Ohio Telecom Association et al. v. FCC and USA (Data Breach Reporting Req’ts)

Question Presented

Whether the Federal Communications Commission had the authority to modify its consumer data breach notification rules in 2023, including expanding the scope to include inadvertent disclosures, breaches of personal data apart from Customer Proprietary Network Information (CPNI), and telecommunications relay services (TRS). And whether the Congressional Review Act (CRA) disapproval of the 2016 Broadband Privacy Order (BPO), of which breach notification rules were a small part, prevents the FCC from enacting its 2023 breach notification rules.

Background

Congress granted the FCC authority to regulate the privacy practices of common carriers–such as telecom companies–in large part through Sections 201 and 222, and TRS providers through Section 225, of the Communications Act. Section 201(b) empowers the FCC to prescribe rules and regulations that make unjust or unreasonable practices by common carriers unlawful; this includes practices related to cybersecurity. Section 222 both imposes a general duty on carriers to protect phone subscriber privacy, and outlines specific obligations for protecting CPNI, which generally pertains to information a carrier must obtain from a phone subscriber in order to reliably provide service (e.g. their number, the other party’s number, the wireless tower they are closest to, etc.). Under Section 225, Congress directed the FCC to ensure that TRS providers enable communication in a manner that is “functionally equivalent” to services provided to consumers without hearing or speech impairments.

In 2023, the FCC used these well-established authorities to modify its existing breach notification rules to better protect consumers, in light of the staggering increase in frequency and severity of breaches of phone subscriber data. Breaches of Social Security Numbers (SSNs) for example, to the extent that SSNs were not considered CPNI, did not need to be reported to consumers under the FCC’s breach notification rules. The agency’s 2023 modification to the rules corrected important gaps such as this one.

When an agency rule is subject to a joint resolution of disapproval under the CRA, the agency is prohibited from enacting a rule that is substantially the same or that is in substantially the same form. The regulatory agency, created by Congress, cannot exert authority in defiance of the will of Congress articulated through legislation such as a CRA disapproval. However, if a new rule is not substantially the same as the disapproved one, it does not represent this prohibited overstep of agency authority.

In 2017, Congress enacted a CRA disapproval of the FCC’s 2016 BPO. The BPO was largely focused on the FCC exerting data privacy and cybersecurity regulatory authority over internet service providers (ISPs). This was in follow up to the FCC’s classification of ISPs as common carriers (commonly referred to as ‘Net Neutrality’), thereby subjecting ISPs to the FCC’s authority under Sections 201(b) and 222. The bulk of the BPO itself and of Congressional debate about rejecting the BPO through a CRA disapproval resolution focused on the FCC’s regulation of ISPs, however there were breach notification provisions contained within the BPO. Notably the BPO did not include any explicit provisions about breach notification for TRS.

The Case

Petitioners were the Ohio Telecom Association, the Texas Association of Business, CTIA the wireless association, NCTA the internet and television association, and USTelecom the broadband association, with Hamilton Relay, a TRS provider, intervening. Their arguments included that the FCC exceeded its statutory authority in modifying its consumer breach notification rules, that the 2017 CRA disapproval of the 2016 BPO prohibits these rules, and that these rules disproportionately burden small providers. They chiefly argued that the FCC’s privacy and data security authorities are limited to CPNI and that the 2023 breach notification rule is substantially similar to a portion of the BPO.

Respondents, the United States, represented by the U.S. DOJ, and the FCC, argued that the FCC’s privacy and data security authorities under 201, 222, and 225, as developed by privacy orders in 1998, 2007, and 2013, as well as by multiple enforcement actions over those decades, are well-established. The Respondents also argued that the CRA resolution of disapproval applies to the entirety of the BPO and not to some portion of the BPO, and moreover that the 2023 rule is not even substantially the same as the small portion of the BPO pertaining to breach notification.

Brief of EPIC, et al.

EPIC’s brief, joined by Public Knowledge and Privacy Rights Clearinghouse, outlined for the Sixth Circuit just how much worse the data breach problem has gotten since 2016, both generally and as it specifically relates to breaches of phone subscriber data. It described how the FCC’s 2023 rule creates necessary incentives for telecom companies to equip consumers to protect themselves from the cascading harms that often result from the harm of the breach itself, such as identity theft or account compromise, by requiring telecom companies to notify their subscribers that their personal data may have been accessed without authorization.

The consumer advocates’ amicus brief complemented the Respondents’ theory of statutory authority and further argued that the FCC is the most appropriate regulator for telecom company data breaches, given its longstanding expertise with the industry.

The brief also cautioned the court about how the Petitioners’ interpretation of the CRA could create permanent regulatory gaps, in addition to complementing the Respondents’ arguments about how the 2023 rule was not substantially the same as the 2016 BPO.