In 2024, various telecom industry associations sued the FCC in the Sixth Circuit, challenging an order that imposed reporting requirements in the event of data breaches involving consumers’ personally identifiable information.
Last week, the Sixth Circuit rejected those challenges. First, it held that the order was within the scope of the FCC’s authority under the Communications Act. Second, it held that the order was not barred by Congress’s disapproval of a 2016 order pursuant to the Congressional Review Act. As a preliminary matter, the Court held that the CRA’s bar on judicial review only barred challenges to “actions taken ‘under’ the CRA,” and did not prohibit challenges to later actions on the grounds that they were substantially similar to previously disapproved rules. On the merits, though, the court held that the 2024 order was not substantially the same as the 2016 one.
Judge Griffin dissented as to both holdings.
