Cybersecurity Policy Report, Sixth Circuit Urged to Review Data Breach Ruling En Banc, (Oct 6, 2025)

By Lynn Stanton

In a joint amici curiae brief, the Washington Legal Foundation, the National Federation of Independent Business (NFIB) Small Business Legal Center, Inc., and the Buckeye Institute have urged the U.S. Court of Appeals for the Sixth Circuit (Cincinnati) to review en banc a decision of a three-judge panel that upheld a challenge of an FCC order dealing with data breach reporting requirements over arguments that its adoption violated a Congressional Review Act (CRA) resolution.

The FCC order in question, which was adopted in late 2023 (CPR, Dec. 14, 2023) and published in 2024, extended data breach reporting requirements to certain personally identifiable information (PII), including Social Security numbers and financial information, rather than just customer proprietary network information (CPNI), such as the numbers a subscriber calls, as well as extending the reporting requirements to providers of telecommunications relay services (TRS).

A three-judge panel of the Sixth Circuit rejected challenges to the order in August (CPR, Aug. 15), finding that section 201 of the Communications Act gave the agency authority to impose data breach reporting requirements regarding PII. Regarding the arguments about the 2017 CRA resolution that nullified a 2016 FCC broadband privacy order, the panel said the CRA barred agencies from adopting in the future any rules that were the same as or substantially similar to rules nullified by a CRA resolution but not from adopting in the future rules that were the same as or substantially similar to a part of the rules nullified by a CRA resolution.

The petitioners, as well as intervenor Hamilton Relay, Inc., have asked for a rehearing en banc.

The FCC recently asked the Sixth Circuit to hold the challenge of the agency’s data breach notification order in abeyance, pending the current Commission’s review of past actions, including the data breach order (CPR, Oct. 2). Petitioners have asked the court to grant their request for rehearing and thereby vacate the three-judge panels’ August ruling before it holds the case in abeyance.

The WLF, NFBI Small Business Legal Center, and Buckeye Institute compare the panel’s view that a CRA resolution does not bar the readoption of a portion of the nullified rules to the idea that a parent’s admonition to a child to not eat a pie is not intended to restrict them from eating a piece of the pie.

Citing Circuit Judge Richard Allen Griffin’s dissent, the amici brief says that such an interpretation means that “CRA voidance can be circumvented with ease. ‘For instance, if the FCC issued an order adopting four discrete rules (Rules A, B, C, and D) and Congress disapproved it, then, under the majority’s logic, the FCC could skirt the disapproval by readopting Rules A and B in one order and Rules C and D in another.’ Dissent 41,” Brief for Washington Legal Foundation et al. as Amici Curiae Supporting Petitioners and En Banc Review, Ohio Telecommunications Association et al. v. FCC, No. 24-3133 (6th Cir. filed Oct. 6, 2025).

“This case presents a question of first impression on the scope of the CRA. The panel majority got the answer wrong—and in a particularly troubling fashion. Should the Court grant the government’s motion to hold this case in abeyance, it should, at a minimum, vacate the panel decision as it does so. But Petitioners’ approach of granting review now is the best approach. Left alone, this precedent will leave the CRA—a provision designed to uphold the separation of powers by preventing runaway agency rulemaking—a feckless and easily outmaneuvered statute. That’s precisely the type of ‘important federal question’ that cries out for en banc review. Mitts v. Bagley, 626 F.3d 366, 370 (6th Cir. 2010) (Sutton, J., concurring in denial of en banc review),” the amici brief adds.

News: FederalLegislation LitigationEnforcement DataPrivacy