United StatesFCC CPNI breach notification rule
In force.
A breach notification rule binding private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Breach notice, Reporting, Retention
As of .
What it requires
- This binds a telecommunications carrier, which for the subpart that holds this rule includes an entity that provides interconnected VoIP service (47 CFR 64.2003(o)).
- After you reasonably determine that a breach of your customers' CPNI has occurred, electronically notify the United States Secret Service and the Federal Bureau of Investigation through the central reporting facility as soon as practicable, and in no event later than seven business days (47 CFR 64.2011(b)).
- Do not notify your customers or disclose the breach publicly, whether voluntarily or under state or local law, until you have completed notifying law enforcement, and then not until 7 full business days have passed after that notice, unless an extraordinarily urgent need to avoid immediate and irreparable harm leads you to notify a class of affected customers sooner after consultation with the relevant investigating agency (47 CFR 64.2011(a) and (b)).
- Do not notify customers or disclose the breach where the relevant investigating agency directs you in writing not to, for an initial period of up to 30 days that the agency may extend (47 CFR 64.2011(b)(3)).
- After you have completed notifying law enforcement, notify your customers of the breach of their CPNI (47 CFR 64.2011(c)).
- Keep a record, electronically or in some other manner, of any breaches discovered, notifications to the Secret Service and the FBI, and notifications to customers, including if available the dates of discovery and notification, a detailed description of the CPNI involved and the circumstances of the breach, for a minimum of 2 years (47 CFR 64.2011(d)).
These lines are LexLint's reading of the law's text, as of .
What this law does
For the subpart that holds the rule, a telecommunications carrier includes an entity that provides interconnected VoIP service. A telecommunications carrier must electronically notify the United States Secret Service and the Federal Bureau of Investigation through a central reporting facility as soon as practicable, and in no event later than seven business days, after reasonable determination of a breach of its customers' CPNI.
The carrier may not notify its customers or disclose the breach to the public until 7 full business days have passed after notification to the Secret Service and the FBI, except as the rule provides in its paragraphs (b)(2) and (b)(3). A carrier that believes there is an extraordinarily urgent need to notify a class of affected customers sooner, in order to avoid immediate and irreparable harm, may proceed to notify them immediately only after consultation with the relevant investigating agency.
An investigating agency that determines that public disclosure or notice to customers would impede an ongoing or potential criminal investigation or national security may direct the carrier not to disclose or notify for an initial period of up to 30 days. After it has completed notifying law enforcement, the carrier must notify its customers of a breach of those customers' CPNI.
Every carrier must maintain a record of breaches discovered, notifications to the Secret Service and the FBI, and notifications to customers, and must retain the record for a minimum of 2 years. A breach has occurred when a person, without authorization or exceeding authorization, has intentionally gained access to, used, or disclosed CPNI.
The Commission's 2023 data breach order rewrote the section, but the amendments to section 64.2011 are delayed indefinitely until the Commission announces their effective dates in the Federal Register.
When LexLint raises it
When your app profile says your app provides telecom services.