; (B) obtaining information about the activities subject to such laws and the associated compliance systems or procedures of such entities; (C) detecting and assessing associated risks to individuals and groups of individuals; and (D) requiring and overseeing ex-ante impact assessments and ex-post outcome audits of high-risk data practices to advance fair and just data practices. (b) Prohibiting unfair or deceptive acts and practices (1) In general The Agency may take any action authorized under this Act to prevent a covered entity from committing or engaging in an unfair or deceptive act or practice (as defined by the Agency under this subsection) in connection with the collection, disclosure, processing, and misuse of personal data. (2) Rulemaking The Agency may prescribe rules applicable to a covered entity identifying as unlawful, unfair, or deceptive acts or practices in connection with the collection, disclosure, processing, and misuse of personal data. Rules under this section may include requirements for the purpose of preventing such acts or practices. (3) Unfairness (A) In general The Agency shall have no authority under this section to declare an act or practice in connection with the collection, disclosure, processing, and misuse of personal data to be unlawful on the grounds that such act or practice is unfair, unless the Agency has a reasonable basis to conclude that— (i) the act or practice causes or is likely to cause substantial injury to consumers which is not reasonably avoidable by consumers