; and (ii) the impact of proposed rules on individuals or groups of individuals; (B) the Agency may provide that a rule shall only apply to a subcategory of covered entities, as defined by the Agency; and (C) the Agency shall consult with civil society groups and members of the public. (c) Monitoring In order to support its rulemaking and other functions, the Agency shall monitor for risks to individuals in the collection, disclosure, processing, and misuse of personal data. 8. Specific agency authorities (a) Supervision of very large covered entities (1) In general This subsection shall apply to any covered entity that satisfies one or more of the following thresholds: (A) The entity has annual gross revenues that exceed $25,000,000. (B) The entity annually buys, receives for the covered entity’s commercial purposes, sells, or discloses for commercial purposes, alone or in combination, the personal information of 50,000 or more individuals, households, or devices. (C) The entity derives 50 percent or more of its annual revenues from the sale of personal data. (2) Supervision The Agency may require reports and conduct examinations on a periodic basis of covered entities described in paragraph (1) for purposes of— (A) assessing compliance with the requirements of Federal privacy laws; (B) obtaining information about the activities subject to such laws and the associated compliance systems or procedures of such entities; (C) detecting and assessing associated risks to individuals and groups of individuals