FCC orders telecom carriers to report PII data breaches within 30 days

The FCC finalized updated data breach reporting rules effective March 13, requiring telecommunications, interconnected VoIP, and TRS providers to promptly notify federal agencies and affected customers of breaches involving PII—within 30 days unless delayed by law enforcement—expanding scope beyond CPNI and including inadvertent disclosures; the changes are motivated by a series of major telecom breaches (e.g., Comcast Xfinity, Verizon, T-Mobile) to strengthen accountability and customer protection.