FCC Looks To Toughen Telco Data Breach Reporting Rules

January 9, 2023

The Federal Communications Commission launched a proceeding to strengthen the Commission’s rules for notifying customers and federal law enforcement of breaches of customer proprietary network information (CPNI). The Commission will look to better align its rules with recent developments in federal and state data breach laws covering other sectors.

“The law requires carriers to protect sensitive consumer information but, given the increase in frequency, sophistication, and scale of data leaks, we must update our rules to protect consumers and strengthen reporting requirements,” said FCC Chairwoman Jessica Rosenworcel. “This new proceeding will take a much-needed, fresh look at our data breach reporting rules to better protect consumers, increase security, and reduce the impact of future breaches.”

The Notice of Proposed Rulemaking released today and adopted by a unanimous vote of the full Commission will launch a formal proceeding to gather information on this important issue and also take comment on rule changes proposed by the Commission. Today’s action seeks to better address telecommunications carriers’ breach notification requirements. The FCC proposes eliminating the current seven business day mandatory waiting period for notifying customers of a breach. The FCC also proposes clarifying its rules to require consumer notification by carriers of inadvertent breaches and requiring notification of all reportable breaches to the FCC, FBI, and U.S. Secret Service.

The FCC will also seek comment on whether to require customer breach notices to include specific categories of information to help ensure they contain actionable information useful to the consumer. The Notice also proposes to make consistent revisions to the Commission’s telecommunications relay services (TRS) data breach reporting rule.