II 

109TH CONGRESS 

2D SESSION S. 2389 

To amend the Communications Act of 1934 to prohibit the unlawful acquisition and use of confidential customer proprietary network information, 

and for other purposes. 

IN THE SENATE OF THE UNITED STATES 

MARCH 8, 2006 

Mr. ALLEN (for himself, Mr. STEVENS, Mr. INOUYE, Mr. BURNS, Mr. WARNER, Mr. SANTORUM, Mr. DORGAN, Mr. NELSON of Florida, Mr. VITTER, 

Mr. PRYOR, Mr. COLEMAN, Mr. TALENT, Mr. MARTINEZ, and Mr. 

THUNE) introduced the following bill; which was read twice and referred 

to the Committee on Commerce, Science, and Transportation 

A BILL 

To amend the Communications Act of 1934 to prohibit the 

unlawful acquisition and use of confidential customer 

proprietary network information, and for other purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE; TABLE OF CONTENTS. 

4 (a) SHORT TITLE.—This Act may be cited as the 

5 ‘‘Protecting Consumer Phone Records Act’’. 

6 (b) TABLE OF CONTENTS.—The table of contents for 

7 this Act is as follows: 

Sec. 1. Short title; table of contents. 


ccoleman on PROD1PC71 with BILLS
2 

•S 2389 IS 

Sec. 2. Unauthorized acquisition, use, or sale of confidential customer proprietary network telephone information. 

Sec. 3. Enhanced confidentiality procedures. 

Sec. 4. Penalties; extension of confidentiality requirements to other entities. 

Sec. 5. Enforcement by Federal Trade Commission. 

Sec. 6. Concurrent enforcement by Federal Communications Commission. 

Sec. 7. Enforcement by States. 

Sec. 8. Preemption of State law. 

Sec. 9. Consumer outreach and education. 

1 SEC. 2. UNAUTHORIZED ACQUISITION, USE, OR SALE OF 

2 CONFIDENTIAL CUSTOMER PROPRIETARY 

3 NETWORK TELEPHONE INFORMATION. 

4 (a) IN GENERAL.—It is unlawful for any person— 

5 (1) to acquire or use the customer proprietary 

6 network information of another person without that 

7 person’s affirmative written consent; 

8 (2) to misrepresent that another person has 

9 consented to the acquisition or use of such other 

10 person’s customer proprietary network information 

11 in order to acquire such information; 

12 (3) to obtain unauthorized access to the data 

13 processing system or records of a telecommuni14 cations carrier or an IP-enabled voice service pro15 vider in order to acquire the customer proprietary 

16 network information of 1 or more other persons; 

17 (4) to sell, or offer for sale, customer propri18 etary network information; or 

19 (5) to request that another person obtain cus20 tomer proprietary network information from a tele21 communications carrier or IP-enabled voice service 


ccoleman on PROD1PC71 with BILLS
3 

•S 2389 IS 

1 provider, knowing that the other person will obtain 

2 the information from such carrier or provider in any 

3 manner that is unlawful under subsection (a). 

4 (b) EXCEPTIONS.— 

5 (1) EXISTING PRACTICES PERMITTED.—Noth6 ing in subsection (a) prohibits any practice per7 mitted by section 222 of the Communications Act of 

8 1934 (47 U.S.C. 222), or otherwise authorized by 

9 law, as of the date of enactment of this Act. 

10 (2) CALLER ID.—Nothing in subsection (a) pro11 hibits the use of caller identification services by any 

12 person to identify the originator of telephone calls 

13 received by that person. 

14 (c) PRIVATE RIGHT OF ACTION FOR PROVIDERS.— 

15 (1) IN GENERAL.—A telecommunications car16 rier or IP-enabled voice service provider may bring 

17 a civil action in an appropriate State court, or in 

18 any United States district court that meets applica19 ble requirements relating to venue under section 

20 1391 of title 28, United States Code— 

21 (A) based on a violation of this section or 

22 the regulations prescribed under this section to 

23 enjoin such violation; 

24 (B) to recover for actual monetary loss 

25 from such a violation, or to receive $11,000 in 


ccoleman on PROD1PC71 with BILLS
4 

•S 2389 IS 

1 damages for each such violation, whichever is 

2 greater; or 

3 (C) both. 

4 (2) TREBLE DAMAGES.—If the court finds that 

5 the defendant willfully or knowingly violated this 

6 section or the regulations prescribed under this sec7 tion, the court may, in its discretion, increase the 

8 amount of the award to an amount equal to not 

9 more than 3 times the amount available under para10 graph (1) of this subsection. 

11 (3) INFLATION ADJUSTMENT.—The $11,000 

12 amount in paragraph (1)(B) shall be adjusted for in13 flation as if it were a civil monetary penalty, as de14 fined in section 3(2) of the Federal Civil Penalties 

15 Inflation Adjustment Act of 1996 (28 U.S.C. 2461 

16 note). 

17 (d) CIVIL PENALTY.— 

18 (1) IN GENERAL.—Any person who violates this 

19 section shall be subject to a civil penalty of not more 

20 than $11,000 for each violation or each day of a 

21 continuing violation, except that the amount as22 sessed for any continuing violation shall not exceed 

23 a total of $11,000,000 for any single act or failure 

24 to act. 


ccoleman on PROD1PC71 with BILLS
5 

•S 2389 IS 

1 (2) SEPARATE VIOLATIONS.—A violation of this 

2 section with respect to the customer proprietary net3 work information of 1 person shall be treated as a 

4 separate violation from a violation with respect to 

5 the customer proprietary network information of any 

6 other person. 

7 (e) LIMITATION.—Nothing in this Act or section 222 

8 of the Communications Act of 1934 (47 U.S.C. 222) au9 thorizes a subscriber to bring a civil action against a tele10 communications carrier or an IP-enabled voice service pro11 vider. 

12 (f) DEFINITIONS.—In this section: 

13 (1) CUSTOMER PROPRIETARY NETWORK INFOR14 MATION.—The term ‘‘customer proprietary network 

15 information’’ has the meaning given that term by 

16 section 222(i)(1) of the Communications Act of 

17 1934 (47 U.S.C. 222(i)(1)). 

18 (2) IP-ENABLED VOICE SERVICE.—The term 

19 ‘‘IP-enabled voice service’’ has the meaning given 

20 that term by section 222(i)(8) of the Communica21 tions Act of 1934 (47 U.S.C. 222(i)(8)). 

22 (3) TELECOMMUNICATIONS CARRIER.—The 

23 term ‘‘telecommunications carrier’’ has the meaning 

24 given it by section 3(44) of the Communications Act 

25 of 1934 (47 U.S.C. 3(44)). 


ccoleman on PROD1PC71 with BILLS
6 

•S 2389 IS 

1 SEC. 3. ENHANCED CONFIDENTIALITY PROCEDURES. 

2 (a) IN GENERAL.—Within 180 days after the date 

3 of enactment of this Act, the Federal Communications 

4 Commission shall— 

5 (1) revise or supplement its regulations, to the 

6 extent the Commission determines it is necessary, to 

7 require a telecommunications carrier or IP-enabled 

8 voice service provider— 

9 (A) to ensure the security and confiden10 tiality of customer proprietary network informa11 tion (as defined in section 222(i)(1) of the 

12 Communications Act of 1934 (47 U.S.C. 

13 222(i)(1))), 

14 (B) to protect such customer proprietary 

15 network information against threats or hazards 

16 to its security or confidentiality; and 

17 (C) to protect customer proprietary net18 work information from unauthorized access or 

19 use that could result in substantial harm or in20 convenience to its customers, and 

21 (2) ensure that any revised or supplemental 

22 regulations are similar in scope and structure to the 

23 Federal Trade Commission’s regulations in part 314 

24 of title 16, Code of Federal Regulations, taking into 

25 consideration the differences between financial inforVerDate Aug 31 2005 02:42 Mar 09, 2006 Jkt 049200 PO 00000 Frm 00006 Fmt 6652 Sfmt 6201 E:\BILLS\S2389.IS S2389

ccoleman on PROD1PC71 with BILLS
7 

•S 2389 IS 

1 mation and customer proprietary network informa2 tion. 

3 (b) COMPLIANCE CERTIFICATION.—Each tele4 communications carrier and IP-enabled voice service pro5 vider to which the regulations under subsection (a) and 

6 section 222 of the Communications Act of 1934 (47 

7 U.S.C. 222) apply shall file with the Commission annually 

8 a certification that, for the period covered by the filing, 

9 it has been in compliance with those requirements. 

10 SEC. 4. PENALTIES; EXTENSION OF CONFIDENTIALITY RE11 QUIREMENTS TO OTHER ENTITIES. 

12 (a) PENALTIES.—Title V of the Communications Act 

13 of 1934 (47 U.S.C. 501 et seq.) is amended by inserting 

14 after section 508 the following: 

15 ‘‘SEC. 509. PENALTIES FOR CONFIDENTIAL CUSTOMER PRO16 PRIETARY NETWORK INFORMATION VIOLA17 TIONS. 

18 ‘‘(a) CIVIL FORFEITURE.— 

19 ‘‘(1) IN GENERAL.—Any telecommunications 

20 carrier or IP-enabled voice service provider that is 

21 determined by the Commission, in accordance with 

22 paragraphs (3) and (4) of section 503(b), to have 

23 violated section 222 of this Act shall be liable to the 

24 United States for a forfeiture penalty. A forfeiture 

25 penalty under this subsection shall be in addition to 


ccoleman on PROD1PC71 with BILLS
8 

•S 2389 IS 

1 any other penalty provided for by this Act. The 

2 amount of the forfeiture penalty determined under 

3 this subsection shall not exceed $30,000 for each 

4 violation, or 3 times that amount for each day of a 

5 continuing violation, except that the amount as6 sessed for any continuing violation shall not exceed 

7 a total of $3,000,000 for any single act or failure to 

8 act. 

9 ‘‘(2) RECOVERY.—Any forfeiture penalty deter10 mined under paragraph (1) shall be recoverable pur11 suant to section 504(a) of this Act. 

12 ‘‘(3) PROCEDURE.—No forfeiture liability shall 

13 be determined under paragraph (1) against any per14 son unless such person receives the notice required 

15 by section 503(b)(3) or section 503(b)(4) of this 

16 Act. 

17 ‘‘(4) 2-YEAR STATUTE OF LIMITATIONS.—No 

18 forfeiture penalty shall be determined or imposed 

19 against any person under paragraph (1) if the viola20 tion charged occurred more than 2 years prior to the 

21 date of issuance of the required notice or notice or 

22 apparent liability. 

23 ‘‘(b) CRIMINAL FINE.—Any person who willfully and 

24 knowingly violates section 222 of this Act shall upon con25 viction thereof be fined not more than $30,000 for each 


ccoleman on PROD1PC71 with BILLS
9 

•S 2389 IS 

1 violation, or 3 times that amount for each day of a con2 tinuing violation, in lieu of the fine provided by section 

3 501 for such a violation. This subsection does not super4 sede the provisions of section 501 relating to imprison5 ment or the imposition of a penalty of both fine and im6 prisonment.’’. 

7 (b) EXTENSION OF CONFIDENTIALITY REQUIRE8 MENTS TO IP-ENABLED VOICE SERVICE PROVIDERS.— 

9 Section 222 of the Communications Act of 1934 (47 

10 U.S.C. 222) is amended— 

11 (1) by inserting ‘‘or IP-enabled voice service 

12 provider’’ after ‘‘telecommunications carrier’’ each 

13 place it appears except in subsections (e) and (g); 

14 (2) by inserting ‘‘or IP-enabled voice service 

15 provider’’ after ‘‘exchange service’’ in subsection (g); 

16 (3) by striking ‘‘telecommunication carriers’’ 

17 each place it appears in subsection (a) and inserting 

18 ‘‘telecommunications carriers or IP-enabled voice 

19 service providers’’; 

20 (4) by inserting ‘‘or provider’’ after ‘‘carrier’’ in 

21 subsection (d)(2), paragraphs (1)(A) and (B) and 

22 (3)(A) and (B) of subsection (i) (as redesignated); 

23 (5) by inserting ‘‘or providers’’ after ‘‘carriers’’ 

24 in subsection (d)(2); and 


ccoleman on PROD1PC71 with BILLS
10 

•S 2389 IS 

1 (6) by inserting ‘‘AND IP-ENABLED VOICE

2 SERVICE PROVIDER’’ after ‘‘CARRIER’’ in the cap3 tion of subsection (c). 

4 (c) DEFINITION.—Section 222(h) of the Communica5 tions Act of 1934 (47 U.S.C. 222(h)) is amended by add6 ing at the end the following: 

7 ‘‘(8) IP-ENABLED VOICE SERVICE.—The term 

8 ‘IP-enabled voice service’ means the provision of 

9 real-time 2-way voice communications offered to the 

10 public, or such classes of users as to be effectively 

11 available to the public, transmitted through cus12 tomer premises equipment using TCP/IP protocol, 

13 or a successor protocol, for a fee (whether part of 

14 a bundle of services or separately) with interconnec15 tion capability such that the service can originate 

16 traffic to, or terminate traffic from, the public 

17 switched telephone network.’’. 

18 (d) TELECOMMUNICATIONS CARRIER AND IP-EN19 ABLED VOICE SERVICE PROVIDER NOTIFICATION RE20 QUIREMENT.—Section 222 of the Communications Act of 

21 1934 (47 U.S.C. 222), is further amended— 

22 (1) by redesignating subsection (h) as sub23 section (i); and 

24 (2) by inserting after subsection (g) the fol25 lowing new subsection: 


ccoleman on PROD1PC71 with BILLS
11 

•S 2389 IS 

1 ‘‘(h) NOTICE OF VIOLATIONS.—The Commission 

2 shall by regulation require each telecommunications car3 rier or IP-enabled voice service provider to notify a cus4 tomer within 14 calendar days of any incident of which 

5 such telecommunications carrier or IP-enabled voice serv6 ice provider becomes or is made aware in which customer 

7 proprietary network information relating to such customer 

8 is disclosed to someone other than the customer in viola9 tion of this section or section 2 of the Protecting Con10 sumer Phone Records Act.’’. 

11 SEC. 5. ENFORCEMENT BY FEDERAL TRADE COMMISSION. 

12 (a) IN GENERAL.—Except as provided in sections 6 

13 and 7 of this Act, section 2 of this Act shall be enforced 

14 by the Federal Trade Commission. 

15 (b) VIOLATION TREATED AS AN UNFAIR OR DECEP16 TIVE ACT OR PRACTICE.—Violation of section 2 shall be 

17 treated as an unfair or deceptive act or practice proscribed 

18 under a rule issued under section 18(a)(1)(B) of the Fed19 eral Trade Commission Act (15 U.S.C. 57a(a)(1)(B)). 

20 (c) ACTIONS BY THE COMMISSION.—The Commission 

21 shall prevent any person from violating this Act in the 

22 same manner, by the same means, and with the same ju23 risdiction, powers, and duties as though all applicable 

24 terms and provisions of the Federal Trade Commission 

25 Act (15 U.S.C. 41 et seq.) were incorporated into and 


ccoleman on PROD1PC71 with BILLS
12 

•S 2389 IS 

1 made a part of this Act. Any person that violates section 

2 2 is subject to the penalties and entitled to the privileges 

3 and immunities provided in the Federal Trade Commis4 sion Act in the same manner, by the same means, and 

5 with the same jurisdiction, powers, and duties as though 

6 all applicable terms and provisions of the Federal Trade 

7 Commission Act were incorporated into and made a part 

8 of this Act. 

9 SEC. 6. CONCURRENT ENFORCEMENT BY FEDERAL COM10 MUNICATIONS COMMISSION. 

11 (a) IN GENERAL.—The Federal Communications 

12 Commission shall have concurrent jurisdiction to enforce 

13 section 2. 

14 (b) PENALTY; PROCEDURE.—For purposes of en15 forcement of that section by the Commission— 

16 (1) a violation of section 2 of this Act is 

17 deemed to be a violation of a provision of the Com18 munications Act of 1934 (47 U.S.C. 151 et seq.) 

19 rather than a violation of the Federal Trade Com20 mission Act; and 

21 (2) the provisions of section 509(a)(2), (3), and 

22 (4) of the Communications Act of 1934 shall apply 

23 to the imposition and collection of the civil penalty 

24 imposed by section 2 of this Act as if it were the 


ccoleman on PROD1PC71 with BILLS
13 

•S 2389 IS 

1 civil penalty imposed by section 509(a)(1) of that 

2 Act. 

3 SEC. 7. ENFORCEMENT BY STATES. 

4 (a) IN GENERAL.—The chief legal officer of a State 

5 may bring a civil action, as parens patriae, on behalf of 

6 the residents of that State in an appropriate district court 

7 of the United States to enforce section 2 or to impose the 

8 civil penalties for violation of that section, whenever the 

9 chief legal officer of the State has reason to believe that 

10 the interests of the residents of the State have been or 

11 are being threatened or adversely affected by a violation 

12 of this Act or a regulation under this Act. 

13 (b) NOTICE.—The chief legal officer of a State shall 

14 serve written notice on the Federal Trade Commission and 

15 the Federal Communications Commission of any civil ac16 tion under subsection (a) prior to initiating such civil ac17 tion. The notice shall include a copy of the complaint to 

18 be filed to initiate such civil action, except that if it is 

19 not feasible for the State to provide such prior notice, the 

20 State shall provide such notice immediately upon insti21 tuting such civil action. 

22 (c) AUTHORITY TO INTERVENE.—Upon receiving the 

23 notice required by subsection (b), either Commission may 

24 intervene in such civil action and upon intervening— 


ccoleman on PROD1PC71 with BILLS
14 

•S 2389 IS 

1 (1) be heard on all matters arising in such civil 

2 action; and 

3 (2) file petitions for appeal of a decision in such 

4 civil action. 

5 (d) CONSTRUCTION.—For purposes of bringing any 

6 civil action under subsection (a), nothing in this section 

7 shall prevent the chief legal officer of a State from exer8 cising the powers conferred on that officer by the laws of 

9 such State to conduct investigations or to administer oaths 

10 or affirmations or to compel the attendance of witnesses 

11 or the production of documentary and other evidence. 

12 (e) VENUE; SERVICE OF PROCESS.— 

13 (1) VENUE.—An action brought under sub14 section (a) shall be brought in a district court of the 

15 United States that meets applicable requirements re16 lating to venue under section 1391 of title 28, 

17 United States Code. 

18 (2) SERVICE OF PROCESS.—In an action 

19 brought under subsection (a)— 

20 (A) process may be served without regard 

21 to the territorial limits of the district or of the 

22 State in which the action is instituted; and 

23 (B) a person who participated in an al24 leged violation that is being litigated in the civil 


ccoleman on PROD1PC71 with BILLS
15 

•S 2389 IS 

1 action may be joined in the civil action without 

2 regard to the residence of the person. 

3 (f) LIMITATION ON STATE ACTION WHILE FEDERAL

4 ACTION IS PENDING.—If either Commission has insti5 tuted an enforcement action or proceeding for violation of 

6 section 2 of this Act, the chief legal officer of the State 

7 in which the violation occurred may not bring an action 

8 under this section during the pendency of the proceeding 

9 against any person with respect to whom the Commission 

10 has instituted the proceeding. 

11 SEC. 8. PREEMPTION OF STATE LAW. 

12 (a) PREEMPTION.—Section 2 and the regulations 

13 prescribed pursuant to section 3 of this Act and section 

14 222 of the Communications Act of 1934 (47 U.S.C. 222) 

15 and the regulations prescribed thereunder preempt any— 

16 (1) statute, regulation, or rule of any State or 

17 political subdivision thereof that requires a tele18 communications carrier or provider of IP-enabled 

19 voice service to develop, implement, or maintain pro20 cedures for protecting the confidentiality of customer 

21 proprietary network information (as defined in sec22 tion 222(i)(1) of the Communications Act of 1934 

23 (47 U.S.C. 222(i)(1))) held by that telecommuni24 cations carrier or provider of IP-enabled voice serv25 ice, or that restricts or regulates a carrier’s or proVerDate Aug 31 2005 02:42 Mar 09, 2006 Jkt 049200 PO 00000 Frm 00015 Fmt 6652 Sfmt 6201 E:\BILLS\S2389.IS S2389

ccoleman on PROD1PC71 with BILLS
16 

•S 2389 IS 

1 vider’s ability to use, disclose, or permit access to 

2 such information; and 

3 (2) any such statute, regulation, or rule, or ju4 dicial precedent of any State court under which li5 ability is imposed on a telecommunications carrier or 

6 provider of IP-enabled voice service for failure to 

7 comply with any statute, regulation, or rule de8 scribed in paragraph (1) or with the requirements of 

9 section 2 or the regulations prescribed pursuant to 

10 section 3 of this Act or with section 222 of the Com11 munications Act of 1934 or the regulations pre12 scribed thereunder. 

13 (b) LIMITATION ON PREEMPTION.—This Act shall 

14 not be construed to preempt the applicability of— 

15 (1) State laws that are not specific to the mat16 ters described in subsection (a), including State con17 tract or tort law; or 

18 (2) other State laws to the extent those laws re19 late to acts of fraud or computer crime. 

20 SEC. 9. CONSUMER OUTREACH AND EDUCATION. 

21 (a) IN GENERAL.—Within 180 days after the date 

22 of enactment of this Act, the Federal Trade Commission 

23 and Federal Communications Commission shall jointly es24 tablish and implement a media and distribution campaign 

25 to teach the public about the protection afforded customer 


ccoleman on PROD1PC71 with BILLS
17 

•S 2389 IS 

1 proprietary network information under this Act, the Fed2 eral Trade Commission Act and the Communications Act 

3 of 1934. 

4 (b) CAMPAIGN REQUIREMENTS.—The campaign 

5 shall— 

6 (1) promote understanding of— 

7 (A) the problem concerning the theft and 

8 misuse of customer proprietary network infor9 mation; 

10 (B) available methods for consumers to 

11 protect their customer proprietary network in12 formation; and 

13 (C) efforts undertaken by the Federal 

14 Trade Commission and the Federal Commu15 nications Commission to prevent the problem 

16 and seek redress where a breach of security in17 volving customer proprietary network informa18 tion has occurred; and 

19 (2) explore various distribution platforms to ac20 complish the goal set forth in paragraph (1). 

Æ 


ccoleman on PROD1PC71 with BILLS