FCC Seeks Comments on Proposed Expansion of Data Breach Notification Requirements for Telecommunications Carriers, i-VoIP Providers, and TRS Providers
Last Friday, the Federal Communications Commission (“FCC”) or the “Commission”) released a Notice of Proposed Rulemaking (NPRM) seeking public comments on proposed updates to its data breach notice requirements for telecommunications carriers, interconnected Voice over Internet Protocol (i-VoIP) providers, and Telecommunications Relay Services (TRS) providers. FCC rules currently impose a number of notice obligations on these entities when they discover unauthorized access to customer proprietary network information (CPNI), and the NPRM seeks to strengthen those requirements to better protect consumers. The deadline to file comments will be 30 days after the NPRM is published in the Federal Register — likely near the end of February — and reply comments will be due 30 days later.
For telecommunications carriers and i-VoIP providers, the Commission is particularly interested in expanding its definition of “breach” to include inadvertent disclosures of customer information and seeks comment on adopting a harm-based trigger for breach notifications. The FCC is also proposing to require carriers to notify the Commission, in addition to the Secret Service and FBI, as soon as practicable after discovery of a breach, and to eliminate the mandatory waiting period before notifying customers and instead require carriers to notify customers of CPNI breaches without unreasonable delay after discovery of a breach unless requested by law enforcement to postpone the customer notice so as not to jeopardize pending criminal investigations. The FCC also seeks comment on whether it should adopt minimum requirements for the content of customer breach notices. Finally, the NPRM seeks comment on the Commission’s legal authority to issue the proposed rules.
For TRS providers, the FCC proposes changes that would substantially harmonize their CPNI breach notice responsibilities with the proposed changes to notification requirements for telecommunications carriers and i-VoIP providers.
The CommLaw Group Can Help!
If you have any questions about these proposed changes or would like assistance with filing comments, please contact Linda McReynolds at (703) 714-1318 or lgm@commlawgroup.com, or Michal Nowicki at (703) 714-1311 or mjn@commlawgroup.com.
