; or (2) disclose such qualified data and information to a third party for any reason. (c) Effect of violation of information and privacy standards Qualified researchers who intentionally, recklessly, or negligently violate the privacy and cybersecurity safeguards prescribed by the Commission for a qualified research project may be subject to both civil and criminal enforcement, under applicable Federal, State, and local laws. The Commission may refer any such violation to the Department of Justice or the appropriate State law enforcement agency. 6. Reporting Not later than 24 months after the date of enactment of this Act, and annually thereafter, the NSF and the Commission shall submit to the Congress a joint report regarding the operation of this Act, which shall include a detailed statement of all qualified research projects, including with respect to each such project: (1) The identity of any authorized qualified researcher and the institution the researcher is affiliated with. (2) The platforms required to provide qualified data and information to qualified researchers. (3) The categories of qualified data and information each platform was required to provide. (4) The terms of the privacy and cybersecurity safeguards prescribed by the Commission to ensure the security of the qualified data and information. (5) Any recommendations for improvements to the operation of this Act in order to facilitate its aim of providing enhanced platform transparency. 7. Enforcement (a) Unfair or deceptive act or practice (1) In general A platform's failure to comply with subsection (a) or (b) of section 4, or a qualified researcher's failure to comply with subsection (a) or (b) of section 5, shall be treated as a violation of a rule defining an unfair or deceptive act or practice prescribed under section 18(a)(1)(B) of the Federal Trade Commission Act ( 15 U.S.C. 57a(a)(1)(B) ). (2) Powers of the Commission (A) In general The Commission shall enforce the provisions of this Act specified in paragraph (1) in the same manner,