Dive Brief:

• New data breach reporting rules requiring U.S. telecommunications network operators to notify regulators, law enforcement agencies and customers of breaches more quickly took effect Wednesday.
• The updated Federal Communications Commission rules, which were adopted in mid-December, cover the exposure of all personally identifiable information that could create a security risk for customers. The data breach reporting rules, which were last updated 16 years ago, were added to the Federal Register in February and took effect March 13. The rules cover any exposure of customers’ PII, including intentional and inadvertent data breaches.
• “In the past, these rules have only prohibited the disclosure of information about who we call and when,” FCC Chair Jessica Rosenworcel said in a statement when the agency approved the rule change. “But consumers also deserve to know if their carrier has disclosed their Social Security number or financial data or other sensitive information that could put them in harm’s way. We fix that today — and it is overdue.”

Dive Insight:

The rule change at the FCC marks another federal, industrywide effort to compel businesses to disclose data breaches in a more explicit and timely manner. The Securities and Exchange Commission last year imposed new rules requiring companies to disclose any material security incident within four business days of determining materiality.

Wireless carrier data breaches are common. When a cyberattack hit T-Mobile in November 2022, exposing the records of 37 million customers, it marked the eighth publicly acknowledged data breach at the carrier since 2018. This included a massive data breach in August 2021 that exposed personal data of at least 76.6 million people.

Telecom operators are now required to notify the FCC, Secret Service and FBI “as soon as practicable, but not later than seven business days, after reasonable determination of a breach,” the agency said in the Federal Register. Public companies, including major network operators, are subject to the FCC and SEC disclosure rules.

“In the event of a data breach, your carrier has to tell the FCC and tell you in a timely way just what happened and what personal information may be at risk,” Rosenworcel said.

When PII is exposed by a breach, carriers must notify customers “without reasonable delay” and “in no case more than 30 days following reasonable determination of a breach,” the agency said. The FCC eliminated old rules requiring carriers to wait seven business days before notifying customers of a breach.