; (C) systematically monitors a large, publicly accessible physical place; or (D) meets any other criteria established by the Commission in regulations issued under section 3(b)(1). (9) Information system The term information system — (A) means a process, automated or not, that involves personal information, such as the collection, recording, organization, structuring, storage, alteration, retrieval, consultation, use, sharing, disclosure, dissemination, combination, restriction, erasure, or destruction of personal information; and (B) does not include automated decision systems. (10) Personal information The term personal information means any information, regardless of how the information is collected, inferred, or obtained that is reasonably linkable to a specific consumer or consumer device. (11) Store The term store — (A) means the actions of a person, partnership, or corporation to retain information; and (B) includes actions to store, collect, assemble, possess, control, or maintain information. (12) Use The term use means the actions of a person, partnership, or corporation in using information, including actions to use, process, or access information. 3. Data protection authority (a) Acts prohibited It is unlawful for any covered entity to— (1) violate a regulation promulgated under subsection (b); or (2) knowingly provide substantial assistance to any person, partnership, or corporation whose actions violate subsection (b). (b) Regulations (1) In general Not later than 2 years after the date of enactment of this section, the Commission shall promulgate regulations, in accordance with section 553 of title 5, United States Code, that— (A) require each covered entity to conduct automated decision system impact assessments of— (i) existing high-risk automated decision systems, as frequently as the Commission determines is necessary; and (ii) new high-risk automated decision systems, prior to implementation