Telecom Industry Groups to Sixth Circuit: Overturn FCC Data Breach Rules
After a three-judge panel upheld the rules, the full court will rehear the case Oct. 21
WASHINGTON, Sept. 2, 2026 – Broadband industry groups urged federal judges Tuesday to invalidate expanded data breach reporting rules.
The industry groups are worried that if the rules stand, it would be harder for Congress to permanently quash agency rules it disapproved of.
A three-judge panel from the U.S. Court of Appeals for the Sixth Circuit upheld the rules last year, but the court agreed in July to rehear the case with a full panel of 13 judges. The challengers include USTelecom, NCTA, and CTIA, among others.
They argued Tuesday that the data breach rules, adopted in 2023 by the Federal Communications Commission, were too similar to one provision of a rule package that was nullified by Congress in 2017 via the Congressional Review Act.
The CRA allows Congress to ax agency rules with majority votes in both chambers, and prevents the rules from being reissued in the future without explicit Congressional approval.
The Sixth Circuit panel ruled 2-1 last year that that applied to entire rules, and agencies were free to bring back smaller pieces of rule packages that had been struck down.
That would allow agencies to bring back nullified rules piece by piece, Lathan & Watkins partner Roman Martinez wrote for the industry groups.
“If an agency adopts Rules A, B, C, and D in one order and Congress disapproves that order, the panel’s approach lets the agency simply reissue Rules A and B in one order and Rules C and D in another,” he wrote.
The groups also argued that the FCC’s privacy authority was limited to certain voice call-related network information and didn’t extend to the personally identifiable information the 2023 order covered.
The 2023 rules expanded the definition of a data breach that telecoms would have to report and expanded the kinds of customer information companies would have to protect. It applied to telecom and voice providers, while the rules axed in 2017 would also have applied to broadband ISPs, which were telecom carriers at the time.
Oral arguments in the rehearing are set for Oct. 21. The FCC will have to respond by Sept. 30.
FCC has downplayed concerns
FCC Chairman Brednan Carr, a commissioner at the time, dissented from the 2023 rules on the same grounds that the industry groups opposed it, saying it “plainly violates the law.
The agency previously told the court it had been reviewing the rules starting in September 2025, implying it might ultimately repeal them (something the industry groups wouldn’t be satisfied with as it wouldn’t change the CRA precedent).
The agency told the court in July that a rehearing wasn’t necessary. Agency attorney Adam Sorensen argued concerns from industry groups, as well as GOP lawmakers and attorneys general, were overblown.
“Petitioners’ policy concerns are exaggerated,” FCC and Justice Department attorneys wrote. “Congress remains free to disapprove under the CRA any subsequent rule issued by an agency. And even outside the CRA process, Congress is always free through legislation to strip a federal agency of authority to act in a given area.”
The government also argued the court found the 2023 rules were slightly different from the nixed 2017 rules, and thus agencies couldn’t easily make a small change and re-adopt nullified rules as companies feared.
The three-judge panel had found there were differences in the customer notice requirements, and that the 2023 order applied to companies providing call services for people with disabilities.
Martinez called those “minor differences” Wednesday.
“Both rules require customer notice for the same kind of breach, on the same 30-day timeline, and with the same basic required message,” he wrote.
