Data Security and Breach Notification Legislation: Selected Legal Issues
Released: 2015-12-28T00:00:00

Introduction

Recent data breaches at major U.S. retailers have placed a spotlight on concerns about the security of personal information stored in electronic form by corporations and other private entities. A data breach occurs when data containing sensitive personal information is lost, stolen, or accessed in an unauthorized manner, thereby causing a potential compromise of the confidentiality of the data. Existing federal law imposes security and breach notification requirements on specific industries or types of data. For example, certain health information is subject to requirements under the Health Insurance Portability and Accountability Act (HIPAA) and the Health Information Technology for Economic and Clinical Health Act (HITECH Act), while certain financial institutions are subject to requirements under the Gramm-Leach-Bliley Act (GLB). Additionally, 47 states, the District of Columbia (D.C.), and three territories have enacted laws requiring breach notification, while at least 12 states have enacted data security laws.

Several data security and breach notification bills have been introduced in the 114 th Congress, which broadly would impose security and notification requirements on businesses regardless of industry sector, with limited exceptions. Many of the current proposals would leave existing federal requirements in place and exempt institutions and/or data covered by those federal laws from a new regulatory scheme. However, some bills would also propose to supersede existing state laws and prevent states from acting in this area, thereby creating a uniform federal standard throughout the country.

During consideration of proposed bills, two prominent legal issues have arisen. First, to what extent would federal legislation preempt state and local actions (including statutes, regulations, and/or the ability to bring legal claims) regarding data security and breach notification? Second, what effect would such legislation have on the existing authority of the Federal Trade Commission (FTC) and the Federal Communications Commission (FCC) to bring enforcement actions related to data security and breach notification?

This report will discuss these two issues, starting with an examination of the Supreme Court's precedent regarding federal preemption. It will then analyze how these preemption principles might be applied by a reviewing court seeking to determine the preemptive effect of different federal proposals. Next, it will examine the existing jurisdiction and enforcement authority of the FTC and the FCC with regard to data security and breach notification as applied to telecommunications providers and how these agencies' responsibilities might be altered by proposed legislation.

Proposed Legislation on Data Security and Breach Notification

Several bills relating to data security and breach notification have been introduced in the 114 th Congress. The bills take different approaches to imposing data security requirements on covered entities, if at all. For example, some bills establish specific criteria required for a covered entity's data security program, including elements such as design, risk assessment and management, and employee training. Other bills empower the FTC to write rules regarding data security, and require the FTC to address certain topics in those rules. Still others simply state that covered entities must employ reasonable security measures and practices, without identifying what those measures and practices must be. In general, a violation of the data security requirements or standards would be considered to be an unfair or deceptive act or practice, enforceable by the FTC.

Regarding notification, generally, a covered entity is required to provide notice when personal information contained in electronic data that it owns or possesses is either (1) accessed or acquired or (2) accessed and acquired, without authorization. Each bill defines what entities are covered and what constitutes personal information. Notification must usually be provided to residents and/or citizens of the United States as well as to the FTC and, in some cases, credit reporting agencies. Each bill establishes a deadline for notification, either within a certain number of days (such as 30 or 45 days) or as "expediently as possible and without unreasonable delay" after discovering the breach. Delayed notification is required if notice would jeopardize certain kinds of law enforcement investigations or national security.

Each bill defines the required form of notification, which may include written notice by mail or notice by email, when certain conditions are met. In certain circumstances, substitute notification through a posting on a website or publication may be an acceptable replacement for individual notification. The content of the notification includes such elements as the kind of personal information that has been breached, a phone number to contact for further information, and, potentially, information about the availability of free credit reporting services. However, in most cases, if the covered entity determines that the breach poses no reasonable risk of identity theft, fraud, or other unlawful conduct, then notification is not required. Notification requirements may also be waived if the entity is already required to provide notice under an existing federal law, such as HIPAA or GLB.

Violations of the notice requirements would typically be classified as unfair or deceptive acts or practices, which would be enforced by the FTC under existing regulations. Some bills would specifically empower the FTC to write regulations to implement the notification requirements, while others would not. Along with enforcement by the FTC, some of the proposals allow state attorneys general to enforce violations of the rules that affect people in their state through the filing of civil actions.

Some bills contain additional provisions that go beyond security and breach notification and address topics such as data privacy. Additionally, as discussed further below, some bills specifically address the treatment of telecommunications common carriers, while others are silent on the subject. The details of each bill differ and close inspection of each provision and definition is required to determine its specific effect.

State Laws Pertaining to Data Security and Breach Notification

Forty-seven states, D.C., Guam, Puerto Rico, and the U.S. Virgin Islands have enacted legislation requiring businesses to notify affected persons when a data breach occurs. For example, California law requires that businesses that own or license computerized data that include personal information provide notice of a data breach to residents of California in the "most expedient time possible and without unreasonable delay." A breach occurs when such unencrypted data is "acquired by an unauthorized person." The required notice may be delayed if a law enforcement agency determines that the notice "will impede a criminal investigation." The notice must be written in plain language and provide specific information: the name and contact information of the reporting entity; the type of personal information involved in the breach; the approximate date of the breach, if known; a general description of the "breach incident"; and, in certain circumstances, information about credit reporting agencies and identity theft prevention. In addition to notifying individuals whose information is acquired, if the breach affects more than 500 California residents, the entity must also notify the state attorney general.

At least 12 states also have laws specifically addressing data security. For example, Massachusetts has promulgated regulations requiring persons who own or license personal information about a Massachusetts resident to "develop, implement, and maintain a comprehensive information security program.... " Such a program must be in writing and contain administrative, technical, and physical safeguards that are appropriate based on the size and type of business, available resources, and the amount of stored data. Every program shall complete specific tasks, such as "identifying and assessing reasonably foreseeable internal and external risks to the security, confidentiality, and/or integrity" of data; developing employee security policies on storage, access, and transportation of records; and regularly monitoring the program to ensure that it is "operating in a manner reasonably calculated to prevent unauthorized access" to data. Businesses must also conduct an annual review of security measures.

Finally, states may have general consumer protection laws that could potentially be used to remedy the harm caused by a data breach. For example, Illinois law makes unlawful "unfair methods of competition and unfair or deceptive acts or practices ... in the conduct of any trade or commerce." This law includes prohibitions on "deception fraud, false pretense, false promise, misrepresentation or the concealment, suppression, or omission of any material fact, with intent that others rely upon the concealment.... " Individuals whose personal information is compromised in a data breach may attempt to use such a consumer protection law to allege that the breached entity's failure to disclose its inadequate security measures amounts to an unfair or deceptive practice in violation of state law.

Preemption of State Laws, Regulations, and Claims

A major question related to consideration of federal legislation addressing data security and breach notification is whether, and to what extent, the federal law should preempt these existing state laws, thereby displacing state-by-state requirements in favor of a uniform, federal standard for entities covered under the general requirements established in the proposed legislation discussed above.

Federal preemption is rooted in the Supremacy Clause of the U.S. Constitution, which states that "[t]he Constitution, and the Laws of the United States which shall be made in Pursuance thereof; and all Treaties made, or which shall be made, under the Authority of the United States, shall be the supreme Law of the Land." Under the Supremacy Clause, Congress can override any state and local law that falls within Congress's legislative authority. Therefore, the legal issue is not whether Congress has the ability to preempt state and local laws but rather determining the particular circumstances under which federal law, either explicitly or implicitly, preempts state and local laws.

In answering the question of when preemption occurs, the Supreme Court has at times emphasized "two cornerstones of [] pre-emption jurisprudence." First, "the purpose of Congress is the ultimate touchstone in every pre-emption case." Second, "[i]n all pre-emption cases, and particularly in those in which Congress has 'legislated ... in a field which the States have traditionally occupied,' we 'start with the assumption that the historic police powers of the States were not to be superseded by the Federal Act unless that was the clear and manifest purpose of Congress.'" There are two kinds of federal preemption: express preemption and implied preemption.

Express Preemption

Express preemption occurs when a federal statute explicitly states its intent to preempt state and/or local action on a given subject. By including such language, Congress expresses its clear intent that the federal statute is to supersede state attempts to regulate on the issue. If a federal law is deemed to preempt a state law, regulation, or cause of action, then the preempted state law, regulation, or cause of action cannot be the basis for enforcement against covered entities.

Congress may also choose to include a "saving clause" in addition to an express preemption clause. A saving clause seeks to preserve some role for state or local action, by "saving" certain actions from the scope of the express preemption clause. Where a saving clause is present, the express preemption clause and saving clause must be read together in order to determine what kinds of actions will ultimately be superseded under express preemption principles.

All of the current federal legislative proposals in the area include express preemption clauses. Each express preemption clause typically raises at least two different issues: first, the types of state and local actions intended to be displaced and second, the subject matter of the preempted actions. For example, the express preemption clause in H.R. 1770 states:

No State or political subdivision of a State shall, with respect to a covered entity subject to this Act, adopt, maintain, enforce, or impose or continue in effect any law, rule, regulation, duty, requirement, standard, or other provision having the force and effect of law relating to or with respect to the security of data in electronic form or notification following a security breach of such data.

The type of state and local actions covered by this clause would be "any law, rule, regulation, duty, requirement, standard, or other provision having the force and effect of law.... " The subject matter of the preempted actions would be those "relating to or with respect to the security of data in electronic form or notification following a security breach of such data." Therefore, if a state action is of the type covered by the clause, falls within the subject matter of the clause, and is adopted, maintained, enforced, or imposed or continued in effect by the state, the action will be expressly preempted under this clause.

When evaluating express preemption clauses, courts rely on principles of statutory interpretation to determine if a given state or local action is preempted. In trying to effectuate congressional intent, courts look to the "language of the pre-emption statute and the 'statutory framework' surrounding it" as well as the "'structure and purpose of the statute as a whole.'" Therefore, analyzing an express preemption clause is a context-driven exercise, where the specific words in the statute and the intent of the legislative scheme as a whole are of crucial importance.

Types of Actions Being Preempted

Congress can choose to displace any state or local action in an express preemption clause. State actions subject to federal preemption could include positive law enactments, such as state statutes and regulations. State common law, such as the ability to bring lawsuits under theories including breach of contract, negligence, or other torts, can also be preempted by federal law. Both positive law enactments and state common law claims will be referred to as "state actions" throughout this report.

Positive Law

All of the express preemption clauses in the proposed federal data security and breach notification bills are likely to be interpreted as preempting state positive law enactments governing the specific subject matter. Express preemption clauses that use words such as "law," "statute," and/or "regulation" would preempt positive enactments of state and local law. Additionally, positive law enactments clearly impose "requirements" or "prohibitions" and, therefore, clauses using those phrases will also have the effect of preempting state positive law.

Common Law Causes of Action

Less clear is which of the proposed bills are likely to be interpreted as also preempting common law causes of action. The Court has ruled that express preemption clauses referring to "requirements," "standards," or "other provisions with the force or effect of law" cover duties imposed by common law and, therefore, could preempt common law causes of action. For example, in Cipollone v. Liggett Group , a plurality of the Supreme Court held that a provision preempting a state-imposed "requirement or prohibition based on smoking and health" "plainly reaches beyond [positive] enactments" and "easily encompass[es] obligations that take the form of common-law rules.... " since the common law actions at issue were premised on the existence of a legal duty. Furthermore, the Court's precedent indicates that the word "rule" in the phrase "any provision of statute, rule, or regulation" arguably encompasses common law claims. In Sprietsma , the Court noted that if one interpreted the word "law" in the phrase "law or regulation" (as used in the express preemption clause) to encompass both positive law enactments and common law rules, then the term "regulation" becomes superfluous. Similarly, here, one could argue that if one interprets "statute, regulation, or rule" as encompassing only positive law enactments, then the use of the word "rule" is superfluous. Therefore, the better interpretation of the phrase, that gives meaning to each of the words contained therein, appears to be one that encompasses both positive law enactments and common law rules. Therefore, bills that use this wording likely would preempt common law causes of action.

Bills preempting "any provision of the law of any state" may also be interpreted to include common law claims within the scope of express preemption. The Court has noted that "[i]t is routine to call common law rules 'provisions'" and federal courts have previously treated common law claims as the type of claim that could be preempted in statutes that supersede "any provision of state law." While this appears to be the best interpretation of this type of bill, the case law does not provide clear answers. It is likely that both the continued viability of the presumption against preemption and the text and purpose of the broader statutory scheme would have to be closely considered before deciding the appropriate interpretation of these clauses.

If common law actions are eligible for preemption under an express preemption clause, a reviewing court must still determine if the specific action being brought satisfies all elements of the clause. Not all common law actions may be considered to be laws of the state or laws imposed by the state. For example, on several occasions, the Supreme Court has drawn a distinction between common law claims that seek to enforce obligations imposed by the state and claims that derive from self-imposed obligations, voluntarily undertaken by the parties. In American Airlines v. Wolens , the Court concluded that although some common law claims could be preempted under the express preemption clause at issue, a breach of contract claim would not be superseded because the contract represented "privately ordered obligations," not provisions that were enacted or enforced by the state. Therefore, a common law claim that seeks to enforce self-imposed obligations would likely not be considered a rule or standard enacted or enforced by the state and is unlikely to be preempted under these types of express preemption clauses.

A reviewing court may also need to delve into the elements of the common law action to determine if it satisfies all of the elements of an express preemption clause. For example, in Bates v. Dow Agrosciences , the Supreme Court concluded that an express warranty claim regarding a pesticide label was not preempted by a provision applying to "requirements for labeling or packaging." The common law rule underlying the express warranty claim did not require the manufacturer to make an express warranty, it only required that the manufacturer "make good" on the commitment it voluntarily undertook. Therefore, even though losing such a claim would likely induce the manufacturer to change its label, the claim itself still did not constitute a requirement as contemplated by the preemption provision.

Saving Clauses

As noted above, if a saving clause is present, it must be read in conjunction with an express preemption clause to determine what types of state actions will ultimately be superseded based on express preemption.

For example, an express preemption clause that preempts "any law, rule, regulation, duty, requirement, standard, or provision having the force and effect of law" would likely be interpreted as preempting state statutes, regulations, and common law causes of action. However, if that bill has a saving clause stating that the express preemption clause "shall not exempt a covered entity from liability under common law," the express preemption analysis changes. Reading the express preemption and saving clauses together, it is likely that such a bill would be interpreted as expressly preempting state positive law enactments but not state common law causes of action. Saving clauses may also identify specific kinds of laws that are not to be preempted. For example, a saving clause may shield "state trespass, contract, or tort law" from express preemption.

Ultimately, the existence of a saving clause can significantly change the scope of an express preemption clause and must be read in light of the plain text, express preemption clause, and the purpose of the statute as a whole.

Subject Matter of Preempted Actions

Existing federal proposals vary in defining the subject matter of state actions to be preempted. Some bills define the subject matter of preempted actions narrowly, by preempting state statutes, regulations, and/or common law claims that "require" or "expressly require" certain actions. For example, H.R. 580 preempts a state action that

expressly—

(1) requires information security practices and treatment of data containing personal information similar to any of those required under section 2; and

(2) requires notification to individuals of a breach of security resulting in unauthorized access to or acquisition of data in electronic form containing personal information.

This clause is likely to expressly preempt only state laws, regulations, and common law causes of action that specifically impose data security and breach notification requirements. It is unlikely that this kind of provision would be interpreted to preempt general state consumer protection statutes, since these statutes would not "expressly require" certain conduct with regard to security and notification, but rather impose general standards of behavior to be applied to all situations.

Alternatively, several bills use the term "relating to" when describing the subject matter of express preemption. For example, S. 1027 preempts state actions "relating to the protection or security of data in electronic form containing personal information or the notification of a breach of security." Bills using the term "relating to" are likely to be interpreted as preempting a broader swath of state actions. The Supreme Court has described "relating to" within the context of express preemption clauses as broad and having an "expansive sweep." In Morales v. TWA , the Court determined that a provision preempting actions "relating to rate, routes, or services of any air carrier" superseded not only state laws that directly addressed air carriers but laws of general applicability, such as a consumer protection statute, when applied to air carriers. Later cases importantly noted that "the breadth of the words 'related to' does not mean the sky is the limit" and that such words should not be read "with an 'uncritical literalism.'" For example, the Court has cautioned that an express preemption clause regarding motor carriers similar to the air carrier provision "does not preempt state laws affecting carrier prices, routes, or services 'in only a tenuous, remote, or peripheral ... manner.'"

A bill that expressly preempts statutes and regulations "relating to" the protection or security of covered data or the notification of a breach of security would clearly supersede state laws that directly address data security or notification, such as a statute establishing breach notification requirements. It would also likely preempt more general state laws, such as a consumer protection law that prohibits unfair and deceptive acts or practices, because such a law would "relate to" data security and notification when it is applied to a data breach.

Finally, some bills use the phrase "with respect to" to describe the subject matter of preempted state actions. For example, H.R. 2205 preempts state actions

with respect to the responsibilities of any person to—

(1) protect the security of information relating to consumers that is maintained, communicated, or otherwise handled by, or on behalf of, the person;

(2) safeguard information relating to consumers from—

(A) unauthorized access; and

(B) unauthorized acquisition;

(3) investigate or provide notice of the unauthorized acquisition of, or access to, information relating to consumers, or the potential misuse of the information, for fraudulent, illegal, or other purposes; or

(4) mitigate any potential or actual loss or harm resulting from the unauthorized acquisition of, or access to, information relating to consumers.

The courts have provided less guidance on the meaning of this phrase and it is unclear if the phrase is likely to be interpreted as similar to "relating to" or narrower in scope. Federal courts have considered at least one express preemption clause that uses "with respect to." The clause, from the Federal Election Campaign Act (FECA), preempted "any provision of state law with respect to election to federal office" and has been interpreted relatively narrowly. The U.S. Court of Appeals for the Fifth Circuit found that the act did not preempt a claim based on a general state fraud statute. In reaching this conclusion, the court appeared to draw a distinction between statutes that specifically regulated federal elections, which would be preempted, and statutes of general applicability that could be applied to federal election activities, which would not be preempted. However, it is unclear if the court's analysis was based strictly on a plain language interpretation or if it relied equally on the text and purpose of the overall legislative scheme.

If a federal law that preempted state statutes and regulations "with respect to" data security were interpreted narrowly, like the FECA provision, it likely would preempt state laws that establish data security standards, but would not preempt a general consumer protection statute. Alternatively, if the provision were interpreted more broadly, it could encompass both the direct data security laws as well as laws of general applicability, such as general consumer protection laws. In this instance, the statute's underlying congressional intent may help guide a court's interpretation of an arguably ambiguous express preemption clause.

Implied Conflict Preemption

The existence of an express preemption provision and/or a saving clause would not necessarily settle the question of the scope of potential preemption under a federal data security and breach notification statute. The Supreme Court has "made clear that the existence of a separate [express] pre-emption provision 'does not bar the ordinary working of conflict pre-emption principles.'" Therefore, after determining the scope of express preemption, a reviewing court may then need to determine if state actions that would not be expressly preempted may, nonetheless, be preempted under principles of implied conflict preemption.

Conflict preemption can be present in two instances: first, where compliance with both the state and federal law is a physical impossibility (impossibility preemption) and second, when the state action "stands as an obstacle to the accomplishment and execution of the full purposes and objectives of Congress" (obstacle preemption).

Impossibility Preemption

Impossibility preemption has previously been described by the Supreme Court as a situation in which a state law prohibits what the federal law requires, or vice versa. Generally, it requires the presence of conflicting affirmative legal obligations imposed by state and federal law. For example, the Supreme Court provided a useful illustration of these principles in Florida Lime & Avocado Growers v. Paul . In a hypothetical it constructed, the Court noted that a state law preventing the picking and marketing of avocados testing less than 8% of oil would be preempted under impossibility preemption if a federal law forbade the picking and marketing of avocados testing more than 7% oil.

However, where a state or federal law simply permits an activity the other restricts or prohibits, impossibility preemption appears not to apply. Commentators have suggested that instances of impossibility preemption are relatively rare.

To illustrate the application of impossibility preemption, consider a hypothetical federal law that expressly preempts less stringent state data breach notification laws, thereby setting a floor for minimum protection but allowing states to impose stricter standards. The federal standard requires covered entities to notify affected persons as expediently as possible and generally within 30 days of discovering a breach, but also provides exceptions under which notification would be delayed, for example if it would impede a criminal investigation or for national security reasons. A state data breach notification statute that imposed more stringent requirements than the federal law would survive under an express preemption analysis but could still be superseded due to impossibility preemption. Under the state statute, a covered entity must delay notification to the affected parties if it would impede a criminal or civil investigation. Assume a covered entity experiences a data breach that triggers both state and federal notification requirements and that notification of that breach would impede a civil investigation. Under the state statute described, the covered entity would be prohibited from providing notice to the affected parties until cleared by law enforcement. However, under the federal law described, which does not allow for delayed notification because of an ongoing civil investigation, the entity would be required to provide notice within 30 days. Since the federal law requires the entity to take action that is prohibited under state law, compliance with both laws would be impossible. Therefore, a reviewing court is likely to conclude that the state law is preempted under impossibility preemption.

Obstacle Preemption

Obstacle preemption analysis is broader in scope. In determining when a state action "stands as an obstacle," a reviewing court must consider congressional intent and the "purposes and objectives" of the federal statute as a whole. "If the purpose of the act cannot otherwise be accomplished," the Supreme Court has held, then "the state law must yield to the regulation of Congress.... " Obstacle preemption can be difficult to apply, since it relies heavily on a reviewing court's interpretation of Congress's purposes in creating the legislative scheme at issue and may require a nuanced analysis of the applicable state law.

Consequently, proposals that focus on creating a uniform, nationwide standard for data security and breach notification are more likely to supersede state law under obstacle preemption—since the existence of individual state standards would prohibit national uniformity—than a federal law that instead focused on setting minimum national standards.

Determining whether a state common law cause of action that remains valid after an express preemption analysis would still be superseded under obstacle preemption can be particularly difficult. The outcome of such an analysis may depend upon how a reviewing court interprets the elements of the claim under state law and the precise purpose of the federal law. The Supreme Court confronted this kind of question regarding the nature of a state tort claim in Mutual Pharmaceutical Company, Inc. v. Bartlett . In that case, the Court had to determine whether a New Hampshire tort design-defect claim was preempted by federal law under impossibility preemption. In discussing the specifics of the claim, the five Justices of the majority determined that the state tort cause of action imposed a duty on the defendant to take a specific remedial action and, therefore, was preempted. However, two Justices writing in dissent argued that the state tort law did not impose an affirmative legal obligation on the defendant to take the remedial action. Instead, they stated that the claim "create[d] an incentive" for the defendant or similar entities to make changes to their products "to try to avoid liability." This case highlights the complexity of this analysis, which depends on a court's interpretation of the specific elements of the state common law claim, and the possibility that judges may come to differing conclusions about the proper analysis of a specific claim.

Similarly, a reviewing court could view a negligence claim, if successful, as creating a legal duty for the defendant to implement better data security practices, including potentially a specific type of security mechanism. Under this view, the defendant and similarly situated entities in that state would then be subject to a legal requirement imposed by state common law to adopt those security practices, which a review court may determine to be in conflict with a federal law whose purpose is to create one uniform standard nationwide. Alternatively, a reviewing court might view that common law negligence claim as simply a request by the plaintiffs to be compensated for their injuries. Under this interpretation, the claim may not be in conflict with a federal law that seeks uniformity, since it would not impose an affirmative legal obligation on the defendant to take specific actions to cure its data security defects, but would simply require that the defendant compensate the plaintiffs.

Agency Enforcement of Data Security and Breach Notification Requirements

Another question that has arisen in the debate on federal data security and breach legislation is which federal agency should be responsible for enforcing the new requirements. The various proposals would primarily task the Federal Trade Commission (FTC) with enforcing the new requirements, but take differing approaches as to whether the Federal Communications Commission (FCC) should be permitted to retain its existing enforcement authority regarding data security and breach notification for telecommunication providers.

Current FTC Authority: Unfair or Deceptive Acts and Practices

The FTC has broad authority under Section 5 of the Federal Trade Commission Act (FTCA) to prohibit "unfair or deceptive acts or practices in or affecting commerce.... " Under the statute, an act or practice may be unfair if it "causes or is likely to cause substantial injury to consumers which is not reasonably avoidable by consumers themselves and not outweighed by countervailing benefits to consumers or to competition." While the FTC's authority over unfair or deceptive practices is broad, it is not unlimited. For example, the FTC cannot use this authority to enforce against all "persons, partnerships, or corporations.... " Rather, several entities are exempted from the scope of this authority, including

banks and savings and loan institutions described in 15 U.S.C. § 57a(f)(3); federal credit unions described in 15 U.S.C. § 57a(f)(4); common carriers subject to the Communications Act of 1934, as amended;common carriers subject to subtitle IV of title 49;air carriers and foreign air carriers subject to part A of subtitle VII of title 49; andpersons, partnerships, or corporations subject to the Packers and Stockyards Act.

Therefore, for example, the FTC could not bring an enforcement action alleging an unfair or deceptive act or practice, engaged in as part of its common carrier activities, against a telephone company that is classified as a common carrier by the FCC under the Communications Act.

The FTC has employed its unfair or deceptive act or practice authority to bring enforcement actions and to seek settlements with companies that experience data breaches. These actions generally focus on the allegedly deceptive nature of the claims companies make about the security provided for consumers' data and/or the company's failure to reasonably safeguard consumer data that leads to a breach. For more information on the FTC's use of this authority in the data security and breach context, see CRS Report R43723, The Federal Trade Commission's Regulation of Data Security Under Its Unfair or Deceptive Acts or Practices (UDAP) Authority , by [author name scrubbed].

Current FCC Authority

While telecommunications common carriers are not subject to the FTC's unfair or deceptive acts or practices authority, they are required to follow FCC rules relating to data security and breach notification. Section 222 of the Communications Act establishes a duty for common carriers "to protect the confidentiality of proprietary information of... customers.... " Furthermore, under Section 201 of the Communications Act, common carriers must ensure that all "charges, practices, classifications, and regulations" relating to telecommunications service are just and reasonable, which the FCC has interpreted as applying to carriers' practices of protecting customers' personally identifiable information.

Additionally, Sections 631 and 338(i) of the Communications Act establish more limited security rights for subscribers of cable and satellite television providers, as discussed below.

Common Carriers

Section 201(b) and 222 requirements apply to entities that are classified as common carriers under Title II of the Communications Act, which includes traditional telecommunications common carriers (such as telephone companies). Following the FCC's 2015 Open Internet Order, in which the Commission reclassified broadband Internet access service providers (BIAS or Internet service providers) as Title II common carriers, these sections also apply to those entities, provided that the FCC's reclassification decision survives legal challenge. For more information on the 2015 Open Internet Order, see CRS Report R43971, Net Neutrality: Selected Legal Issues Raised by the FCC's 2015 Open Internet Order , by [author name scrubbed].

Section 222 Customer Proprietary Network Information (CPNI)

Common carriers are subject to obligations derived from Section 222 of the Communications Act, which requires them to guard the confidentiality of customer proprietary network information (CPNI) and ensure that it is not disclosed to third parties without customer approval or as required by law. CPNI is defined as

(A) information that relates to the quantity, technical configuration, type, destination, location, and amount of use of a telecommunications service subscribed to by any customer of a telecommunications carrier, and that is made available to the carrier by the customer solely by virtue of the carrier-customer relationship; and

(B) information contained in the bills pertaining to telephone exchange service or telephone toll service received by a customer of a carrier;

except that such term does not include subscriber list information.

It includes such information as call records, location information, features of a customer's service, and billing records, among other types of data.

The FCC has issued regulations explaining common carriers' duties to protect CPNI. These regulations define when a carrier is permitted to use and/or share CPNI with other entities without a customer's approval and when a carrier can only use and/or share CPNI subject to a customer's opt-in or opt-out approval. Carriers are also required to notify law enforcement and customers when a breach of CPNI occurs.

In its Open Internet Order, the FCC specifically declined to forbear from applying Section 222 to Internet service providers, stating:

We find that forbearance from the application of section 222 with respect to broadband Internet access service is not in the public interest... and that section 222 remains necessary for the protection of consumers... The Commission has emphasized that '[c]onsumers' privacy needs are no less important when consumers communicate over and use broadband Internet access than when they rely on [telephone] services.'

While the statutory requirements of Section 222 apply to Internet service providers, the FCC did choose to forbear from applying its CPNI rules to Internet service providers. The Commission noted that the rules would not necessarily "be well suited to broadband Internet access service" since "certain of those rules appear more focused on concerns that have been associated with voice service ... [and] do not address many of the types of sensitive information to which a provider of broadband Internet access service is likely to have access." However, the Commission stressed that Internet service providers must still comply with the text of the statutory provisions in Section 222.

Section 201(b) Reasonableness Requirements

The FCC has also relied on its Section 201(b) authority to bring enforcement actions against common carriers that suffer data breaches. Section 201(b) states that common carrier "charges, practices, classifications, and regulations" must be just and reasonable. For example, in 2015, the FCC entered into a consent decree with AT&T following an investigation into the company's alleged failure to protect the confidentiality of CPNI that led to a data breach. The FCC declared that AT&T's "failure to reasonably secure" CPNI not only violated its duties under Section 222 but "also constitute[d] an unjust and unreasonable practice in violation of the [Communications] Act." It referenced an earlier enforcement action in which the FCC determined that a "failure to protect and secure" customers' personally identifiable information, CPNI, and other kinds of data, was an unjust and unreasonable practice in violation of Section 201(b). This failure was evidenced in part by the fact that the carrier did not encrypt any of its customers' data that was stored on servers accessible over the public Internet. Along with Section 222, Section 201(b)'s reasonableness requirement appears to be another tool the FCC can use to hold carriers accountable for certain data security and breach failures.

Cable and Satellite Providers

Several statutory provisions also impose data security requirements on cable and satellite television providers. Section 631 of the Communications Act prohibits a cable operator from using a cable system "to collect personally identifiable information concerning a subscriber without the prior written or electronic consent of the subscriber concerned." Furthermore, cable operators are forbidden from disclosing a subscriber's personally identifiable information without the subscriber's consent (with limited exceptions) and must "take such actions as are necessary to prevent unauthorized access to such information" by a third party. Similar provisions apply to satellite television carriers. These data security requirements for cable and satellite operators include protections for a subscriber's viewing history.

Proposed Changes to FTC and FCC Enforcement Authority

Several of the bills being considered in the 114 th Congress propose changes to the FTC and FCC's existing enforcement authority regarding data security and/or breach notification, while two others would leave the current system essentially unaltered. Under the bills that propose no changes to enforcement authority, common carriers under the Communications Act would not be subject to new data security and breach notification requirements, since they are not subject to FTC unfair or deceptive acts or practices authority. Common carriers would continue to be subject to Sections 201(b) and 222, as enforced by the FCC. Alternatively, cable and satellite providers would be subject to both the bills' new requirements, because they fall within the FTC's unfair or deceptive acts or practices authority, and Section 338(i) or 631, as applicable.

Some of the bills that propose changes to the current agency enforcement structure would expand the FTC's jurisdiction and leave the FCC's existing statutory and regulatory authority intact. For example, under H.R. 1704 , the FTC would enforce the new requirements "in the same manner, by the same means, and with the same jurisdiction, powers, and duties" as it has under the FTCA, except that the exceptions to its Section 5 authority "shall not apply." The bill does not alter the FCC's authority under Sections 201, 222, 338(i), or 631, although it does require the FTC to consult with the FCC before promulgating rules regarding an entity within the FCC's jurisdiction. If this type of bill were enacted, common carriers and cable and satellite providers would all be subject to both the new requirements in the bill, as enforced by the FTC, and the FCC's existing requirements.

Alternatively, some bills both expand the FTC's jurisdiction and eliminate some or all of the FCC's authority to regulate in this area. For example, H.R. 1770 states that,

as sections 201, 202, 222, 338, and 631 of the Communications Act of 1934... and any regulations promulgated thereunder, apply to covered entities with respect to securing information in electronic form from unauthorized access, including notification of unauthorized access to data in electronic form containing personal information, such sections and regulations promulgated thereunder shall have no force or effect , unless such regulations pertain solely to 9–1–1 calls.

Under this bill, with the exception of regulations pertaining solely to 911 calls, the FCC retains no authority to enforce its requirements under Sections 201, 222, 338, and 631. Therefore, if this type of bill were enacted, common carriers and cable and satellite providers would be subject to the new requirements, as enforced by the FTC, but would no longer have to comply with the FCC requirements. Other bills only eliminate the FCC's ability to enforce some of the relevant Communications Act provisions regarding data security and breach notification, but not all.

Removing the FCC's authority in this area may reduce the types of data that are subject to security and breach notification requirements, as compared with a proposal that imposes new requirements while maintaining the FCC's authority. For example, data within the existing definition of CPNI may not meet the definition of "covered information" in the federal proposal, and, therefore, may not be subject to the new federal standards nor the security and breach notification requirements in the CPNI rules, if those rules have "no force or effect" going forward.

Proponents of bills that reduce or eliminate the FCC's authority in this subject area have emphasized the benefits of imposing a uniform, predictable standard across all covered entities. Opponents of this approach argue that restricting FCC authority weakens consumer protection by eliminating clear, predictable rules with which companies are accustomed to complying. Some also argue that the type of data to be protected under new federal requirements would be more limited than the data protected under the Communications Act provisions and, therefore, eliminating the FCC's ability to enforce those provisions will reduce consumers' data protection. These issues are likely to continue to be discussed as the bills are considered in the 114 th Congress.