2023-00824: Data Breach Reporting Requirements
Public comment closed .
Get alerted when the next rule lands
New rules open for comment on their own schedule. Pick how you want to hear about them — we email you when one appears.
Publishing to members? Embed a live rule tracker on your own site — the proposed rules in your area and the comment deadlines closing on them, updating themselves. Free, one line of HTML.
Create a free account & build one →Summary
In this document, the Federal Communications Commission (Commission) begins the process to update and strengthen its data breach rule to provide greater protections to the public. We propose to expand the Commission's definition of "breach" to include inadvertent disclosures of customer information and seek comment on adopting a harm-based trigger for breach notifications. We also propose to require carriers to notify the Commission, in addition to the Secret Service and FBI, as soon as practicable after discovery of a breach. We also propose to eliminate the mandatory waiting period before notifying customers and instead require carriers to notify customers of CPNI breaches without unreasonable delay after discovery of a breach unless requested by law enforcement. We also propose to make changes to our TRS data breach reporting rule consistent with those we propose to our CPNI breach reporting rule.
The agency’s own summary, as published.
What this changes
Amends 1 part of the Code of Federal Regulations — the standing rules this notice rewrites.
Don't miss the comment window
One Click Politics alerts you on every deadline, hearing, and rule change.
See all rules with comments due soon →