75, and 76 of the Internal Revenue Code of 1986. (31) Section 1106 of the Social Security Act ( 42 U.S.C. 1306 ). (32) The Stored Communications Act ( 18 U.S.C. 2701 et seq. ). (33) Any other privacy or information security provision of Federal law. 503. Relation to State law This Act, and any amendment, standard, rule, requirement, assessment, or regulation promulgated under this Act, does not annul, alter, affect, or exempt any person subject to the provisions of this Act from complying with the laws of any State or political subdivision of a State with respect to privacy or consumer protection, except to the extent that those laws are inconsistent with any provisions of this Act, and then only to the extent of the inconsistency. For purposes of this section, a law of a State or political subdivision of a State is not inconsistent with this Act if the protection such law affords any consumer is greater than the protection provided by this Act. 504. Severability If any provision of this Act or the amendments made by this Act, or the application thereof, is held unconstitutional or otherwise invalid, the validity of the remainder of the Act, the amendments, and the application of such provision shall not be affected thereby. VI NIST and NSF Activities 601. National Institute of Standards and Technology privacy research and development Section 2 of the National Institute of Standards and Technology Act ( 15 U.S.C. 272 ) is amended by adding at the end the following: (f) Privacy risk management research In carrying out the activities under subsection (c)(19), the Director shall, to the extent practicable and appropriate— (1) develop, and periodically update, in collaboration with appropriate Federal agencies, industry, State, local, and Tribal governments, civil society, other nonprofit organizations, and the Information Security and Privacy Advisory Board, a privacy risk management framework that covers risks associated with data processing and that shall— (A) identify voluntary, consensus-based technical