; and (D) the measures the covered entity will employ to minimize the risks described in subparagraph (C), including technological and physical safeguards. (3) Commission The term Commission means the Federal Trade Commission. (4) Consumer The term consumer means an individual. (5) Covered entity The term covered entity means any person, partnership, or corporation over which the Commission has jurisdiction under section 5(a)(2) of the Federal Trade Commission Act ( 15 U.S.C. 45(a)(2) ) that— (A) had greater than $50,000,000 in average annual gross receipts for the 3-taxable-year period preceding the most recent fiscal year, as determined in accordance with paragraphs (2) and (3) of section 448(c) of the Internal Revenue Code of 1986; (B) possesses or controls personal information on more than— (i) 1,000,000 consumers; or (ii) 1,000,000 consumer devices; (C) is substantially owned, operated, or controlled by a person, partnership, or corporation that meets the requirements under subparagraph (A) or (B); or (D) is a data broker or other commercial entity that, as a substantial part of its business, collects, assembles, or maintains personal information concerning an individual who is not a customer or an employee of that entity in order to sell or trade the information or provide third-party access to the information. (6) Data protection impact assessment The term data protection impact assessment means a study evaluating the extent to which an information system protects the privacy and security of personal information the system processes. (7) High-risk automated decision system The term high-risk automated decision system means an automated decision system that— (A) taking into account the novelty of the technology used and the nature, scope, context, and purpose of the automated decision system, poses a significant risk— (i) to the privacy or security of personal information of consumers; or (ii) of resulting in or contributing to inaccurate, unfair, biased, or discriminatory decisions impacting consumers