New FCC Data Breach Rules Draw Criticism For Problems Beyond The CRA

There has been a lot of coverage about the Federal Communications Commission's (FCC and Commission) new and expansive data breach notification Order, approved on a 3-2 vote at the Commission's December 13 Open Meeting. Much of this coverage has focused on the Congressional Review Act (CRA), a topic that commenters raised in response to the Notice of Proposed Rulemaking and that Commissioners Carr and Simington cited as a major legal barrier to the new rules in their dissents. But while the CRA is an important part of the discussion of the new rules' legality (and will come up again as the Commission considers its renewed push for net neutrality), focusing only on the CRA can obscure more fundamental legal and policy issues with the new rules that were raised by commenters and also highlighted in dissents. As Commissioner Carr observed, "even if the CRA never passed, the FCC's decision would exceed the Commission's authority."