Industry Examining Its Options After Loss in 6th Circuit Data Case
Industry will likely turn to the FCC to address a 6th U.S. Circuit Appeals Court decision on Wednesday upholding the agency’s 2024 data breach notification rules. When the rules were approved, now Chairman Brendan Carr and former Republican Commissioner Nathan Simington dissented.
Sign up for a free preview to unlock the rest of this article
Privacy Daily provides accurate coverage of newsworthy developments in data protection legislation, regulation, litigation, and enforcement for privacy professionals responsible for ensuring effective organizational data privacy compliance.
Carr said at the time the order didn’t attempt to explain how data breach rules aren't the same or much the same as those nullified as part of the ISP privacy rules overturned in a 2017 Congressional Review Act (CRA) resolution of disapproval.
The Ohio Telecom Association, USTelecom, NCTA and CTIA were among the industry groups that challenged the rules. “We are reviewing the 6th Circuit panel’s decision and considering our next steps,” a USTelecom spokesperson said in an email.
“Carr can ease the rules without further litigation, so this might affect the industry's thinking,” Andrew Schwartzman, senior counselor at the Benton Institute for Broadband & Society, told us on Thursday. The most important issue tackled by the court was a holding that the 2024 order doesn’t violate the CRA, he said. “This is an important question as to which there has not been any judicial case law,” he said.
Schwartzman said the decision also helps clarify another matter where there has been some uncertainty. No court has held that the 60-day period for seeking judicial review is triggered by the release date rather than the date of Federal Register publication, he said. When publication is slow, "as sometimes happens, lawyers worry about this and have sometimes filed protectively prior to … publication,” Schwartzman said. The 6th Circuit joins the D.C. and the 3rd circuits “in following the FCC's rule specifying that the trigger date” is Federal Register publication.
Public Knowledge filed a brief supporting the rules “so it’s good to see them upheld,” said PK Legal Director John Bergmayer. What industry or the FCC will do next is unclear, he said. “Carr is in a different situation now where he needs an FCC with authority” to act on the items he wants to address, Bergmayer said.
Chris Frascella, counsel to the Electronic Privacy Information Center, said had the court vacated the rule, “it might have created a gap in consumer protections,” which are “especially relevant” given the growing number of data breaches and the role of notification “in mitigating the downstream harms.” In other cases, the FCC has filed for stays “even after oral argument to pull back a rule to rework it internally, and the agency did not do that here,” Frascella said in an email.
Carr’s dissent “is particularly relevant now,” emailed Kristian Stout, innovation policy director for the International Center for Law & Economics. One of the key arguments the court heard about how the FCC got around the CRA “is precisely what Carr flagged,” Stout said. Given the dissent and the court’s narrow interpretation of the CRA’s “substantially the same” standard, “there may be a strategic opening to request en banc review or appeal, leveraging Carr’s original concerns about the CRA and statutory overreach,” Stout said.