FCC expands cooperation with states on data security, privacy enforcement

Dive Brief:

The Federal Communications Commission on Monday said it will nearly double the number of state attorneys general enforcing privacy, data protection and cybersecurity, marking an expansion of a program it launched in 2023.
The FCC will now work with attorneys general in Maine, Vermont, Massachusetts, Delaware and Indiana to coordinate investigations on protecting consumer privacy and data. The states will join those already working with the agency, which includes Connecticut, New York, Pennsylvania, Illinois, Oregon and the District of Columbia.
The state attorneys general will coordinate with the FCC’s Privacy and Data Protection Task Force, which was formed to help investigate possible violations of federal privacy and data security laws.

Dive Insight:

The FCC has taken an active role in enforcing cybersecurity and data protection, as companies in the telecommunications sector have access to enormous volumes of consumer data.

State attorneys general play a critical role in enforcing data protection for consumers in their individual states. The cooperation allows the FCC to work with states on numerous elements of investigations, including fielding consumer complaints, interviewing witnesses and conferring with outside experts.

“Consumers expect their data will remain private and that any exposure of their personal information will be addressed with urgency and accountability,” FCC Chair Jessica Rosenworcel said in a statement. “Success on this front requires strong partnerships between federal enforcement officials and state leaders.”

The agency oversees a number of critical sectors, including internet, wireless carriers and satellite communications. Each of these sectors have dealt with significant data breaches in recent years.

The FCC earlier this month reached a $31.5 million settlement with T-Mobile over a series of data breaches between 2021 and 2023. The agency also reached a $13 million settlement with AT&T in September over a third-party data breach.