; and (B) in subparagraph (B), in the matter following paragraph (2), by striking of not more than $10,000 for each violation and inserting , which shall be not more than an amount that is the greater of $50,000 per violation, taken as an aggregate sum of all violations, and 4 percent of the total annual gross revenue of the person, partnership, or corporation for the prior fiscal year . 5. Annual data protection reports (a) Reports (1) In general Each covered entity that has not less than $1,000,000,000 per year in revenue and stores, shares, or uses personal information on more than 1,000,000 consumers or consumer devices or any covered entity that stores, shares, or uses personal information on more than 50,000,000 consumers or consumer devices shall submit to the Commission an annual data protection report describing in detail whether, during the reporting period, the covered entity complied with the regulations promulgated in accordance with subparagraphs (A) and (B) of section 7(b)(1). To the extent that the covered entity did not comply with these regulations, this statement shall include a description of which regulations were violated and the number of consumers whose personal information was impacted. (2) Regulations Not later than 2 years after the date of enactment of this Act, the Federal Trade Commission shall promulgate regulations in accordance with section 553 of title 5, United States Code, carrying out this subsection. (b) Failure of corporate officers To certify privacy and data security reports (1) In general Chapter 63 of title 18, United States Code, is amended by adding at the end the following: 1352. Failure of corporate officers to certify data protection reports (a) Definitions In this section: (1) Covered entity The term covered entity has the meaning given the term in section 2 of the Mind Your Own Business Act of 2019 . (2) Willfully The term willfully means the voluntary, intentional violation of a known legal duty. (b) Certification of annual data protection reports Each annual