with substantial experience in the field of privacy and data protection, who uses procedures and standards generally accepted in such field. (B) Audit requirements Each such audit shall— (i) set forth the privacy, security, and data use controls that the operator has implemented and maintained during the reporting period