FCC Adopts Data Breach Notification Rules For Telecommunications Providers

At the end of 2023, the Federal Communications Commission ("FCC" or "the Commission") adopted updates to its existing 16-year-old data breach notification rules ("prior rules") designed to ensure that sensitive customer information is adequately protected by providers of telecommunications, interconnected Voice over Internet Protocol ("VoIP"), and telecommunications relay services ("TRS") (such providers, collectively, "carriers").¹ The FCC released the final order on December 21, 2023. The updates to the rules add to the increasing regulation of data protection and security by federal agencies.

The FCC's prior rules, which were originally adopted in 1998 and updated in 2007, required carriers to notify law enforcement and customers of breaches involving Customer Proprietary Network Information ("CPNI"), which the FCC has interpreted to include "information such as the phone numbers called by a consumer, the frequency, duration, and timing of such calls;