FCC data breach reporting rules face renewed scrutiny as court unpauses challenge
The U.S. Court of Appeals for the Sixth Circuit has resumed a legal challenge by major industry trade groups against FCC data breach rules originally adopted in 2023. The FCC is still reviewing potential revisions to these reporting requirements, which have faced ongoing scrutiny regarding the agency's authority in light of past Congressional Review Act actions.
Key Takeaways
- Sixth Circuit resumed the case after the FCC missed a June 17, 2024, deadline to finalize its internal rule review.
- Rules adopted in December 2023 expanded reportable breaches to include personally identifiable information (PII) beyond traditional network data.
- Trade groups including NCTA, CTIA, and USTelecom argue the 2023 rules violate the Congressional Review Act by mimicking 2017 rules nullified by Congress.
- The 2023 order requires providers to notify the FCC and law enforcement within seven business days of determining a breach has occurred.
Why It Matters
The unpausing of this challenge places immediate pressure on the FCC to provide regulatory clarity for streaming and broadband carriers regarding data governance. For the broader ecosystem, the outcome will define the boundaries of agency authority under the Congressional Review Act—specifically whether the FCC can reinstate portions of previously nullified privacy frameworks. If industry groups prevail, it could strip the agency of its ability to enforce expanded reporting for PII, potentially returning oversight to a fragmented state-by-state patchwork. Watch for whether Chairman Brendan Carr, an original dissenter of the 2023 rules, moves to voluntarily repeal the order before a full 16-judge panel ruling occurs.
Additional Context
The legal conflict centers on the interpretation of the Congressional Review Act (CRA), which prohibits agencies from reissuing rules that are 'substantially the same' as those struck down by Congress. Per Mayer Brown in September 2025, a three-judge panel of the Sixth Circuit initially upheld the 2023 rules, ruling that the CRA does not prevent the FCC from adopting portions of a larger nullified package if the new rule is narrower in scope. However, industry groups have petitioned for an en banc rehearing, arguing that this interpretation allows agencies to bypass Congressional disapproval by simply repackaging regulations. The 2023 rules were a significant departure from previous standards, expanding the definition of a 'breach' to include both intentional and inadvertent disclosures. According to Akin Gump in August 2025, the order also removed a mandatory waiting period for customer notification, requiring carriers to inform users without unreasonable delay. While then-Commissioner Brendan Carr argued at the time that the rules 'plainly violate the law,' the current FCC leadership under the Biden administration has defended the expansion as necessary to address modern cybersecurity threats that go beyond traditional phone records. This regulatory tug-of-war occurs as the FCC also navigates broader authority issues following its 2024 effort to reclassify broadband as a Title II telecommunications service. Per Reuters in early 2025, the Sixth Circuit had already signaled skepticism toward the FCC’s general authority over broadband providers. The outcome of the data breach challenge could further restrict the agency's ability to mandate uniform privacy and security practices across the ISP landscape, which acts as the underlying delivery infrastructure for the entire streaming video market.
Read full article at broadbandbreakfast.com
Get this in your inbox → Subscribe
Enjoy our coverage?
Add StreamingMeme as a preferred source on Google to see more of our streaming news at the top of your Search results.
Add as preferred source