and the objectives of assuring airport safety and security, increasing airport capacity, reducing congestion, helping fund noise and environmental mitigation costs, and financing small state and community airports. The main financial advantage of AIP to airports is that, as a grant program, it can provide funds for capital projects without the financial burden of debt financing, although airports are required to provide a modest local match to the federal funds. Limitations on the use of AIP grants include the range of projects that AIP can fund and the requirement that recipients adhere to all program regulations and grant assurances. Federal law requires the Secretary of Transportation to publish a national plan for the development of public-use airports in the United States. This appears as a biannual Federal Aviation Administration (FAA) publication called the National Plan of Integrated Airport System s (NPIAS) . For an airport to receive AIP funds, it must be listed in the NPIAS. AIP program structure and authorizations are set in FAA authorization acts. Modifications have been made to AIP through the years, but the basic program structure remains the same. The most recent act, the FAA Reauthorization Act of 2018 ( P.L. 115-254 ), authorized AIP funding through FY2023. The trust fund was designed to assure an adequate and consistent source of funds for federal airport and airway programs. It is the primary funding source for most FAA activities in addition to federal grants to airports. These include facilities and equipment (F&E); research, engineering, and development (R, E&D); and FAA operations and maintenance (O&M). Congress determines how much the trust fund will be allowed to expend for various purposes, including the AIP. The money flowing into the Airport and Airway Trust Fund comes from a variety of aviation-related taxes. These taxes were authorized by the Taxpayer Relief Act of 1997 ( P.L. 105-34 ) and reauthorized by the 2018 FAA reauthorization act. Revenue sources include the following: 7.5% ticket tax, $4.20 flight segment tax, 6.25% tax on cargo waybills, 4.4 cents per gallon on commercial aviation fuel, 19.4 cents per gallon on general aviation gasoline, 21.9 cents per gallon on general aviation jet fuel, 14.1 cents per gallon fractional ownership surtax on general aviation jet fuel, $18.60 international arrival tax, $18.60 international departure tax, and 7.5% "frequent flyer" award tax. In most years since the trust fund was established, the revenues plus interest on the unexpended balances brought in more money than was being paid out. This led to the growth in the end-of-year unexpended balances in the trust fund. At times these unexpended balances are inaccurately referred to as a surplus. In practice, FAA may have committed unexpended balances to fund particular airport projects, so those balances may not be available for other purposes. Most air carriers have altered their pricing structures in ways that have implications for the trust fund. Ancillary fees are now commonly charged for services such as checked baggage that in the past were included in the ticket price. Such fees are not subject to the 7.5% ticket tax. Had the $4.57 billion in baggage fees collected in 2017 been subject to the ticket tax, the trust fund might have received more than $343 million in additional revenue. AIP spending authorized and the amounts actually made available for grants from the aviation trust fund since FY2000 are illustrated in Table 1 . After trending upward from FY1982 to FY1992, grant funding approved in annual appropriations declined through the mid-1990s as part of federal deficit reduction efforts, leaving large gaps between authorized AIP spending levels and the amounts the program was actually allowed to expend. This occurred despite provisions in place since 1976 designed to ensure that federal capital spending for airports is fully funded at the authorized level (see Text B ox ). The Wendell H. Ford Aviation Investment and Reform Act for the 21 st Century (AIR21; P.L. 106-181 ), enacted in 2000, provided major increases in AIP's authorization, starting in FY2001. During FY2001-FY2006 AIP was funded near its fully authorized levels. The amount available for grants peaked at $3.47 billion in FY2008. From FY2008 through FY2011, when AIP was authorized by a series of authorization extension acts, appropriators set the program's annual obligation limitation at $3.515 billion. The 2012 FAA Modernization and Reform Act authorized funding through FY2015 at an annual level of $3.35 billion. In July 2016, the FAA Extension, Safety, and Security Act of 2016 ( P.L. 114-190 ) was passed to further extend the authorization of AIP at the annual level of $3.35 billion through September 30, 2017. The 115 th Congress passed a six-month extension ( P.L. 115-63 ) of aviation funding and programs through the end of March 2018. Subsequently, the Consolidated Appropriations Act, 2018 ( P.L. 115-141 ), provided a further extension through the end of FY2018. In addition to the annual funding of $3.35 billion, the 2018 appropriations act provided a $1.0 billion appropriation from the general fund to the AIP discretionary grants program. The Secretary of Transportation was directed to keep this supplemental funding available through September 30, 2020, and to give priority to nonprimary, nonhub, and small hub airports. These supplemental funds are not included in the AIP funding summary or discussion in this report, as FAA is in the process of evaluating applications and distributing funds. The FAA Reauthorization Act of 2018 ( P.L. 115-254 ) funded AIP from FY2019 through FY2023 at an annual level of $3.35 billion. It also authorized supplemental annual funding from the general fund to the AIP discretionary grants program ($1.02 billion in FY2019, $1.04 billion in FY2020, $1.06 billion in FY2021, $1.09 billion in FY2022, and $1.11 billion in FY2023), and required at least 50% of these additional funds to be available to nonhub and small hub airports. In February 2019, Congress passed the Consolidated Appropriations Act, 2019 ( P.L. 116-6 ). The act provided a $500 million supplemental appropriation from the general fund to the AIP discretionary grants program and required that this money remain available through September 30, 2021. The distribution system for AIP grants is complex. It is based on a combination of formula grants (also referred to as apportionments or entitlements) and discretionary funds. Each year the entitlements are first apportioned by formula to specific airports or types of airports. Once the entitlements are satisfied, the remaining funds are defined as discretionary funds. Airports apply for discretionary funds for projects in their airport master plans. Formula grants and discretionary funds are not mutually exclusive, in the sense that airports receiving formula funds may also apply for and receive discretionary funds. Grants are generally awarded directly to airports. Legislation sets forth definitions of airports that are relevant both in discussions of the airport system in general and of AIP funding distribution in particular (see Appendix B ). The statutory provisions for the allocation of both formula and discretionary funds are based on these definitions. Entitlements are funds that are apportioned by formula to airports and may generally be used for any eligible airport improvement or planning project. These funds are divided into four categories: primary airports, cargo service airports, general aviation airports, and Alaska supplemental funds (see Appendix B for a full list of airport definitions). Each category distributes AIP funds by a different formula (49 U.S.C. §47114). Most airports have up to three years to use their apportionments. Nonhub commercial service airports have up to four years. The formula distributions are contingent on an annual AIP obligation limitation of $3.2 billion or more. If this threshold is not met in a particular fiscal year, most formulas revert to prior authorized funding formulas. Primary Airports. The apportionment for airports that board more than 10,000 passengers each year is based on the number of boardings (also referred to as enplanements) during the prior calendar year. The amount apportioned for each fiscal year is equal to double the amount that would be received according to the following formulas: $7.80 for each of the first 50,000 passenger boardings; $5.20 for each of the next 50,000 passenger boardings; $2.60 for each of the next 400,000 passenger boardings; $0.65 for each of the next 500,000 passenger boardings; and $0.50 for each passenger boarding in excess of 1 million. The minimum allocation to any primary airport is $1 million. The maximum is $26 million. Cargo Service Airports. Some 3.5% of AIP funds subject to apportionment are apportioned to airports served by all-cargo aircraft with a total annual landed weight of more than 100 million pounds. The allocation formula is the proportion of the individual airport's landed weight to the total landed weight at all cargo service airports. General Aviation Airports. General aviation, reliever, and nonprimary commercial service airports are apportioned 20% of AIP funds subject to apportionment. From this share, all airports, excluding all nonreliever primary airports, receive the lesser of the following: $150,000; or one-fifth of the estimated five-year costs for airport development for each of these airports as listed in the most recent NPIAS. Any remaining funds are distributed according to a state-based population and area formula. FAA makes the project decisions on the use of these funds in consultation with the states. Although FAA has ultimate control, some states view these funds as an opportunity to address general aviation needs from a statewide, rather than a local or national, perspective. Alaska Supplemental Funds. Funds are apportioned to airports in Alaska to assure that Alaskan airports receive at least twice as much funding as they did under the Airport Development Aid Program in 1980. Foregone Apportionments. Large and medium hub airports that collect a passenger facility charge of $3 or less have their AIP formula entitlements reduced by an amount equal to 50% of their projected PFC revenue for the fiscal year until they forgo or give back 50% of their AIP formula grants. In the case of PFC above the $3 level the percentage forgone is 75%. A special small airport fund, which provides grants on a discretionary basis to airports smaller than medium hub, gets 87.5% of these foregone funds. The discretionary fund gets the remaining 12.5%. The discretionary funds (49 U.S.C. §§47115-47116) include the money not distributed under the apportioned entitlements, as well as the forgone PFC revenues that were not deposited into the small airport fund. AIP discretionary funding for FY2018 was about 9.4% of the total AIP funding. Discretionary grants are approved by FAA based on project priority and other selection criteria. Figure 1 illustrates the composition of both apportioned and discretionary grants, based on FY2018 data. Despite its name, the discretionary fund is not allocated solely at FAA's discretion. Allocations are subject to the following three set-asides and certain other spending criteria: Airport Noise Set-Asides . At least 35% of discretionary funds are set aside for noise compatibility planning and for carrying out noise abatement and compatibility programs. Military Airport Program . At least 4% of discretionary funds are set aside for conversion and dual use of up to 15 current and former military airports. The program allows funding of some projects not normally eligible under AIP. Grants for Reliever Airports . There is a set-aside of two-thirds of 1% of discretionary funds for reliever airports in metropolitan areas suffering from flight delays. The Secretary of Transportation is also directed to see that 75% of the grants made from the discretionary fund are used to preserve and enhance capacity, safety, and security at primary and reliever airports, and also to carry out airport noise compatibility planning and programs at these airports. From the remaining 25%, FAA is required to set aside $5 million for the testing and evaluation of innovative aviation security systems. Subject to these limitations and the three set-asides, the Secretary of Transportation, through FAA, has discretion in distribution of grants from the remainder of the discretionary fund. Under this program, FAA provides funds directly to participating states for projects at airports classified as other than primary airports. Each participating state receives a block grant made up of the state's apportionment (formula) funds and available discretionary funds. A block grant program state is responsible for selecting and funding AIP projects at the small airports in the state. In making the selections, the participating states are required to comply with federal priorities. Each block grant state is responsible for project administration as well as most of the inspection and oversight roles normally assumed by FAA. The states that currently participate in the state block grant program are Georgia, Illinois, Michigan, Missouri, New Hampshire, North Carolina, Pennsylvania, Tennessee, Texas, and Wisconsin. For AIP projects, the federal government share differs depending on the type of airport. The federal share, whether funded by formula or discretionary grants, is as follows: 75% for large and medium hub airports (80% for noise compatibility projects); 90% for other airports; "not more than" 90% for airport projects in states participating in the state block grant program; 70% for projects funded from the discretionary fund at airports receiving exemptions under 49 U.S.C. §47134, the pilot program for private ownership of airports; airports reclassified as medium hubs due to increased passenger volumes may retain eligibility for up to a 90% federal share for a two-year transition period; certain economically distressed communities receiving subsidized air service may be eligible for up to a 95% federal share of project costs. This cost-share structure means that smaller airports pay a lower share of AIP-funded project costs than larger airports. The airports themselves must raise the remaining share from other sources. Although smaller airports' individual grants are of much smaller dollar amounts than the grants going to large and medium hub airports, the smaller airports are much more dependent on AIP to meet their capital needs. This is particularly the case for noncommercial airports, such as general aviation and reliever airports, which received over 25% of AIP grants distributed in FY2018. Air carriers have objected to this allocation, pointing out that their passengers and freight shippers pay the vast majority of revenue flowing into the trust fund. General aviation interests, however, defend AIP grants to noncommercial airports. Figure 2 shows the share of AIP grants awarded in FY2018, by value, broken out by airport type. Figure 3 displays AIP grants awarded by type of project for FY2018. For the most part, AIP development grants support "airside" development projects such as runways, taxiways, aprons, navigation aids, lighting, and airside safety projects. Substantial AIP funds also go for state block grants and noise planning and abatement. AIP spending on roads is generally restricted to roads on or entering airport property. In cases in which a primary or reliever airport may want to begin an AIP-eligible project without waiting for the funds to become available, FAA is authorized to issue a letter of intent (LOI). If it does so, the LOI states that eligible project costs, up to the allowable federal share, will be reimbursed according to a schedule set forth in the letter. Although the LOI technically does not obligate the federal government, it is an indication of FAA's approval of the scope and timing of the project, as well as the federal intent to fund the project in future years. Because most primary airports fund their major development projects with tax-exempt revenue bonds, the evidence of federal support that the LOI provides is likely to lead to favorable bond interest rates. The airport may proceed with the project with assurance that all AIP-allowable costs specified in the LOI will remain eligible for reimbursement over the life of the LOI. Both entitlement and discretionary funds are used to fulfill LOIs. FAA limits the total of discretionary funds in all LOIs subject to future obligation to roughly 50% of forecast available discretionary funds. LOIs have certain eligibility restrictions. They can only be issued to cover projects at primary and reliever airports. The proposed airport development project or action must "enhance airfield capacity in terms of increased aircraft operations, increased aircraft seating or cargo capacity, or reduced airfield operational delays." For large and medium hub airports, the project must enhance "system-wide airport capacity significantly." Airports' grant applications are conditioned on assurances regarding future airport operations. Examples of such assurances include making the airport available for public use on reasonable conditions and without unjust economic discrimination (against all types, kinds, and classes of aeronautical activities); charging air carriers making similar use of the airport substantially comparable amounts; maintaining a current airport layout plan; making financial reports to FAA; and expending airport revenue only on capital or operating costs at the airport. Within the AIP context, assurances are a means of guaranteeing the implementation of federal policy. Obligations derived from airports' assurances extend beyond the formal closure of AIP grant-supported projects. Obligations related to the use, operation, and maintenance of an airport remain in effect for the expected life of the improvement, up to 20 years. In the case of the purchase of land with AIP funds, the federal obligations do not expire. Airports may request that FAA release them from their AIP contractual obligations. Typically, as a condition of the release, the airport sponsor must either reimburse the federal government for the AIP grants (in the case of land grants, the federal share of the fair market value of the land) or reinvest the amount in an approved AIP project (see Text B ox ). When airport managers or interest groups express concerns about the "strings attached" to AIP funding, they are usually referring to AIP grant assurances. In 1990, federal deficits and expected tight budgets led to concerns that the Airport and Airway Trust Fund and other existing sources of funds for airport development would be insufficient to meet national airport needs. This led to authorization of a new user charge, the Passenger Facility Charge (PFC). The PFC was seen as a complementary funding source to AIP. The Aviation Safety and Capacity Expansion Act of 1990 allowed the Secretary of Transportation to authorize public agencies that control commercial airports to impose a fee on each paying passenger boarding an aircraft at their airports. Initially, there was a $3 cap on each airport's PFC and a $12 limit on the total PFCs that a passenger could be charged per round trip. The PFC is a state, local, or port authority fee, not a federally imposed tax deposited into the Treasury. Because of the complementary relationship between AIP and PFCs, PFC provisions are generally folded into the sections of FAA reauthorization legislation dealing with AIP. The money raised from PFCs must be used to finance eligible airport-related projects. Unlike AIP funds, PFC funds may be used to service debt incurred to carry out projects. Legislation in 2000 raised the PFC ceiling to $4.50, with an $18 limit on the total PFCs that a passenger can be charged per round trip. To impose a PFC above $3 an airport has to show that the funded projects will make significant improvements in air safety, increase competition, or reduce congestion or noise impacts on communities, and that these projects could not be fully funded by using the airport's AIP formula funds or AIP discretionary grants. Large and medium hub airports imposing PFCs above the $3 level forgo 75% of their AIP formula funds. PFCs at large and medium hub airports may not be approved unless the airport has submitted a written competition plan to FAA, which includes information about the availability of gates, leasing arrangements, gate-use requirements, controls over airside and ground-side capacity, and intentions to build gates that could be used as common facilities. The FAA Modernization and Reform Act of 2012 included minor changes to the PFC program. The act made permanent the trial program that authorized nonhub small airports to impose PFCs. The act also required GAO to study alternative means of collecting PFCs without including the PFC in the ticket price. The FAA Reauthorization Act of 2018 did not include significant changes to the PFC program and maintained the $4.50 PFC cap, with a maximum charge of $18 per round-trip flight. It did include a provision, however, that required a qualified organization to conduct a study assessing the infrastructure needs of airports and existing financial resources for commercial service airports and to make recommendations on the actions needed to upgrade the national aviation infrastructure system. Unlike AIP grants, of which over 67% in FY2018 went to airside projects (runways, taxiways, aprons, and safety-related projects), PFC revenues are heavily used for landside projects, such as terminals and transit systems on airport property, and for interest payments. Table 2 shows the AIP grant awards and PFC approvals by project type in FY2018. Annual system-wide PFC collections grew from $85.4 million in 1992 to over $3.4 billion in 2018. The PFC statutory language lends itself to a broader interpretation of "capacity enhancing" projects, and the implementing regulations are less constraining than those for AIP funds. Air carriers, which historically have preferred funding to be dedicated to airside projects, must be notified and provided with an opportunity for consultation about airports' proposals to fund projects with PFC revenues. They are generally less involved in the PFC project planning and decisionmaking process than is the case with AIP projects. The difference in the pattern of project types may also be influenced by the fact that larger airports, which collect most of the PFC revenue, tend to have substantial landside infrastructure, whereas smaller airports that are much more dependent on AIP funding have comparatively limited landside facilities. Bonds have long been a major source of funding for capital projects at primary airports. According to Bond Buyer, a trade publication, airports raised approximately $17.4 billion in 84 bond issues in 2018, a substantial increase over the $14.7 billion raised in 116 issues in 2017. Most airport-related bonds are classified as tax-exempt private activity bonds (PABs). These bonds, issued by a local government or public authority, allow the use of landing fees, charges on airport users, and property taxes on privately controlled on-airport buildings, such as cargo facilities, to service debt without obligating tax revenue. Their tax-exempt status enables airports to raise funds more cheaply than would otherwise be the case because investors enjoy a federal income tax exclusion on interest paid on the bonds. In some cases, revenue from PFCs may be used to service the bonds. PABs may be used to build facilities that are directly related and essential to servicing aircraft, enabling aircraft to take off and land, and transferring passengers or cargo to or from aircraft. Normally, airport bonds might be classified as taxable PABs because they are used to finance facilities where more than 90% of the activity is private and more than 90% of the repayment is from revenue generated by the facility. Issuers of taxable PABs must pay higher interest rates than required on tax-exempt bonds, to compensate investors for the taxes due on interest income. Congress therefore created an exception allowing airports that are owned by governmental entities to issue "qualified" PABs that are tax-exempt.  The majority of airport bonds are considered by the Internal Revenue Service to be "qualified" PABs. Some recent proposals would allow privately owned airports to receive the same tax-preferred treatment of their bonds as airports owned by public authorities. A possible precedent for this is the Safe, Accountable, Flexible, Efficient Transportation Equity Act: A Legacy for Users ( P.L. 109-59 , §1143; SAFETEA-LU), which allowed for up to $15 billion in tax-exempt bond financing for highways or freight transfer facilities that would otherwise not qualify for tax-exempt financing. Many of the supporters of the SAFETEA-LU provisions envisioned expanded eligibility for PABs as a means of facilitating public-private partnerships between a public authority and an outside investor. In the airport context, this would be analogous to an airport authority agreeing to a long-term lease with a private investor who would have the ability to enter the market for tax-exempt bonds to finance improvements at the airport and, perhaps, also to finance the purchasing costs of the lease itself. By statute, the safe operation of airports is the highest aviation priority. Other priorities established by Congress include increasing capacity to the maximum feasible extent, minimizing noise impacts, and encouraging efficient service to state and local communities (i.e., support for general aviation airports). But there are significant disagreements about the appropriate degree of federal participation in airport development and finance and about the specific types of expenditure that should be given priority within AIP. Airline and airport operators tend to view the fully authorized funding of the program as a good thing. An alternative view, however, is that too much has been spent on AIP, particularly at smaller airports that do not play a significant role in commercial aviation. The assessment of airport capital needs is fundamental to determining the appropriate federal support needed to foster a safe and efficient national airport system. The federal government's interest goes beyond capacity issues to include implementation of federal safety and noise policies. Both FAA and the Airports Council International-North America (ACI-NA) have issued projections of airports' long-term financial needs. In its most recent NPIAS report, FAA estimated that the national system's capital needs for FY2019-FY2023 will total $35.1 billion (an annual average of approximately $7 billion). The ACI-NA infrastructure needs survey resulted in an estimate of $128.1 billion over the same years (an annual average of approximately $25.6 billion). The main reason for the widely differing estimates was disparate views on what kinds of airport projects to include. The NPIAS report was based on information taken from airport master plans and state system plans, but FAA planners screened out planned projects not justified by aviation activity forecasts or not eligible for AIP grants. Only designated NPIAS airports were included in the FAA study. Implicit in this methodology is that the planning has been carried through to the point where financing is identified. Not all projects used to develop the NPIAS estimates are actually completed, or in some cases even begun, within the range of years covered in the NPIAS estimates. ACI-NA argues that the NPIAS underestimates AIP eligible needs because not all such needs will be in the current airport plans. The ACI-NA study reflects the broader business view of major airport operators and casts a substantially wider net. It includes projects funded by PFCs, bonds, or state or local funding; airport-funded air traffic control facilities; airport- or TSA-funded security projects; "necessary" AIP-ineligible projects such as parking facilities, hangars, revenue portions of terminals, and off-airport roads/transit facilities; and AIP-eligible projects not reported to FAA in the belief that there would be a low probability of receiving additional AIP funding. Its 2019-2023 infrastructure needs survey, for example, included major airport terminal projects that are ineligible for AIP grants. The ACI-NA study also includes projects without identified funding sources. The ACI-NA estimate is higher than the FAA estimate because of the wider net it casts and because it is adjusted for projected inflation. The estimates are important because the primary AIP reauthorization issue is the program's appropriate level of funding. Because the ACI-NA airport needs projection includes much that is not eligible for AIP grants, its accuracy may not be as critical in evaluating appropriate AIP funding levels as that of the NPIAS projections. On the other hand, the broader ACI-NA estimate may be more significant for policy choices related to bond issuance and PFCs, since these sources fund a broader range of projects than AIP. In 2004, then-FAA Administrator Marion C. Blakey stated that the agency's goal was to increase total capacity at the top 35 U.S. airports by 30% over a 10-year period. FAA's Operational Evolution Plan (OEP) is intended to increase the capacity and efficiency of the National Airspace System (NAS) over a 10-year period to keep up with the expected growth in demand for air travel and air cargo. In support of that goal, FAA released a study focused on the 35 busiest airports, Capacity Needs in the National Airspace System: An Analysis of Airport and Metropolitan Area Demand and Operational Capacity in the Future (also referred to as FACT1). The study projected 18 airports would need additional capacity by 2020. In 2007, FACT1 was updated by a second study, FACT2. FACT2 expanded the study to include 21 non-OEP airports that were identified as having the potential to be capacity constrained or were in capacity-constrained metropolitan areas. The study examined airports that would need capacity increases and also projected which airports would need capacity increases in 2015 and 2025. It identified four airports plus the New York metropolitan area that needed additional capacity in 2007. It further identified 14 hub airports as likely to be capacity-constrained in 2025. FACT2 found that, in comparison to FACT1, many non-OEP airports "... have higher capacities than originally presumed and thus less need for additional capacity." A further update, FACT3, was released in January 2015. FACT3 forecasted that the 2007-2009 recession, volatile fuel costs, airline consolidation, and replacement of many 50-seat regional jets with larger aircraft would result in 32% fewer operations and about 23% fewer enplanements in 2025 at the 30 core airports than forecast in FACT2. It projected that airport delays would remain concentrated at a few major hub airports, notably the three New York City-area airports, Philadelphia International Airport, and Hartsfield-Jackson Atlanta International Airport. This study may have implications for the reauthorization of AIP. The large runway projects that are the focus of the OEP can require long lead times—10 or more years from concept to initial construction is not unusual. At large and medium hub airports, runway projects are usually paid for, in part, by AIP funds. Therefore, some projects needed by 2025 may require AIP funding in earlier years. Because large and medium airports that levy PFCs must forgo either 50% or 75% of their AIP formula entitlement funds, most federal funding for their runway projects would probably need to take the form of AIP discretionary funds. The pool of discretionary funds is primarily the remainder of annual funding after the entitlement formula requirements are satisfied. Of the forgone PFC funds, 87.5% are reserved for the small airport fund and are also not available for OEP airports. If the AIP budget is constrained in the future, either under a reauthorization bill or during the annual appropriations process, and the entitlement formulas remain as they are, the discretionary portion of the AIP budget may be squeezed, limiting large airports' ability to draw on AIP funds for major capacity expansion projects. Many of the attributes of AIP's programmatic structure are similar to those of the 1982 act that created the program. Over the years these attributes have been modified based on perceived needs and on the practical politics of passing the periodic FAA reauthorization bills that contain the AIP provisions. These considerations make a major overhaul of the AIP structure unlikely, but may leave room for programmatic adjustments in the distribution of apportionments. One such adjustment might shift AIP funds to enhancing capacity at large and medium hub airports. There are several ways Congress might accomplish this. One would be to eliminate the requirement that large and medium hub airports that impose the maximum PFCs forgo 75% of their entitlements. This change would give larger airports a greater share of entitlement funding, but at the cost of reducing AIP grants to small airports. Alternatively, changes in the statutory set-asides of discretionary funds could give FAA more flexibility to use that money for capacity enhancement, but might reduce funding for noise mitigation and other purposes. Changes in the last several FAA authorization acts increased entitlements and broadened the range of landside projects eligible for AIP grants. These changes generally benefitted airports smaller than medium hub size. In particular, the increased amount of apportioned funds has limited the availability of funds for discretionary grants at major airports. Further changes giving airports increased flexibility in the use of their entitlements might benefit smaller airports not served by commercial aviation, in line with the national goal of having an "extensive" national airport system, but this use of funds might conflict with the goal of reducing congestion at major commercial airports. The current apportionment system relies on a $3.2 billion funding level trigger mechanism to lift most of the apportionments to twice their formula level. This has been in place for two reauthorization cycles. Should that trigger be breached, entitlements for all airports would be reduced drastically. The entitlement formulas may not be sustainable, without depleting discretionary funds, in the absence of additional funding for AIP. One way to reduce the amount of trust fund revenue needed for AIP would be to allow large and medium hub airports to opt out of AIP and rely exclusively on PFCs to finance capital projects. This would require raising or eliminating the federal cap on PFCs. These "defederalized" airports could then be released from some or all of the AIP grant assurances under which they now operate, such as land use requirements and airport revenue use restrictions. If airports exit the program, AIP spending could be reduced or could be redirected to other NPIAS airports. Airport privatization denotes a change in ownership from a public entity (such as a local government or an airport authority established by a state government) to a private one. In a number of countries, such as Great Britain, government-owned airports have been privatized by sale to private owners. In the United States, some airports have allowed private ownership of certain on-airport facilities or management functions, but the ownership of all major airports remains in the hands of government entities. The Airport Privatization Pilot Program (49 U.S.C. §47134; Section 149 of the Federal Aviation Reauthorization Act of 1996, P.L. 104-264 , as amended) authorizes FAA to exempt up to 10 airports from certain federal restrictions on the use of airport revenue off-airport. Participating airports may be also exempted from certain requirements on the repayment of federal grants. Privatized airports may still participate in the AIP, but at a lower federal share (70%). The pilot program was renamed the Airport Investment Partnership Program (AIPP) in the 2018 FAA reauthorization act and expanded to admit more than 10 airports. The AIPP provides that at primary airports, the airport sponsor may only recover from the sale or lease an amount approved by at least 65% of the scheduled air carriers serving the airport, as well as by both scheduled and unscheduled air carriers that together account for 65% of the total landed weight at the airport for the year. The requirement that air carriers approve the use of airport revenue for nonairport purposes, such as profit distribution, may have served to limit interest in the program. To date, only two airports have completed the privatization process established under the provisions of the AIPP. One of those, Stewart International Airport in New York State, subsequently reverted to public ownership when it was purchased by the Port Authority of New York and New Jersey. Luis Muñoz Marín International Airport in San Juan, PR, is now the only commercial service airport operating under private management after privatization under the APPP. As of 2018, there are three applicants under active FAA consideration: Hendry County Airglades Airport in Clewiston, FL; Westchester Airport in White Plains, NY; and St. Louis Lambert International Airport in St. Louis, MO. There is no certainty that any AIP cost savings from privatization would be retained for use by the other AIP-eligible airports. AIP spending is determined by the authorization and appropriations process, and Congress could choose to use any savings to reduce the program size, to marginally assist in deficit reduction, to reduce general fund portions of FAA operations funding, or to make money available for spending elsewhere. Debate over FAA reauthorization generally brings forth proposals to alter the AIP grant assurances, such as ensuring that workers on airport construction projects receive prevailing wages set under the Davis-Bacon Act and pledging to use airport revenue solely for spending on airport operations and capital costs. If AIP spending remains constrained, critics are likely to argue that the grant assurances raise the cost of projects to increase airport capacity and complicate the closure and reuse of underutilized airports or airports that are locally unpopular due to noise or safety concerns. Historically, a basic funding issue is whether to change the existing discretionary fund set-aside for noise mitigation and abatement. The noise set-aside, however, has been increased in previous reauthorization acts and is now 35% of discretionary funding. Demand to use AIP funds for noise mitigation could increase if Congress grants FAA the flexibility to fund noise mitigation projects that are outside the DNL 65 decibel (dB) noise impact area, but this could divert resources from capacity and safety projects. A related issue is whether to make the planning for noise-mitigating air traffic control procedures at individual airports eligible for AIP funding. The central issue related to PFCs is whether to raise the $4.50 per enplaned passenger ceiling or to eliminate the ceiling altogether. In general, airports argue for increasing or eliminating the ceiling, whereas most air carriers and some passenger advocates oppose higher limits on the PFCs. A 2015 GAO study analyzed the effects by raising the PFC cap under three scenarios: setting the cap at $6.47, $8.00, or $8.50. The study found raising PFC would significantly increase airport funding, but could also marginally slow passenger growth and therefore the growth in revenues to the trust fund. PFC supporters feel that the PFC is more reliable than AIP funding, which is subject to the authorization and appropriations process. They also argue that PFCs are procompetitive, helping airports build gates and facilities that both encourage new entrant carriers and allow incumbent carriers to expand. Advocates of an increase in the cap also argue that over time, the value of the PFC has been eroded by inflation and an adjustment is therefore necessary. The permissible uses of revenues are an ongoing point of contention. Airport operators, in particular, would like more freedom to use PFC funds for off-airport projects, such as transportation access projects, and want the process of obtaining FAA approval to be streamlined. Carriers, on the other hand, often complain that airports use PFC funds to finance proposals of dubious value, especially outside airport boundaries, instead of high-priority projects that offer meaningful safety or capacity enhancements. The major air carriers are also unhappy with their limited influence over project decisions, as airports are required only to consult with resident air carriers instead of having to get their agreement on PFC-funded projects. Unlike interest income from governmental bonds, which is not subject to the alternative minimum tax (AMT), interest from private activity bonds is still subject to the AMT. ACI-NA has proposed broadening the definition of governmental airport bonds to, in effect, include either all airport bonds or at least those bonds issued for public-use projects that meet AIP or PFC eligibility requirements. Opponents of such changes express concerns that these changes would reduce U.S. Treasury revenues. Some also argue it would make more sense to change the AMT as part of a tax bill rather than including a specific exemption for income on airport bonds in an FAA reauthorization bill. In either case, such a change would not be under the jurisdiction of the congressional committees that will have jurisdiction over most reauthorization provisions. Changes to the AMT would be under the jurisdiction of the congressional tax-writing committees, the House Committee on Ways and Means and the Senate Committee on Finance. Appendix A. Legislative History of Federal Grants-in-Aid to Airports Prior to World War II the federal government viewed airports as a local responsibility. During the 1930s, it spent about $150 million a year on airports through work relief agencies such as the Works Progress Administration (WPA). The first federal support for airport construction was granted during World War II. After the war, the Federal Airport Act of 1946 (P.L. 79-377) created the Federal Aid to Airports Program, using funds appropriated annually from the general fund. Initially much of this spending supported conversion of military airports to civilian use. In the 1960s substantial funding went to upgrade and extend runways for use by commercial jets. By the end of the 1960s, congestion, both in the air and on the ground at U.S. airports, was seen as evidence that airport capacity was inadequate. Airport and Airway Development and Revenue Acts of 1970 (P.L. 91-258) In 1970, Congress responded to the capacity concerns by passing two acts. The first, the Airport and Airway Development Act (Title I of P.L. 91-258), established the Airport Development Aid Program (ADAP) and the Planning Grant Program (PGP), and set forth the programs' grant criteria, distribution guidelines, and authorization of grant-in-aid funding for the first five years of the program. The second, the Airport and Airway Revenue Act of 1970 (Title II of P.L. 91-258), established the Airport and Airway Trust Fund. Revenues from levies on aviation users and fuel were dedicated to the fund. Under the 1970 acts the trust fund could pay capital costs and, when excess funds existed, could also help cover FAA's administrative and operations costs. Airport and Airway Development and Revenue Acts Amendments of 1971 (P.L. 92-174) The Nixon Administration's FAA budget requests for FY1971 and FY1972 under the new trust fund system brought it into immediate conflict with Congress over the budgetary treatment of trust fund revenues. The Administration treated the new financing system as a user-pay system, whereas many Members of Congress viewed the trust fund as primarily a capital fund. The 1971 Amendments Act made the trust fund a capital-only account (although only through FY1976), disallowing the use of trust fund revenues for FAA operations. Airport and Airway Development Amendments Act of 1976 ( P.L. 94-353 ) The 1976 act made a number of adjustments to the ADAP and reauthorized the Airport and Airway Trust Fund through FY1980. The act again allowed the use of trust fund resources for the costs of air navigation services (a part of operations and maintenance). However, in an attempt to assure adequate funding of airport grants, the act included "cap and penalty" provisions which placed an annual cap on spending for costs of air navigation systems and a penalty that reduced these caps if airport grants were not funded each year at the airport program's authorized levels. This cap was altered multiple times in reauthorization acts in the following decades. ADAP grants totaled about $4.1 billion from 1971 through 1980. Congress did not pass authorizing legislation for ADAP during FY1981 and FY1982, during which the aviation trust fund lapsed, although spending for airport grants continued. Airport and Airway Improvement Act of 1982 ( P.L. 97-248 ) The 1982 act created the current AIP and reactivated the Airport and Airway Trust Fund. It altered the funding distribution among the newly defined categories of airports, extending aid eligibility to privately owned general aviation airports, increasing the federal share of eligible project costs, and earmarking 8% of total funding for noise abatement and compatibility planning. The act also required the Secretary of Transportation to publish a national plan for the development of public-use airports in the United States. This biannual publication, the National Plan of Integrated Airport Systems (NPIAS) , identifies airports that are considered important to the national aviation system. For an airport to receive AIP funds it must be listed in the NPIAS. Although the 1982 act was amended often in the 1980s and early 1990s, the general structure of AIP remained the same. The Airport and Airway Safety and Capacity Expansion Act of 1987 ( P.L. 100-223 ; 1987 act) authorized significant spending increases for AIP and added a cargo service apportionment. It also included provisions to encourage full funding of AIP at the authorized level. Title IX of P.L. 101-508 , the Omnibus Budget Reconciliation Act of 1990 (OBRA1990), included the Aviation and Airway Safety and Capacity Act of 1990, which allowed airports, under certain conditions, to levy a Passenger Facility Charge (PFC) to raise revenue and also established the Military Airport Program (MAP), which provided AIP funding for capacity and/or conversion-related projects at joint-use or former military airports. The Airport Noise and Capacity Act of 1990 (OBRA 1990, Title IX, Subtitle D) set a national aviation noise policy. OBRA1990 included the Revenue Reconciliation Act of 1990, which reauthorized the Aviation Trust Fund and adjusted some of the aviation taxes. The Federal Aviation Reauthorization Act of 1994 ( P.L. 103-305 ) reauthorized AIP for two more years and again made modifications in the cap and penalty provisions. Federal Aviation Reauthorization Act of 1996 ( P.L. 104-264 ) The 1996 reauthorization of the AIP made a number of adjustments to entitlement funding and discretionary set-aside provisions. It also included directives concerning intermodal planning, cost reimbursement rules, letters of intent, and the small airport fund. A demonstration airport privatization program and a demonstration program for innovative financing techniques were established. The demonstration status of the state block grant program was removed. The act did not reauthorize the taxes that supported the Airport and Airway Trust Fund. This was done by the Taxpayer Relief Act of 1997 ( P.L. 105-34 ), which extended, subject to a number of modifications, the existing aviation trust fund taxes through September 30, 2007. The Wendell H. Ford Aviation Investment and Reform Act for the 21 st Century of 2000 (AIR21; P.L. 106-181 ) The enactment of AIR21 was the culmination of two years of legislative effort to pass a multiyear FAA reauthorization bill. The initial debate focused on provisions to take the aviation trust fund off-budget or erect budgetary "firewalls" to assure that all trust fund revenues and interest would be spent each year for aviation purposes. These proposals, however, never emerged from the conference committee. Instead, the enacted legislation included a so-called "guarantee" that all of each year's receipts and interest credited to the trust fund would be made available annually for aviation purposes. AIR21 did not make major changes in the structure or functioning of AIP. It did, however, greatly increase the amount available for airport development projects. The AIP funding authorization rose from $1.9 billion in FY2000 to $3.4 billion in FY2003. The formula funding and minimums for primary airports were doubled starting in FY2001. The state apportionment for general aviation airports was increased from 18.5% to 20%. The noise set-aside was increased from 31% to 34% of discretionary funding and a reliever airport discretionary set-aside of 0.66% was established. AIR21 also increased the PFC maximum to $4.50 per boarding passenger. In return for imposing a PFC above the $3 level, large and medium hub airports would forgo 75% of their AIP formula funds. This had the effect of making a greater share of AIP funding available to smaller airports. Vision 100: Century of Aviation Reauthorization Act of 2003 ( P.L. 108-176 ; H.Rept. 108-334 ) Vision 100, signed by President George W. Bush on December 12, 2003, included significant changes to AIP. The law codified the AIR21 spending "guarantees" through FY2007. It increased the discretionary set-aside for noise compatibility projects from 34% to 35%. It increased the amount that an airport participating in the Military Airport Program (MAP) could receive to $10 million for FY2004 and FY2005, but in FY2006 and FY2007 it returned the maximum funding level to $7 million. The act allowed nonprimary airports to use their entitlements for revenue-generating aeronautical support facilities, including fuel farms and hangars, if the Secretary of Transportation determines that the sponsor has made adequate provisions for the airside needs of the airport. The law permitted AIP grants at small airports to be used to pay interest on bonds issued to finance airport projects. The act included a trial program to test procedures for authorizing small airports to impose PFCs. Vision 100 repealed the authority to use AIP or PFC funds for most airport security purposes. FAA Modernization and Reform Act of 2012 ( P.L. 112-95 ) The 2012 FAA reauthorization act funded AIP for four years from FY2012 to FY2015 at an annual level of $3.35 billion. A new provision, Section 138, permitted small airports reclassified as medium hubs due to increased passenger volumes to retain eligibility for up to a 90% federal share for a two-year transition period. This provision also allows certain economically distressed communities receiving subsidized air service to be eligible for up to a 95% federal share of project costs. The 2012 act maintained the $4.50 PFC cap, with a maximum charge of $18 per round-trip flight. It included a provision that instructed GAO to study alternative means for collecting PFCs. The act also expanded the number of airports that could participate in the airport privatization pilot program from 5 to 10. This law was extended through July 15, 2016. The FAA Extension, Safety, and Security Act of 2016 ( P.L. 114-190 ) The 2016 FAA extension act funded AIP through FY2017 at an annual level of $3.35 billion. A new provision, Section 2303, provided temporary relief to small airports that had 10,000 or more passenger boardings in 2012 but had fewer than 10,000 during the calendar year used to calculate the AIP apportionment for FY2017. This provision allowed such airports to receive apportionment for FY2017 an amount based on the number of passenger boardings at the airport during calendar year 2012. The FAA Reauthorization Act of 2018 ( P.L. 115-254 ) The 2018 FAA reauthorization act funded AIP for five years from FY2019 through FY2023 at an annual level of $3.35 billion. It also authorized supplemental annual funding from the general fund to the AIP discretionary funds—$1.02 billion in FY2019, $1.04 billion in FY2020, $1.06 billion in FY2021, $1.09 billion in FY2022, and $1.11 billion in FY2023—and required at least 50% of the additional discretionary funds to be available to nonhub and small hub airports. The act included a provision permitting eligible projects at small airports (including those in the State Block Grant Program) to receive 95% federal share of project costs (otherwise capped at 90%), if such projects are determined to be successive phases of a multiphase construction project that received a grant in FY2011. The 2018 reauthorization expanded the number of states that could participate in the State Block Grant Program from 10 to 20 and also expanded the existing airport privatization pilot program (now renamed the Airport Investment Partnership Program) to include more than 10 airports. The law included a provision that forbids states or local governments from levying or collecting taxes on a business on an airport that "is not generally imposed on sales or services by that State, political subdivision, or authority unless wholly utilized for airport or aeronautical purposes." Appendix B. Definitions of Airports Included in the NPIAS Commercial Service Airports Publicly owned airports that receive scheduled passenger service and board at least 2,500 passengers each year (506 airports). Primary Airports . Airports that board more than 10,000 passengers each year. There are four subcategories: Large Hub Airports . Board 1% or more of system -wide boardings ( 30 airports, 72 % of all enplanements)Medium Hub Airports . Board 0.25% but less than 1% (31 airports, 16% of all enplanements) Small Hub Airports . Board 0.05% but less than 0.25% (72 airports, 8% of all enplanements) Non hub Primary Airports . Board more than 10,000 but less than 0.05% (247 airports, 3% of all enplanements) Non primary Commercial Service Airports . Board at least 2,500 but no more than 10,000 passengers each year (126 airports, 0.1% of all enplanements). Other Airports General Aviation Airports . General aviation airports do not receive scheduled commercial or military service but typically do support business, personal, and instructional flying; agricultural spraying; air ambulances; on-demand air-taxies; and/or charter aircraft service (2,554 airports). Reliever Airports . Airports designated by FAA to relieve congestion at commercial airports and provide improved general aviation access (261 airports). Cargo Service Airports . Airports served by aircraft that transport cargo only and have a total annual landed weight of over 100 million pounds. An airport may be both a commercial service and a cargo service airport. New Airports Seven airports are anticipated to be built between 2019 and 2023. They include two primary airports, two nonprimary commercial service airports, and three general aviation airports.

Question: Write a one-page summary of the report 1.

Answer: "Cross-border data flows" refers to the movement or transfer of information between computer servers across national borders. Such data flows enable people to transmit information for online communication, track global supply chains, share research, provide cross-border services, and support technological innovation. Ensuring open cross-border data flows has been an objective of Congress in recent trade agreements and in broader U.S. international trade policy. The free flow of personal data, however, has raised security and privacy concerns. U.S. trade policy has traditionally sought to balance the need for cross-border data flows, which often include personal data, with online privacy and security. Some stakeholders, including some Members of Congress, believe that U.S. policy should better protect personal data privacy and security, and have introduced legislation to set a national policy. Other policymakers and analysts are concerned about increasing foreign barriers to U.S. digital trade, including data flows. Recent incidents of private information being shared or exposed have heightened public awareness of the risks posed to personal data stored online. Consumers' personal online data is valued by organizations for a variety of reasons, such as analyzing marketing information and easing the efficiency of transactions. Concerns are likely to grow as the amount of online data organizations collect and the level of global data flows expand. As Congress assesses policy options, it may further explore the link between cross-border data flows, online privacy, and trade policy; the trade implications of a comprehensive data privacy policy; and the U.S. role in establishing best practices and binding trade rules that seek to balance public policy priorities. There is no globally accepted standard or definition of data privacy in the online world, and there are no comprehensive binding multilateral rules specifically about cross-border data flows and privacy. Several international organizations, including the Organisation for Economic Co-operation and Development (OECD), G-20, and Asia-Pacific Economic Cooperation (APEC) forum, have sought to develop best practice guidelines or principles related to privacy and cross-border data flows, although none are legally binding. U.S. and other recent trade agreements are establishing new enforceable trade rules and disciplines. Countries vary in their data policies and laws; some focus on limiting access to online information by restricting the flow of data beyond a country's borders, aiming to protect domestic interests (e.g., constituents' privacy). However, these policies can also act as protectionist measures. The EU and China, two top U.S. trading partners, have established prescriptive rules on cross-border data flows and personal data from different perspectives. The EU General Data Protection Regulation (GDPR) is driven by privacy concerns; China is focused on security. Their policies affect U.S. firms seeking to do business in those regions, as well as in other markets that emulate the EU and Chinese approaches. Unlike the EU or China, the United States does not broadly restrict cross-border data flows and has traditionally regulated privacy at a sectoral level to cover data, such as health records. U.S. trade policy has sought to balance the goals of consumer privacy, security, and open commerce. The proposed United States-Mexico-Canada Agreement (USMCA) represents the Trump Administration's first attempt to include negotiated trade rules and disciplines on privacy, cross-border data flows, and security in a trade agreement. While the United States and other countries work to define their respective national privacy strategies, many stakeholders seek a more global approach that would allow interoperability between differing national regimes to facilitate and remove discriminatory trade barriers to cross-border data flows; this could offer an opportunity for the United States to lead the global conversation. Although Congress has examined issues surrounding online privacy and has considered multiple bills, there is not yet consensus on a comprehensive U.S. online data privacy policy. Congress may weigh in as the Administration seeks to define U.S. policy on data privacy and engages in international negotiations on cross-border data flows.