SUPPLEMENTARY INFORMATION:

OMB Control Number: 3060-XXXX.

Title: Data Breach Reporting.

Type of Review: New collection.

Respondents: Business or other for-profit.

Number of Respondents and Responses: 145 respondents; 290 responses.

Estimated Time per Response: 36 hours.

Frequency of Response: On occasion reporting requirements; record keeping requirement, one-time reporting requirement, third party disclosure requirement, (the required disclosures need only be made once upon each triggering instance, e.g. each time that a breach occurs).

Obligation to Respond: Mandatory. Statutory authority for this information collection is contained in sections 1, 2, 4, 201, 202, 222, 303, 316, 338, 631, 705 of the Communications Act of 1934, as amended, and section 706 of the Telecommunications Act of 1996, as amended, 47 U.S.C. Sections 151, 152, 154, 201, 202, 222, 303, 316, 338, 551, 605, and 1302.

Total Annual Burden: 5,220 hours.

Total Annual Cost: No Cost.

Privacy Act Impact Assessment: This information collection affects individuals or households; thus, there are impacts under the Privacy Act. However, the government is not directly collecting this information and the Report and Order directs carriers to ( printed page 3314) protect the information to the extent it is customer proprietary information.

Nature and Extent of Confidentiality: The Commission is not requesting that respondents submit confidential information. Any respondent who submits information to the Commission, which the respondent believes is confidential, may request confidential treatment of such information under section 0.459 of the Commission's rules. See47 CFR Section 0.459.

Needs and Uses: Section 222 requires that telecommunications carriers protect the confidentiality of customer proprietary information, and places restrictions on the use, disclosure, or permission of access to customer information absent customer approval. To include broadband Internet access services, and also to update the privacy rules for the changing business and technology landscape, the Commission adopted updated rules on October 27, 2016 ( 2016 Privacy Order ).^[1] Among other things, the rules require telecommunications carriers, including BIAS providers, as well as interconnected VoIP providers, to: (1) Notify customers, the Commission, and the Federal Bureau of Investigation and the Secret Service under certain circumstances, when customer proprietary information is breached; and (2) maintain records of breaches and breach notifications. Each of these information collections is necessary to fulfill the purposes of the Act as implemented by the Report and Order. Requirements to disclose breaches of customer proprietary information are necessary to ensure that customers and law enforcement can act to limit the harms caused by breaches. Similarly, the rules' recordkeeping requirements for information about breaches of customer information are necessary to ensure continued protection of customer information through, inter alia, the identification of possible security vulnerabilities.