FCC’s data breach reporting rules for telecoms are upheld in appeals court

A federal appeals court upheld the FCC’s 2024 data breach reporting rules for telecoms, confirming the agency’s authority to require notification of breaches involving 500+ customers’ PII within seven business days. The rules expand prior CPNI-focused requirements to include broader PII such as Social Security numbers and email addresses, and the decision rejects industry challenges under the Congressional Review Act. The article also notes recent FCC settlements with T-Mobile, AT&T, and TracFone related to past data protection failures.