; (9) using and expending of funds; (10) implementing this Act through rules, orders, guidance, interpretations, statements of policy, investigations, and enforcement actions; and (11) performing such other functions as may be authorized or required by law. (b) Delegation of authority The Director may delegate to any duly authorized employee, representative, or agent any power vested in the Director or the Agency by law, except that the Director may not delegate the power to appoint the Deputy Director under section 301(c). (c) Autonomy of agency regarding recommendations and testimony No officer or agency of the United States shall have any authority to require the Director or any other officer of the Agency to submit legislative recommendations, or testimony or comments on legislation, to any officer or agency of the United States for approval, comments, or review prior to the submission of such recommendations, testimony, or comments to the Congress, if such recommendations, testimony, or comments to the Congress include a statement indicating that the views expressed therein are those of the Director or such officer, and do not necessarily reflect the views of the President. (d) Rulemaking authority (1) In general The Director may prescribe rules and issue orders and guidance, as may be necessary or appropriate to enable the Agency to implement, administer, and carry out the purposes and objectives of this Act, and to prevent evasions thereof. (2) Regulations The Agency may issue regulations after notice and comment in accordance with section 553 of title 5, United States Code, as may be necessary to implement, administer, and carry out this Act. (e) Consultations In implementing or enforcing this Act, the Director may consult with— (1) Federal agencies that have— (A) jurisdiction over Federal privacy laws; and (B) expertise in privacy or information security; (2) State attorneys general, State privacy regulators, and other State agencies that have expertise in privacy or information security