WASHINGTON, D.C. — Today, Rep. Kat Cammack led a letter to Federal Communications Commission Chairwoman Jessica Rosenworcel about the adoption of a new Report and Order in the Data Breach Reporting Requirements proceeding that includes rules that would violate the Congressional Review Act (CRA).
The Congressional Review Act exists as part of Congress’s Article I authority to exercise oversight of federal agencies. If Congress passes a Resolution of Disapproval about a rule, the new rule does not take effect and may not be reissued substantially in the same form in a future rule.
The letter states: “These rules are substantially the same as those Congress disapproved of in the Protecting the Privacy of Customers of Broadband and Other Telecommunications Services proceeding (2016 Privacy Order) in 2017. Therefore, it would be unlawful for the FCC to adopt these new rules.”
It continues: “In many ways, the proposed Data Breach Reporting Requirements rules are substantially the same as the rules in the 2016 Privacy Order. For example, requirements for notification, content of customer notification, and recordkeeping largely mirror each other. Given these similarities, we are shocked that the FCC is attempting to revive these rules after Congress explicitly rejected them… [w]hen Congress overrules an agency, that action is final; no agency has the power to ignore the plain meaning of a Congressional statute. Here, Congress has already spoken: rules like those in the 2016 Privacy Order are not to be adopted. Therefore, we urge you not to move forward with the Data Breach Reporting Requirements Report and Order.”
Congresswoman Cammack spoke about this issue during a subcommittee hearing with FCC Commissioner Brendan Carr in November. Watch the clip here.
Joining Congresswoman Cammack on the letter are her colleagues on the Energy & Commerce Committee: Neal Dunn, Gus Bilirakis, Morgan Griffith, Randy Weber, Larry Bucshon, Richard Hudson, Jeff Duncan, Rick Allen, and Greg Pence.
