You are given two reports by the government agency.  

Report 1:
The Department of Defense (DOD) obligates more than $300 billion annually to pay for goods and services (including research and development). Most of these acquisitions are governed by numerous statutes and regulations found in Title 10 of the United States Code, the Federal Acquisition Regulation (FAR), and the Defense Federal Acquisition Regulation Supplement (DFARS). DOD can also enter into certain transactions without triggering most of the standard acquisition statutes and regulations by using other transaction (OT) authorities. In recent years, Congress has expanded these authorities and DOD is increasingly using OTs for research, prototyping, and production. This report examines (1) how OTs work, (2) why they were established, (3) potential benefits and risks of using OTs, and (4) whether there are data available against which to measure their effectiveness. Appendix A provides a legislative history of DOD's other transaction authorities. On October 4, 1957, the Soviet Union triggered a space race with the United States when it successfully launched Sputnik I into orbit, becoming the first nation to send a man-made satellite into space. Congress, concerned that the United States was falling behind in space, held a series of hearings on an "emergency" effort to respond to the Soviet launch of Sputnik. At the same time, a bill was introduced in the Senate to create an agency with the means to quickly and efficiently develop a national space program. These efforts led to passage of the National Aeronautics and Space Act of 1958 (Space Act, P.L. 85-568) in July 1958, which established the National Aeronautics and Space Administration (NASA). In an effort to give the new agency "the necessary freedom to carry on research, development, and exploration ... to insure the full development of these peaceful and defense uses without unnecessary delay," the Space Act granted NASA broad authority to "enter into and perform such contracts, leases, cooperative agreements, or other transactions as may be necessary" to accomplish its mission of research and exploration (emphasis added). Congress extended different variations of OT authorities to other select agencies, granting the authority to DOD in the FY1990 & 1991 National Defense Authorization Act (NDAA, P.L. 101-189 ). For an analysis of which non-DOD agencies can use OTs and how the authorities differ by agency, see Appendix B . Other transactions are legally binding contracts that are generally exempt from federal procurement laws and regulations such as the Competition in Contracting Act and the Federal Acquisition Regulation. In contrast, traditional procurement contracts must adhere to the procurement rules set forth in statute and regulation. Generally, DOD can use other transaction authorities for three purposes: 1. conduct research, 2. develop prototypes, or 3. contract for follow-on production of a successful prototype project. DOD's other transaction authorities are found in two sections of law: 10 U . S . C . 2371 grants DOD the authority to use other transactions to carry out basic, applied, and advanced research projects. DOD regulations treat these projects as financial assistance instruments, not as contracts. 10 U . S . C . 2371b permits the use of other transactions to conduct prototype projects and follow-on production. OTs can only be used for prototypes if one of the following applies: at least one nontraditional defense contractor significantly participating in the project; all significant participants are small businesses or nontraditional defense contractors; at least one-third of the total cost of the prototype project is provided by nongovernment participants; or the senior procurement acquisition official provides in writing an explanation of the exceptional circumstances justifying an OT. Follow-on production can only be conducted when the underlying prototype OT was competitively awarded, and the prototype project was successfully completed. 10 U . S . C . 2373 , while generally not considered an o ther t ransaction authority , allows DOD to buy certain items and designs for experimental or test purposes without having to adhere to the procurement laws set forth in Chapter 137 of Title 10. OT authorities grant government officials the flexibility to include, amend, or exclude contract clauses and requirements that are mandatory in traditional procurements (e.g., termination clauses, payments, audit requirements, intellectual property, and contract disputes). OTs can be structured in numerous ways, including a direct relationship between a single government agency and a single provider; joint ventures; partnerships; multiple agencies joining together to fund an agreement encompassing multiple providers; or through a consortium. One common application of OTs is to forge an agreement with a consortium. A consortium is an organized group— it can consist of nonprofits, academic institutions, or contractors— focusing on a specific technology area. Generally, a lead entity coordinates and directs a consortium's activities. Consortia have consisted of a handful to as many as 1,000 members. Consortia can act to facilitate multiparty agreements whereby each member is akin to its own co-prime contractor with the government. In such a case, the government articulates the need or problem it is trying to solve, and the various members of the consortium can submit white papers for consideration. In this scenario, OTs can serve as an efficient way for all members to send unsolicited technology suggestions and solutions to solve a defined challenge. Consortia can also be used to develop an ecosystem of entities working together on a project, whereby members of a consortium pool resources and collaborate with DOD. A number of analysts argue that using consortia in this way gives the federal government a unique ability to leverage and pool the technological expertise and innovation of multiple entities in a particular sector, thereby strengthening and advancing a sector of the industrial base that may have defense applications. Seen like this, OTs can be considered a mechanism to promote defense technology and the defense industrial base, with the potential added benefit of advancing the domestic commercial technology base. Some analysts, however, have argued that many of today's consortia do not operate as collaborative organizations, but function more like managed multiple award task order contracts. These analysts argue that DOD should seek to foster more collaboration in consortia. Some analysts have argued that consortia reduce competition, since only members of the consortium under contract can participate in the project or submit white papers for consideration and funding. Others counter that even when an OT is signed with a single consortium, competition could be increased, since all members of the consortium are notified of the opportunity (expanding the pool of potential competitors aware of the opportunity), and the OT will foster internal competition among consortium members. OTs are not procurement contracts and thus are exempt from numerous procurement statutes and regulations, including the statutes in Chapter 137 of Title 10 ( Procurement Generally ). They are, however, bound by standard contract and other select laws and regulations. Examples of laws that do not apply include the Truth in Negotiations Act, Competition in Contracting Act, Cost Accounting Standards, Contract Disputes Act, and select intellectual property statutes such as the Bayh-Dole Act. A number of these laws are aimed at oversight and protecting the interests of taxpayers. While the Competition in Contracting Act does not apply, 10 U.S.C. 2371b requires that research and prototype projects be competed "to the maximum extent practicable." DOD policy mirrors the statutory language, stating "[C]ompetition is a good thing. It helps keep prices low, quality high, and gives the government leverage in negotiations." To the extent that OTs induce nontraditional contractors to work with DOD, OTs can be viewed as promoting competition among (and within) entities that would not normally compete for DOD contracts. However, the lack of explicitly defined competition requirements could result in less competition for certain OTs. OTs are not free from all legislative and regulatory requirements. Generally, statutes and regulations that are not procurement-specific apply, including the Trade Secrets Act, (18 U.S.C. 1905); the Economic Espionage Act (18 U.S.C. 1831-39); elements of the Freedom of Information Act (5 U.S.C. 552); and fiscal and property laws, such as the Anti-deficiency Act (31 U.S.C. 1341); and the Tucker Act (28 U.S.C. 1491). As can be seen by these citations, many of these statutes are not located in the procurement titles of Title 10 or Title 41. The Government Accountability Office (GAO) has held that OTs are not procurement contracts, and therefore it will not review protests of such an award or solicitation. However, GAO will review "a timely protest that an agency is improperly using its other transaction authority." OT contracts can be protested to the Court of Federal Claims, although there is debate as to the extent of the court's jurisdiction. The limited protest jurisdiction of GAO is appealing to many government procurement officials. One senior Air Force official reportedly stated that OTs are "just so much faster and so much more attuned to getting something that we want today and not have to spend a couple of years going through a protest, going through this huge process to get something we wanted two years ago." It generally does not take that long to go through a GAO protest. By statute, GAO must issue an opinion on a protest within 100 days of the protest being filed, and 70% of cases are resolved in less than 60 days. While exempt from GAO bid protests, OTs are not exempt from GAO audits. Generally, OTs that include government payments exceeding $5 million are required to include a clause granting GAO the right to examine the records of any related party. However, this requirement has a number of limitations. Used properly, OTs can provide significant benefits to DOD. Along with the potential benefits come certain risks. Some of the potential benefits to OTs highlighted by analysts and officials include providing a mechanism to pool R&D resources with industry to facilitate development of, and obtain "the latest state-of-the-art, dual use technologies"; attracting nontraditional contractors with promising technological capabilities to work with DOD; lowering costs by eliminating requirements associated with the Federal Acquisition Regulations (i.e., costs associated with required reporting and administrative activities) or sharing costs with industry; and "speeding up" the acquisition process. A number of experts argue that OTs provide a unique mechanism for DOD to invest in, and influence the direction of, technology development even when the end result is not directly tied to a military capability. As one observer noted, the real benefit to DOD may be that [t]he R&D has been accomplished and is available to the technical and scientific communities. As a result, a subsequent phase of research can begin or a particular approach can be demonstrated to be of no value. Some argue that OTs have particular import today. Drawing parallels to the space race, these analysts argue that DOD is engaged in a defense technology race. According to the 809 Panel: DoD is now in a period during which the time a particular technology is a dominant force on the battlefield is getting increasingly shorter, disruptive technologies are emerging at a faster pace, and these technologies are more widely dispersed…In a world with rapidly changing technology, time is a valuable resource that must not be taken for granted. It is difficult to predict what capabilities DoD will need 5 to 10 years from now—biotechnology, nanotechnology, artificial intelligence, robotics, or a new technology area not even known today. It also is unclear on what plane the military will conduct warfare—traditional battlefields, space, cyberspace, or some other domain. The current acquisition system lacks the agility needed to adapt to new paradigms. These analysts argue that OTs and similar rapid acquisition authorities are critical for DOD to compete in such a fast-paced global environment where technology and innovation are no longer driven by DOD, but by industry and foreign competitors. In 1960, the United States accounted for 69% of global R&D, with U.S. defense-related R&D alone accounting for more than one-third of global R&D. The federal government funded approximately twice as much R&D as U.S. business. However, from 1960 to 2016, the U.S. share of global R&D fell to 28%, and the federal government's share of total U.S. R&D fell from 65% to 24%, while business's share more than doubled from 33% to 67%. As a result of these global, national, and federal trends, federal defense R&D's share of total global R&D fell to 3.7% in 2016. Given the shift in the global R&D landscape, and the diminishing influence of DOD as a market mover, analysts suggest that the current procurement system is overburdened by regulations and bureaucratic processes that slow the system, increase costs, and dissuade companies from doing business with DOD. In contrast, OTs are viewed as faster, attracting companies that would otherwise forgo working with DOD and promoting broader investment in critical defense capabilities. As one analyst wrote: OTAs are currently the only way to remove the barriers necessary to get these nontraditional sources of innovation to do business with the military. Properly constructed, OTAs help speed up the process, respect a company's IP through negotiation rather than regulatory fiat, and result in contracting under commercial terms and conditions. Congress also appears to have shifted its view on appropriate use of other transactions. In the FY1999 conference report, Congress stated that [OT] authority should only be used in the exceptional cases where it can be clearly demonstrated that a normal contract or grant will not allow sufficient access to affordable technologies. By comparison, in the FY2018 NDAA, Congress expanded OT authorities and stated the following: In the execution of science and technology and prototyping programs, the Secretary of Defense shall establish a preference, to be applied in circumstances determined appropriate by the Secretary, for using transactions other than contracts, cooperative agreements, and grants. Along with the potential benefits come potential risks, including that of diminished oversight and exemption from laws and regulations designed to protect government and taxpayer interests. Some analysts, while acknowledging the important role of OTs, raise concerns over transparency and how these agreements are being employed. As one industry official stated, OTs are a contracting method, not a substitute for good acquisition practices. Discussing a particular OT for cloud services that was protested and ultimately cancelled by DOD, one observer argued The cloud contract provides a teachable moment for procurement reform-minded officials in the Pentagon and Capitol Hill. The problem was not with the OTA mechanism, which remains an essential element of reforming Pentagon procurement. Rather, the problem was with a lack of transparency with how the mechanism was employed. Scott Amey, general counsel of the Project on Government Oversight, cautioned We have to seriously consider how we are using [OTs]; whether we are using them as intended, whether we are getting the goods and services that we really want and need, whether we are getting them at the best cost and process, and we are using this procurement vehicle as a way to just circumvent the rules and have contractors not have the administration and oversight they need to hold them accountable. I'm just afraid this is going to result in a lot of waste, fraud, and abuse in the future. Congress has expressed repeated concerns that OTs could be used to circumvent congressional intent. In the FY1999 NDAA, the committees emphasized that the authority should only be used in a limited manner. The conference report stated the following: The conferees are especially concerned that such authority not be used to circumvent the appropriate management controls in the standard acquisition and budgeting process. Congress echoed a similar concern in the FY2019 NDAA. According to the House report: The committee also urges the Department to reiterate through established guidelines that OTA is not a means for circumventing appropriate use of the Federal Acquisition Regulations, and that full and open competition should be used to the maximum extent possible to maintain a sense of integrity, fairness, and credibility in the Federal Procurement process. Other transactions are also exempt from many of the socioeconomic policies put in place by Congress to promote public policies, including some Buy America requirements. Some analysts have raised concerns that OTs are a way to circumvent many of the public policies enshrined in the acquisition process. A number of analysts and officials have raised concerns that if DOD uses OTs in ways not intended by Congress—or is perceived to abuse the authority—Congress could clamp down on the authority. Under Secretary of the Army Ryan McCarthy reportedly stated that the military department is "trying to be very judicious about this authority so we don't lose it." Some analysts argue that Congress is already clamping down on the use of OTs. These analysts point to language in the FY2019 NDAA and FY2019 appropriations legislation ( P.L. 115-245 ) requiring additional reporting and notification (see Appendix A ). Such notification and reporting requirements, however, are not new; when Congress expanded OT authorities in the past, reporting and notification requirements were commonly included. The reporting requirements may also be a result of congressional frustration with a lack of transparency and data on how DOD uses OTs. DOD lacks authoritative data that can be used to assess OT effectiveness and better understand broader trends associated with these agreements. The most frequently cited source for such data is the Federal Procurement Data System-Next Generation (FPDS-NG), which is the primary source for tracking data on contract obligations, including other transactions for prototypes and follow-on production. FPDS-NG is configured to track data on cost-sharing, other transaction award type, and prevalence of nontraditional contractors. Obligations connected to OTs for research are tracked by the Defense Assistance Awards Data System, which is primarily used to track grants and cooperative agreements. This bifurcation of how OT data are tracked makes it more difficult to get a consolidated view of OT data. According to DOD, all OT data will be reported through FPDS-NG starting in late 2019. The procurement data in FPDS-NG are not fully reliable. There are quality issues relating to accuracy, completeness, and timeliness of data. CRS reviewed FPDS-NG data for prototype OT agreements signed or modified between FY2015 and FY2017 and found similar data inconsistencies. DOD officials acknowledge that they do not have sufficiently reliable data upon which to conduct analysis on the use of OTs and are taking steps to try to improve the data. The analyses below reflect CRS's effort to analyze DOD's use of other transaction authority based on the best available data. According to FPDS-NG, in FY2017, DOD obligated $2.1 billion—and received $360 million in cost-share contributions—on prototype other transaction agreements, representing less than 1% of DOD's total FY2017 contract obligations (approximately $320 billion). Despite the small percentage of obligations, OTs are growing quickly and are expected to continue to grow at a rapid pace. From FY2013 to FY2017, the number of new prototype agreements increased from 12 to 94, an increase of over 650% (see Table 1 ). DOD's Defense Innovation Unit (DIU, formerly known as the Defense Innovation Unit Experimental, or DIUx) was involved with approximately half of the prototype agreements executed in 2017. DOD officials have stated their intent to further increase the department's use of OTs. Officials say that this increase is due to Congress expanding the statutory authority. The Army executed more than 66% of the prototype OT agreements between FY2013 and FY2017, often on behalf of other military departments and components (see Table 2 ). Army Contracting Command-New Jersey at Picatinny Arsenal executes many of these agreements. DIU currently uses Picatinny Arsenal to execute all of its other transaction agreements. A number of private sector companies do not pursue federal government contracts because they are unwilling to forfeit intellectual property rights or adhere to some of the procurement regulations. One of the goals of OTs is to expand the defense marketplace by creating a mechanism for access to technologies and services of companies that would not otherwise work with DOD, particularly startups and companies developing innovative technology. As one industry representative stated: Because they are "outside" the FAR, OT agreements do not require such cumbersome oversight and audit requirements such as those imposed by the Truth in Negotiations Act, cost and pricing data or an expensive Cost Accounting System (CAS) qualified financial system. CAS compliant financial systems can cost a company millions of dollars to implement and maintain — and are therefore a significant, if not potentially fatal, barrier to government market entry for startups and small, innovative companies. These requirements tend to reinforce the "legacy advantage" of large traditional contractors, who can afford to hire and staff these requirements with large staffs of accountants and lawyers. A number of nontraditional companies told CRS that they are more likely to work with DOD because of the department's other transaction authorities. Despite these claims, some observers question whether OTs are effectively bringing nontraditional contractors into the defense marketplace. A DOD Inspector General report examining other transactions from FY1994 to FY2001 found that OTs did not attract significant numbers of nontraditional defense contractors to do business with DOD. The report found that of the 209 prototype agreements examined, traditional defense contractors received 95% of the $5.7 billion in funds awarded. A recent analysis of FPDS-NG data by Federal News Network had similar findings. According to the report, from FY2015 to FY2017, while nontraditional defense contractors were awarded most of the new OTs (66% vs. 33% for traditional defense contractors), the dollar value of the OTs favored traditional contractors ($20.8 billion vs. $7.4 billion for nontraditional contractors). Some observers have questioned the accuracy of the data published by Federal News Network. According to Charlie McBride, president of Consortium Management Group (which manages two consortia working with DOD through OTs), 88% of the total dollar value of awards to CMG Group has gone to nontraditional prime contractors, and nontraditional entities have participated in the remaining 12%. This debate highlights the lack of authoritative data on OTs. The currently available data may not accurately reflect the extent to which nontraditional contractors are engaged in OT agreements. FPDS-NG does not collect data regarding subcontractors or consortia composition, making it difficult to determine the nature and extent to which nontraditional defense contractors and entities may be working under OT agreements with DOD directly or as subcontractors. When Congress extended OT authority to DOD, it authorized inserting a clause requiring a person or entity to make payments to DOD as a condition of receiving support under the agreement. Such funds were to be merged into an account dedicated to support DARPA advanced research projects. The intent of this provision was to permit DARPA to "recoup the fruits of such arrangements, when there is a 'dual use' potential for commercial application" and reinvest the funds to develop other technologies. In addition to the recoupment authority, DOD can share costs with other parties under an OT. Using this approach, the amount of each party's share is negotiated and incorporated into the agreement. Congress believed that OTs and cooperative agreements were ideal vehicles for promoting DOD-industry collaboration in developing dual-use technologies. For example, the FY1992 & 1993 NDAA ( P.L. 102-190 ) authorized DOD to enter into cooperative and other transaction agreements to develop critical dual-use technologies as set forth in the Defense Critical Technologies Plan. According to the Senate report: ... the United States tends to underinvest in dual-use technologies. National security requirements alone often do not justify major DOD support, and market prospects alone often appear to be too long-term or high risk to justify US industry carrying the entire development burden.... The committee encourages use of cooperative agreements and other transactions in lieu of grants or contracts.... The provision would require that at least 50 percent of funding over the life of a partnership derive from non-federal sources but would allow for a smaller industry share at the start. In the 1990s, some DARPA OTs required participants to share costs because the types of work completed generally involved R&D that was mutually beneficial to government needs and industry commercial goals. In certain instances, present-day OTs have cost-sharing requirements that foster collaborative research. Some analysts believe that DOD is not always realizing all the benefits that OTs have to offer, such as sufficiently leveraging private capital or forming true consortia of multiple parties pooling resources. Some of these analysts believe that DOD does not sufficiently use consortia to leverage private investment through the pursuit of collaborative, mutually beneficial, dual-use technologies. Some observers argue that as the legislation on OTs has evolved, the cost-sharing provision for prototype projects has come to create an unfair playing field biased against traditional defense contractors. For prototype projects, traditional contractors generally are required to assume one-third of costs whereas nontraditional defense contractors and small businesses generally do not have to cost share. From a fairness perspective, these observers argue that traditional contractors should not have a mandatory cost share. These observers also point out that some nontraditional defense contractors are companies with billions of dollars of revenue that should not be granted a competitive cost advantage. Putting traditional defense contractors at a competitive disadvantage could deny DOD access to those companies with the most experience working on defense products, potentially depriving the military of access to leading defense-related research and technology. Other observers argue that the cost share as currently structured is appropriate: traditional defense contractors hold a significant competitive edge in their understanding of, and have the systems in place to manage, traditional contracts. In contrast, nontraditional and small businesses, which generally cannot compete with the traditional defense contractors, need the exemption from the cost-share requirement to be able to work with DOD. These observers also argue that traditional contractors are awarded the majority of dollars obligated to OTs, proving how difficult it is for nontraditional suppliers to break into the defense marketplace. Additionally, traditional contractors could avoid the cost-sharing requirement by teaming with a nontraditional contractor. DOD has not effectively tracked data on cost sharing. A 2017 report to Congress indicated that in FY2016 DOD obligated $1 billion for prototype agreements and received $68 million in cost-share contributions. A CRS review found numerous concerns with the data underlying the report, and with DOD's analytical conclusions. See Appendix C for further discussion. A number of analysts and industry officials have raised concerns that DOD could use OTs to avoid competitions, as OTs are exempt from the Competition in Contracting Act. According to statute, follow-on production using other transaction authority can only be awarded if the underlying R&D agreement was competed. In addition, 10 U.S.C. 2371b states that "to the maximum extent practicable" OTs must be competed. Determining whether OTs are being used to circumvent competition requires a two-step analysis: 1. Are OTs competed less often that traditional contracts? 2. Is there a benefit to these OTs being competed? Available FPDS-NG data suggest that DOD is broadly complying with 10 U.S.C. 2371b's competition mandate. Between FY2013 and FY2017, approximately 89% of all new OT prototype agreements were competed in some fashion. Many observers and analysts believe that OT agreements can be executed substantially faster, sometimes in a matter of weeks, compared to the months or years it typically takes to execute traditional contracts. Based in part on this belief, some officials and analysts are touting OTs as a new model for conducting acquisitions and the answer to many of the problems in defense acquisition. These analysts argue that in a world of increasingly fast technology development, DOD acquisitions must go faster or risk being left behind. Many acquisition professionals argue that OT contracts are not inherently faster than traditional contracting; instead, they are executed faster because they are not encumbered by the reviews, protests, and bureaucratic layers that have been overlaid on traditional contracting. According to these officials, OTs take just as long as traditional contracts if the same execution and oversight processes are applied. And because all terms are negotiable, complex negotiations could make OTs take longer to execute than traditional contracts that have required, nonnegotiable conditions. The Other Transactions Guide states The OT award process will not always be faster than the traditional procurement processes and sometimes can be as long or longer. The speed of award is tied to many factors, many of which are internal to the organization. DOD has not tracked data on the relative time it takes to execute OTs vs. traditional contracts, making it impossible to objectively assess these claims. Analysts and officials generally agree that the workforce plays a critical role in determining the success or failure of an acquisition. Because there are fewer predefined requirements, OTs can be more difficult to negotiate than traditional contracts, putting DOD at greater risk of not getting what it wants at a reasonable price. The complexity and difficulty of negotiations is particularly high when there are intellectual property/patent rights issues, as is the case with most OTs. Given these challenges, OTs often require more experienced and capable government representatives to ensure implementation of agreements that are in the government's best interest. Some analysts question the extent to which the workforce is sufficiently trained and equipped to negotiate OTs. In response to this concern, in the FY2018 NDAA, Congress required workforce education and training for OTs, and required DOD to establish a cadre of intellectual property experts to advise, assist, and provide resources to program offices that are developing intellectual property strategies for contracts and agreements (see Appendix A ). DOD officials acknowledge that more training and education is required. Given the complexity of OTs and the limited extent to which they are used, some analysts and industry officials suggested that there may be a benefit to establishing a centralized office within DOD responsible for executing or overseeing all other transaction agreements. Such a structure could help ensure that those members of the acquisition workforce engaged in other transactions are sufficiently experienced, trained, and qualified. A number of analysts have argued that DOD should take steps to improve its use of OTs. Many of these analysts have suggested that data are not consistently and accurately tracked, regulations and guidance on when and how to use OTs are vague or insufficient, and the workforce is not sufficiently prepared to effectively use OTs. A number of officials have acknowledged these shortcomings and DOD is reportedly taking steps to address them. For example, in December 2018, DOD issued an updated Other Transactions Guide , a comprehensive guide containing best practices, case studies, and a clarification of myths related to other transaction authorities. In addition, Defense Acquisition University developed new course materials addressing OTs and is working to expand its offerings of relevant training and classes. However, numerous acquisition officials question whether it is possible, or even desirable, to try to quickly implement training aimed at preparing the thousands of DOD acquisition officials to execute OTs. Some of these officials have suggested it might be appropriate to only allow a limited and vetted number of acquisition professionals to be OT agreements officers. Some argue that OTs are just one "tool in the tool box," appropriate for only specific types of contracts, and should not be used to avoid the statutory and regulatory framework or to try to accelerate the process just for the sake of speed. Others have suggested that OTs should be used to cut through bureaucracy, speed up the acquisition process, avoid regulations and bid protests, and perhaps eventually supplant the regular FAR-based contracting process. Given the benefits and risks associated with OTs, questions for Congress include the following: 1. To what extent and in what circumstances do the potential benefits of OTs in terms of cost, schedule, and added capabilities outweigh concerns over potential fraud, waste, abuse, diminished oversight, and other public policy objectives? 2. Should OT authorities be extended further, curtailed, or maintained? The FY2019 NDAA required DOD to submit a report annually through 2021, summarizing DOD's use of OTs, including organizations involved; number of transactions; amounts of payments; and purpose, description, and status of projects. The NDAA also required the Defense Innovation Unit to submit a report to Congress, to include the number of traditional and nontraditional defense contractors with DOD contracts or other transactions resulting directly from the unit's initiatives. The conference report for the FY2019 defense appropriations bill included language expressing the conferees' "[concern] with the lack of transparency surrounding the employment of OTA, particularly for follow-on production." The conferees directed DOD to provide quarterly reports to the House and Senate appropriations committees listing each active OT, and to include additional information for each agreement. The conferees also directed GAO to review DOD's use of OTs to determine whether the "employment of this authority conforms to applicable statutes and guidelines, to include the identification of any potential conflicts." GAO was also required to report on the extent to which OTs have been used since FY2016. The multitude of reporting requirements, and the questionable reliability of the available data, raise a number of questions that Congress may wish to explore, such as the following: 1. To what extent, if any, should the current reporting requirements be consolidated to create a more streamlined and consistent flow of information to Congress? 2. What specific data does Congress need in these reports to effectively conduct oversight? For example, what percentage of research OTs result in prototype projects and follow-on production? 3. To what extent are the data sufficiently reliable, and will such data be easily retrievable in the future, to allow Congress to conduct effective, timely, and ongoing oversight? If the data are not sufficiently reliable or accessible in the future, what other data collection and tracking methods could Congress mandate to ensure ongoing access to reliable data? 4. How are OTs being used? Where and when in the acquisition lifecycle is the authority being used? To what extent is the requirements process being circumvented when DOD awards an OT follow-on production contract for a major system? One analyst suggested that "no efficiency is lost if only the most able personnel are authorized to procure and administer" OT agreements and further argued that expanding the use of OTs would increase the training costs by expanding the number of people who can "weave complex agreements in a relatively unstructured environment." Congress may consider whether DOD should establish an acquisition innovation lab or center of excellence responsible for overseeing, executing, and approving all OTs across the department. Such a lab or center could be staffed and supported by a cadre of professionals with experience across the acquisition lifecycle who have a willingness and ability to embrace new ideas and rethink existing practices. Alternatively, such labs or centers could be established in the military departments. Having centers in each organization could allow for consideration of the different missions and business approaches of the departments and help educate the workforce on a more systematic basis. Proponents argue that such an office would help ensure that only experienced and capable officials, with the appropriate training, use OT authorities. Such an office could also help protect against layering internal DOD policies and bureaucracies onto OTs by placing OTs outside of the traditional bureaucratic acquisition process. Proponents could further argue that such an office could better propagate best practices and ensure that OTs are used appropriately and are consistent with guidance and legislation. Having a single office responsible for executing or approving all OTs could also help ensure more timely and accurate information, giving Congress more visibility into DOD's use of other transaction authorities. To the extent that a single, high-level official is responsible for managing and overseeing all OTs, Congress might wish to consider repealing or modifying existing statutory approval requirements. If such an office was able to provide timely and accurate information, Congress might also consider some of the current reporting requirements unnecessary, and may choose to repeal some of the reporting requirements. Opponents of such a proposal argue that centralizing OTs would have the opposite effect, increasing bureaucracy by adding yet another office within DOD. Opponents also argue that such an office could make it more time-consuming to get a project underway and may discourage program offices from attempting or suggesting OTs. Some also argue that a single office may not have the resources to execute and approve agreements in a timely manner, and would inhibit spreading expertise on how to execute OT agreements more broadly across the acquisition workforce. Even proponents who might in theory support establishing such an office could raise significant concerns regarding how such an office would function in practice. A number of alternative options could be pursued to address concerns raised by opponents of establishing a centralized office. Some of these alternative options include the following: Granting such an office primary, but not exclusive, authority to execute OTs. For example, agreement officers specifically authorized to do so could execute OTs, with the centralized office conducting a peer review. Under this construct, the office could also be charged with providing information and expertise/consulting services on the use of OTs to program offices contemplating using the authorities. Establishing centers within each military department, with a designated office in OSD serving a coordinating function (with nondelegable approval authority residing in the military department office designated for OTs). Creating the office as a pilot program for three years, to help DOD manage OTs until such time as the workforce becomes more experienced and proficient in using these agreements. Appendix A. Legislative History Other transaction authority first appeared in the National Aeronautics and Space Act of 1958. Since then, Congress has extended OT authorities to 11 federal agencies and a number of other federal offices (see Appendix B for information on other federal entities with similar authorities). This appendix traces the legislative history of OT authorities and select related statutes applicable to DOD. To read the full text of the three statutory provisions related to OTs (10 U.S.C. 2371, 2371b, and 2373), see Appendix D . National Aeronautics and Space Act of 1958 (P.L. 85-568) Creation of Other Transaction Authority On July 29, 1958 President Dwight D. Eisenhower signed into law the National Aeronautics and Space Act (P.L. 85-568), which established the National Aeronautics and Space Administration (NASA). The purpose of the act included the expansion of human knowledge, preservation of the role of the United States as a leader in space science and technology, and pursuing the most effective utilization of the scientific and engineering resources of the United States. Section 203(b)(5) of the Space Act provided NASA the authority (emphasis added) to enter into and perform such contracts, leases, cooperative agreements, or other transactions as may be necessary in the conduct of its work and on such terms as it may deem appropriate, with any instrumentality of the United States ... or with any person, firm, association, corporation, or educational institution. To the maximum extent practicable and consistent with the accomplishments of the purpose of this Act, such contracts, leases, agreements, and other transactions shall be allocated by the Administrator in a manner which will enable small-business concerns to participate equitably and proportionately in the conduct of the work of the Administration. Intellectual Property Rights The Space Act specifically addressed NASA's "property rights in inventions." Section 305 stated that any invention made in the performance of any work under any contract is the exclusive property of the United States "unless the Administrator waives all or any part of the rights." This was true even when the person who created the invention "was not employed or assigned to perform research, development, or exploratory work, but the invention is nevertheless related to the contract" and was made during working hours, or with a contribution of the government. The act granted the Administrator wide latitude to "waive all or any part of the rights of the United States under this section" if doing so was deemed to be in the best interests of the United States. When such rights were waived, NASA retained an irrevocable, nonexclusive, nontransferable royalty-free license by or on behalf of the United States. National Defense Authorization Act for FY1990 & FY1991 ( P.L. 101-189 ) The FY1990 & FY1991 NDAA granted DARPA temporary authority to enter into "cooperative agreements and other transactions" for the purpose of conducting advanced research projects. The statute clarified that OTs should only be used when "the use of standard contracts or grants is not feasible or appropriate." Congress restricted funding for OTs and cooperative agreements to $25 million of appropriated funds for FY1990 and FY1991, and set the authority to expire on September 30, 1991. Cost Sharing The FY1990 & FY1991 NDAA permitted OTs (or cooperative agreements) to include a clause requiring a person or entity to make payments to DOD as a condition of receiving support under the agreement. Such funds were to be merged into an account dedicated to supporting DARPA advanced research projects using cooperative agreements and other transactions. The act required, to the extent practicable, that funds provided by the government not exceed the total amount provided by the other parties to the project. According to the Senate report, one of the intents of the cost-sharing provision was to permit DARPA to "recoup the fruits of such arrangements, when there is a 'dual use' potential for commercial application" and to reinvest the funds to develop other technologies. Reporting Requirements The FY1990 & FY1991 NDAA required DOD to submit an annual report on the use of OTs and cooperative agreements, to include a description of each agreement and the technologies involved, the potential military and commercial utility of the technology, the reasons a contract or grant was not feasible to support the research, and the amount of payments, if any, received by the federal government under the agreement. National Defense Authorization Act for FY1991 ( P.L. 101-510 ) Section 244 increased the funds authorized for cooperative agreements and OTs from $25 million to $50 million. However, no such funding was appropriated. Reporting and Notification Requirements The conference report required DOD to submit to Congress a report listing the cooperative agreements and consortia intended to be used in FY1991-1992. The conference report also required DOD to provide the armed services and appropriations committees 30 days' notice prior to DOD signing a cooperative agreement or agreement with a consortia under OT authority. The Senate report focused on consortia as a method to pool resources, share research among numerous participants, and promote critical dual-use technology. Department of Defense Appropriations Act, 1992 ( P.L. 102-172 ) Limitations on the Use of OTs Section 8113A of P.L. 102-172 placed temporary limitations on the use of agreements undertaken pursuant to 10 U.S.C. 2371: Section 8113A limited the use of OTs and cooperative agreements exclusively to DARPA (to the exclusion of the rest of DOD) for FY1992. Section 8113A limited DARPA to obligating or expending no more than $37.5 million in FY1992 for cooperative agreements or OTs undertaken pursuant to 10 U.S.C. 2371. Section 8113A further established that no more than $75 million could be obligated or expended by DARPA in FY1992 for DOD dual-use critical technology partnerships. National Defense Authorization Act for FY1992 & FY1993 ( P.L. 102-190 ) Expanded Authority Section 826 extended other transaction authority to the military departments, and established separate fund accounts in each department for cost sharing. Section 826 also repealed the sunset for cooperative agreements and OTs, making the authorities permanent. Section 821 authorized DOD to enter into cooperative and other transaction agreements to develop critical dual-use technologies as set forth in the Defense Critical Technologies Plan. According to the Senate report ... the United States tends to underinvest in dual-use technologies. National security requirements alone often do not justify major DOD support, and market prospects alone often appear to be too long-term or high risk to justify US industry carrying the entire development burden.... The committee encourages use of cooperative agreements and other transactions in lieu of grants or contracts.... The provision would require that at least 50 percent of funding over the life of a partnership derive from non-federal sources but would allow for a smaller industry share at the start. The conference report stated that the partnerships should focus on programs that fit into the security needs within DARPA. The conference report also stated that OTs are appropriate for those cases where the "regulations applicable to the allocation of patent and data rights under the procurement statutes may not be appropriate to partnership arrangements in certain cases." National Defense Authorization Act for FY1993 ( P.L. 102-484 ) Cost Sharing Section 4221 established 10 U.S.C. 2511, which required DOD to establish cooperative arrangements with industry, educational institutions, federal labs, and other entities, to pursue research, development, and application of dual-use technologies. The section authorized DOD to use grants, contracts, cooperative agreements, or OTs to create these partnerships, and that the Federal government should not contribute more than 50% of the costs related to projects under this authority. National Defense Authorization Act for FY1994 ( P.L. 103-160 ) Expanded Authority Section 827 established 10 U.S.C. 2358, which gave the Secretary of Defense and the Secretaries of the military departments the authority to conduct basic, advanced, and applied research through the use of contracts, cooperative agreements, grants, and OTs. Previously, OTs were only authorized for advanced research. Prototype Authorities Section 845 granted DARPA the authority to use OTs for prototype projects directly related to weapons or weapon systems proposed to be acquired by DOD. Section 845 required that "to the maximum extent practicable," prototypes be competitively awarded. This authority was set to terminate after three years. Section 845 remained as a note to 10 U.S.C. 2371 until separately codified as 10 U.S.C. 2371b in the FY2016 NDAA ( P.L. 114-92 ). Federal Acquisition Streamlining Act of 1994 ( P.L. 103-355 ) Section 1301 redesignated the language in 10 U.S.C. 2358 (granting the authority to use OTs) to 10 U.S.C. 2371. Reporting Requirements Section 1301 also required DOD to submit an annual report to the armed services committees, to include a general description of the other transactions, including the technologies involved in the research, the potential military and, if any, commercial utility of such technologies, the reasons for not using a contract or grant to provide support for such research, and the amount of payments, if any, received during the fiscal year pursuant to a clause in the other transactions and to what accounts such payments were credited. National Defense Authorization Act for FY1997 ( P.L. 104-201 ) Section 203 required that a senior DOD official be designated in OSD, and that the officials' sole responsibility be developing policy related to, and ensuring implementation of, DOD's dual-use technology program. This section authorized DOD to use OTs (as well as contracts, cooperative agreements, and grants) for dual-use projects only if the project "is entered into through the use of competitive procedures." Section 743 granted DOD the authority to use OTs to conduct research on Gulf War Syndrome, to determine its relationship to possible exposures of members of the Armed Forces to chemical warfare agents and hazardous materials, and the use of inoculations and new drugs. Expanded Prototype Authorities Section 804 amended Section 845 of the FY1994 NDAA by extending to the military departments and officials designated by the Secretary of Defense, the authority to use OTs for certain prototype projects. This authority, originally granted solely to DARPA and set to expire after three years, was given a new termination date of September 30, 1999. Reporting Requirements Section 267 modified elements of the annual report to the armed services committees. National Defense Authorization Act for FY1998 ( P.L. 105-85 ) Section 832 amended 10 U.S.C. 2371 by clarifying that certain information submitted to DOD (i.e. a proposal, business plan, technical information) be protected from disclosure pursuant to 5 U.S.C. 552 for a period of five years. Strom Thurmond National Defense Authorization Act for FY1999 ( P.L. 105-261 ) Section 241 extended the sunset day for the authority to use OTs for prototypes from September 30, 1999, to September 30, 2001. Section 817 amended Section 2371 of Title 10, United States Code, clarifying that information submitted by outside parties in cooperative agreements for basic, applied, and advanced research is protected from disclosure under Section 552 of Title 5, United States Code. Department of Defense Appropriations Act, 1999 ( P.L. 105-262 ) While the enacted FY1999 defense appropriations bill ( P.L. 105-262 ) did not include legislative language addressing OTs, H.Rept. 105-591 , which accompanied the House-reported version of H.R. 4103 , included language expressing the House Appropriations Committee's "serious reservations" regarding the Air Force's then-proposed use of an OT agreement—instead of a contract— to develop the Evolved Expendable Launch Vehicle (EELV) program. The committee noted that "under [OTs] traditional safeguards which protect the government's interest in large acquisition programs are largely absent," and required the Under Secretary of Defense for Acquisition, Technology, and Logistics (now the Under Secretary of Defense for Acquisition and Sustainment) and the DOD Inspector General to certify to the congressional defense committees that the use of an OT was appropriate for the EELV program, and that "adequate safeguards exist[ed] to protect the government's interest and monitor program performance." National Defense Authorization Act for FY2000 ( P.L. 106-65 ) Section 801 required that for prototypes using OT authorities, DOD ensure that GAO, under its audit authority, have access to records relating to other transaction prototype agreements exceeding $5 million. Section 801 allowed for a waiver to GAO access and exempted entities that over the last year have not entered into an agreement with DOD that provided for audit access by a government entity. According to the Senate report: Senior DOD officials have sought legislation to extend other transaction authority to production contracts. Under current authority, there is some debate about whether GAO has audit access to other transactions. As the size, costs, and complexity of programs being funded using other transactions increases, the committee wants to ensure that the GAO has audit access in relation to the higher levels of spending and added risks. Reporting Requirements The Senate report also addressed reporting requirements and congressional intent to review the use of OTs. The report stated the following: The committee is assessing the utility of other transaction prototype authority. The statement of managers accompanying the Strom Thurmond National Defense Authorization Act of 1999 directed the Secretary of Defense to report on the use of this authority to the congressional defense committees, no later than March 1, 1999. In addition, both the Department of Defense Inspector General and the General Accounting Office are reviewing the use of other transaction prototype authority and will report to Congress in the coming year. The committee is interested in the extent that new commercial firms are entering the DOD marketplace through the use of other transaction authority, as well as the degree of cost sharing between the government and non-federal government parties. The committee is also interested in any lessons learned from the broad exemptions to federal law provided by other transaction authority. For example, other transactions are exempt from the Competition in Contracting Act, Truth in Negotiations Act, Contract Disputes Act, Antikickback Act of 1986, Procurement Integrity Act, Service Contract Act, Buy American Act, and chapter 137 of title 10, United States Code. Questions have been raised about whether the government's interest is adequately protected in the absence of the applicability of these statutes. Conversely, advocates of the view that the government should take advantage of the flexibility of other transactions have championed proposals to extend other transaction authority to production. The committee directs the Secretary of Defense to provide a new report that updates information in the March 1999 report on the use of other transaction prototype authority to the congressional defense committees by February 1, 2000. National Defense Authorization Act for FY2001 ( P.L. 106-398 ) Limitations on the Use of OTs Section 803 limited the use of OTs for prototype projects to only those circumstances when at least one nontraditional defense contractor significantly participates in the project, one-third of the total cost of the project is paid out of funds provided by parties to the transaction other than the federal government, or the senior procurement executive determines in writing that exceptional circumstances justify use of an OT. Nontraditional defense contractor was defined as an entity that for a period of one year has not entered into or performed "any contract that is subject to full coverage under the cost accounting standards" or "any other contract in excess of $500,000 to carry out prototype projects or to perform basic, applied, or advanced research projects for a Federal agency, that is subject to the Federal Acquisition Regulation.'' Section 803 also extended the authority to use OTs for prototypes from September 30, 2001, to September 30, 2004. According to the Senate report, the intent of using OTs for prototypes is to attract companies that typically do not do business with the Department of Defense and encourage cost sharing and experimentation in potentially more efficient ways of doing business with traditional defense contractors. Other transaction authority is an important acquisition tool that can facilitate the incorporation of commercial technology into military weapon systems. In an environment where, in many areas, commercial technology is now more advanced than defense technology, it is imperative that the Department continue to have the flexibility to use innovative contractual instruments that provide access to this technology. There are, however, improvements that can be made in managing and overseeing these contractual arrangements. Section 804 clarified the extent of GAO's access to records in instances where the party in question has only done business with the government in the preceding year through an OT or cooperative agreement. National Defense Authorization Act for FY2002 ( P.L. 107-107 ) Expanded Authority—Follow-on Production Section 822 of the FY2002 NDAA granted DOD the authority to award a follow-on production contract for prototype projects when at least one-third of the total cost of the prototype project is to be paid out of funds provided by non-federal government sources. Under this authority, such a follow-on contract could be awarded without competition if the prototype project was successfully completed, the number of units in the production contract does not exceed the number of units specified in the underlying prototype agreement, and the price for each unit does not exceed the price specified in the underlying transaction. Department of Defense and Emergency Supplemental Appropriations for Recovery from and Response to Terrorist Attacks on the United States Act, 2002 ( P.L. 107-117 ) Establishment of Army Venture Capital Initiative (AVCI) Section 8150 designated $25 million of the FY2002 funds made available for Army Research, Development, Test, and Evaluation (RDT&E) to be made available to the Secretary of the Army for the purpose of funding a venture capital investment corporation established pursuant to 10 U.S.C. 2371. A 2014 RAND report stated that OT authorities were used only to form the AVCI, and were not used to acquire products or services: "While OT authorities were used to form [AVCI] itself, any volume of the Army's purchase of products and services from [AVCI] companies is conducted under the FAR." National Defense Authorization Act for FY2004 ( P.L. 108-136 ) Expanded Authority Section 847 of the FY2004 NDAA extended the authority to use an OT for developing prototypes to improve weapons or weapon systems currently in use by the Armed Forces. Previously, such authority was restricted to prototypes "directly relevant to weapons or weapon systems proposed to be acquired or developed" by DOD. Section 847 also established a pilot program for transitioning prototypes to follow-on contracts for production for nontraditional defense contractors. Under the pilot program, such a follow-on contract could be treated as a commercial item or an item developed with both federal and private sector funds (for purposes of negotiating intellectual property rights). The pilot program was restricted to contracts with nontraditional defense contractors, where the value of the contract does not exceed $50 million (approximately $70 million in FY2018 dollars), and that are firm-fixed price or fixed price with economic adjustment. The pilot program was set to sunset September 30, 2008. Section 1441 authorized any agency that engages in basic, applied, or advanced research and development projects that facilitated defense against or recovery from terrorism or nuclear, biological, chemical, or radiological attack to exercise the same general authority given to DOD as found in 10 U.S.C. 2371 (including for prototype projects). Reporting Requirements Section 1031 sunset the annual reporting requirement for OT after the report covering FY2006 was submitted. National Defense Authorization Act for FY2006 ( P.L. 109-163 ) Restricted Authority and Notification Requirements Section 212 of the FY2006 NDAA directed the Army to procure the Future Combat System using contract procedures set forth in part 15 of the Federal Acquisition Regulation, in lieu of an OT. Section 823 extended ethics requirements to OT prototype authority and required the congressional defense committees be notified in writing at least 30 days before such authority is exercised. Certification Requirements Section 823 also amended Section 845 of the FY1994 NDAA, requiring a written determination by a senior procurement executive for other transaction prototype projects estimated between $20 million and $100 million, and for a written determination by the Under Secretary of Defense for Acquisition, Technology, and Logistics for prototype projects that exceed $100 million. According to the Senate report: Section 845 was intended to be used for limited prototype projects, particularly those in which the Department seeks to engage nontraditional defense contractors that may be averse to the requirements imposed by a standard Department procurement contract. For this reason, the statement of managers accompanying the Strom Thurmond National Defense Authorization Act for Fiscal Year 1999 (Public Law 105–261) states: The conferees continue to believe that the section 845 authority should only be used in the exceptional cases where it can be clearly demonstrated that a normal contract or grant will not allow sufficient access to affordable technologies. The conferees are especially concerned that such authority not be used to circumvent the appropriate management controls in the standard acquisition and budgeting process. …. The committee does not believe that the $20.9 billion agreement entered between the Army and the Lead Systems Integrator for the FCS program is consistent with the language and intent of section 845 authority. Section 845 authority is intended to be used for limited prototype projects, particularly those in which the Department of Defense seeks to engage nontraditional defense contractors that may be averse to the requirements imposed by a standard Department contract. Department of Defense Appropriations Act, 2007 ( H.R. 5631 ) Reporting Requirement The FY2007 defense appropriations bill ( P.L. 109-289 ) did not include language addressing OTs. The conference report ( H.Rept. 109-676 ) included language expressing the conferees' "[concern] with the continued use of OTA contracts by the Missile Defense Agency," as such contracts "lack the customary safeguards found under FAR-based contracts for organizational conflict of interest, truth in negotiations and submission of cost and pricing data." The conferees "strongly encourage[d]" the Missile Defense Agency to convert "large development and procurement contracts using OTA to FAR-based contracts," and directed the Missile Defense Agency to submit a report to the congressional defense committees on the use of OTs, to include the number, value, and justification for the use of such agreements. National Defense Authorization Act for FY2008 ( P.L. 110-181 ) Section 823 extended the authority for prototype projects for five more years, from September 30, 2008, to September 30, 2013. National Defense Authorization Act for FY2009 ( P.L. 110-417 ) Section 822 required DOD to issue guidance on rights in technical data under non-FAR agreements, including OTs. Section 822 also required that appropriate provisions relating to rights in technical data be included in non-FAR agreements, consistent with policy guidance. This requirements is in statute at 10 U.S.C. 2320 note. Section 824 expanded the scope of the pilot program for transition to follow-on contracts for certain prototype projects to include research projects carried out under 10 U.S.C. 2371. Authority to use the pilot program, set to expire September 30, 2008, was extended to September 30, 2010. Section 874 required OT data be included in the Federal Procurement Data System. National Defense Authorization Act for FY2011 ( P.L. 111-383 ) Section 866 changed the definition of nontraditional defense contractor, conforming the definition to that found in 10 U.S.C. 2302(9). National Defense Authorization Act for FY2013 ( P.L. 112-239 ) Section 863 extended the authority for using OTs for prototype projects from September 30, 2013, to September 30, 2018. Carl Levin and Howard P. "Buck" McKeon National Defense Authorization Act for FY2015 ( P.L. 113-291 ) Expanded Authority Section 812 expanded the authority to use OT for prototypes, to include those "directly related to enhancing the mission effectiveness of military personnel and the supporting platforms, systems, components, or materials proposed to be acquired or developed by the Department of Defense, or to improvement of platforms, systems, components, or materials in use by the Armed Forces." Prior to the FY2015 NDAA, OTs could only be used for prototypes relating to weapons or weapon systems proposed to be developed, or for the improvement of weapons or weapon systems currently in use. Reporting Requirements Section 1071 repealed the reporting requirement language found in 10 U.S.C. 2371, relating to OTs for research projects. National Defense Authorization Act for FY2016 ( P.L. 114-92 ) Until the FY2016 NDAA, the prototyping and follow-on production authority established in Section 845 of the FY1994 NDAA (as amended) was found in 10 U.S.C. 2371 note. Section 815 of the FY2016 NDAA simultaneously repealed Section 845 of the FY1994 NDAA and put the repealed language into the newly created 10 U.S.C. 2371b. The FY2016 NDAA also modified 2371b by making the authority permanent. Expanded Authority and Small Business The authorities in Section 2371b were expanded to allow their use when "all significant participants in the transaction other than the Federal government are small businesses or nontraditional contractors" and when the agency determines that using an OT would expand the defense supply base in a manner that could not be accomplished through a contract. Section 815 eased the restriction on follow-on production contracts or transactions. Section 815 amended the definition of a nontraditional defense contractor found in 10 U.S.C. 2302 to be an entity that is not currently performing, and for one year prior to an OT has not performed on any contract or subcontract that is subject to full coverage under the cost accounting standards pursuant to Section 1502 of Title 41, U.S.C. Section 815 also required DOD to update its guidance to reflect changes in the statute. The conference report stated that Congress believed OTs are an attractive option for firms and organizations that do not usually participate in government contracting due to typical overhead burdens and the "one size fits all" rules governing defense acquisition. The report also stated that OTs could support DOD's effort to access new sources of technological innovation, specifically with Silicon Valley startup firms and small commercial firms. National Defense Authorization Act for FY2018 ( P.L. 115-91 ) Expanded Authority Section 216 of the FY2018 NDAA authorized nonprofit research institutions to enter into OTs with DOD for prototype projects. Section 862 amended 10 U.S.C. 2358, granting the Secretary of Defense and the military departments the authority to pursue basic research, applied research, advanced research, and development projects under the OT authorities granted in Sections 2371 and 2371b of Title 10. Workforce Section 802 required DOD to establish a cadre of intellectual property experts to advise, assist, and provide resources to program offices who are developing intellectual property strategies for contracts and agreements. Section 863 required training and education for personnel involved in OTs and other innovative contracting methods. Certification Requirements and Small Business Section 864 adjusted the language of the statute to state that the dollar threshold relates to the specific transaction for a prototype project and not for the value of the entire project. Section 864 defined a transaction for follow-on production to include "all individual prototype sub-projects awarded under the transaction to a consortium of United States industry and academic institutions." Section 864 also increased the dollar thresholds for required approvals and defined the term small business to include small businesses under Section 9 of the Small Business Act to ensure that companies participating in the Small Business Innovation Research and Small Business Technology Transfer programs were considered small businesses for the purposes of the cost-sharing requirements. Miscellaneous Section 867 required the Secretary of Defense to establish a preference for OTs in the "execution of science and technology and prototyping programs." Section 1711 required DOD to carry out a pilot program to "assess the feasibility and advisability of increasing the manufacturing capability of the defense industrial base." Pursuant to the pilot, Section 1711 authorized DOD to use OTs to support production capabilities in small and medium-sized manufacturers. John S. McCain National Defense Authorization Act for FY2019 ( P.L. 115-232 ) Section 211 of the FY2019 NDAA clarified that follow-on production of a prototype or subproject within a consortium may occur if the individual prototype or subproject is complete; all projects associated with the consortium do not need to be completed before follow-on production of a specific prototype. Expanded Authority The FY2019 NDAA authorized the use of OTs to develop enhanced personal protective equipment (Section 226) and to carry out research under the Explosive Ordnance Disposal Defense Program (Section 311). Reporting Requirements Section 244 required the Defense Innovation Unit to submit a report to Congress, to include the number of traditional and nontraditional defense contractors with DOD contracts or other transactions resulting directly from the unit's initiatives. Section 873 required DOD to submit an annual report through 2021, summarizing DOD's use of OTs, including organizations involved; number of transactions; amounts of payments; and purpose, description, and status of projects. Department of Defense Appropriations Act, 2019 ( P.L. 115-245 ) Reporting Requirements While the enacted FY2019 defense appropriations bill did not include legislative language addressing OTs, the conference report included language expressing the conferees' "[concern] with the lack of transparency surrounding the employment of OTA, particularly for follow-on production." The conferees directed DOD to provide quarterly reports to the House and Senate appropriations committees listing each active OT, and to include the following information on each agreement: funding military service or DOD component; major command (if applicable); contracting activity; appropriation title; budget line item; minimum and maximum award value; vendor; obligations and expenditures to date; product service code; period of performance; and indication if the OT agreement included an option for follow-on production (with a description of the scope of anticipated follow-on production). The conferees also directed GAO to review DOD's use of OTs to determine whether the "employment of this authority conforms to applicable statutes and guidelines, to include the identification of any potential conflicts." GAO was also required to report on the extent to which OTs have been used since FY2016. Notification Requirements The House report to accompany H.R. 6157 acknowledged OTs as an "important tool to provide flexibility and agility for cutting-edge research and development projects and prototypes." However, the report stated its concern "with the lack of transparency on the use of OTA authority for follow-on production procurements," and directed that no funds could be obligated or expended for a follow-on production contract or a transaction carried out under 10 U.S.C. 2371b, until 30 days after the Secretary of Defense provides the congressional defense committees with a notification of the proposed contract or transaction, to include a justification of why an OT is being used for production. Appendix B. Non-DOD Federal Agencies with Agency-Wide OT or Related Authorities A number of agencies have varying other transaction or similar authorities, as reflected in Table B-1 . The table below is not a comprehensive or definitive listing of every federal government entity with OT or related authorities. In some instances, offices, agencies, commissions, and other federal government entities have OT or related authorities that are only associated with certain programs or projects, such as the National Institutes of Health (which has OT authority for such specific activities such as the National Heart, Blood Vessel, Lung, and Blood Diseases and Blood Resources Program [42 U.S.C. §285b-3] and the Cures Acceleration Network [42 U.S.C. §287a]). Appendix C. Reliability of Data on Other Transactions All data have imperfections and limitations. FPDS-NG data can be used to identify broad trends and produce rough estimates, or to gather information about specific contracts. Some observers say that despite their shortcomings, FPDS-NG data are substantially more comprehensive than what is available in most other countries in the world. Understanding the limitations of government procurement data—including knowing when, how, and to what extent to rely on data—can help policymakers incorporate FPDS-NG data more effectively into their decisionmaking process. FPDS-NG OT Data Quality and Accuracy Issues Decisionmakers should be cautious when using data from FPDS-NG to develop policy or otherwise draw conclusions, especially with respect to OTs. In some cases, the data themselves may not be reliable. In other instances, a query for particular data may return differing results, depending on the parameters and timing of the analysis. In particular, all DOD data entered into FPDS-NG are subject to a 90-day delay, and updates to "data, including new actions, modifications, and corrections are made on a regular basis," which could result in changes to "data ... for current and/or prior fiscal years." Inconsistencies in FPDS-NG Data Within FPDS-NG, two primary collections of obligation data exist: one associated with standard government procurement contracts or modifications to such contracts, and the other associated with prototype OT agreements or modifications to such agreements. FPDS-NG's collection of prototype OT data allows for the input of additional data elements—such as nongovernment dollars associated with cost-share prototype OT agreements—not included in FPDS-NG's collection of standard government procurement contract data. More consequentially, FPDS-NG's prototype OT data include two similar data elements that allow users to identify the fiscal year a prototype OT agreement was signed or modified. One, labeled in the database as "Fiscal Year," appears to allow users entering data into the system to manually assign a fiscal year to a transaction. FPDS-NG users entering data into the system appear to have interpreted this data element in various, conflicting ways. For example, a Department of the Air Force OT agreement was signed in February 2016 for the development of rocket propulsion system prototypes under the Evolved Expendable Launch Vehicle (EELV) program. FPDS-NG records an obligation of $115 million in FY2020 for this agreement. Fiscal law bars DOD from obligating money now for future fiscal years that have not yet occurred. The second, labeled "Contract Fiscal Year," appears to be based on the date the prototype OT agreement was signed or modified. See Table C-1 for a comparison of the "Fiscal Year" and "Contract Fiscal Year" elements for selected new prototype OT agreements signed between FY2013 and FY2017. If a user selects the Fiscal Year data element when attempting to review high-level data on recent trends in the use of prototype OT agreements within DOD—such as the total amount obligated for prototype OT agreements on an annual basis—that user will obtain a substantially different result than if he or she selects the Contract Fiscal Year data element for a similar analysis. See Table C-2 for a comparison of action obligations and nongovernment contributions using the Fiscal Year and Contract Fiscal Year data elements for new prototype OT agreements signed between FY2013 and FY2017. DOD OT Data Analysis Methodological Issues in Congressional Reports A March 2017 report to Congress entitled "An Assessment of Cost-Sharing in Other Transaction Agreements for Prototype Projects," completed by the Office of the Under Secretary of Defense for Acquisition, Technology, and Logistics indicated that In FY2016, DOD obligated (Note: Two outliers in 2016 excluded) $1 billion in section 2371b awards and received $68 million in cost-share contributions after excluding two significant trend outliers. DOD cited FPDS-NG as the source for its analysis, and defined the "significant trend outliers" excluded as "two $40 million OTAs with total cost-share of $270 million," likely referring to two DARPA prototype OT agreements conducted on a cost-share basis initiated in FY2016. However, a CRS analysis of the same FPDS-NG data identified numerous inconsistencies in DOD's methodological approach. Recreation of DOD Methodology Specifically, DOD appears to have conducted its analysis using the "Fiscal Year" data element referenced in this report's discussion of FPDS-NG OT data quality and accuracy issues, which would attribute some prototype OT activities to the wrong fiscal year for the purposes of comparative trend analysis. DOD also compared two disparate transaction types: the reported "$1 billion in Section 2371b awards" includes all action obligations associated with ongoing prototype OT activities in FY2016, including transactions associated with prototype OT indefinite delivery contracts, while the "$68 million in cost-share contributions" includes only cost-share contributions associated with new prototype OT agreements. If DOD used the "Contract Fiscal Year" data element, excluded the identified "trend outliers," and focused on all action obligations and cost-share contributions associated with ongoing prototype OT activities, it would have found instead that the department obligated $1.4 billion for prototype OT agreements in FY2016, with an additional $313.5 million in cost-share contributions from the private sector. On the other hand, if DOD used the "Contract Fiscal Year" data element, excluded the identified "trend outliers," and focused on only action obligations and cost-share contributions associated with new prototype OT agreements, it would have found instead that the department obligated $400 million for prototype OT agreements in FY2016, with an additional $272.1 million in cost-share contributions from the private sector. Appendix D. Other Transaction Authority Statutes 10 U.S.C. §2371. Research projects: transactions other than contracts and grants (a) ADDITIONAL FORMS OF TRANSACTIONS AUTHORIZED.— The Secretary of Defense and the Secretary of each military department may enter into transactions (other than contracts, cooperative agreements, and grants) under the authority of this subsection in carrying out basic, applied, and advanced research projects. The authority under this subsection is in addition to the authority provided in Section 2358 of this title to use contracts, cooperative agreements, and grants in carrying out such projects. (b) EXERCISE OF AUTHORITY BY SECRETARY OF DEFENSE.— In any exercise of the authority in subsection (a), the Secretary of Defense shall act through the Defense Advanced Research Projects Agency or any other element of the Department of Defense that the Secretary may designate. (c) ADVANCE PAYMENTS.— The authority provided under subsection (a) may be exercised without regard to Section 3324 of Title 31. (d) RECOVERY OF FUNDS.— (1) A cooperative agreement for performance of basic, applied, or advanced research authorized by Section 2358 of this title and a transaction authorized by subsection (a) may include a clause that requires a person or other entity to make payments to the Department of Defense or any other department or agency of the Federal Government as a condition for receiving support under the agreement or other transaction. (2) The amount of any payment received by the Federal Government pursuant to a requirement imposed under paragraph (1) may be credited, to the extent authorized by the Secretary of Defense, to the appropriate account established under subsection (f). Amounts so credited shall be merged with other funds in the account and shall be available for the same purposes and the same period for which other funds in such account are available. (e) CONDITIONS.— (1) The Secretary of Defense shall ensure that- (A) to the maximum extent practicable, no cooperative agreement containing a clause under subsection (d) and no transaction entered into under subsection (a) provides for research that duplicates research being conducted under existing programs carried out by the Department of Defense; and (B) to the extent that the Secretary determines practicable, the funds provided by the Government under a cooperative agreement containing a clause under subsection (d) or a transaction authorized by subsection (a) do not exceed the total amount provided by other parties to the cooperative agreement or other transaction. (2) A cooperative agreement containing a clause under subsection (d) or a transaction authorized by subsection (a) may be used for a research project when the use of a standard contract, grant, or cooperative agreement for such project is not feasible or appropriate. (f) SUPPORT ACCOUNTS.— There is hereby established on the books of the Treasury separate accounts for each of the military departments and the Defense Advanced Research Projects Agency for support of research projects and development projects provided for in cooperative agreements containing a clause under subsection (d) and research projects provided for in transactions entered into under subsection (a). Funds in those accounts shall be available for the payment of such support. (g) EDUCATION AND TRAINING.—The Secretary of Defense shall— (1) ensure that management, technical, and contracting personnel of the Department of Defense involved in the award or administration of transactions under this section or other innovative forms of contracting are afforded opportunities for adequate education and training; and (2) establish minimum levels and requirements for continuous and experiential learning for such personnel, including levels and requirements for acquisition certification programs. (h) REGULATIONS.— The Secretary of Defense shall prescribe regulations to carry out this section. (i) Protection of Certain Information From Disclosure.-(1) Disclosure of information described in paragraph (2) is not required, and may not be compelled, under Section 552 of Title 5 for five years after the date on which the information is received by the Department of Defense. (2)(A) Paragraph (1) applies to information described in subparagraph (B) that is in the records of the Department of Defense if the information was submitted to the Department in a competitive or noncompetitive process having the potential for resulting in an award, to the party submitting the information, of a cooperative agreement for performance of basic, applied, or advanced research authorized by Section 2358 of this title or another transaction authorized by subsection (a). (B) The information referred to in subparagraph (A) is the following: (i) A proposal, proposal abstract, and supporting documents. (ii) A business plan submitted on a confidential basis. (iii) Technical information submitted on a confidential basis. 10 U.S.C. §2371b. Authority of the Department of Defense to carry out certain prototype projects (a) AUTHORITY.— (1) Subject to paragraph (2), the Director of the Defense Advanced Research Projects Agency, the Secretary of a military department, or any other official designated by the Secretary of Defense may, under the authority of Section 2371 of this title, carry out prototype projects that are directly relevant to enhancing the mission effectiveness of military personnel and the supporting platforms, systems, components, or materials proposed to be acquired or developed by the Department of Defense, or to improvement of platforms, systems, components, or materials in use by the armed forces. (2) The authority of this section- (A) may be exercised for a transaction (for a prototype project) that is expected to cost the Department of Defense in excess of $100,000,000 but not in excess of $500,000,000 (including all options) only upon a written determination by the senior procurement executive for the agency as designated for the purpose of Section 1702(c) of Title 41, or, for the Defense Advanced Research Projects Agency or the Missile Defense Agency, the director of the agency that- (i) the requirements of subsection (d) will be met; an d (ii) the use of the authority of this section is essential to promoting the success of the prototype project; and (B) may be exercised for a transaction (for a prototype project) that is expected to cost the Department of Defense in excess of $500,000,000 (including all options) only if- (i) the Under Secretary of Defense for Acquisition, Technology, and Logistics determines in writing that- (I) the requirements of subsection (d) will be met; an d (II) the use of the authority of this section is essential to meet critical national security objectives; and (ii) the congressional defense committees are notified in writing at least 30 days before such authority is exercised. (3) The authority of a senior procurement executive or director of the Defense Advanced Research Projects Agency or Missile Defense Agency under paragraph (2)(A), and the authority of the Under Secretary of Defense for Acquisition, Technology, and Logistics under paragraph (2)(B), may not be delegated. (b) EXERCISE OF AUTHORITY.— (1) Subsections (e)(1)(B) and (e)(2) of such Section 2371 shall not apply to projects carried out under subsection (a). (2) To the maximum extent practicable, competitive procedures shall be used when entering into agreements to carry out projects under subsection (a). (c) COMPTROLLER GENERAL ACCESS TO INFORMATION.— (1) Each agreement entered into by an official referred to in subsection (a) to carry out a project under that subsection that provides for payments in a total amount in excess of $5,000,000 shall include a clause that provides for the Comptroller General, in the discretion of the Comptroller General, to examine the records of any party to the agreement or any entity that participates in the performance of the agreement. (2) The requirement in paragraph (1) shall not apply with respect to a party or entity, or a subordinate element of a party or entity, that has not entered into any other agreement that provides for audit access by a Government entity in the year prior to the date of the agreement. (3) (A) The right provided to the Comptroller General in a clause of an agreement under paragraph (1) is limited as provided in subparagraph (B) in the case of a party to the agreement, an entity that participates in the performance of the agreement, or a subordinate element of that party or entity if the only agreements or other transactions that the party, entity, or subordinate element entered into with Government entities in the year prior to the date of that agreement are cooperative agreements or transactions that were entered into under this section or Section 2371 of this title. (B) The only records of a party, other entity, or subordinate element referred to in subparagraph (A) that the Comptroller General may examine in the exercise of the right referred to in that subparagraph are records of the same type as the records that the Government has had the right to examine under the audit access clauses of the previous agreements or transactions referred to in such subparagraph that were entered into by that particular party, entity, or subordinate element. (4) The head of the contracting activity that is carrying out the agreement may waive the applicability of the requirement in paragraph (1) to the agreement if the head of the contracting activity determines that it would not be in the public interest to apply the requirement to the agreement. The waiver shall be effective with respect to the agreement only if the head of the contracting activity transmits a notification of the waiver to Congress and the Comptroller General before entering into the agreement. The notification shall include the rationale for the determination. (5) The Comptroller General may not examine records pursuant to a clause included in an agreement under paragraph (1) more than three years after the final payment is made by the United States under the agreement. (d) APPROPRIATE USE OF AUTHORITY.— (1) The Secretary of Defense shall ensure that no official of an agency enters into a transaction (other than a contract, grant, or cooperative agreement) for a prototype project under the authority of this section unless one of the following conditions is met: (A) There is at least one nontraditional defense contractor or nonprofit research institution participating to a significant extent in the prototype project. (B) All significant participants in the transaction other than the Federal Government are small businesses (including small businesses participating in a program described under Section 9 of the Small Business Act (15 U.S.C. 638)) or nontraditional defense contractors. (C) At least one third of the total cost of the prototype project is to be paid out of funds provided by sources other than other than the Federal Government. (D) The senior procurement executive for the agency determines in writing that exceptional circumstances justify the use of a transaction that provides for innovative business arrangements or structures that would not be feasible or appropriate under a contract, or would provide an opportunity to expand the defense supply base in a manner that would not be practical or feasible under a contract. (2) (A) Except as provided in subparagraph (B), the amounts counted for the purposes of this subsection as being provided, or to be provided, by a party to a transaction with respect to a prototype project that is entered into under this section other than the Federal Government do not include costs that were incurred before the date on which the transaction becomes effective. (B) Costs that were incurred for a prototype project by a party after the beginning of negotiations resulting in a transaction (other than a contract, grant, or cooperative agreement) with respect to the project before the date on which the transaction becomes effective may be counted for purposes of this subsection as being provided, or to be provided, by the party to the transaction if and to the extent that the official responsible for entering into the transaction determines in writing that- (i) the party incurred the costs in anticipation of entering into the transaction; and (ii) it was appropriate for the party to incur the costs before the transaction became effective in order to ensure the successful implementation of the transaction. (e) Definitions.—In this section: (1) The term "nontraditional defense contractor" has the meaning given the term under Section 2302(9) of this title. (2) The term "small business" means a small business concern as defined under Section 3 of the Small Business Act (15 U.S.C. 632). (f) FOLLOW-ON PRODUCTION CONTRACTS OR TRANSACTIONS.— (1) A transaction entered into under this section for a prototype project may provide for the award of a follow-on production contract or transaction to the participants in the transaction. A transaction includes all individual prototype subprojects awarded under the transaction to a consortium of United States industry and academic institutions. (2) A follow-on production contract or transaction provided for in a transaction under paragraph (1) may be awarded to the participants in the transaction without the use of competitive procedures, notwithstanding the requirements of Section 2304 of this title, if - (A) competitive procedures were used for the selection of parties for participation in the transaction; and (B) the participants in the transaction successfully completed the prototype project provided for in the transaction. (3) Contracts and transactions entered into pursuant to this subsection may be awarded using the authority in subsection (a), under the authority of Chapter 137 of this title, or under such procedures, terms, and conditions as the Secretary of Defense may establish by regulation. (g) AUTHORITY TO PROVIDE PROTOTYPES AND FOLLOW-ON PRODUCTION ITEMS AS GOVERNMENT-FURNISHED EQUIPMENT.— An agreement entered into pursuant to the authority of subsection (a) or a follow-on contract or transaction entered into pursuant to the authority of subsection (f) may provide for prototypes or follow-on production items to be provided to another contractor as Government-furnished equipment. (h) APPLICABILITY OF PROCUREMENT ETHICS REQUIREMENTS.— An agreement entered into under the authority of this section shall be treated as a Federal agency procurement for the purposes of Chapter 21 of Title 41. 10 U.S.C. §2373. Procurement for experimental purposes (a) AUTHORITY.— The Secretary of Defense and the Secretaries of the military departments may each buy ordnance, signal, chemical activity, transportation, energy, medical, space-flight, and aeronautical supplies, including parts and accessories, and designs thereof, that the Secretary of Defense or the Secretary concerned considers necessary for experimental or test purposes in the development of the best supplies that are needed for the national defense. (b) PROCEDURES.— Purchases under this section may be made inside or outside the United States and by contract or otherwise. Chapter 137 of this title applies only when such purchases are made in quantities greater than necessary for experimentation, technical evaluation, assessment of operational utility, or safety or to provide a residual operational capability.

 

 Report 2:
R ecent high-profile data breaches and privacy violations have raised national concerns over the legal protections that apply to Americans' electronic data. While some concern over data protection stems from how the government might utilize such data, mounting worries have centered on how the private sector controls digital information, the focus of this report. Inadequate corporate privacy practices and intentional intrusions into private computer networks have exposed the personal information of millions of Americans. At the same time, internet connectivity has increased and varied in form in recent years, expanding from personal computers and mobile phones to everyday objects such as home appliances, "smart" speakers, vehicles, and other internet-connected devices. Americans now transmit their personal data on the internet at an exponentially higher rate than the past. Along with the increased connectivity, a growing number of "consumer facing" actors (such as websites) and "behind the scenes" actors (such as data brokers and advertising companies) collect, maintain, and use consumers' information. While this data collection can benefit consumers—for instance, by allowing companies to offer them more tailored products—it also raises privacy concerns, as consumers often cannot control how these entities use their data. As a consequence, the protection of personal data has emerged as a major issue for congressional consideration. Despite the increased interest in data protection, the legal paradigms governing the security and privacy of personal data are complex and technical, and lack uniformity at the federal level. The Supreme Court has recognized that the Constitution provides various rights protecting individual privacy, but these rights generally guard only against government intrusions and do little to prevent private actors from abusing personal data online. At the federal statutory level, while there are a number of data protection statutes, they primarily regulate certain industries and subcategories of data. The Federal Trade Commission (FTC) fills in some of the statutory gaps by enforcing the federal prohibition against unfair and deceptive data protection practices. But no single federal law comprehensively regulates the collection and use of personal data. In contrast to the "patchwork" nature of federal law, some state and foreign governments have enacted more comprehensive data protection legislation. Some analysts suggest these laws, which include the European Union's (EU's) General Data Protection Regulation (GDPR) and state laws such as the California Consumer Privacy Act (CCPA), will create increasingly overlapping and uneven data protection regimes. This fragmented legal landscape coupled with concerns that existing federal laws are inadequate has led many stakeholders to argue that the federal government should assume a larger role in data protection policy. However, at present, there is no consensus as to what, if any, role the federal government should play, and any legislative efforts at data protection are likely to implicate unique legal concerns such as preemption, standing, and First Amendment rights, among other issues. This report examines the current U.S. legal landscape governing data protection, contrasting the current patchwork of federal data protection laws with the more comprehensive regulatory models in the CCPA and GDPR. The report also examines potential legal considerations for the 116th Congress should it consider crafting more comprehensive federal data protection legislation. The report lastly contains an Appendix , which contains a table summarizing the federal data protection laws discussed in the report. Historically, the common law in the United States had little need to protect privacy—as one commentator has observed, "[s]olitude was readily available in colonial America." Although common law had long protected against eavesdropping and trespass, these protections said little to nothing about individual rights to privacy, per se. Over time, gradual changes in the technological and social environment caused a shift in the law. In 1890, Louis Brandeis and Samuel Warren published a groundbreaking article in the Harvard Law Review entitled The Right to Privacy . Reacting to the proliferation of the press and advancements in technology such as more advanced cameras, the article argued that the law should protect individuals' "right to privacy" and shield them from intrusion from other individuals. The authors defined this emergent right as the "right to be let alone." Scholars have argued that this article created a "revolution" in the development of the common law. In the century that followed Brandeis's and Warren's seminal article, most states recognized the so-called "privacy torts"—intrusion upon seclusion, public disclosure of private facts, false light or "publicity," and appropriation. These torts revolve around the central idea that individuals should be able to lead, "to some reasonable extent, a secluded and private life." The Supreme Court described this evolution of privacy tort law as part of a "strong tide" in the twentieth century toward the "so-called right of privacy" in the states. Despite this "strong tide," some scholars have argued that these torts, which were developed largely in the mid-twentieth century, are inadequate to face the privacy and data protection problems of today. Furthermore, some states do not accept all four of these torts or have narrowed and limited the applicability of the torts so as to reduce their effectiveness. As discussed in greater detail below, state common law provides some other remedies and protections relevant to data protection, via tort and contract law. However, while all of this state common law may have some influence on data protection, the impact of this judge-made doctrine is unlikely to be uniform, as courts' application of these laws will likely vary based on the particular facts of the cases in which they are applied and the precedents established in the various states. As reflected in the common law's limited remedies, at the time of the founding, concerns about privacy focused mainly on protecting private individuals from government intrusion rather than on protecting private individuals from intrusion by others. Accordingly, the Constitution's Bill of Rights protects individual privacy from government intrusion in a handful of ways and does little to protect from non-governmental actors. Some provisions protect privacy in a relatively narrow sphere, such as the Third Amendment's protection against the quartering of soldiers in private homes or the Fifth Amendment's protection against self-incrimination. The most general and direct protection of individual privacy is contained in the Fourth Amendment, which states that "[t]he right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated . . ." For more than 100 years, the Fourth Amendment was generally read to prohibit only entry into private places rather than to provide general right to privacy. However, alongside the developments in the common law, constitutional law evolved over time to place a greater emphasis on protecting an individual's personal privacy. In particular, in 1967, the Supreme Court in Katz v. United States explained that the Fourth Amendment, while not creating a general "right to privacy," nonetheless protected "people, not places," and guarded individual privacy against certain types of governmental intrusion. This principle has continued to evolve over time, and has come to protect, to some extent, individuals' interest in their digital privacy. For example, in the 2018 case of Carpenter v. United States , the Supreme Court concluded that the Fourth Amendment's protection of privacy extended to protecting some information from government intrusion even where that information was shared with a third party. In Carpenter , the Court concluded that individuals maintain an expectation of privacy, protected by the Fourth Amendment, in the record of their movements as recorded by their cellular provider. Carpenter distinguished earlier cases which had relied upon the principle that information shared with third parties was generally not subject to Fourth Amendment scrutiny, concluding that "an individual maintains a legitimate expectation of privacy in the record of his physical movements as captured through [his cellular phone]." The Court's holding means that, in the future, the government must obtain a warrant supported by probable cause to obtain this information. The Fourth Amendment thus provides a limited bulwark against government intrusion into digital privacy. In addition to the protection provided by the Fourth Amendment, in the 1960s and 1970s, the Court concluded that the Fourteenth Amendment's guarantee of "liberty" implied the existence of a more general right of privacy, protecting individuals from government intrusion even outside the "search and seizure" context. In the 1977 case Whalen v. Roe , the Supreme Court explained that this constitutional right of privacy "in fact involve[s] at least two different kinds of interests. One is the individual interest in avoiding disclosure of personal matters, and another is the interest in independence in making certain kinds of important decisions." The second of these interests relates primarily to individual rights concerning the "intimacies of [persons'] physical relationship," as well as the right to abortion, and has little connection to data protection. However, the first of the interests listed in Whalen could potentially relate to data protection. This interest, the right to avoid certain disclosures, has come to be known as the right to "informational privacy." Despite its broad expression in Whalen , every Supreme Court case to consider the informational privacy right has rejected the constitutional claim and upheld the government program alleged to have infringed on the right. In Whalen itself, physicians and patients challenged a New York law that required the recording of the names and addresses of all persons who had obtained certain drugs for which there was both a lawful and unlawful market. Although the Court acknowledged that the statute "threaten[ed] to impair . . . [the plaintiffs'] interest in the nondisclosure of private information," the Court observed that the disclosures were an "essential part of modern medical practice" and the New York law had protections in place against unwarranted disclosure that showed a "proper concern" for the protection of privacy. Together, the Court found these factors sufficient to uphold the law. In the wake of Whalen and Nixon v. Administrator of General Services —a case decided the same year as Whalen that also considered the right to informational privacy—courts have struggled to articulate the precise contours of the right. The most recent Supreme Court case to consider the right to informational privacy, NASA v. Nelson , went so far as to suggest that the right might not exist, "assuming without deciding" that the right existed in the course of rejecting the constitutional claim challenge to a government background check program for hiring. Despite the Supreme Court's lack of clarity about the right to informational privacy, "most federal circuit courts" recognize the right to various extents. All of the constitutional rights involving privacy, like the common law privacy torts, focus on public disclosure of private facts. This focus limits their potential influence on modern data privacy debates, which extends beyond the disclosure issue to more broadly concern how data is collected, protected, and used. Perhaps more importantly, whatever the reach of the constitutional right to privacy, the "state action doctrine" prevents it from being influential outside the realm of government action. Under this doctrine, only government action is subject to scrutiny under the Constitution, but purely private conduct is not proscribed, "no matter how unfair that conduct may be." As a result, neither the common nor constitutional law provides a complete framework for considering many of the potential threats to digital privacy and consumer data. Rather, the most important data protection standards come from statutory law. Given the inherent limitations in common law and constitutional protections, Congress has enacted a number of federal laws designed to provide statutory protections of individuals' personal information. In contrast with the scheme prevalent in Europe and some other countries, rather than a single comprehensive law, the United States has a "patchwork" of federal laws that govern companies' data protection practices. These laws vary considerably in their purpose and scope. Most impose data protection obligations on specific industry participants—such as financial institutions, health care entities, and communications common carriers—or specific types of data, such as children's data. Other laws, however, supplement the Constitution's limited privacy protections and apply similar principles to private entities. The Stored Communications Act (SCA), for instance, generally prohibits the unauthorized access or disclosure of certain electronic communications stored by internet service providers. Lastly, some laws prohibit broad categories of conduct that, while not confined to data protection, limit how companies may handle personal data. Most notably, the Federal Trade Commission Act (FTC Act) prohibits "unfair or deceptive acts or practices." As some scholars have pointed out, the FTC has used its authority under the FTC Act to develop norms and principles that effectively fill in the gaps left by other privacy statutes. These laws are organized below, beginning with those most narrowly focused on discrete industries and moving toward more generally applicable laws. In light of its gap-filling function, this section lastly discusses the FTC Act—along with the Consumer Financial Protection Act (CFPA), which covers similar types of conduct. The Appendix to this report contains a table summarizing the federal data protection laws discussed. The Gramm-Leach-Bliley Act (GLBA) imposes several data protection obligations on financial institutions. These obligations are centered on a category of data called "consumer" "nonpublic personal information" (NPI), and generally relate to: (1) sharing NPI with third parties, (2) providing privacy notices to consumers, and (3) securing NPI from unauthorized access. First, unless an exception applies, GLBA and its implementing regulations prohibit financial institutions from sharing NPI with non-affiliated third parties unless they first provide the consumers with notice and an opportunity to "opt-out." Furthermore, financial institutions are prohibited altogether from sharing account numbers or credit card numbers to third parties for use in direct marketing. Second, financial institutions must provide "clear and conspicuous" initial and annual notices to customers describing their privacy "policies and practices." These notices must include, among other things, the categories of NPI collected and disclosed, the categories of third parties with which the financial institution shares NPI, and policies and practices with respect to protecting the confidentiality and security of NPI. Third, GLBA and its implementing regulations (often referred to as the "Safeguards Rule" ) require financial institutions to maintain "administrative, technical, and physical safeguards" to "insure the security and confidentiality" of "customer" (as opposed to "consumer") NPI, and to protect against "any anticipated threats or hazards" or "unauthorized access" to such information. Financial institutions regulated by federal banking agencies are further required to implement a program for responding to the unauthorized access of customer NPI. The Consumer Financial Protection Bureau (CFPB), FTC, and federal banking agencies share civil enforcement authority for GLBA's privacy provisions. However, the CFPB has no enforcement authority over GLBA's data security provisions. Under the data security provisions, federal banking regulators have exclusive enforcement authority for depository institutions, and the FTC has exclusive enforcement authority for all non-depository institutions. GLBA does not specify any civil remedies for violations of the Act, but agencies can seek remedies based on the authorities provided in their enabling statutes, as discussed below. GLBA also imposes criminal liability on those who "knowingly and intentionally" obtain or disclose "customer information" through false or fraudulent statements or representations. Criminal liability can result in fines and up to five years' imprisonment. GLBA does not contain a private right of action that would allow affected individuals to sue violators. Under the Health Insurance Portability and Accountability Act (HIPAA), the Department of Health and Human Services (HHS) has enacted regulations protecting a category of medical information called "protected health information" (PHI). These regulations apply to health care providers, health plans, and health care clearinghouses (covered entities), as well as certain "business associates" of such entities. The HIPAA regulations generally speak to covered entities': (1) use or sharing of PHI, (2) disclosure of information to consumers, (3) safeguards for securing PHI, and (4) notification of consumers following a breach of PHI. First, with respect to sharing, HIPAA's privacy regulations generally prohibit covered entities from using PHI or sharing it with third parties without patient consent, unless such information is being used or shared for treatment, payment, or "health care operations" purposes, or unless another exception applies. Covered entities generally may not make treatment or services conditional on an individual providing consent. Second, with respect to consumer disclosures, covered entities must provide individuals with "adequate notice of the uses and disclosures of [PHI] that may be made by the covered entity, and of the individual's rights and the covered entity's legal duties with respect to [PHI]." These notices must be provided upon consumer request, and covered entities maintaining websites discussing their services or benefits must "prominently post" the notices on their websites. Furthermore, an individual has the right to request that a covered entity provide him with a copy of his PHI that is maintained by the covered entity. In some cases, an individual may also request that the covered entity provide information regarding specific disclosures of the individual's PHI, including the dates, recipients, and purposes of the disclosures. Third, with respect to data security, covered entities must maintain safeguards to prevent threats or hazards to the security of electronic PHI. Lastly, HIPAA regulations contain a data breach notification requirement, requiring covered entities to, among other things, notify the affected individuals within 60 calendar days after discovering a breach of "unsecured" PHI. Violations of HIPAA's privacy requirements can result in criminal or civil enforcement. HHS possesses civil enforcement authority and may impose civil penalties, with the amount varying based on the level of culpability. The Department of Justice has criminal enforcement authority and may seek fines or imprisonment against a person who, in violation of HIPAA's privacy requirements, "knowingly" obtains or discloses "individually identifiable health information" or "uses or causes to be used a unique health identifier." HIPAA does not, however, contain a private right of action that would allow aggrieved individuals to sue alleged violators. The Fair Credit Reporting Act (FCRA) covers the collection and use of information bearing on a consumer's creditworthiness. FCRA and its implementing regulations govern the activities of three categories of entities: (1) credit reporting agencies (CRAs), (2) entities furnishing information to CRAs (furnishers), and (3) individuals who use credit reports issued by CRAs (users). In contrast to HIPAA or GLBA, there are no privacy provisions in FCRA requiring entities to provide notice to a consumer or to obtain his opt-in or opt-out consent before collecting or disclosing the consumer's data to third parties. FCRA further has no data security provisions requiring entities to maintain safeguards to protect consumer information from unauthorized access. Rather, FCRA's requirements generally focus on ensuring that the consumer information reported by CRAs and furnishers is accurate and that it is used only for certain permissible purposes. With respect to accuracy, CRAs must maintain reasonable procedures to ensure the accuracy of information used in "consumer reports." CRAs must further exclude adverse information, such as "accounts placed in collection" or civil judgements, from consumer reports after a certain amount of time has elapsed. Furnishers must similarly establish reasonable policies and procedures to ensure the accuracy of the information reported to CRAs and may not furnish to a CRA any consumer information if they have reasonable cause to believe that information is inaccurate. Consumers also have the right to review the information CRAs have collected on them to ensure such information is accurate. CRAs must disclose information contained in a consumer's file upon the consumer's request, as well as the sources of the information and the identity of those who have recently procured consumer reports on the consumer. Should a consumer dispute the accuracy of any information in his file, CRAs and furnishers must reinvestigate the accuracy of the contested information. In addition to the accuracy requirements, under FCRA consumer reports may be used only for certain permissible purposes such as credit transactions. Accordingly, a CRA may generally furnish consumer reports to a user only if it "has a reason to believe" the user intends to use it for a permissible purpose. Likewise, users may "use or obtain a consumer report" only for a permissible purpose. Along with the permissible purpose requirement, users must further notify consumers of any "adverse action" taken against the consumer based on the report. Adverse actions include refusing to grant credit on substantially the terms requested, reducing insurance coverage, and denying employment. The FTC and the CFPB share civil enforcement authority over FCRA, with each agency possessing enforcement authority over entities subject to their respective jurisdictions. In addition to government enforcement, FCRA provides a private right of action for consumers injured by willful or negligent violations of the Act. Consumers bringing such actions for negligent violations of the Act may recover actual damages, attorney's fees, and other litigation costs. For willful violations, consumers may recover either actual damages or statutory damages ranging from $100 to $1,000, attorney's fees, other litigation costs, and "such amount of punitive damages as the court may allow." FCRA also imposes criminal liability on any individual who knowingly and willfully obtains consumer information from a CRA under false pretenses and on any officer or employee of a CRA who knowingly and willfully provides consumer information to a person not authorized to receive that information. The Communications Act of 1934 (Communications Act or Act), as amended, established the Federal Communications Commission (FCC) and provides a "comprehensive scheme" for the regulation of interstate communication. Most relevant to this report, the Communications Act includes data protection provisions applicable to common carriers, cable operators, and satellite carriers. The Telecommunications Act of 1996 amended the Communications Act to impose data privacy and data security requirements on entities acting as common carriers. Generally, common carrier activities include telephone and telegraph services but exclude radio broadcasting, television broadcasting, provision of cable television, and provision of broadband internet. The privacy and security requirements imposed on entities acting as common carriers are primarily centered on a category of information referred to as "customer proprietary network information (CPNI)." CPNI is defined as information relating to the "quantity, technical configuration, type, destination, location, and amount of use of a telecommunications service subscribed to by any customer of a telecommunications carrier," and is "made available to the carrier by the customer solely by virtue of the carrier-customer relationship." Section 222(c) of the Communications Act and the FCC's implementing regulations set forth carriers' obligations regarding CPNI. These provisions cover three main issues. First, carriers must comply with certain use and disclosure rules. Section 222(c) imposes a general rule that carriers may not "use, disclose, or permit access to" "individually identifiable" CPNI without customer approval, unless a particular exception applies. Before a carrier may solicit a customer for approval to use or disclose their CPNI, it must notify customers of their legal rights regarding CPNI and provide information regarding the carrier's use and disclosure of CPNI. Second, carriers must implement certain safeguards to ensure the proper use and disclosure of CPNI. These safeguards must include, among other things, a system by which the "status of a customer's CPNI approval can be clearly established" prior to its use, employee training on the authorized use of CPNI, and "reasonable measures" to discover and protect against attempts to gain unauthorized access to CPNI." Lastly, carriers must comply with data breach requirements. Following a "breach" of customers' CPNI, a carrier must disclose such a breach to law enforcement authorities no later than seven days following a "reasonable determination of the breach." After it has "completed the process of notifying law enforcement," it must notify customers whose CPNI has been breached. In addition to the CPNI requirements, the Communications Act contains three other potentially relevant data privacy and security provisions pertaining to common carriers. First, Section 222(a) of the Act states that carriers must "protect the confidentiality of proprietary information" of "customers." Second, Section 201(b) of the Act declares unlawful "any charge, practice, classification, and regulation" in connection with a carrier's communication service that is "unjust or unreasonable." Lastly, Section 202(a) provides that it shall "be unlawful for any common carrier to make any unjust or unreasonable discrimination in charges, practices, classification, regulations, facilities, or services . . . ." In a 2016 rule, which was subsequently overturned pursuant to the Congressional Review Act, the FCC attempted to rely on these three provisions to regulate a broad category of data called "customer proprietary information" (customer PI). While customer PI is not defined in the statute, the FCC's 2016 rule defined it broadly to include CPNI, as well as other "personally identifiable information" and the "content of communications." The FCC reasoned that Section 222(a) imposes a general duty, independent from Section 222(c), on carriers to protect the confidentiality of customer PI. It further maintained that Sections 201(b) and 202(a) provide independent "backstop authority" to ensure that no gaps are formed in commercial data privacy and security practices, similar to the FTC's authority under the FTC Act. However, given that Congress overturned the 2016 rule, the FCC may be prohibited under the CRA from relying on these three provisions to regulate data privacy and security. Under the CRA, the FCC may not reissue the rule in "substantially the same form" or issue a "new rule that is substantially the same" as the overturned rule "unless the reissued or new rule is specifically authorized by a law enacted after the date of the joint resolution disapproving the original rule." The FCC is empowered to enforce civil violations of the Communications Act's provisions, including its common carrier provisions. The FCC may impose a "forfeiture penalty" against any person who "willfully or repeatedly" violates the Act or the FCC's implementing regulations. The Communications Act further imposes criminal penalties on those who "willfully and knowingly" violate the statute or the FCC's implementing regulations. Along with its general civil and criminal provisions, the Communications Act provides a private right of action for those aggrieved by violations of its common carrier provisions; in such actions, plaintiffs may seek actual damages and reasonable attorney's fees. In addition to common carriers, the Communications Act imposes a number of data privacy and security requirements on how "cable operators" and "satellite carriers" (i.e., covered entities) treat their subscribers' "personally identifiable information" (PII). These requirements relate to: (1) data collection and disclosure; (2) subscribers' access to, and correction of, their data; (3) data destruction; (4) privacy policy notification; and (5) data security. First, covered entities must obtain the "prior written or electronic consent" of a subscriber before collecting the subscriber's PII or disclosing it to third parties. There are several exceptions to this consent requirement. Among other things, covered entities may collect a subscriber's PII in order to obtain information necessary to render service to the subscriber, and they may disclose a subscriber's PII if the disclosure is necessary to "render or conduct a legitimate business activity" related to the service they provide. Second, covered entities must provide subscribers, at "reasonable times and a convenient place," with access to all of their PII "collected and maintained," and they must further provide subscribers a reasonable opportunity to correct any error in such information. Third, covered entities are obligated to destroy PII if it is "no longer necessary for the purpose for which it is was collected" and there are "no pending requests or orders for access to such information." Fourth, covered entities must provide subscribers with a privacy policy notice at the "time of entering into an agreement" for services and "at least once a year thereafter." These notices must describe, among other things: (1) the nature of the subscriber's PII that has been, or will be, collected, (2) the nature, frequency, and purpose of any disclosure of such information and the types of persons to whom the disclosure is made, and (3) the times and place at which the subscriber may have access to such information. Lastly, the Communications Act imposes a general data security requirement on covered entities; they must "take such actions as are necessary to prevent unauthorized access to [PII] by a person other than the subscriber" or the covered entity. The Communications Act provides a private right of action for "[a]ny person aggrieved by any act" of a covered entity in violation of these requirements. In such actions, a court may award actual damages, punitive damages, and reasonable attorneys' fees and other litigation costs. Additionally, covered entities violating these provisions may be subject to FCC civil enforcement and criminal penalties that, as previously noted, are generally applicable to violations of the Communications Act. The Video Privacy Protection Act (VPPA) was enacted in 1988 in order to "preserve personal privacy with respect to the rental, purchase, or delivery of video tapes or similar audio visual materials." The VPPA does not have any data security provisions requiring entities to maintain safeguards to protect consumer information from unauthorized access. However, it does have privacy provisions restricting when covered entities can share certain consumer information. Specifically, the VPPA prohibits "video tape service providers" —a term that includes both digital video streaming services and brick-and-mortar video rental stores —from knowingly disclosing PII concerning any "consumer" without that consumer's opt-in consent. The VPPA provides several exceptions to this general rule. In particular, video tape service providers may disclose PII to "any person if the disclosure is incident to the ordinary course of business." Providers may also disclose PII if the disclosure solely includes a consumer's name and address and does not identify the "title, description, or subject matter of any video tapes or other audio visual material," and the consumer has been provided with an opportunity to opt out of such disclosure. The VPPA does not empower any federal agency to enforce violations of the Act and there are no criminal penalties for violations, but it does provide for a private right of action for persons aggrieved by the Act. In such actions, courts may award actual damages, punitive damages, preliminary and equitable relief, and reasonable attorneys' fees and other litigation costs. The Family Educational Rights and Privacy Act of 1974 (FERPA) creates privacy protections for student education records. "Education records" are defined broadly to generally include any "materials which contain information directly related to a student" and are "maintained by an educational agency or institution." FERPA defines an "educational agency or institution" to include "any public or private agency or institution which is the recipient of funds under any applicable program." FERPA generally requires that any "educational agency or institution" (i.e., covered entities) give parents or, depending on their age, the student (1) control over the disclosure of the student's educational records, (2) an opportunity to review those records, and (3) an opportunity to challenge them as inaccurate. First, with respect to disclosure, covered entities must not have a "policy or practice" of permitting the release of education records or "personally identifiable information contained therein" without the consent of the parent or the adult student. This consent requirement is subject to certain exceptions. Among other things, covered entities may disclose educational records to (1) certain "authorized representatives," (2) school officials with a "legitimate educational interest," or (3) "organizations conducting studies" for covered entities "for the purpose of developing, validating, or administering predictive tests, administering student aid programs, and improving instructions." Covered entities may also disclose the information without consent if it constitutes "directory information" and the entity has given notice and a "reasonable period of time" to opt out of the disclosure. Second, in addition to the disclosure obligations, covered entities must not have a "policy of denying" or "effectively prevent[ing]" parents or an adult student from inspecting and reviewing the underlying educational records. Covered entities must further "establish appropriate procedures" to grant parents' review requests "within a reasonable period of time, but in no case more than forty-five days after the request has been made." Lastly, covered entities must provide an "opportunity for a hearing" to challenge the contents of the student's education records as "inaccurate, misleading, or otherwise in violation of the privacy rights of students." Covered entities must further "provide an opportunity for the correction or deletion of any such inaccurate, misleading or otherwise inappropriate data contained therein and to insert into such records a written explanation of the parents respecting the content of such records." Parents or adult students who believe that their rights under FERPA have been violated may file a complaint with the Department of Education. FERPA authorizes the Secretary of Education to "take appropriate actions," which may include withholding federal education funds, issuing a "cease and desist order," or terminating eligibility to receive any federal education funding. FERPA does not, however, contain any criminal provisions or a private right of action. While federal securities statutes and regulations do not explicitly address data protection, two requirements under these laws have implications for how companies prevent and respond to data breaches. First, federal securities laws may require companies to adopt controls designed to protect against data breaches. Under Section 13(b)(2)(B) of the Securities and Exchange Act of 1934 (Exchange Act), public companies and certain other companies are required to "devise and maintain a system of internal accounting controls sufficient to provide reasonable assurances" that "transactions are executed in accordance with management's general or specific authorization," and that "access to assets is permitted only in accordance with management's general or specific authorization." In a recent report, the Securities and Exchange Commission (SEC) suggested that, in order to comply with this requirement, companies should consider "cyber-related threats" when formulating accounting controls. The report discussed the SEC's investigation of companies that wrongly transferred millions of dollars in response to fraudulent emails, generally noting that "companies should pay particular attention to the obligations imposed by Section 13(b)(2)(B)" in light of the "risks associated with today's ever expanding digital interconnectedness." Second, federal securities laws may require companies to discuss data breaches when making required disclosures under securities laws. The Exchange Act, Securities Act of 1933 (Securities Act), and their implementing regulations require certain companies to file a number of disclosures with the SEC. Specifically, the Securities Act requires companies issuing securities in a public offering to file detailed statements registering the offering (registration statements), and the Exchange Act requires public companies to file periodic reports on an annual, quarterly, and ongoing basis. These filings must contain certain categories of information, such as a description of the most significant factors that make investing in the company speculative or risky (known as "risk factors") and a description of any "events, trends, or uncertainties that are reasonably likely to have a material effect on its results of operations, liquidity, or financial condition . . . ." Further, when making these filings, or any other statements in connection with the purchase or sale of a security, companies are required to include any "material" information necessary to make the statements made therein "not misleading." In interpretive guidance issued in February 2018, the SEC indicated that, pursuant to these obligations, companies may be required to disclose in their filings cyber incidents such as data breaches. The SEC can enforce violations of the Securities Act and the Exchange Act, including the accounting controls requirement and the disclosure requirements, through civil actions filed in court or administrative "cease and desist" proceedings. The SEC may seek civil penalties, disgorgement, and injunctive relief (in civil actions) or a cease and desist order (in administrative proceedings). Furthermore, under both the Exchange Act and the Securities Act, individuals aggrieved by a company's misrepresentation or omission of a material fact in connection with the purchase or sale of a security may sue the company for actual damages incurred by the individual. There is not, however, a private right of action for violations of the Exchange Act's accounting controls requirement. Lastly, in addition to civil enforcement, both the Securities Act and the Exchange Act impose criminal liability; any person who "willfully" violates the acts or their implementing regulations may be subject to fines and imprisonment. The Children's Online Privacy Protection Act (COPPA) and the FTC's implementing regulations regulate the online collection and use of children's information. Specifically, COPPA's requirements apply to: (1) any "operator" of a website or online service that is "directed to children," or (2) any operator that has any "actual knowledge that it is collecting personal information from a child" (i.e., covered operators). Covered operators must comply with various requirements regarding data collection and use, privacy policy notifications, and data security. First, COPPA and the FTC's implementing regulations prohibit covered operators from collecting or using "personal information" from children under the age of thirteen without first obtaining parental consent. Such consent must be "verifiable" and must occur before the information is collected. Second, covered operators must provide parents with direct notice of their privacy policies, describing their data collection and sharing policies. Covered operators must further post a "prominent and clearly labeled link" to an online notice of its privacy policies at the home page of its website and at each area of the website in which it collects personal information from children. Lastly, covered operators that have collected information from children must establish and maintain "reasonable procedures" to protect the "confidentiality, security, and integrity" of the information, including ensuring that the information is provided only to third parties that will similarly protect the information. They must also comply with certain data retention and deletion requirements. Under COPPA's safe harbor provisions, covered operators will be deemed to have satisfied these requirements if they follow self-regulatory guidelines the FTC has approved. COPPA provides that violations of the FTC's implementing regulations will be treated as "a violation of a rule defining an unfair or deceptive act or practice" under the FTC Act. Under the FTC Act, as discussed in more detail below, the FTC has authority to enforce violations of such rules by seeking penalties or equitable relief. COPPA also authorizes state attorneys general to enforce violations affecting residents of their states. COPPA does not contain any criminal penalties or any provision expressly providing a private right of action. The Electronic Communications Privacy Act (ECPA) was enacted in 1986, and is composed of three acts: the Wiretap Act, the Stored Communications Act (SCA), and the Pen Register Act. Much of ECPA is directed at law enforcement, providing "Fourth Amendment like privacy protections" to electronic communications. However, ECPA's three acts also contain privacy obligations relevant to non-governmental actors. ECPA is perhaps the most comprehensive federal law on electronic privacy, as it is not sector-specific, and many of its provisions apply to a wide range of private and public actors. Nevertheless, its impact on online privacy practices has been limited. As some commentators have observed, ECPA "was designed to regulate wiretapping and electronic snooping rather than commercial data gathering," and litigants attempting to apply ECPA to online data collection have generally been unsuccessful. The Wiretap Act applies to the interception of a communication in transit. A person violates the Act if, among other acts, he "intentionally intercepts . . . any wire, oral, or electronic communication." The Wiretap Act defines an "electronic communication" broadly, and courts have held that the term includes information conveyed over the internet. Several thresholds must be met for an act to qualify as an unlawful "interception." Of particular relevance are three threshold issues. First, the communication must be acquired contemporaneously with the transmission of the communication. Consequently, there is no "interception" where the communication in question is in storage. Furthermore, the acquired information must relate to the "contents" of the communication, defined as information concerning the "substance, purport, or meaning of that communication." As a result, while the Act applies to information like the header or body of an email, the Act does not apply to non-substantive information automatically generated about the characteristics of the communication, such as IP addresses. Third, individuals do not violate the Wiretap Act if they are a "party to the communication" or received "prior consent" from one of the parties to the communication. The party-to-the-communication and consent exceptions have been subject to significant litigation; in particular, courts have often relied on the exceptions to dismiss suits alleging Wiretap Act violations due to online tracking, holding that websites or third-party advertisers who tracked users' online activity were either parties to the communication or received consent from a party to the communication. The SCA prohibits the improper access or disclosure of certain electronic communications in storage. With respect to improper access, a person violates the SCA if he obtains an "electronic communication" in "electronic storage" from "a facility through which an electronic communication service is provided" by either: (1) "intentionally access[ing] [the facility] without authorization" or (2) "intentionally exceed[ing] an authorization." Although the statute does not define the term "facility," most courts have held that the term is limited to a location where network service providers store communications. However, courts have differed over whether a personal computer is a "facility." Most courts have excluded personal computers from the reach of the SCA, but some have disagreed. With respect to improper disclosure, the SCA generally prohibits entities providing "electronic communication services" or "remote computing services" from knowingly divulging the contents of a communication while holding the communication in electronic storage. Similar to the Wiretap Act, the SCA's access and disclosure prohibitions are subject to certain exceptions. In particular, individuals do not violate the SCA if they are the sender or intended recipient of the communication or when a party to the communication consents to the access or disclosure. As with the Wiretap Act, courts have relied on these two exceptions to dismiss suits under the SCA related to online tracking. The Pen Register Act prohibits the installation of a "pen register" or "trap and trace device" without a court order. A pen register is a "device or process" that "records or decodes" outgoing "dialing, routing, addressing, or signaling information," and a trap and trace device is a "device or process" that "captures the incoming . . . dialing, routing, addressing, and signaling information." In contrast to the Wiretap Act, the Pen Register Act applies to the capture of non-content information, as the definitions of pen registers and trap and trace devices both exclude any device or process that captures the "contents of any communication." Furthermore, the Pen Register Act prohibits only the use of a pen register or trap and trace device and does not separately prohibit the disclosure of non-content information obtained through such use. The statute does, however, have several exceptions similar to those contained in the Wiretap Act and SCA. Among other things, providers of an electronic or wire communication service will not violate the Act when they use a pen register or trap and trace device in order to "protect their rights or property" or "where the consent of the user of that service has been obtained." The Wiretap Act and the SCA both provide for private rights of action. Persons aggrieved by violations of either act may bring a civil action for damages, equitable relief, and reasonable attorney's fees. For actions under the Wiretap Act, damages are the greater of: (1) actual damages suffered by the plaintiff, or (2) "statutory damages of whichever is the greater of $100 a day for each day of violation or $10,000." For actions under the SCA, damages are "the sum of the actual damages suffered by the plaintiff and the profits made by the violator," provided that all successful plaintiffs are entitled to receive at least $1,000. Violations of the Wiretap Act and SCA are also subject to criminal prosecution and can result in fines and imprisonment. In contrast, the Pen Register Act does not provide for a private right of action, but knowing violations can result in criminal fines and imprisonment. The Computer Fraud and Abuse Act (CFAA) was originally intended as a computer hacking statute and is centrally concerned with prohibiting unauthorized intrusions into computers, rather than addressing other data protection issues such as the collection or use of data. Specifically, the CFAA imposes liability when a person "intentionally accesses a computer without authorization or exceeds authorized access, and thereby obtains . . . information from any protected computer." A "protected computer" is broadly defined as any computer used in or affecting interstate commerce or communications, functionally allowing the statute to apply to any computer that is connected to the internet. Violations of the CFAA are subject to criminal prosecution and can result in fines and imprisonment. The CFAA also allows for a private right of action, allowing aggrieved individuals to seek actual damages and equitable relief, such as an injunction against the defendant. As with ECPA, internet users have attempted to use this private right of action to sue companies tracking their online activity, arguing that companies' use of tracking devices constitutes an unauthorized access of their computers. In this vein, CFAA is theoretically a more generous statute than ECPA for such claims because it requires authorization from the owner of the computer (i.e., the user), rather than allowing any party to a communication (i.e., either the user or the website visited by the user) to give consent to the access. In practice, however, such claims have typically been dismissed due to plaintiffs' failure to meet CFAA's damages threshold. Specifically, as a threshold to bring a private right of action, a plaintiff must show damages in excess of $5,000 or another specific type of damages such as physical injury or impairment to medical care. The FTC Act has emerged as a critical law relevant to data privacy and security. As some commentators have noted, the FTC has used its authority under the Act to become the "go-to agency for privacy," effectively filling in gaps left by the aforementioned federal statutes. While the FTC Act was originally enacted in 1914 to strengthen competition law, the 1938 Wheeler-Lea amendment revised Section 5 of the Act to prohibit a broad range of unscrupulous or misleading practices harmful to consumers. The Act gives the FTC jurisdiction over most individuals and entities, although there are several exemptions. For instance, the FTC Act exempts common carriers, nonprofits, and financial institutions such as banks, savings and loan institutions, and federal credit unions. The key provision of the FTC Act, Section 5, declares unlawful "unfair or deceptive acts or practices" (UDAP) "in or affecting commerce." The statute provides that an act or practice is "unfair" only if it "causes or is likely to cause substantial injury to consumers which is not reasonably avoidable by consumers themselves and not outweighed by countervailing benefits to consumers or to competition." While the statute does not define "deceptive," the FTC has clarified in guidance that an act or practice is to be considered deceptive if it involves a material "representation, omission, or practice that is likely to mislead [a] consumer" who is "acting reasonably in the circumstances." Under the FTC Act, the agency may enact rules defining specific acts or practices as UDAPs, often referred to as "trade regulation rules" (TRRs) or "Magnuson-Moss" rulemaking. However, to enact TRRs the FTC must comply with several procedures that are not required under the notice-and-comment rulemaking procedures set forth in Section 553 of the Administrative Procedure Act (APA), which are the default rulemaking procedures for federal agencies. Among other things, these additional procedures require the FTC to publish an advance notice of proposed rulemaking (ANPRM), give interested persons an opportunity for an informal hearing, and issue a statement accompanying the rule regarding the "prevalence of the acts or practices treated by the rule." Consequently, the FTC rarely uses its TRR rulemaking authority and has not enacted any TRRs regarding data protection. Rather, as discussed further below, the agency largely uses enforcement actions to signal the types of acts and practices it considers to be impermissible UDAPs. The FTC has brought hundreds of enforcement actions against companies alleging deceptive or unfair data protection practices. Most of these actions result in companies entering into consent decrees requiring the companies to take certain measures to prevent any further violations. While these consent decrees are not legally binding on those who are not a party to them, they are significant because they reflect the type of practices that the FTC views as "unfair" or "deceptive." Indeed, some scholars view the principles arising from them as a type of "common law of privacy." Given the uniquely important role FTC enforcement plays in the U.S. data protection landscape, it is worth noting the types of data protection practices the FTC has viewed as "unfair" or "deceptive." Perhaps the most settled principle of the FTC's "common law of privacy" is that companies are bound by their data privacy and data security promises. The FTC has taken the position that companies act deceptively when they gather, use, or disclose personal information in a way that contradicts their posted privacy policy or other statements, or when they fail to adequately protect personal information from unauthorized access despite promises that that they would do so. In addition to broken promises, the FTC has alleged that companies act deceptively when they make false representations in order to induce disclosure of personal information. For example, in FTC v. Sun Spectrum Commc'ns Org., Inc. , the FTC alleged that several telemarketers acted "deceptively" by misrepresenting themselves as a credit card company and requesting personal information from individuals, ostensibly for the purpose of providing non-existent credit cards to the individuals. The FTC has further maintained that companies act deceptively when their privacy policies or other statements provide insufficient notice of their privacy practices. For instance, in In the Matter of Sears Holdings Management Co. , the FTC alleged that Sears acted deceptively by failing to disclose the extent to which downloadable software would monitor users' internet activity, merely telling users that it would track their "online browsing." Along with "deceptive claims," the FTC has also alleged that certain data privacy or data security practices may be "unfair." Specifically, the FTC has maintained that it is unfair for a company to retroactively apply a materially revised privacy policy to personal data that it collected under a previous policy. The FTC has also taken the position that certain default privacy settings are unfair. In the case FTC v. Frostwire , for example, the FTC alleged that a peer-to-peer file sharing application had unfair privacy settings because, immediately upon installation, the application would share the personal files stored on users' devices unless the users went through a burdensome process of unchecking many pre-checked boxes. With respect to data security, the FTC has more recently maintained that a company's failure to safeguard personal data may be "unfair," even if the company did not contradict its privacy policy or other statements. While at least one court has agreed that such conduct may be "unfair" under the FTC Act, a recent U.S. Court of Appeals for the Eleventh Circuit case, LabMD v. FTC , suggests that any FTC cease and desist order based on a company's "unfair" data security measures must allege specific data failures and specific remedies. In LabMD , the court noted that the FTC's order "contain[ed] no prohibitions" but "command[ed] [the company] to overhaul and replace its data-security program to meet an indeterminable standard of reasonableness." The court concluded that such an order was unenforceable, reasoning that the order "effectually charge[d] the district court [enforcing the order] with managing the overhaul." The court further suggested that penalizing a company for failing to comply with an imprecise standard "may constitute a denial of due process" because it would not give the company fair notice of the prohibited conduct. Ultimately, while LabMD did not decide whether inadequate data security measures may be "unfair" under the FTC Act, the decision is nevertheless a potentially significant limitation on the FTC's ability to remedy such violations of the statute. LabMD is also a notable case because it adds to the relatively sparse case law on the FTC Act's "unfair or deceptive" prohibition. As mentioned, the large majority of the FTC enforcement actions are settled, with parties entering into consent decrees. To the extent FTC allegations are contested, the FTC may either commence administrative enforcement proceedings or civil litigation against alleged violators. In an administrative enforcement proceeding, an Administrative Law Judge (ALJ) hears the FTC's complaint and may issue a cease and desist order prohibiting the respondent from engaging in wrongful conduct. In civil litigation, the FTC may seek equitable relief, such as injunctions or disgorgement, when a party "is violating, or is about to violate," the FTC Act. The FTC may only seek civil penalties, however, if the party has violated a cease and desist order, consent decree, or a TRR. The FTC Act does not provide a private right of action, and it does not impose any criminal penalties for violations of Section 5. Similar to the FTC Act, the CFPA prohibits covered entities from engaging in certain unfair, deceptive, or abusive acts. Enacted in 2010 as Title X of the Dodd-Frank Wall Street Reform and Consumer Protection Act, the CFPA created the Consumer Financial Protection Bureau (CFPB) as an independent agency within the Federal Reserve System. The Act gives the CFPB certain "organic" authorities, including the authority to take any action to prevent any "covered person" from "committing or engaging in an unfair, deceptive, or abusive act or practice" (UDAAP) in connection with offering or providing a "consumer financial product or service." The CFPB's UDAAP authority under the CFPA is very similar to the FTC's UDAP authority under the FTC Act; indeed, the CFPA contains the same definition of "unfair" as in the FTC Act, and the CFPB has adopted the FTC's definition of "deceptive" acts or practices. However, there are several important differences. First, the CFPA's UDAAP prohibition includes "abusive" practices, as well as unfair or deceptive ones. An act or practice is abusive if it either (1) "materially interferes with the ability of a consumer to understand a term or condition of a consumer financial product or service" or (2) "takes unreasonable advantage of" a consumer's (a) lack of understanding, (b) inability to protect her own interest in selecting or using a consumer financial product or service, or (c) reasonable reliance on a covered person to act in her interest. While abusive conduct may also be unfair or deceptive, abusiveness is a separate standard that may cover additional conduct. Second, the CFPA prohibits UDAAPs only in connection with offering or providing a "consumer financial product or service." A product or service meets this standard if it is one of the specific financial product or services listed in the CFPA and is offered or provided to consumers primarily for personal, family, or household purposes. Lastly, the CFPA applies only to "covered persons" or "service providers." The statute defines "covered persons" as persons who offer or provide a consumer financial product or service, and it defines "service providers" as those who provide a "material service" to a "covered person" in connection with offering or providing a consumer financial product or service. As some commentators have noted, the CFPB could follow in the FTC's footsteps and use its UDAAP authority to regulate data protection. However, the CFPB has generally been inactive in the data privacy and security space. Indeed, to date, it has brought only one such enforcement action, which involved allegations that an online payment platform, Dwolla, Inc., made deceptive statements regarding its data security practices and the safety of its online payments system. To the extent it does use its authority, the CFPB has some powerful procedural advantages in comparison with the FTC. In particular, the CFPB can enact rules identifying and prohibiting particular UDAAP violations through the standard APA rulemaking process, whereas the FTC must follow the more burdensome Magnuson-Moss rulemaking procedures. Regarding enforcement, the CFPA authorizes the CFPB to bring civil or administrative enforcement actions against entities engaging in UDAAPs. Unlike the FTC, the CFPB can seek civil penalties in all such enforcement actions, as well as equitable relief such as disgorgement or injunctions. However, as with the FTC Act, the CFPA does not provide a private right of action that would allow adversely affected individuals to sue companies violating the Act. The statute also does not impose any criminal penalties for UDAAP violations. Adding to the complex federal patchwork of data protection statutes are the laws of the fifty states. First and foremost, major regulators of privacy and data protection in the states include the courts, via tort and contract law. With respect to tort law, in addition to the "privacy" causes of action that developed at the state level during the early 20th century (discussed above), negligence and other state tort law claims serve as a means to regulate businesses that are injured from data security issues or otherwise fail to protect their customers from foreseeable harm. Contracts, implied contracts, and other commercial causes of action can also form important bulwarks for privacy. The common law, however, is not perfect: it is subject to variability from state to state, and within states, from judge to judge and jury to jury. In addition to the common law, most states have their own statutory framework which may affect data protection and the use of data by private entities. For example, many states have a consumer protection law, sometimes prohibiting unfair or deceptive practices, often referred to as "little FTC Acts." These laws, like the FTC Act, are increasingly being used to address privacy matters. In addition, each state has passed a data breach response law, requiring some form of response or imposing liability on companies in the event of a breach of their data security. While an examination of every state data security law is beyond the scope of this report, at least one state has undertaken a general and ambitious effort to regulate data security. Specifically, the California Consumer Privacy Act (CCPA), enacted in 2018, has captured significant attention. Unlike the federal patchwork provisions, neither the method of data collection nor the industry that the business operates in limits the potential application of the CCPA. Instead, the CCPA applies to any company that collects the personal information of Californians, is for-profit, does business in California, and satisfies a basic set of thresholds. Analysts have suggested that these thresholds are low enough that the law could reach a considerable number of even "relatively small" businesses with websites accessible in California. The CCPA also does not distinguish between the sources of the data that comes within its scope. Rather, the CCPA regulates all "personal information," which, by the CCPA's definition, covers nearly any information a business would collect from a consumer. The law does not require the presence of any individual identifier, such as a name or address, for data to fall within the meaning of personal information. Rather, the CCPA broadly defines personal information as "information that identifies, relates to, describes, or is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household." Following this definition, the CCPA provides some telling illustrations of what constitutes personal information, including any "electronic network activity [such as] browsing history, search history, and information regarding a consumer's interaction with an Internet Web site, application, or advertisement" and "inferences drawn from any of" this information. The CCPA provides consumers with three main "rights." The first of these is a " right to know " the information that businesses have collected or sold about them. This right requires that businesses must, in advance of any collection, "inform [by mail or electronically] consumers as to the categories of personal information to be collected and the purposes" to which the information will be put. Second, the CCPA provides consumers with the " right to opt out " of the sale of a consumer's information. Under the new law, businesses must inform consumers of this right, and if a consumer so affirmatively opts out, the business cannot again sell the consumer's information unless the consumer subsequently provides the business express authorization. Finally, the CCPA gives consumers the right, in certain circumstances, to request that a business delete any information collected about the consumer (i.e., " right to delete "). Under the law, a business that receives such a request must delete the information collected and direct its "service providers" to do the same. The primary means to enforce the CCPA are actions brought by the California Attorney General. According to the statute, businesses that fail to provide the protections required by the CCPA and fail to cure those violations within 30 days are liable for civil penalties of up to $7,500 per violation. Penalties or settlements collected under the CCPA are to be deposited with the newly created Consumer Privacy Fund, the funds for which are used only to offset costs incurred in connection with the administration of the CCPA. While the CCPA provides for a private cause of action, allowing for individual and class action lawsuits against businesses, this cause of action is only available in the case of a consumer whose "nonencrypted or nonredacted personal information" is subject to "unauthorized access and exfiltration, theft, or disclosure" as a result of a failure to "implement and maintain reasonable security procedures." Further, such actions can be brought only if a consumer provides a business with 30 days' written notice and provides the business with opportunity to cure the violation, unless the consumer suffered actual pecuniary damages. The statute does not specify how a business could "cure" a violation of this type. Consumers may obtain damages under this section of no less than $100 and no more than $750 "per incident," or actual damages, whichever is greater, as well as injunctive relief. Statements by some Members of Congress during Congressional hearings have already noted the CCPA's likely importance to future federal legislative efforts. Further, some outside commentators have argued explicitly that the CCPA should be preempted by a future federal law. These statements may be motivated by the likely fact that, if left intact, the California law could shape industry and consumer concerns both inside and outside California. First, the law is likely to be the "first in a long line of similar pieces of legislation," all of which may model themselves after the CCPA, or will have to respond to its impact. Second, even though the statute is the product of a single state, its broad jurisdictional reach would bring companies throughout the United States and from around the world into its sweep. These factors combined are likely to make the CCPA important to federal legislators. Furthermore, some of the provisions of the California law could form a model for future federal regulation—although along those lines, another potential model it has to compete with is Europe's GDPR. In addition to U.S. states like California, some foreign nations have enacted comprehensive data protection legislation. The EU, in particular, has long applied a more wide-ranging data protection regulatory scheme. Whereas privacy principles in the U.S. Constitution focus on government intrusions into private life and U.S. data privacy statutes generally are sector-specific, European privacy regulations have generally concerned any entity's accumulation of large amounts of data. As a result, foundational EU treaties provide individuals with a general right to "protection of personal data" from all potential interferences. The objective of the EU's most recent data privacy legislation—the GDPR—is to safeguard this right to personal data protection, while ensuring that data moves freely within the EU. Beginning in the 1970s, individual European countries began enacting broad, omnibus national statutes concerning data protection, privacy, and information practices. Although these domestic laws shared certain features, their differing data privacy and protection standards occasionally impeded the free flow of information between European countries. As a consequence, the EU attempted to harmonize its various national privacy laws by adopting an EU-wide data privacy and protection initiative—the 1995 Directive on the Protection of Individuals with Regard to the Processing of Personal Data and on the Free Movement of Such Data (Data Protection Directive). While the Data Protection Directive applied on an EU-wide basis, EU law authorized each member-nation to implement the directive's requirements into the country's national law. By 2012, the European Commission—the executive body of the EU —came to view differing implementations of the Data Protection Directive at the national level as problematic. The Commission concluded that a single regulation should be developed in order to eliminate the fragmentation and administrative burdens created by the directive-based system. The Commission also sought to bring EU law up to date with developments in technology and globalization that changed the way data is collected, accessed, and used. In pursuit of these goals, the EU developed and adopted the GDPR, which replaced the 1995 Data Protection Directive and went into effect on May 25, 2018. The GDPR regulates the processing of personal data that meet its territoriality requirements, discussed below. Processing includes collection, use, storage, organization, disclosure or any other operation or set of operations performed on personal data, unless an exception applies. Personal data is defined as any information relating to an identified or identifiable person, and it can include names, identification numbers, location data, IP addresses, cookies, and any other information through which an individual can be directly or indirectly identified. The GDPR applies different requirements for controllers and processors of personal data. In general, a controller determines the purposes and means of processing personal data, and a processor is responsible for processing data on behalf of a controller. From a territorial perspective, the GDPR applies to organizations that have an "establishment" in the EU and that process personal data in the context of the activities of that establishment. The GDPR does not define "establishment," but states that it "implies the effective and real exercise of activity through stable arrangements." In a pre-GDPR case, the Court of Justice of the European Union stated that the concept of establishment under the 1995 Data Protection Directive extended "to any real and effective activity—even a minimal one—exercised through stable arrangements." Entities that meet the establishment requirement are subject to the GDPR even if their data processing activities take place outside the EU. The GDPR also applies to non-EU-established entities that offer goods or services to individuals in the EU or monitor individuals' behavior in the EU. Because many businesses with an online presence offer goods and services to EU individuals, the GDPR applies to many businesses outside the EU. The GDPR lays out seven guiding principles for the processing of personal data. While these principles are not "hard and fast rules" themselves, they inform the interpretation of the GDPR and its more concrete requirements, discussed below. The GDPR requires data controllers and processors to have a lawful basis to process personal data. The regulation delineates six possible legal bases: (1) consent; (2) performance of contract; (3) compliance with a legal obligations; (4) protection of the "vital interests" (i.e., the life) of the data subject or another individual; (5) tasks carried out in the public interest (e.g., by a government entity); and (6) the "legitimate interests" of the controller or a third party, unless the fundamental rights and freedom of the data subject override those interests. Commentators describe the "legitimate interests" category as the most flexible and as the potential basis for a host of common activities, such as processing carried out in the normal course of business, provided that the processing is not unethical, unlawful, or otherwise illegitimate. When data processing is premised on consent, the consent must be freely given, specific, informed, and unambiguous, and it can be withdrawn at any time. Additional consent requirements and restrictions apply to especially sensitive data, such as children's information and data that reveals ethnic origins, political opinions, religious beliefs, union status, sexual orientation, health information, and criminal histories. The GDPR provides a series of rights to individuals and corresponding obligations for data controllers, unless an exception applies. The GDPR requires organizations to implement a range of measures designed to ensure and demonstrate that they are in compliance with the regulation. When proportionate in relation to the processing activities, such measures may include adopting and implementing data protection policies and taking a "data protection by design and default" approach whereby the organization implements compliance measures into all stages of data processing. Measures may also include the following: establishing GDPR-conforming contracts with data processors; maintaining records of processing activities; conducting impact assessments on personal data use that is likely to risk individual rights and freedoms; appointing a data protection officer; and adhering to relevant codes of conduct and compliance certification schemes. The GDPR also requires controllers and processors to implement technical and organizational measures to ensure a level of data security that is "appropriate to the risk" presented by the data processing. In implementing data security measures, organizations must consider the "state of the art, the costs of implementation," the nature, scope, and context, and purposes of processing, and the likelihood and potential severity of an infringement on individual rights if data security were to be violated. The GDPR does not impose a "one-size-fits-all" requirement for data security, and security measures that are "appropriate" (and therefore mandatory) will depend on the specific circumstances and risks. For example, a company with an extensive network system that holds a large amount of sensitive or confidential information presents greater risk, and therefore must install more rigorous data security protections than an entity that holds less data. When appropriate, organizations should consider encryption and pseudonymization —the processing of personal data such that the data can no longer be attributed to a specific individual. Security measures should ensure the confidentiality, integrity, and resilience of processing systems; be able to restore access to personal data in the event of an incident; and include a process for testing security effectiveness. In the event of a personal data breach, the GDPR requires controllers to notify the designated EU government authority "without undue delay" and no later than 72 hours after learning of the breach, unless the breach is "unlikely to result in a risk to the rights and freedoms of natural persons." For example, whereas a company must report the theft of a customer database that contains information that could be used for future identity fraud given the high level of risk to individuals, it may not need to report the loss of more innocuous data, such as a directory of staff office phone numbers. When notification to the government is required, the notification must describe the nature and likely consequences of the breach, identify measures to address the breach, and identify the employee responding to the incident. When data processors experience a breach, they must notify the controller without undue delay. In addition to governmental notification, controllers must notify the individuals whose data has been compromised if the breach is likely to result in a "high risk to the rights and freedoms" of individuals. The "high risk" threshold is higher than the threshold for notifying the government authority, but it could met in circumstances when individuals may need to take steps to protect themselves from the effects of a data breach. According to the United Kingdom's data protection regulatory authority, for example, a hospital that disclosed patient medical records as a result of a data breach may present a "high risk" to individuals, but a university that accidentally deleted, but was able to re-create, an alumni contact information database may not meet the mandatory individual reporting threshold. Notification to the individual must describe the breach in clear and plain language and contain at least the same information as provided in the governmental notifications. Notification to the individual is not required in the following cases: the controller implemented appropriate technical and organizational protection measures, such as encryption, that will render the data unintelligible; the controller took subsequent measures that will ensure that the high risk to individual rights and freedom are no longer likely to materialize; or individual notifications would involve disproportionate efforts, in which case the controller must provide public notice of the breach. Regardless of whether notification is required, controllers must document all data breaches so that government supervisory authorities can verify compliance at a later date. The EU has long regulated the transfer of data from EU member states to foreign countries, and the GDPR continues to restrict such international data transfers. Like the 1995 Data Protection Directive, the GDPR authorizes data transfer from within the EU to a non-EU country if the receiving country ensures an adequate level of protection for personal data. To meet this requirement, the non-EU country must offer a level of protection that is "essentially equivalent to that ensured" by the GDPR. If the European Commission previously made an adequacy decision under the Data Protection Directive's legal framework, that decision remains in force under the GDPR. U.S. and EU officials previously developed a legal framework—the U.S.-EU Privacy Shield—for protecting transatlantic data flow into the United States. Under the Privacy Shield framework, U.S.-based organizations self-certify to the International Trade Administration in the Department of Commerce that they will comply with the framework's requirements for protecting personal data by complying with, among other provisions, notice requirements, data retention limits, security requirements, and data processing purpose principles. In 2016, the European Commission concluded that the Privacy Shield framework provided adequate protections under the Data Protection Directive. That adequacy determination continues to apply under the GDPR, although the European Commission annually reviews whether the Privacy Shield framework continues to provide an adequate level of protection. In the absence of an adequacy decision from the European Commission, the GDPR permits data transfers outside the EU when (1) the recipient of the data has itself established appropriate safeguards , and (2) effective legal remedies exist for individuals to enforce their data privacy and protection rights. Appropriate safeguards include: a legally binding agreement between public authorities or bodies; binding corporate rules; standard contract clauses adopted by the European Commission; and approved codes of conduct and certification mechanisms. U.S. companies that do not participate in Privacy Shield often must rely on standard contract clauses to be able to receive data from the EU. The GDPR also identifies a list of circumstances in which data may be transferred outside the EU even without appropriate safeguards or an adequacy decision. These circumstances include, among other reasons, when: an individual has provided informed consent; transfer is necessary for the performance of certain contracts involving the data subject; or the transfer is necessary for important reasons of public interests. One of the most commented-upon aspects of the GDPR is its high ceiling for administrative fines. For the most serious infractions of the GDPR, regulatory bodies within individual EU countries may impose fines up to 20 million euro (approximately $22 million) or 4% of global revenue, whichever is higher, for certain violations of the GDPR. The GDPR also provides tools for individuals to enforce compliance with its terms. Individuals whose personal data is processed in a way that does not comport with the GDPR may lodge a complaint with regulatory authorities. Individuals also have the right to an "effective judicial remedy" (i.e., to pursue a lawsuit) against the responsible data processor or controller, and individuals may obtain compensation for their damages from data processors or controllers. The GDPR may be relevant to the 116th Congress' consideration of data protection initiatives in several ways. Because the GDPR applies to U.S. companies that offer goods and services to individuals in the EU, many U.S. companies have developed new data protection practices in an effort to comply with its requirements. Other businesses reported that they withdrew from the European market rather than attempt to obtain compliance GDPR. For those companies that remained in the European market, some have stated that they will apply their GDPR-compliant practices on a company-wide basis rather than changing their model only when doing business in the EU. Consequently, the GDPR already directly impacts the data protection practices of some U.S. companies. The GDPR also has served as a prototype for comprehensive data protection legislation in other governments. For example, commentators have described China's Personal Information Security Specification, which defines technical standards related to the collection, storage, use, transfer, and disclosure of personal information, as modeled on the GDPR. And the CCPA includes elements similar to the GDPR, such as an enumeration of individual rights related to data privacy. If this trend continues, GDPR-like data protection laws may become more commonplace internationally. Finally, some argue that Congress should consider enacting comprehensive federal data protection legislation similar to the GDPR. As discussed below, however, other observers and some officials in the Trump Administration have criticized the GDPR, describing the regulation as overly prescriptive and likely to result in negative unintended consequences. Regardless of the merits of these positions, the GDPR may remain a focal point of discussion in the debate over whether the United States should develop a more comprehensive data protection policy. Although some commentators argue that the federal government should supplement the current patchwork of federal data protection laws with more comprehensive legislation modeled on the CCPA or GDPR, some Trump Administration officials have criticized these legislative approaches and questioned whether they will improve data privacy outcomes. The Administration has argued that many comprehensive data privacy models have resulted in "long, legal, regulator-focused privacy policies and check boxes, which only help a very small number of users[.]" Rather than pursuing a prescriptive model in which the government defines (or prescribes) data protection rules, the Trump Administration advocates for what it describes as an outcome-based approach whereby the government focuses on the "outcomes of organizational practices, rather than on dictating what those practices should be." In September 2018, the National Telecommunications and Information Administration (NTIA) in the Department of Commerce issued a request for public comments on the Trump Administration's efforts to develop an outcome-based approach to advancing consumer privacy that also protects prosperity and innovation. According to NTIA, changes in technology have led consumers to conclude that they are losing control over their personal information, while at the same time that foreign and state privacy laws have led to a fragmented regulatory landscape that disincentives innovation. Accordingly, NTIA is attempting to develop a set of "user-centric" privacy outcomes and goals that would underpin the protections that should be produced by any federal actions related to consumer privacy. NTIA's proposed policy focuses on a set of outcomes that the Trump Administration seeks to achieve: In addition to identifying desired outcomes, NTIA's request for public comments states that the Trump Administration is in the process of developing "high-level goals for Federal action" related to data privacy. NTIA's proposed privacy framework shares certain elements of prescriptive legal regimes like the GDPR and CCPA. Common features include a right to withdraw consent to certain uses of personal data; accountability for third-party vendors and servicers; and a right to access, amend, complete, correct, or delete personal data. But NTIA's request for public comments does not specifically describe how the Trump Administration intends to accomplish its outcomes and goals. Instead, it states that NTIA "understand[s] that there is considerable work to be done to achieve" the identified objectives. The comment period closed on November 9, 2018, and NTIA received input from more than 200 individuals and entities. The debate over whether Congress should consider federal legislation regulating data protection implicates numerous legal variables and options. "Data protection" itself is an expansive concept that melds the fields of data privacy (i.e., how to control the collection, use, and dissemination of personal information) and data security (i.e., how to protect personal information from unauthorized access or use and respond to such unauthorized access or use). There is no single model for data protection legislation in existing federal, state, or foreign law. For example, some state laws focus solely on data security or address a particular security concern, such as data breach notifications. Other state laws isolate a single privacy-related issue, such as the transparency of data brokers—companies that aggregate and sell consumers' information, but that often do not have a direct commercial relationship with consumers. Recent data protection laws such as the CCPA and GDPR appear to indicate a trend toward combining data privacy and security into unified legislative initiatives. These unified data protection paradigms typically are structured on two related features: (1) an enumeration of statutory rights given to individuals related to their personal information and (2) the creation of legal duties imposed on the private entities that possess personal information. The specific list and nature of rights and duties differ depending on the legislation, and some have proposed to define new rights in federal legislation that do not have a clear analog in existing state or foreign law. Consequently, at present, there is no agreed-upon menu of data protection rights and obligations that could be included in federal legislation. Although data protection laws and proposals are constantly evolving, some frequently discussed legal rights include: the right to know what personal data is being collected, used, and disseminated, and how those activities are occurring; the right to control the use and dissemination of personal data, which may include the right to opt out or withhold consent to the collection or sharing of such data; the right to review personal data that has been collected and to delete or correct inaccurate information; the right to obtain a portable copy of personal data; the right to object to improper activities related to personal data; and the right to learn when a data breach occurs; Commonly discussed obligations for companies that collect, use, and disseminate personal data include rules defining: how data is collected from individuals; how companies use data internally; how data is disseminated or disclosed to third parties; what information companies must give individuals related to their data; how data is kept secure; when breaches of security must be reported; the accuracy of data; and reporting requirements to ensure accountability and compliance. Whether to enact federal data protection legislation that includes one or more of these rights and obligations has been the subject of a complex policy debate and multiple hearings in recent Congresses. Part of the legislative debate concerns how to enforce such rights and obligation and raises questions over the role of federal agencies, state attorneys general, and private citizen suits. In addition, some elements of the data protection proposals and models could implicate legal concerns and constitutional limitations. While the policy debate is outside the scope of this report, the following sections discuss legal considerations relevant to federal data protection proposals that the 116th Congress may choose to consider. These sections begin by analyzing legal issues related to the internal structure and definition of data protection-related rights and obligations and then move outward toward an examination of external legal constraints. A primary conceptual point of debate concerning data protection legislation is whether to utilize the so-called "prescriptive" method or an "outcome-based" approach to achieve a particular law's objectives. Under the prescriptive approach, the government defines data protection rules and requires regulated individuals and entities to comply with those rules. Both the GDPR and CCPA use a prescriptive approach, and some legislation proposed in the 116th Congress would use this method by delineating certain data protection requirements. The Trump Administration, however, has argued that a prescriptive approach can stymie innovation and result in compliance checklists without providing measurable privacy benefits. As an alternative methodology, the Administration advocated for what it described as an outcome-based approach whereby the government focuses on the outcomes of organizational practices, rather than defining the practices themselves. Some federal information technology laws, such as the Federal Information Security Management Act (FISMA), use an outcome-oriented approach to achieve federal objectives, although agency implementation of such laws may become prescriptive in nature. The Administration has not specified how it intends to achieve its desired data protection goals without prescribing data protection rules, but additional direction appears to be forthcoming, according to the NTIA's request for public comment. Another issue that may be considered in crafting federal data protection policy is how to define the contours of the data that the federal government proposes to protect or the specific entities or industries that it proposes to regulate. The patchwork of existing data protection statutes define protected information in a variety of ways, many of which depend on the context of the law. For example, HIPAA is limited to "protected health information" and GLBA governs "financial information" that is personally identifiable but not publicly available. By contrast, GDPR and CCPA regulate all "personal" information—a term defined in both laws as information that is associated with a particular individual or is capable of being associated with an individual. Some federal data proposals would apply a similar scope to those of the GDPR and CCPA. If enacted, such broad data protection laws have the potential to create multiple layers of federal data protection requirements: (1) general data protection requirements for "personal" information and (2) sector-specific requirements for data regulated by the existing "patchwork" of data protection laws. Other legislative proposals have sought to avoid dual layers of regulations by stating that the proposed data protection requirements would not apply to individuals or entities covered by certain existing federal privacy laws. Agency enforcement is another key issue to consider when crafting any future federal data protection legislation. As discussed, under the current patchwork of federal data protection laws, there are multiple federal agencies responsible for enforcing the myriad federal statutory protections, such as the FTC, CFPB, FCC, and HHS. Of these agencies, the FTC is often viewed—by industry representatives, privacy advocates, and FTC commissioners themselves —as the appropriate primary enforcer of any future national data protection legislation, given its significant privacy experience. There are, however, several relevant legal constraints on the FTC's enforcement authority. First, the FTC generally lacks the ability to issue fines for first-time offenses. In UDAP enforcement actions, the FTC may issue civil penalties only in certain limited circumstances, such as when a person violates a consent decree or a cease and desist order. Consequently, the FTC often enters into consent decrees addressing a broad range of conduct, such as a company's data security practices, seeking penalties for violations of those decrees. However, as the LabMD case discussed earlier in this report suggests, if the FTC imposes penalties based on imprecise legal standards provided in a rule or order, the Due Process Clause of the Fifth Amendment may constrain the agency's authority. Second, the plain text of the FTC Act deprives the FTC of jurisdiction over several categories of entities, including banks, common carriers, and nonprofits. Third, the FTC generally lacks authority to issue rules under the APA's notice-and-comment process that is typically used by agencies to issue regulations. Rather, the FTC must use a more burdensome—and, consequently, rarely used—process under the Magnuson-Moss Warranty Act. As some FTC Commissioners and commentators have noted, these legal limitations may be significant in determining the appropriate federal enforcement provisions in any national data security legislation. While Congress may not be able to legislate around constitutional constraints, future legislation could address some of these limitations—for instance, by allowing the FTC to seek penalties for first-time violations of rules, expanding its jurisdictions to include currently excluded entities, or providing the FTC notice-and-comment rulemaking authority under the APA. These current legal constraints on FTC authority may also be relevant in determining whether national legislation should allow private causes of action or enforcement authority for state attorneys general, as some commentators have suggested that private causes of action and enforcement by state attorneys general are essential supplements to FTC enforcement. Legislation involving privacy may propose to allow individuals to seek private remedy for violations in the courts. Congress may seek to establish a private right of action allowing a private plaintiff to bring an action against a third party based directly on that party's violation of a public statute. As it has done with many sector-specific privacy laws, Congress, in a data protection statute, could provide not only for this right, but also for specific remedies beyond compensatory damages, such as statutory damages or even treble damages for injured individuals. However, it may be very difficult to prove that someone has been harmed in a clear way by many of the violations that might occur under a hypothetical data protection and privacy regime. Victims of data breaches and other privacy violations, generally speaking, do not experience clear and immediate pecuniary or reputational harm. This obstacle might threaten not only a consumer's ability to obtain monetary relief, but also could run up against the limits of the federal courts' "judicial power" under Article III of the U.S. Constitution. Article III extends the judicial power of the federal courts to only "cases" and "controversies." As part of that limitation, the Supreme Court has stated that courts may adjudicate a case only where a litigant possesses Article III standing. A party seeking relief from a federal court must establish standing. Specifically, the party must show that he has a genuine stake in the relief sought because he has personally suffered (or will suffer): (1) a concrete, particularized and actual or imminent injury; (2) that is traceable to the allegedly unlawful actions of the opposing party; and (3) that is redressable by a favorable judicial decision. These requirements, particularly the requirement of "imminence," form significant barriers for lawsuits based on data protection. Imminence, according to the Supreme Court in Clapper v. Amnesty International , requires that alleged injury be " certainly impending " to constitute injury-in-fact. Speculation and assumptions cannot be the basis of standing. This reasoning has caused courts to dismiss data breach claims where plaintiffs cannot show actual misuse of data, but can only speculate that future thieves may someday cause them direct harm. These requirements are constitutional in nature and apply regardless of whether a statute purports to give a party a right to sue. This constitutional requirement limits Congress' ability to use private rights of action as an enforcement mechanism for federal rights, as the recent Supreme Court case Spokeo, Inc. v. Robins illustrates. Spokeo involved a Federal Credit Reporting Act (FCRA) lawsuit brought by Thomas Robins against a website operator that allowed users to search for particular individuals and obtain personal information harvested from a variety of databases. Robins alleged that Spokeo's information about him was incorrect, in violation of the FCRA requirement that consumer reporting agencies "follow reasonable procedures to assure maximum possible accuracy" of consumer reports. As discussed earlier in this report, FCRA provides for a private right of action making any person who willfully fails to comply with its requirements liable to individuals for, among other remedies, statutory damages. The lower court understood that Robins did not specifically allege any actual damages he had suffered, such as the loss of money resulting from Spokeo's actions. Nonetheless, the court concluded that the plaintiff had standing to seek statutory damages because his injury was sufficiently particular to him—FCRA had created a statutory right for Robins and his personal interest was sufficient for standing. The Supreme Court disagreed with the lower court, however, explaining that the lower court had erred by eliding the difference between Article III's "concreteness" and "particularization" requirements. Specifically, the Court concluded that a plaintiff must demonstrate a concrete injury separate from a particularized injury, meaning that plaintiffs must show that their injury "actually exist[s]." While tangible injuries, like monetary loss, are typically concrete, a plaintiff with an "intangible injury" must show that it is "real" and not "abstract" in order to demonstrate concreteness. For example, the Spokeo Court suggested that the mere publication of an incorrect zip code, although it could violate FCRA, would not be a sufficiently concrete injury for standing purposes. As a result, the Court remanded the case to the lower court to determine if the injury alleged in the case was both particularized and concrete. Spokeo does not eliminate Congress' role in creating standing where it might not otherwise exist. The Supreme Court explained that the concreteness requirement is "grounded in historical practice" and, as a result, Congress' judgment on whether an intangible harm is sufficiently concrete can be "instructive." However, as Spokeo explained, Congress cannot elevate every privacy violation to the status of a concrete injury. Both before and after Spokeo , the lower courts have resolved standing disputes in lawsuits involving privacy and data protection, where parties argue about whether particular injuries are sufficiently concrete for purpose of Article III. Congress can possibly resolve some of these disputes by elevating some otherwise intangible injuries to concrete status. But Spokeo illustrates that there may be a residuum of harmless privacy violations for which Congress cannot provide a judicial remedy. Another legal issue Congress may need to consider with respect to any federal program involving data protection and privacy is how to structure the federal-state regime—that is, how to balance whatever federal program is enacted with the programs and policies in the states. Federal law, under the Supremacy Clause, has the power to preempt or displace state law. As discussed above, there are a host of different state privacy laws, and some states have begun to legislate aggressively in this area. The CCPA in particular represents a state law that is likely to have a national effect. Ultimately, unless Congress chooses to occupy the entire field of data protection law, it is likely that the state laws will end up continuing to have a role in this area. Further, given that the states are likely to continue to experiment with legislation, the CCPA being a prime example, it is likely that preemption will be a highly significant issue in the debate over future federal privacy legislation. As the Supreme Court has recently explained, preemption can take three forms: "conflict," "express," and "field." Conflict preemption requires any state laws that conflict with a valid federal law to be without effect. Conflict preemption can occur when it is impossible for a private party to simultaneously comply with both federal and state requirements, or when state law amounts to an obstacle to the accomplishment of the full purposes of Congress. Express preemption occurs when Congress expresses its intent in the text of the statute as to which state laws are displaced under the federal scheme. Finally, field preemption occurs when federal law occupies a 'field' of regulation "so comprehensively that it has left no room for supplementary state legislation." Ultimately, the preemptive scope of any federal data protection legislation will turn on the "purpose" of Congress and the specific language used to effectuate that purpose. If Congress seeks to adopt a relatively comprehensive system for data protection, perhaps the most obvious means to preempt a broad swath of state regulation would be to do so "expressly" within the text of the statute by including a specific preemption provision in the law. For example, several existing federal statutes expressly preempt all state law that "relate to" a particular subject matter. The Supreme Court has held that this "related to" language encompasses any state law with a "connection with, or reference to" the subject matter referenced. Similar language can be used to displace all state laws in the digital data privacy sphere to promote a more uniform scheme. Congress could alternatively take a more modest approach to state law. For example, Congress could enact a data protection framework that expressly preserves state laws in some ways and preempts them in others. A number of federal statutes preempt state laws that impose standards "different from" or "in addition to" federal standards, or allow the regulator in charge of the federal scheme some authority to approve certain state regulations. These approaches would generally leave intact state schemes parallel to or narrower than the federal scheme. For example, a statute could permit a state to provide for additional liability or different remedies for violation of a federal standard. Congress could do the same with federal data protection legislation, using statutory language to try to ensure the protection of the provisions of state law that it sought to preserve. Although legislation on data protection could take many forms, several approaches that would seek to regulate the collection, use, and dissemination of personal information online may have to confront possible limitations imposed by the First Amendment of the U.S. Constitution. The First Amendment guarantees, among other rights, "freedom of speech." Scholars have split on how the First Amendment should be applied to proposed regulation in the data protection sphere. In one line of thinking, data constitutes speech, and regulation of this speech, even in the commercial context, should be viewed skeptically. Other scholars have argued that an expansive approach would limit the government's ability to regulate ordinary commercial activity, expanding the First Amendment beyond its proper role. This scholarly debate informs the discussion, but does not provide clear guidance on how to consider any particular proposed regulation. The Supreme Court has never interpreted the First Amendment as prohibiting all regulation of communication. Instead, when confronting a First Amendment challenge to a regulation, a court asks a series of questions in order to determine whether a particular law or rule runs afoul of the complicated thicket of case law that has developed in this area. The first question courts face when considering a First Amendment challenge is whether the challenged regulation involves speech or mere non-expressive conduct. As the Supreme Court has explained, simply because regulated activity involves "communication" does not mean that it comes within the ambit of the First Amendment. Where speech is merely a "component" of regulated activity, the government generally can regulate that activity without inviting First Amendment scrutiny. For example, "a law against treason…is violated by telling the enemy the Nation's defense secrets," but that does not bring the law within the ambit of First Amendment scrutiny. Assuming the regulation implicates speech rather than conduct, it typically must pass First Amendment scrutiny. However, not all regulations are subject to the same level of scrutiny. Rather, the Court has applied different tiers of scrutiny to different types of regulations. For example, the Court has long considered political and ideological speech at the "core" of the First Amendment—as a result, laws which implicate such speech generally are subject to strict scrutiny. Pursuant to this standard, the government must show that such laws are narrowly tailored to serve a compelling state interest. By contrast, the Court has historically applied less rigorous scrutiny to laws regulating "commercial speech." Commercial speech is subject to a lower level of scrutiny known as the Central Hudson test, which generally requires the government to show only that its interest is "substantial" and that the regulation "directly advances the governmental interest asserted" without being "more extensive than necessary to serve that interest." These principles have provided general guidance to lower courts in deciding cases that intersect with data protection, but implicit disagreements between these courts have repeatedly demonstrated the difficulty in striking the balance between First Amendment interests and data-protection regulation. For example, in 2001 in Trans Union Corp. v. FTC , the D.C. Circuit upheld an FTC order that prohibited Trans Union from selling marketing lists containing the names and addresses of individuals. The court assumed that disclosing or using the marketing lists was speech, not conduct, but concluded that the FTC's restrictions on the sale of the marketing lists generally concerned "no public issue," and, as such, was subject to "reduced constitutional protection." The court derived its "no public issue" rule from the Supreme Court's case law on defamation, which generally views speech that is solely in the private interest of the speaker as being subject to lower First Amendment protection from defamation suits than speech regarding matters of a public concern. Applying this "reduced constitutional protection" to the context of Trans Union's marketing lists, the court determined that the regulations were appropriately tailored. While the Trans Union court did not cite to Central Hudson , other courts have gone on to apply similar reasoning to uphold data protection laws from constitutional challenge under the ambit of Central Hudson 's commercial speech test. In contrast with the relatively lenient approach applied to a privacy regulation in Trans Union , in U.S. West v. FCC , the Tenth Circuit struck down FCC regulations on the use and disclosure of Consumer Proprietary Network Information (CPNI). The regulations stated that telecommunications carriers could use or disclose CPNI only for the purpose of marketing products to customers if the customer opted in to this use. The court determined that these provisions regulated commercial speech because they limited the ability of carriers to engage in consumer marketing. Applying Central Hudson , the court held that although the government alleged a general interest in protecting consumer privacy, this interest was insufficient to justify the regulations. The panel ruled that the regulations did not materially advance a substantial state interest because the government failed to tie the regulations to specific and real harm, supported by evidence. The court also concluded that a narrower regulation, such as a consumer opt-out, could have served the same general purpose. After the Tenth Circuit's decision in U.S. West , the FCC responded by making minor changes to its regulations, maintaining some elements of the opt-in procedure for the use of CPNI and reissuing them with a new record. After this reissuance, the D.C. Circuit considered these modified-but-similar regulations in a 2009 case. In that case, the D.C. Circuit upheld the regulations without attaching much significance to the FCC's changes, and apparently implicitly disagreeing with the Tenth Circuit about both the importance of the privacy interest at stake and whether the opt-in procedure was proportional to that interest. The Supreme Court's first major examination of the First Amendment in this context came in 2011. That year, the Court decided Sorrell v. IMS Health, Inc. , a case that is likely to be critical to understanding the limits of any future data protection legislation. In Sorrell , the Court considered the constitutionality of a Vermont law that restricted certain sales, disclosures, and uses of pharmacy records. Pharmaceutical manufacturers and data miners challenged this statute on the grounds that it prohibited them from using these records in marketing, thereby imposing what they viewed to be an unconstitutional restriction on their protected expression. Vermont first argued that its law should be upheld because the "sales, transfer, and use of prescriber-identifying information" was mere conduct and not speech. The Court explained that, as a general matter, "the creation and dissemination of information are speech within the meaning of the First Amendment," and thus there was "a strong argument that prescriber identifying information is speech for First Amendment purposes." Ultimately, however, the Court stopped short of fully embracing this conclusion, merely explaining that it did not matter whether the actual transfer of prescriber-identifying information was speech because the law nonetheless impermissibly sought to regulate the content of speech—the marketing that used that data, as well as the identities of speakers—by regulating an input to that speech. As the Court explained, the Vermont law was like "a law prohibiting trade magazines from purchasing or using ink." Second, Vermont argued that, even if it was regulating speech, its regulations passed the lower level of scrutiny applicable to commercial speech. The Court disagreed. The Court explained that the Vermont law enacted "content- and speaker-based restrictions on the sale, disclosure and use of prescriber identifying information" because it specifically targeted pharmaceutical manufacturers and prohibited certain types of pharmaceutical marketing. As the Court stated in a previous case, "[c]ontent-based regulations are presumptively invalid" because they "raise[] the specter that the Government may effectively drive certain ideas or viewpoints from the marketplace." Further, the Sorrell Court observed that the legislature's stated purpose was to diminish the effectiveness of marketing by certain drug manufacturers, in particular those that promoted brand-name drugs, suggesting to the Court that the Vermont law went "beyond mere content discrimination, to actual viewpoint discrimination." As a result, the Court concluded that some form of "heightened scrutiny" applied. Nevertheless, the Court reasoned that, even if Central Hudson 's less rigorous standard of scrutiny applied, the law failed to meet that standard because its justification in protecting physician privacy was not supported by the law's reach in allowing prescriber-identifying information's use "for any reason save" marketing purposes. Most of the lower courts outside the data protection and privacy context that have considered Sorrell have held that Sorrell 's reference to "heightened scrutiny" did not override the Central Hudson test in commercial speech cases, even where those cases include content- or speaker- based restrictions. Others, however, have held that content- and speaker-based restrictions must comport with something more rigorous than the traditional Central Hudson test, but it is not clear what this new standard requires or where it leads to a different outcome than Central Hudson . As a result, while Sorrell 's impact on privacy and data protection regulation has been considered by a few courts, no consensus exists on the impact it will have. However, a few commentators have observed that the case will likely have an important effect on the future of privacy regulation, if nothing else, by having all but concluded that First Amendment principles apply to the regulation of the collection, disclosure, and use of personally identifiable information as speech, not conduct. With respect to such future regulation, policymakers will likely want, at the minimum, to meet the Central Hudson requirement of ensuring that any restrictions on the creation, disclosure or use of information are justified by a substantial interest and that the regulations are no more extensive than necessary to further that interest. To illustrate, the Court in Sorrell identified HIPAA as a permissible "privacy" regulation because it allowed "the information's sale or disclosure in only a few narrow and well-justified circumstances." This dictum suggests that Congress is able to regulate in the data protection sphere as long as it avoids the pitfalls of the law in Sorrell . However, it may not always be easy to determine whether any given law involves speaker or content discrimination. In Sorrell itself, for instance, three dissenting Justices argued that the content and speaker discrimination that took place under the Vermont law was inevitable in any economic regulation. As a result, resolving these issues as data privacy legislation becomes more complex is likely to create new challenges for legislators. The current legal landscape governing data protection in the United States is complex and highly technical, but so too are the legal issues implicated by proposals to create unified federal data protection policy. Except in extreme incidents and cases of government access to personal data, the "right to privacy" that developed in the common law and constitutional doctrine provide few safeguards for the average internet user. Although Congress has enacted a number of laws designed to augment individual's data protection rights, the current patchwork of federal law generally is limited to specific industry participants, specific types of data, or data practices that are unfair or deceptive. This patchwork approach also extends to certain state laws. Seeking a more comprehensive data protection system, some governments—such as California and the EU—have enacted wide-ranging laws regulating many forms of personal data. Some argue that Congress should consider creating similar protections in federal law, but others have criticized the EU's and California's approach to data protection. Should the 116th Congress consider a comprehensive federal data protection program, its legislative proposals may involve numerous decision points and legal considerations. An initial decision point is the scope and nature of any legislative proposal. There are numerous data protection issues that could be addressed in any future legislation, and different possible approaches for addressing those issues (such as using a "prescriptive" or "outcome-based" approach). Other decision points may include defining the scope of any protected information and determining the extent to which any future legislation should be enforced by a federal agency. Further, to the extent Congress wants to allow individuals to enforce data protection laws and seek remedies for the violations of such laws in court, it must account for Article III's standing requirements. Under the Supreme Court's 2016 Spokeo Inc. v. Robins decision, plaintiffs must experience more than a "bare procedural violation" of a federal privacy law to satisfy Article III and to sue to rectify a violation of that law. Federal preemption also raises complex legal questions—not only of whether to preempt state law, but what form of preemption Congress should employ. Finally, from a First Amendment perspective, Supreme Court jurisprudence suggests that while some "privacy" regulations are permissible, any federal law that restricts protected speech, particularly if it targets specific speakers or content, may be subject to more stringent review by a reviewing court.

Question: Write a one-page summary of the report 1.

Answer: The Department of Defense (DOD) obligates more than $300 billion annually to buy goods and services, and to support research and development. Most of these acquisitions are governed by procurement statutes and regulations found in Title 10 (and parts of other select titles) of the United States Code, the Federal Acquisition Regulation (FAR), and the Defense Federal Acquisition Regulation Supplement. Under certain circumstances, DOD can enter into an other transaction (OT) agreement instead of a traditional contract. OT agreements are generally exempt from federal procurement laws and regulations. These exemptions grant government officials the flexibility to include, amend, or exclude contract clauses and requirements that are mandatory in traditional procurements (e.g., termination clauses, cost accounting standards, payments, audit requirements, intellectual property, and contract disputes). OT authorities also grant more flexibility to structure agreements in numerous ways, including joint ventures; partnerships; consortia; or multiple agencies joining together to fund an agreement encompassing multiple providers. Other transaction agreements are legally binding contracts; they are referred to as agreements to distinguish them from the traditional procurement contracts governed by the FAR and procurements laws. Other transaction authorities are set forth in two sections of law: 10 U.S.C. 2371—granting authority to use OTs for basic, applied, and advanced research projects. 10 U.S.C. 2371b—granting authority to use OTs for prototype projects and follow-on production. Under this authority, a prototype project can only be conducted if at least one nontraditional defense contractor significantly participates in the project; all significant participants are small businesses or nontraditional defense contractors; at least one-third of the total cost of the prototype project is provided by nongovernment participants; or the senior procurement acquisition official provides a written justification for using an OT. Follow-on production can only be conducted when the underlying prototype OT was competitively awarded, and the prototype project was successfully completed. OTs have the potential to provide significant benefits to DOD, including attracting nontraditional contractors with promising technological capabilities to work with DOD, establishing a mechanism to pool resources with other entities to facilitate development of, and obtain, state-of-the-art dual-use technologies, and offering a unique mechanism for DOD to invest in, and influence the direction of, technology development. A number of analysts warn that along with the potential benefits come significant risks, including potentially diminished oversight and exemption from laws and regulations designed to protect government and taxpayer interests. In FY2017, DOD obligated $2.1 billion on prototype OT agreements, representing less than 1% of contract obligations for the year. However, the use of OTs is expected to grow at a rapid pace, due in part to recent statutory changes expanding other transaction authorities. A number of analysts and officials have raised concerns that if DOD uses OTs in ways not intended by Congress—or is perceived to abuse the authority—Congress could clamp down on the authority. Generally, DOD lacks authoritative data that can be used to measure and evaluate the use of other transaction authorities.