; or (ii) another court of competent jurisdiction. (B) Service of process In an action brought under paragraph (1), process may be served in any district in which— (i) the defendant is an inhabitant, may be found, or transacts business; or (ii) venue is proper under section 1391 of title 28, United States Code. (5) Actions by other State officials (A) In general In addition to a civil action brought by an attorney general under paragraph (1), any other officer of a State who is authorized by the State to do so may bring a civil action under paragraph (1), subject to the same requirements and limitations that apply under this subsection to civil actions brought by attorneys general. (B) Savings provision Nothing in this subsection may be construed to prohibit an authorized official of a State from initiating or continuing any proceeding in a court of the State for a violation of any civil or criminal law of the State. 5. Regulations (a) Regulations Not later than 180 days after the date of enactment of this Act, the Federal Trade Commission, in consultation with the National Institute of Standards and Technology, shall promulgate regulations, in accordance with section 553 of title 5, United States Code— (1) describing data security, minimization, and retention standards to be met at a minimum by processors; (2) defining what is harmful and highly offensive under paragraphs (1) and (2) of section 3(c); and (3) expanding the list of exceptions described in section 3(e) in cases where it is impossible for a controller to obtain affirmative consent from, or provide notice to, end users. (b) Considerations In promulgating regulations under subsection (a), the Commission shall consider, among other factors— (1) the size of the processor; (2) the complexity of the offerings of the processor