The FCC might let your carrier notify you sooner about its next big data breach

Published 1 day ago

But will there be any bite to its bark?

Data breaches are an inevitable facet of modern life. There is no security so robust that a hacker can’t penetrate it. What matters is how we mitigate that risk. Unfortunately, we can’t mitigate the risks that we aren’t aware of. That’s why it’s crucial for businesses that regularly handle sensitive information (like telecom carriers) to inform customers when their data's been involved in a breach as early as possible. The FCC is now signaling that it wants to make sure carriers are doing all they can to keep customers informed, and is considering some new rules for making that happen.

Although the FCC hasn’t made anything official, Chairwoman Jessica Rosenworcel issued a press release outlining proposed rules that would change the breach reporting requirements for telecom carriers. These companies are already obliged to report data breaches, but according to Rosenworcel “these rules need updating to fully reflect the evolving nature of data breaches and the real-time threat they pose to affected consumers.”

The proposal outlines a few major changes to the status quo. Waiting periods before carriers are permitted to notify customers are currently seven business days long, and these would be done away with. There would also be new requirements for notifying the FBI or Secret Service, as well as a rule that would inform customers of even inadvertent breaches.

These changes don’t deviate very far from where we are now. Carriers can already forgo the seven-day rule if there is an urgent need to tell their customers. There's no existing language exempting “inadvertent” breaches from disclosure regulations. And businesses are already obliged to inform the FBI and the Secret Service of a breach within seven business days via the FCC website.

On the surface this seems like a lot of bloviating: lots of words for not much change. But we don’t know the full details of the proposed rule change just yet. The document released Wednesday is a proposal for a proposed rule change. The next step is for the full FCC commission to vote on the proposal before it is published in the Federal Register. The last rule change it made that affected smartphone users was announced in September and officially proposed in October, so we may have some more details in a few weeks.