Battle could be brewing over new FCC data breach reporting rules

The US Federal Communications Commission (FCC) wants to update its 2007 data breach reporting rules for telecom carriers due to an increased frequency of leaks. The proposed changes include an expanded definition of a data breach, requiring notification of incidents even if unintentional. Telecom carriers are against the change, particularly Verizon, arguing it would unnecessary increase obligations. The FCC wants to eliminate the 7-day wait period for customer notifications after a breach and is also considering a ‘harm-based’ trigger for notifications. The final rules may not be in place for three to four years.