Cybersecurity Policy Report, TechFreedom Urges En Banc Review in Data Breach Case, (Oct 10, 2025)

By Lynn Stanton

TechFreedom has urged the U.S. Court of Appeals for the Sixth Circuit (Cincinnati) to review en banc a decision of a three-judge panel that upheld a challenge of an FCC order dealing with data breach reporting requirements over arguments that its adoption violated a Congressional Review Act (CRA) resolution.

The FCC order in question, which was adopted in late 2023 (CPR, Dec. 14, 2023) and published in 2024, extended data breach reporting requirements to certain personally identifiable information (PII), including Social Security numbers and financial information, rather than just customer proprietary network information (CPNI), such as the numbers a subscriber calls, as well as extending the reporting requirements to providers of telecommunications relay services (TRS).

A three-judge panel of the Sixth Circuit rejected challenges to the order in August (CPR, Aug. 15), finding that section 201 of the Communications Act gave the agency authority to impose data breach reporting requirements regarding PII. Regarding the arguments about the 2017 CRA resolution that nullified a 2016 FCC broadband privacy order, the panel said the CRA barred agencies from adopting in the future any rules that were the same as or substantially similar to rules nullified by a CRA resolution but not from adopting in the future rules that were the same as or substantially similar to a part of the rules nullified by a CRA resolution.

The petitioners, as well as intervenor Hamilton Relay, Inc., have asked for a rehearing en banc.

The FCC recently asked the Sixth Circuit to hold the challenge of the agency’s data breach notification order in abeyance, pending the current Commission’s review of past actions, including the data breach order (CPR, Oct. 2). Petitioners have asked the court to grant their request for rehearing and thereby vacate the three-judge panels’ August ruling before it holds the case in abeyance.

TechFreedom, in an amicus curiae brief filed Monday, said the panel’s August decision “resolved a question of exceptional importance, mistakenly holding that courts must compare revised rules to entire agency orders to determine whether they are substantially the same. Op. 34. The ruling allows agencies to ‘circumvent the CRA[,]’ and thus congressional will, by reissuing rules piecemeal. Dissent 40, 41. The case strikes at ‘the heart of the CRA’ and warrants the full Court’s attention. Id. at 40,” Brief for TechFreedom as Amicus Curiae in Support of Petitioner’s Petition for En Banc Review, Ohio Telecommunications Association et al. v. FCC, No. 24-3133 (6th Cir. filed Oct. 6, 2025).

It pointed to the incorporation of the definition of rule from the Administrative Procedure Act into the Congressional Review Act: “the whole or a part of an agency statement of general or particular applicability and future effect designed to implement, interpret, or prescribe law or policy.”

“The majority fails to identify any conclusive context indicating that, here, Congress intended to prohibit reissuance of only one part of the 2016 order,” TechFreedom said.

“Rather than grapple with the relevant context, the majority shifts the burden of proof to Congress, arguing that, to prohibit reissuance of a specific part of a prior rule, Congress must ‘pass[] resolutions with specific language.’ Op. 34. The majority’s interpretation of the CRA, however, prevents Congress from prohibiting the issuance of new rules that are substantially the same as disapproved rules — no matter what language the legislature uses,” TechFreedom added.

As previously reported, the Washington Legal Foundation, the National Federation of Independent Business (NFIB) Small Business Legal Center, Inc., and the Buckeye Institute have filed a joint amici curiae brief that also urged the Sixth Circuit to review the decision of the three-judge panel en banc, arguing that letting agencies reissue substantially similar CRA-nullified rules in piecemeal fashion would be akin to a child being allowed to eat slices of pie when told “don’t eat the pie.”

News: FederalLegislation LitigationEnforcement DataPrivacy DataBreach