Cybersecurity Policy Report, Sixth Circuit Urged to Reject FCC Data Breach Requirements, (Sep 8, 2026)
Organizations Mentioned:USTelecom | Washington Legal Foundation
By Jeff Williams
Ahead of an en banc rehearing scheduled for Oct. 21, the Washington Legal Foundation (WLF), the National Federation of Independent Business Small Business Legal Center, and the Buckeye Institute have urged the U.S. Court of Appeals for the Sixth Circuit (Cincinnati) to reject a 2025 decision by a three-judge Sixth Circuit panel upholding an FCC order extending data breach reporting requirements to certain personally identifiable information (PII) rather than just customer proprietary network information (CPNI), as well as to providers of telecommunications relay services (TRS).
In a joint filing, the groups argued that data breach rules adopted by FCC in 2023 and published in 2024 violated a 2017 Congressional Review Act (CRA) resolution annulling a 2016 order that adopted “substantially the same” rules. The groups argued that the 2025 ruling by the three-judge panel upholding the 2023 rules that were only a part of what was annulled by the CRA resolution amounted to an “end-run around” the CRA resolution, Brief for Washington Legal Foundation et al. as Amici Curiae in Support of Petitioners and Vacatur, Ohio Telecom Association et al., Hamilton Relay, Inc. v. FCC, Nos. 24-3133, 24-3206, 24-3252 (Sept. 8, 2026).
“No future Congress ‘specifically authorized’ the FCC to reissue the data-breach rule” after the CRA resolution, WLA and the others said. “But in 2024, that’s exactly what the FCC did.”
The Sixth Circuit panel rejected challenges of the order lodged by the Ohio Telecom Association, the Texas Association of Business, CTIA, NCTA, and USTelecom (CPR, Aug. 15, 2025), and the petitioners, as well as intervenor and TRS provider Hamilton Relay, requested a rehearing en banc.
While there were “ornamental changes here and there,” and some small technical differences in the later order as compared to the 2016 order, those should not negate the CRA resolution, the WLF and other groups said. “A parent’s instruction to a ten-year-old not to eat a pie isn’t license to have ‘just’ two or three slices. And Congress’s announcement that an overarching rule lacks ‘force or effect’ precludes the agency from taking it piecemeal back into the Code of Federal Regulations.”
News: FederalLegislation LitigationEnforcement DataPrivacy