The FCC proposes new data breach rules for phone companies

The image is by Alex Castro.

If the proposal from the Federal Communication Commission's chairwoman passes, phone companies would have to follow new rules about how they notify customers and the government. According to the notice of proposed rulemaking, the risk to consumers from security breeches involving customer information is increasing.

The current rules give telecommunication providers seven business days to notify the FBI and Secret Service of data breeches that leak customer proprietary network information. The company can't tell customers about the breach until seven days after the information has been relayed to federal law enforcement. The proposal suggests adding the FCC to the list of agencies that companies will have to notify in the case of a data breach. They would have to send out notifications in the case of a mistake.

It is necessary for law enforcement to be notified of a breach before it can be sent to consumers.

According to the FCC, some of the most sensitive personal information that carriers and providers have about their customers is known as CPNI. It can include data about when and where a customer made a call. It can also include customers' billing account name, phone number, and information about their plan. According to the notice, the update would better align the Commission's rules with the ones that have recently been put in place for other industries by federal and state governments.

This proposal is not being made in a vacuum. T-Mobile customers had their data exposed in a data breach. The carrier had suffered a much larger cybersecurity incident earlier in the year, which affected over 50 million people and was already the carrier's fifth breach in four years. The FCC proposed rules that would have placed stricter requirements on how and when notifications were sent.

The FCC is currently in a political stalemate with two Democrat members and two Republican members, so it may be a while before these requirements are applied to phone companies. The White House has nominated Gigi Sohn to fill the fifth seat on the commission, but there is currently a stalemate with the Senate on actually getting her confirmed. Even if Sohn is confirmed by the Senate, the proposal is just the beginning of the rule-changing process.