; and (D) the measures the covered entity will employ to minimize the risks described in subparagraph (C), including technological and physical safeguards. (3) Commission The term Commission means Federal Trade Commission. (4) Consumer The term consumer means an individual. (5) Covered entity The term covered entity — (A) means any person, partnership, or corporation over which the Commission has jurisdiction under section 5(a)(2) of the Federal Trade Commission Act ( 15 U.S.C. 45(a)(2) ) that— (i) had greater than $50,000,000 in average annual gross receipts for the 3-taxable-year period preceding the most recent fiscal year, as determined in accordance with paragraphs (2) and (3) of section 448(c) of the Internal Revenue Code of 1986; (ii) possesses or controls personal information on more than— (I) 1,000,000 consumers; or (II) 1,000,000 consumer devices; (iii) is substantially owned, operated, or controlled by a person, partnership, or corporation that meets the requirements under clauses (i) or (ii); or (iv) is a data broker or other commercial entity that, as a substantial part of their business, collects, assembles, or maintains personal information concerning an individual who is not a customer or an employee of that entity in order to sell or trade the information or provide third-party access to the information. (6) Data protection impact assessment The term data protection impact assessment means a study evaluating the extent to which an information system protects the privacy and security of personal information the system processes. (7) Executive capacity The term executive capacity means an assignment within an organization in which the employee primarily— (A) directs the management of the organization or a major component or function of the organization; (B) establishes the goals and policies of the organization, component, or function; (C) exercises wide latitude in discretionary decision making