Federal Communications Commission

FCC-CIRC2312-06

who are likely to expect the same privacy protections when dealing with VRS providers, whether they are using VRS or point-to-point video services. ⁴³²

123. We conclude that, for the same reasons cited in the 2013 VRS Reform Order , these sources of authority for establishing the current data breach rule for TRS now authorize the Commission to amend this rule to ensure that TRS users continue to receive privacy protections equivalent to those enjoyed by users of telecommunications and VoIP services. The record in this proceeding supports this conclusion. As AARO states, the Commission has “ample legal authority” to amend its data breach rule for TRS under sections 222 and 225. ⁴³³

5. Impact of the Congressional Disapproval of the 2016 Privacy Order

124. In 2016, the Commission attempted to revise its breach notification rules as part of a larger proceeding addressing privacy requirements for ISPs. ⁴³⁴ The rules the Commission adopted in the 2016 Privacy Order applied to telecommunications carriers and interconnected VoIP providers in addition to ISPs, which had been classified as providers of telecommunications services in 2015. ⁴³⁵ In 2017, however, Congress nullified those 2016 revisions to the Commission’s privacy rules under the CRA. ⁴³⁶ Pursuant to the language of the Resolution of Disapproval, the 2016 Privacy Order was rendered “of no force or effect.” ⁴³⁷ That resolution conformed to the procedure set out in the CRA, which requires agencies to submit most rules to Congress before they can take effect and provides a mechanism for Congress to disapprove of such rules. Pursuant to the operation of the CRA, the 2016 Privacy Order “may not be reissued in substantially the same form, and a new rule that is substantially the same as such a rule may not be issued, unless the reissued or new rule is specifically authorized by a law enacted after the date of the joint resolution disapproving the original rule.” ⁴³⁸

125. We conclude that the CRA is best interpreted as prohibiting the Commission from reissuing the 2016 Privacy Order in whole, or in substantially the same form, or from adopting another item that is substantially the same as the 2016 Privacy Order . It does not prohibit the Commission from revising its breach notification rules in ways that are similar to, or even the same as, some of the revisions that were adopted in the 2016 Privacy Order , unless the revisions adopted are the same, in substance, as the 2016 Privacy Order as a whole.

126. Congress’s Resolution of Disapproval, by its terms, disapproved “the rule submitted by the Federal Communications Commission relating to ‘Protecting the Privacy of Customers of Broadband

⁴³² 2013 VRS Reform Order , 28 FCC Rcd at 8686-87, para. 171.

⁴³³ AARO Comments at 4; see also Hamilton Relay Comments at 9 (stating that section 225 “provides sufficient authority to impose CPNI data breach notification obligations on TRS providers”); EPIC et al. Reply at 17.

⁴³⁴ 2016 Privacy Order , 31 FCC Rcd at 14019-33, paras. 261-291. In 2015, the Commission classified broadband Internet access service as a telecommunications service subject to Title II of the Act, a decision that the D.C. Circuit upheld in U.S. Telecom Ass’n v. FCC , 825 F.3d 674 (D.C. Cir. 2016). See Protecting and Promoting the Open Internet , GN Docket No. 14-28, Report and Order on Remand, Declaratory Ruling, and Order, 30 FCC Rcd 5601, 5733-34, paras. 306-308 (2015), aff’d , U.S. Telecom Ass’n v. FCC , 825 F.3d 674 (D.C. Cir. 2016). As a result of classifying broadband Internet access service as a telecommunications service, such services were subject to sections 201 and 222 of the Act.

⁴³⁵ See 2016 Privacy Order , 31 FCC Rcd at 13925, para. 39, 14033-34, para. 293. In 2017, the Commission reversed the 2015 classification decision so that Title II obligations, including section 222, no longer apply to ISPs. Restoring Internet Freedom , WC Docket No. 17-108, Declaratory Ruling, Report and Order, and Order, 33 FCC Rcd 311 (2017), aff’d in part and remanded in part , Mozilla Corp. v. FCC , 940 F.3d 1 (D.C. Cir. 2019), on remand , Order on Remand, 35 FCC Rcd 12328 (2020), ptns. for recon. pending .

⁴³⁶ See Resolution of Disapproval; 5 U.S.C. § 801(b)(1), (f); see also 2017 CRA Disapproval Implementation Order .

⁴³⁷ Resolution of Disapproval.

⁴³⁸ 5 U.S.C. § 801(b)(2).

59