20326 Federal Register / Vol. 63, No. 79 / Friday, April 24, 1998 /Rules and Regulations

State/location Community

No. Effective date of eligibility Current effectivemap date

Region IV

North Carolina: Wayne County, unincorporated

areas.

370254 ......do ......................................................................... Do.

Region VI

Arkansas: Sebastian County, unincorporated areas .. 050462 ......do ......................................................................... Do.

Region VI

Stuttgart, city of, Arkansas County ............................. 050002 ......do ......................................................................... Do.

Region VIII

Wyoming: Sheridan County, unincorporated areas ... 560047 March 30, 1998, Suspension Withdrawn .................. March 30, 1998.

Region IX

California:

Palmdale, city of, Los Angeles County ............... 060144 ......do ......................................................................... Do.

Los Angeles County, unincorporated areas ........ 065043 ......do ......................................................................... Do.

Region X

Washington:

Issaquah, city of, King County ............................ 530079 ......do ......................................................................... Do.

King County, unincorporated areas .................... 530071 ......do ......................................................................... Do.

Redmond, city of, King County ........................... 530087 ......do ......................................................................... Do.

Skykomish, town of, King County ....................... 530236 ......do ......................................................................... Do.

1The Town of Rockville has adopted the Charleston County (CID #455413) Flood Insurance Rate Map dated November 4, 1992. 2The Village of Bear Creek has adopted the Hays County (CID #480321) Flood Insurance Rate Map dated February 18, 1998. 3The City of Bulverde East has adopted the Comal County (CID #485463) Flood Insurance Rate Map dated July 17, 1995. 4The City of Center Point has adopted the Kerr County (CID #480419) Flood Insurance Rate Map dated May 1, 1979.

Code for reading third column: Emerg.—Emergency; Reg.—Regular; Rein.—Reinstatement; Susp.—Suspension; With.—Withdrawn; NSFHA—

Non Special Flood Hazard Area.

(Catalog of Federal Domestic Assistance No.

83.100, ‘‘Flood Insurance’’)

Issued: April 15, 1998.

Michael J. Armstrong,

Associate Director for Mitigation.

[FR Doc. 98–10941 Filed 4–23–98; 8:45 am]

BILLING CODE 6718–05–P

FEDERAL COMMUNICATIONS

COMMISSION

47 CFR Parts 22 and 64

[CC Docket No. 96–115; FCC 98–27]

Telecommunications Carriers’ Use of

Customer Proprietary Network

Information and Other Customer

Information

AGENCY: Federal Communications

Commission.

ACTION: Final rule.

SUMMARY: The Second Report and Order

(Order) released February 26, 1998

promulgates regulations to implement

the statutory obligations of section 222

of the Telecommunications Act of 1996

relating to telecommunications carriers’

use of Customer Proprietary Network

Information (CPNI) and other customer

information. The Order resolves CPNI

issues raised in other proceedings that

have been deferred to this proceeding,

including obligations in connection

with sections 272 and 274 of the 1996

Act.

EFFECTIVE DATE: May 26, 1998.

FOR FURTHER INFORMATION CONTACT: Lisa

Choi, Attorney, Common Carrier

Bureau, Policy and Program Planning

Division, (202) 418–1580. For additional

information concerning the information

collections contained in this Order,

contact Judy Boley at (202) 418–0214, or

via the Internet at jboley@fcc.gov.

SUPPLEMENTARY INFORMATION: This is a

summary of the Commission’s Order

adopted February 19, 1998, and released

February 26, 1998. The full text of this

Order is available for inspection and

copying during normal business hours

in the FCC Reference Center, 1919 M

St., N.W., Room 239, Washington, D.C.

The complete text also may be obtained

through the World Wide Web, at http:/

/www.fcc.gov/Bureaus/Common

Carrier/Orders/fcc98–27.wp, or may be

purchased from the Commission’s copy

contractor, International Transcription

Service, Inc., (202) 857–3800, 1231 20th

St., N.W., Washington, D.C. 20036. This

Report and Order contains new or

modified information collections subject

to the Paperwork Reduction Act of 1995

(PRA). It has been submitted to the

Office of Management and Budget

(OMB) for review under the PRA. OMB,

the general public, and other federal

agencies are invited to comment on the

new or modified information collections

contained in this proceeding.

Regulatory Flexibility Certification

As required by the Regulatory

Flexibility Act, the Order contains a

Final Regulatory Flexibility Analysis

which is set forth in the Order. A brief

description of the analysis follows.

Pursuant to section 604 of the

Regulatory Flexibility Act, the

Commission performed a

comprehensive analysis of the Order

with regard to small entities. This

analysis includes: (1) a succinct

statement of the need for, and objectives

of, the Commission’s decisions in the

Order; (2) a summary of the significant

issues raised by the public comments in

response to the initial regulatory

flexibility analysis, a summary of the

Commission’s assessment of these

issues, and a statement of any changes

made in the Order as a result of the

comments; (3) a description of and an

estimate of the number of small entities

to which the Order will apply; (4) a

description of the projected reporting,

recordkeeping and other compliance

requirements of the Order, including an

estimate of the classes of small entities

which will be subject to the requirement

and the type of professional skills

necessary for compliance with the

requirement; (5) a description of the

steps the Commission has taken to

minimize the significant economic

impact on small entities consistent with

the stated objectives of applicable

statutes, including a statement of the
Federal Register / Vol. 63, No. 79 / Friday, April 24, 1998 /Rules and Regulations 20327

factual, policy, and legal reasons for

selecting the alternative adopted in the

Order and why each one of the other

significant alternatives to each of the

Commission’s decisions which affect

small entities was rejected.

Paperwork Reduction Act

This Report and Order contains either

a new or modified information

collection. The Commission, as part of

its continuing effort to reduce

paperwork burdens, invites the general

public and the Office of Management

and Budget (OMB) to comment on the

information collections contained in

this Order, as required by the Paperwork

Reduction Act of 1995, Public Law 104–

12. Written comments by the public on

the information collections are due 30

days after date of publication in the

Federal Register. OMB notification of

action is due July 6, 1998. Comments

should address: (1) whether the new or

modified collection of information is

necessary for the proper performance of

the functions of the Commission,

including whether the information shall

practical utility; (b) the accuracy of the

Commission’s burden estimates; (c)

ways to enhance the quality, utility, and

clarity of the information collected; and

(d) ways to minimize the burden of the

collection of information on the

respondents including the use of

automated collection techniques or

other forms of information technology.

OMB Control Number: 3060–0715.

Title: Implementation of the

Telecommunications Act of 1996:

Telecommunications Carriers’ Use of

customer proprietary Network

Information and Other Customer

Information.

Form No.: N/A.

Type of Review: Revised collection.

Respondents: Business or other forprofit.

Public reporting burden for the

collection of information is estimated as

follows:

Information collection

Number of

respondents

(approximately)

Annual hour

burden per response

Total annual burden

Customer Approval (47 CFR 64.2007) .................................................................................... 4,832 78 hours ........... 376,896 hours.

Customer Approval Documentation and Recordkeeping (47 CFR 64.2007(e) and 64.2009) 4,832 30 minutes ........ 2,416 hours.

Notification of CPNI Rights (47 CFR 64.2007(f)) .................................................................... 4,832 78 hours ........... 376,896 hours.

Notification Recordkeeping (47 CFR 64.2007(e)) ................................................................... 4,832 30 minutes ........ 2,416 hours.

Audit Mechanism (47 CFR 64.2009) ....................................................................................... 4,832 30 minutes ........ 2,416 hours.

Event Histories Recordkeeping (47 CFR 64.2009(d)) ............................................................. 4,832 30 minutes ........ 2,416 hours.

Corporate Compliance Certification (47 CFR 64.2009(e)) ...................................................... 4,832 1 hour ............... 4,832 hours.

Aggregate customer Information Disclosure Requirements for LECs ..................................... 1,400 1 hour ............... 1,400 hours.

Subscriber List Information Disclosure Requirement for Providers of Telephone Exchange

Service*.

1,400 4 hours ............. 5,600 hours.

CPNI Disclosure to Third Parties* ........................................................................................... 500 5 hours ............. 2,500 hours.

*These requirements are imposed pursuant to statute. See 47 U.S.C. 222.

Total Annual Burden: 777,788 burden

hours.

Estimated Costs Per Respondents:

$47,500 (avg.); Total cost to industry:

$229,520,000.

Needs and Uses: The Second Report

and Order implements the statutory

obligations of section 222 of the

Telecommunications Act of 1996.

Among other things, carriers are

permitted to use CPNI, without

customer aproval, to market offerings

that are related to, but limited by, the

customer’s existing service relationship

with their carrier. Carriers must obtain

express customer approval to use CPNI

to market service outside the customer’s

existing service relationship. Carriers

must provide a one-time notification of

customers’ CPNI rights prior to any

solicitation for approval. All of the

collections would be used to ensure that

telecommunications carriers comply

with the CPNI requirements the

Commission promulgates in the Order

and to implement section 222 of the

statute.

Synopsis of Second Report and Order

I. Commission Authority

1. We conclude that we have

authority to promulgate regulations

implementing section 222.

II. Carrier’s Right to Use CPNI Without

Customer Approval

A. Scope of a Carrier’s Right Pursuant to

Section 222(c)(1)(A): the ‘‘Total Service

Approach’’

2. The statutory language makes clear

that Congress did not intend for the

implied customer approval to use,

disclose, or permit access to CPNI under

section 222(c)(1)(A) to extend to all of

the categories of telecommunications

services offered by the carrier, as

proposed by advocates of the single

category approach. First, Congress’

repeated use of the singular

‘‘telecommunications service’’ must be

given meaning. Section 222(c)(1)

prohibits a carrier from using CPNI

obtained from the provision of ‘‘a

telecommunications service’’ for any

purpose other than to provide ‘‘the

telecommunications service from which

such information is derived’’ or services

necessary to, or used in, provision of

‘‘such telecommunications service.’’ We

agree with many commenters that this

language plainly indicates that Congress

both contemplated the possible

existence of more than one carrier

service and made a deliberate decision

that section 222(c)(1)(A) not extend to

all. Indeed, Congress’ reference to plural

‘‘telecommunications services’’ in

sections 222(a) and 222(d)(1)

demonstrates a clear distinction

between the singular and plural forms of

the term. Under well-established

principles of statutory construction,

‘‘where Congress has chosen different

language in proximate subsections of

the same statute,’’ we are ‘‘obligated to

give that choice effect.’’ Consistent with

this, section 222(c)(1)’s explicit

restriction of a carrier’s ‘‘use’’ of CPNI

‘‘in the provision of’’ service further

evidences Congress’ intent that carriers’

own use of CPNI be limited to the

service provided to the particular

customer, and not be expanded to all

the categories of telecommunications

services available from the carrier.

3. We therefore reject the single

category approach as contrary to the

statutory language.

4. We likewise reject parties’

suggestions that we interpret section

222(c)(1)(A) based on prior Commission

decisions, including the McCaw orders,

various Computer III orders, as well as

the Common Carrier Bureau’s opinion

in BankAmerica v. AT&T, which

permitted the sharing of customer

information among affiliated companies

based on the existing business

relationship and the perceived benefits
20328 Federal Register / Vol. 63, No. 79 / Friday, April 24, 1998 /Rules and Regulations

of integrated marketing. We similarly

reject parties’ reliance on other statutes,

particularly the Cable Television

Consumer Protection and Competition

Act (1992 Cable Act) and the Telephone

Consumer Protection Act of 1991

(TCPA), as well as the Commission’s

implementation of those Acts. Neither

of these statutes contains the specific

and unique language of section 222

which expressly limits a carrier’s ‘‘use’’

of customer information. Again, to the

extent other provisions are probative,

they indicate that Congress was clear

when it intended to exempt information

sharing within the context of the

existing business relationship from

general consumer protection provisions,

but chose not to in section 222.

5. We also conclude, contrary to the

suggestion of its proponents, that the

discrete offering approach is not

required by the language of section

222(c)(1)(A).

Our rejection of the discrete category

approach, and support for the total

service approach, is also informed by

our understanding of the relationship

between sections 222(c)(1)(A) and (d)(1).

Had Congress intended to permit

carriers to use CPNI only for

‘‘rendering’’ service, as suggested under

the discrete offering approach, and as

explicitly provided in section 222(d)(1),

it would not have needed to create the

exception in section 222(c)(1)(A). In

contrast, by interpreting section

222(c)(1)(A) as we do, to permit some

use of CPNI for marketing purposes, we

give meaning to both statutory

provisions. Indeed, in contrast with the

various parties’ views concerning the

scope of section 222(c)(1)(A),

commenters that addressed the meaning

of section 222(d)(1) uniformly suggest

that it does not extend to a carrier’s use

of CPNI for marketing purposes.

6. The legislative history confirms our

view that in section 222 Congress

intended neither to allow carriers

unlimited use of CPNI for marketing

purposes as they moved into new

service avenues opened through the

1996 Act, nor to restrict carrier use of

CPNI for marketing purposes altogether.

7. Finally, we also reject the various

arguments advanced by GTE, PacTel,

USTA, and U S WEST that our adoption

of an interpretation more limited than

the single or two category approaches

raises Constitutional concern.

8. We reject the Constitutional takings

arguments because, to the extent CPNI

is property, we agree that it is better

understood as belonging to the

customer, not the carrier.

9. We likewise reject parties’ Equal

Protection challenges based on section

222’s limitation to telecommunications

carriers alone.

10. Non-Telecommunications

Offerings. Several carriers argue that

certain non-telecommunications

offerings, in addition to being covered

by section 222(c)(1)(B), also should be

included within any service distinctions

we adopt pursuant to section

222(c)(1)(A), including inside wiring,

customer premises equipment (CPE),

and certain information services. Based

on the statutory language, however, we

conclude that inside wiring, CPE, and

information services do not fall within

the scope of section 222(c)(1)(A)

because they are not

‘‘telecommunications services.’’ More

specifically, section 222(c)(1)(A) refers

expressly to carrier use of CPNI in the

provision of a ‘‘telecommunications

service.’’

11. We conclude that carriers may not

use CPNI derived from the provision of

a telecommunications service for the

provision or marketing of information

services pursuant to section

222(c)(1)(A). We likewise conclude that

inside wiring and CPE do not fall within

the definition of ‘‘telecommunications

service,’’ and thus do not fall within the

scope of section 222(c)(1)(A).

12. We also conclude that, to the

extent that services formerly described

as adjunct-to-basic are offered by CMRS

providers, these should be considered

either within the provision of CMRS

under section 222(c)(1)(A), or as

services necessary to, or used in, CMRS

under section 222(c)(1)(B). In addition,

we agree with the result advocated by

WTR, and conclude that a reasonable

interpretation of section 222(c)(1)(A)

permits carriers to use, disclose, or

permit access to CPNI for the limited

purpose of conducting research on the

health effects of their service.

13. Special Treatment for Certain

Carriers. We conclude that Congress did

not intend to, and we should not at this

time, distinguish among carriers for the

purpose of applying section 222(c)(1).

Based on the statutory language, it is

clear that section 222 applies to all

carriers equally and, with few

exceptions, does not distinguish among

classes of carriers.

14. We also decline to forbear from

applying section 222(c)(1), or any of our

associated rules, to small or competitive

carriers, as SBT requests.

15. We also agree with a number of

parties that there should be no

restriction on the sharing of CPNI

among a carrier’s various

telecommunications-related entities that

provide different service offerings to the

same customer.

16. In addition to finding that the total

service approach is most consistent with

the statutory language and legislative

history, we are persuaded that, as a

policy matter, the total service approach

also best advances the principles of

customer control and convenience

implicitly embodied in sections

222(c)(1) and (c)(2).

17. Customers do not expect that

carriers will need their approval to use

CPNI for offerings within the existing

total service to which they subscribe. We

believe it reasonable to conclude that,

where a customer subscribes to a

diverse service offering—a mixture of

local, long distance, and CMRS—from

the same carrier or its subsidiary or

affiliated companies, the customer

views its telecommunications service as

the total service offering that it has

purchased, and can be presumed to

have given implied consent to its carrier

to use its CPNI for all aspects of that

service.

18. By contrast, neither the discrete

offering approach nor the three category

approach serves the statutory principle

of customer convenience or reasonably

reflects customers’ expectations of what

constitutes their telecommunications

service.

19. We also reject the discrete offering

and three category approaches because

we share the concern expressed by

many parties that such restrictive

interpretations may be difficult to

implement as service distinctions, and

corresponding customer subscriptions,

become blurred with market and

technological advances.

20. Customers do not expect that

carriers will use CPNI to market

offerings outside the total service to

which they subscribe.

21. Second, even if the Westin survey

accurately shows that customers desire

‘‘one-stop shopping,’’ and would permit

carriers to share information in order to

offer improved service, our

interpretation of section 222(c)(1) does

not foreclose carriers’ ability to offer

integrated packages nor the beneficial

marketing uses to which CPNI can be

made.

22. To be sure, under the total service

approach carriers may not use CPNI

without prior customer approval to

target customers they believe would be

receptive to new categories of service.

23. Finally, we reject the claim put

forth by several proponents of the single

category approach that narrower

interpretations of section 222(c)(1)(A)

would result in significant

administrative burdens for carriers. On

the contrary, we conclude that the total

service approach is the least onerous

administratively.
Federal Register / Vol. 63, No. 79 / Friday, April 24, 1998 /Rules and Regulations 20329

B. Scope of Carrier’s Right Pursuant to

Section 222(c)(1)(B)

24. As a threshold matter, given the

wide range of views on the

interpretation of section 222(c)(1)(B), we

reject U S WEST’s assertion that we

simply craft rules repeating, verbatim,

the statutory language. We clarify,

however, that we do not attempt here to

catalogue every service included within

the scope of section 222(c)(1)(B), but

rather address the specific offerings that

have been proposed in the record as

falling within that section, in particular,

CPE, certain information services, and

installation, maintenance, and repair

services. We likewise believe that

section 222(c)(1)(B) most appropriately

is interpreted as recognizing that

customers impliedly approve their

carrier’s use of CPNI in connection with

certain non-telecommunications

services. This implied approval,

however, is expressly limited to those

services ‘‘necessary to, or used in, the

provision of such telecommunications

service.’’ Through this limiting

language, we believe carriers’ CPNI use

is confined only to certain nontelecommunications services (i.e. those

‘‘services’’ either ‘‘necessary to’’ or

‘‘used in’’), as well as to those services

that comprise the customer’s total

service offering (i.e. ‘‘such [section

222(c)(1)(A)] telecommunications

service’’).

25. CPE and Certain Information

Services. Based on the statutory

language we conclude that, contrary to

the position advanced by several

parties, a carrier may not use, disclose,

or permit access to CPNI, without

customer approval, for the provision of

CPE and most information services

because, as other commenters assert,

they are not ‘‘services necessary to, or

used in, the provision of such

telecommunications service’’ under

section 222(c)(1)(B).

26. Contrary to NYNEX’s argument,

we conclude that Congress’ designation

of the publishing of directories as

‘‘necessary to, or used in’’ the provision

of a telecommunications service does

not require a broad reading of section

222(c)(1)(B) that encompasses all

information services. We are persuaded

that section 222(c)(1)(B) covers services

like those formerly characterized as

‘‘adjunct-to-basic,’’ in contrast to the

information services such as call

answering, voice mail or messaging,

voice storage and retrieval services, fax

store and forward, and Internet access

services, that the parties identified in

the record.

27. Our interpretation is supported by

Congress’ example of the publishing of

directories. The publishing of

directories, like those services formerly

described as adjunct-to-basic, can

appropriately be viewed as necessary to

and used in the provision of complete

and adequate telecommunication

service.

28. As a matter of statutory

construction, we find that the language

of section 222(c)(1)(B) is clear and

unambiguous, and does not permit the

interpretation that CPE and most

information services are ‘‘services

necessary to, or used in, the provision

of such telecommunications service.’’

But even if that language is ambiguous,

we are unpersuaded by parties’ contrary

arguments based on the legislative

history and policy considerations.

29. We also reject suggestions that

restrictions on CPNI sharing in the

context of CPE and information services

would be contrary to customer

expectations, as well as detrimental to

the goals of customer convenience and

one-stop shopping. As ITAA notes,

CPNI is not required for one-stop

shopping.

30. Finally, we reject parties’

contentions that we should permit

carriers to use CPNI in connection with

CPE and information services because

the Commission in the past permitted

more information sharing.

31. Installation, Maintenance, and

Repair Service. We conclude that,

pursuant to section 222(c)(1)(B), a

carrier may use, disclose, or permit

access to CPNI, without customer

approval, in its provision of inside

wiring installation, maintenance, and

repair services.

32. Specifically, we are persuaded

that installation, maintenance, and

repair of inside wiring is a service both

‘‘necessary to’’ and ‘‘used in’’ a carrier’s

provision of wireline

telecommunications service. As such,

carriers may use, without customer

approval, CPNI derived from wireline

service for the provision of inside

wiring installation, maintenance, and

repair services.

33. We further believe that our

conclusion is fully consistent with

customer expectation, and thereby

furthers the statutory principles of

customer control and convenience

embodied in section 222.

C. Scope of Carrier’s Right Pursuant to

Section 222(d)(1)

34. In the context of installation,

maintenance, and repair of inside

wiring, we conclude that section

222(d)(1), as well as section 222(c)(1)(B),

permit carrier use of CPNI without

customer approval for the provision of

such services. We agree with virtually

all commenters that section 222(d)(1)’s

permission for carriers to use CPNI ‘‘to

initiate, render, bill, and collect for

telecommunications services’’ includes

the actual installation, maintenance,

and repair of inside wiring.

35. Our conclusion is consistent with

Equifax’s concerns that we not interpret

sections 222(d)(1) as well as 222(d)(2) in

a manner that impedes carriers’ access

to information for the purpose of billing,

fraud prevention, and related services,

as well as the carriers’ ability to provide

the required information.

36. Contrary to the claims of AT&T

and MCI, we further conclude, however,

that the term ‘‘initiate’’ in section

222(d)(1) does not require that CPNI be

disclosed by carriers when competing

carriers have ‘‘won’’ the customer. We

agree with GTE that section 222(d)(1)

applies only to carriers already

possessing the CPNI, within the context

of the existing service relationship, and

not to carriers seeking access to CPNI.

37. Furthermore, a carrier’s failure to

disclose CPNI to a competing carrier

that seeks to initiate service to a

customer that wishes to subscribe to the

competing carrier’s service, may well,

depending upon the circumstances,

constitute an unreasonable practice in

violation of section 201(b). We also do

not believe, contrary to the position

suggested by AT&T, that section

222(d)(1) permits the former (or soon-tobe former) carrier to use the CPNI of its

former customer (i.e., a customer that

has placed an order for service from a

competing provider) for ‘‘customer

retention’’ purposes.

III. ‘‘Approval’’ Under Section 222(c)(1)

A. Express Versus Notice and Opt-Out

38. We conclude, contrary to the

position of a number of parties, that an

express approval mechanism is the best

means to implement this provision

because it will minimize any unwanted

or unknowing disclosure of CPNI. In

addition, such a mechanism will limit

the potential for untoward competitive

advantages by incumbent carriers. In

contrast, under an opt-out approach, as

even its proponents admit, because

customers may not read their CPNI

notices, there is no assurance that any

implied consent would be truly

informed.

39. We are not persuaded by the

statutory argument raised by the BOCs,

AT&T, and GTE that Congress’

requirement of an ‘‘affirmative written

request’’ in section 222(c)(2) means that

Congress intended to permit notice and

opt-out when it required only

‘‘approval’’ in section 222(c)(1).
20330 Federal Register / Vol. 63, No. 79 / Friday, April 24, 1998 /Rules and Regulations

40. We likewise reject U S WEST’s

claim that the earliest versions of what

became H.R. 1555 requires that we

interpret ‘‘approval’’ to permit notice

and opt-out.

41. We believe that, although the

legislative history offers no specific

guidance on the meaning of ‘‘approval’’

in section 222(c)(1), the language in the

Conference Report, explaining that

section 222 strives to ‘‘balance both

competitive and consumer privacy

interests with regard to CPNI,’’ strongly

supports our conclusion that express

approval is the better reading of the

statutory language.

42. We also reject the arguments that

Congress’ express provision for a notice

and opt-out mechanism in section 551

of the Act somehow compels that result

here even though the language of

section 222 contains no similar express

reference to such a mechanism. To the

contrary, section 551 confirms that

Congress knew how to draft a notice and

opt-out provision when it determined

that such an approach was appropriate.

For all these reasons we reject

commenters’ arguments that notice and

opt-out is in some manner required by

the language of section 222, or other

precedent.

43. We reject PacTel’s and U S

WEST’s contention that customers do

not expect carriers to seek affirmative

approval for the use of information to

market services to which they do not

subscribe, and that to do so would

confuse them. To the contrary, based on

the results of U S WEST’s affirmative

approval market trial, as well as those

of a similar trial reported by Ameritech,

we believe that, when customers wish to

do so, they have no problem

understanding a carrier’s solicitation for

approval and granting consent for the

use of CPNI outside the scope of their

total service offering.

44. We reject the argument that

imposing an express approval

requirement will ‘‘effectively eliminate

integrated marketing’’ and thwart the

development of one stop shopping.

While section 222 precludes carriers

from jointly marketing certain services

through the use of CPNI, nothing in

section 222 prevents carriers from

jointly marketing services without

relying on CPNI, as CPI and Cox point

out. Moreover, while the use of CPNI

may facilitate the marketing of

telecommunications services to which a

customer does not subscribe, such use is

not necessary for carriers to engage in

joint marketing. We thus reject PacTel’s

contention that an express approval

requirement would vitiate section

601(d) of the 1996 Act, which allows

carriers to market CMRS services jointly

with other telecommunications services,

and section 272(g) of the Act, which

permits BOC joint marketing of

telephone exchange service and inregion interLATA service, under certain

conditions. To the contrary, carriers are

free to market jointly

telecommunications services without

using CPNI to the extent such marketing

is otherwise permissible under other

provisions. In addition, as TRA points

out, a customer desiring an integrated

telecommunications service offering

tailored to its needs simply may give

approval to allow its carrier to access

CPNI for purposes outside of sections

222(c)(1)(A) and (B).

45. We reject U S WEST’s argument

that an express approval requirement

under section 222(c)(1) would

impermissibly infringe upon a carrier’s

First Amendment rights. At the outset,

we think there is a substantial question

as to whether CPNI restrictions even

implicate constitutionally protected

‘‘speech.’’ Carriers remain free to

communicate with present or potential

customers about the full range of

services that they offer, and section 222

therefore does not prevent a carrier from

engaging in protected speech with

customers regarding its business or its

products. What carriers cannot do is use

confidential CPNI in a manner that is

not permitted by the statute. While

section 222 may constrain carriers’

ability to more easily ‘‘target’’ certain

customers for marketing by limiting in

some circumstances their internal use of

confidential customer information, we

question whether that of itself

constitutes a restriction on protected

‘‘speech’’ within the purview of the

First Amendment. Nevertheless, to the

extent that it were concluded that CPNI

restrictions under section 222 did affect

carrier communications with their

customers or unrelated third parties in

such a way as to implicate the First

Amendment, at most commercial

speech would be at issue since any

limitations under section 222 relate

solely to the economic interests of the

speaker and its audience. But any

governmental restrictions on

commercial speech will be upheld

where, as here, the government asserts

a substantial interest in support of the

regulation, the regulation advances that

interest, and the regulation is narrowly

drawn. As the Supreme Court has

observed, it has never deemed it an

abridgement of freedom of speech to

make a course of conduct illegal merely

because the conduct was initiated or

conducted in part through language; to

the contrary, similar regulation of

business activity has been held not to

violate the first Amendment.

46. We further conclude that an

express approval requirement would not

violate the free speech rights of

customers. To the extent a customer

wishes to receive information on

offerings outside the scope of its total

service offering, it simply may grant

approval under section 222(c)(1). As we

previously noted, to the extent

customers are engaged in

communications with their carrier

regarding the servicing of their account,

they are more likely to grant approval.

B. Written, Oral and/or Electronic

Approval

47. We conclude that carriers should

be permitted to obtain such approval

through written, oral, or electronic

means, as several commenters contend.

48. We disagree with parties arguing

that section 222 mandates written

approval. We find nothing in the

language or design of section 222 that

limits carriers to obtaining only written

approval, despite arguments advanced

by some of these commenters.

49. We also reject the contention that

section 222(d)(3) of the Act supports a

written approval requirement. While

section 222(d)(3) contemplates oral

approval in creating an exception for

CPNI use during an inbound call,

section 222(d)(3) also may be

interpreted simply to permit a carrier to

use CPNI to provide a customer with

information for the duration of an

inbound call, based on oral approval,

even if the customer otherwise has

restricted the carrier’s use of its CPNI,

as Ameritech points out.

50. We conclude that a carrier relying

on oral customer approval should be

required to notify customers of their

CPNI rights, and should bear the burden

of demonstrating that a customer has

granted approval subsequent to such

notification pursuant to the rules we

adopt in this order.

C. Duration, Frequency, and Scope of

Approval

51. We conclude that approval

obtained by a carrier for the use of CPNI

outside of section 222(c)(1), whether

oral, written, or electronic, should

remain in effect until the customer

revokes or limits such approval, as some

parties suggest. We do not require

carriers to renew customer approval

periodically, for example, annually or

semi-annually, or to presume that

customer approval is valid only for the

duration of the transaction, if the

customer has not otherwise specified

the time period during which the

approval remains valid.
Federal Register / Vol. 63, No. 79 / Friday, April 24, 1998 /Rules and Regulations 20331

52. We decline to establish at this

time a restriction on the number of

times a carrier may contact a customer

to obtain approval for the use of CPNI

outside of section 222(c)(1), despite

arguments raised by some parties.

53. We conclude that allowing a

customer to grant partial use of CPNI is

consistent with one of the underlying

principles of section 222 to ensure that

customers maintain control over CPNI.

A carrier could obtain partial use by

virtue of its ability to view customer

records for a limited duration,

notwithstanding the customer’s

restriction of CPNI use.

D. Verification of Approval

54. We conclude that a carrier relying

on oral approval under section 222(c)(1)

should bear the burden of

demonstrating that such approval has

been given in compliance with the rules

we adopt in this order, as a number of

parties contend.

55. Because carriers must bear the

burden of demonstrating that they have

obtained oral approval under section

222(c)(1), we find it unnecessary to

mandate specific verification

mechanisms at this time. In general, we

agree with those commenters arguing

that a carrier relying on oral approval

should be able to meet its burden by, for

example, audiotaping customer

conversations, or by demonstrating that

a qualified independent third party

operating in a location physically

separate from the carrier’s telemarketing

representative has obtained customer

approval under section 222(c)(1)

subsequent to adequate notification of

its CPNI rights, and has confirmed the

appropriate verification data, e.g., the

customer’s date of birth or social

security number. In contrast, we would

likely not consider the mere absence of

any CPNI restriction in the customer’s

database or other account record

sufficient to verify that a customer has

given express approval in accordance

with section 222(c)(1), despite SBC’s

suggestion. In addition, because carriers

are required under our rules to notify

customers of their CPNI rights prior to

soliciting approval, we do not require

them to send follow-up letters to

customers confirming approval,

contrary to some parties’ contentions.

56. Finally, we require that carriers

maintain records of notification and

approval, whether written, oral, or

electronic, and be capable of producing

them if the sufficiency of a customer’s

notification and approval is challenged.

Maintenance of such records will

facilitate the disposition of individual

complaint proceedings. We thus require

that carriers maintain such records for a

period of at least one year in order to

ensure a sufficient evidentiary record

for CPNI compliance and verification

purposes.

E. Informed Approval Through

Notification

57. We require carriers to provide

their customers notification if the carrier

wishes to use, disclose or permit access

to CPNI beyond the purposes specified

in sections 222(c)(1)(A) and (B); at this

time, however, we make no decision on

whether notice is required for use of

CPNI within the scope of sections

222(c)(1)(A) and (B).

58. We agree with the majority of

commenters that customers must be

made aware of their CPNI rights before

they can be deemed to have ‘‘waived’’

those rights.

59. We reject BellSouth’s contention

that customers reasonably expect

businesses with whom they have a preexisting relationship to use CPNI to offer

new services, and that therefore carrier

use of CPNI for the development and

marketing of services should be deemed

to be permitted or invited, in the

absence of specific notification to the

customer. Specific notification of the

customer’s CPNI rights, as a component

of informed ‘‘approval’’ under section

222(c)(1), is warranted for uses of CPNI

outside the customer’s total service

offering.

F. Form and Content of Notification

60. Form of Notification. We conclude

that a carrier should be permitted to

provide either written or oral

notification, as a number of parties

contend. Such notification, for example,

may take the form of a bill insert, an

individual letter, or an oral presentation

that advises the customer of his or her

right to restrict carrier access to CPNI.

61. We are not persuaded by parties’

assertions that oral notification is

necessarily less verifiable than written,

will result in abuses, create greater

disputes and confuse customers, is too

difficult to accomplish successfully, or

could be used to dissuade customers

from releasing CPNI to a competitor. We

therefore conclude that a carrier

providing verbal notification of a

customer’s CPNI rights must carry the

burden of showing that such notice has

been given, in compliance with the

requirements we adopt in this order. We

further find that carriers may use any

reasonable method for verifying oral

notification that adequately confirms

that such notification has been given,

including, but not limited to,

audiotaping customer conversations or

using an independent third party

verification process.

62. We find no reason to impose

different notification requirements on

large and small carriers, as some

commenters suggest.

63. Content of Notification. At a

minimum, customer notification,

whether oral or written, must provide

sufficient information to enable the

customer to make an informed decision

as to whether to permit a carrier to use,

disclose, or permit access to CPNI. If a

carrier intends to share CPNI with an

affiliate (or non-affiliate) outside the

scope of section 222(c)(1), the notice

must state that the customer has a right,

and the carrier a duty, under federal

law, to protect the confidentiality of

CPNI. In addition, the notice must

specify the types of information that

constitute CPNI and the specific entities

that will receive the CPNI, describe the

purposes for which the CPNI will be

used, and inform the customer of his or

her right to disapprove those uses, and

to deny or withdraw access to CPNI at

any time. The notification also must

advise customers of the precise steps

they must take in order to grant or deny

access to CPNI, and must clearly state

that a denial of approval will not affect

the provision of any services to which

the customer subscribes. Any

notification that does not provide the

customer the option of denying access,

or implies that approval is necessary to

ensure the continuation of services to

which the customer subscribes, or the

proper servicing of the customer’s

account, would violate our notification

requirements.

64. We also require that any

notification provided by a carrier for

uses of CPNI outside of section 222(c)(1)

be reasonably comprehensible and nonmisleading. In this regard, a notification

that uses, for example, legal or technical

jargon could be deemed not to be

‘‘reasonably comprehensible’’ under our

requirements. If written notice is

provided, the notice must be clearly

legible, use sufficiently large type, and

be placed in an area so as to be readily

apparent to a customer. Finally, we

require that, if any portion of a

notification is translated into another

language, then all portions of the

notification must be translated into that

language.

65. We agree with CWI that a carrier

should not be prohibited from stating in

the notice that the customer’s approval

to use CPNI may enhance the carrier’s

ability to offer products and services

tailored to the customer’s needs. We

also do not preclude a carrier from

addressing the rights of unaffiliated

third parties to obtain access to the

customer’s CPNI. Consequently, a

carrier would not be prohibited from,
20332 Federal Register / Vol. 63, No. 79 / Friday, April 24, 1998 /Rules and Regulations

for example, informing a customer that

it may direct the carrier to disclose CPNI

to unaffiliated third parties upon

submission to the carrier of an

affirmative written request, pursuant to

section 222(c)(2) of the Act. However, a

carrier would be prohibited from

including any statement attempting to

encourage a customer to freeze third

party access to CPNI.

66. We also conclude that carriers

must provide notification of a

customer’s CPNI rights, whether oral or

written, prior to any solicitation for

approval. A customer must be fully

informed of its right to restrict carrier

access to sensitive information before it

can waive that right. Any notification

that is provided subsequent to a

solicitation for customer approval under

section 222(c)(1) is inadequate to inform

a customer of such right. The

notification may be in the same

conversation or document as the

solicitation for approval, as long as the

customer would hear or read the

notification prior to the solicitation for

approval. Finally, we conclude that the

solicitation for approval to use CPNI,

whether in the form of a signature line,

check-off box or other form, should be

proximate to the written or oral

notification, rather than at the end of a

long document that the customer might

sign for other purposes, or at the

conclusion of a lengthy conversation

with the customer, for example.

Similarly, the solicitation for approval,

if written, should not be on a document

separate from the notification, even if

such document is included within the

same envelope or package. The notice

should state that any customer approval,

or denial of approval, for the use of

CPNI outside of section 222(c)(1) is

valid until the customer affirmatively

revokes or limits such approval or

denial.

67. We conclude that carriers need

only provide one-time notification to

customers of their CPNI rights, as

suggested by some parties.

IV. Aggregate Customer Information

68. We reject the claim that our

interpretation of sections 222(c)(1) and

222(c)(3) would constitute an unlawful

taking. Even assuming carriers have a

property interest in either CPNI or

aggregate customer information, our

interpretation of sections 222(c)(1) and

222(c)(3) does not ‘‘deny all

economically beneficial’’ use of

property, as it must, to establish a

successful claim.

69. Although LECs face certain

obligations when they use aggregate

customer information under section

222(c)(3), Congress did not require that

LECs give aggregate customer

information to their competitors upon

request in all circumstances. Rather,

when LECs use this aggregate

information only to tailor their service

offering to better suit the needs of their

existing customers—that is, within the

scope of sections 222(c)(1)(A) and (B),

LECs do not need to disclose the

aggregate information. Moreover, LECs

are permitted to use the aggregate

information when targeting new service

customers—that is, for purposes beyond

the scope of section 222(c)(1)(A) and

(B). When they do so, LECs simply must

give that information to others upon

request.

70. We also reject parties’ Equal

Protection challenge. In order to sustain

an equal protection challenge, parties

challenging the law must prove that the

law has no rational relation to any

conceivable legitimate legislative

purpose. Making LEC aggregate

customer information available on

nondiscriminatory terms, when used for

purposes beyond those in sections

222(c)(1)(A) and (B), is reasonably

related to the legitimate goal of

promoting open competition in

telecommunications markets.

71. Finally, regarding the LECs’ notice

obligations, the nondiscrimination

requirement in section 222(c)(3) protects

competitors from anticompetitive

behavior by requiring that LECs make

aggregate customer information

available ‘‘upon reasonable request.’’

We interpret these terms to permit a

requirement that LECs honor standing

requests for disclosure of aggregate

customer information at the same time

and same price as when disclosed to, or

used on behalf of, their affiliates.

V. Section 222 and Other Act Provisions

72. We recognize an apparent conflict

between sections 222 and 272. Because

Congress did not make its intent clear,

our resolution of the apparent conflict

must therefore be guided by the

interpretation that, in our judgment,

best furthers the policies of these two

provisions, and thereby, best reflects the

statutory design. On this policy basis,

we believe that interpreting section 272

to impose no additional obligations on

the BOCs when they share CPNI with

their statutory affiliates according to the

requirements of section 222, as

implemented in this order, most

reasonably reconciles the goals of these

two provisions.

73. We are persuaded here that we

should interpret section 274 to impose

no additional CPNI requirements

regarding the BOCs’ use of CPNI in

connection with their provision of

electronic publishing. Thus, as in the

case of section 272, where section 222

appropriately balances the potentially

competing interests in the specific

context of carriers’ use and disclosure of

CPNI, we conclude that we should not

upset the balance by ‘‘superimposing’’

nondiscrimination standards in section

274.

VI. Commission’s Existing CPNI

Regulations

74. We conclude that retaining the

Computer III CPNI requirements,

applicable solely to the BOCs, AT&T

and GTE, would produce no discernable

competitive protection, and would be

confusing to both carriers and

customers.

A. BOC Cellular CPNI Rule 22.903(f)

and Computer II Rule 64.702(d)(3)

75. We conclude that we should

eliminate both rules 22.903(f) and

64.702(d)(3).

B. Safeguards Under Section 222

76. We confirm our tentative

conclusion that the Computer III

safeguards, as they currently operate,

should not be applied to other carriers.

Insofar as the statutory scheme we

implement in this order fully supplants

our Computer III CPNI framework, we

are further persuaded that we should

likewise not retain the CPNI safeguards

designed to ensure compliance within

the Computer III framework. The record

nevertheless supports the need to

specify safeguards to prevent

unapproved use, disclosure, and access

to customer CPNI by carrier personnel

and unaffiliated entities under the new

scheme.

77. Although we believe different

rules are not generally necessary for

small or rural carriers, we note that such

carriers may seek a waiver of our new

CPNI rules if they can show that our

rules would be unduly burdensome, and

propose alternative methods for

safeguarding the privacy of their

customers, consistent with section 222.

78. Access Restrictions. We decline to

require restrictions that would prohibit

carrier personnel from accessing CPNI

of customers who have either failed, or

expressly declined, to give requisite

approval for carrier use of CPNI for

marketing purposes.

79. Use Restrictions and Personnel

Training. We specifically require that

carriers develop and implement

software systems that ‘‘flag’’ customer

service records in connection with

CPNI. Carriers have indicated that their

systems could be modified relatively

easily to accommodate such CPNI

‘‘flags.’’ The flag must be conspicuously

displayed within a box or comment
Federal Register / Vol. 63, No. 79 / Friday, April 24, 1998 /Rules and Regulations 20333

field within the first few lines of the

first computer screen. The flag must

indicate whether the customer has

approved the marketing use of his or her

CPNI, and reference the existing service

subscription. In conjunction with such

software systems, we require that all

employees with access to customer

records be trained as to when they can

and cannot access the customer’s CPNI.

Carriers must also maintain internal

procedures to handle employees that

misuse CPNI contrary to the carriers’

stated policy. These requirements

represent minimum guidelines that we

believe most carriers can readily

implement and that are not overly

burdensome.

80. Access Documentation. We

require that carriers maintain an

electronic audit mechanism that tracks

access to customer accounts. The system

must be capable of recording whenever

customer records are opened, by whom,

and for what purpose. We believe

awareness of this ‘‘audit trail’’ will

discourage unauthorized, ‘‘casual’’

perusal of customer accounts, as well as

afford a means of documentation that

would either support or refute claimed

deliberate carrier CPNI violations. We

further require that carriers maintain

such contact histories for a period of at

least one year to ensure a sufficient

evidentiary record for CPNI compliance

and verification purposes.

81. Supervisory Review for Outbound

Marketing Campaigns. We require

carriers to establish a supervisory

review process that ensures compliance

with CPNI restrictions when conducting

outbound marketing. Although

supervisory review would neither be

convenient nor practical when

customers initiate a service call (i.e., in

the inbound marketing context), we

believe that such review is fully

warranted in connection with outbound

marketing campaigns. There is both less

likelihood that customers will detect

CPNI violations and greater incentive

for sales employees to misuse CPNI

when the dialogue with the customer is

initiated by the carrier. Indeed, a major

focus of outbound sales representatives

is on the acquisition of new customers

rather than on the retention of, and

service to, current customers.

Accordingly, we require that sales

personnel obtain supervisory review of

any proposed request to use CPNI for

outbound marketing purposes. We

require carriers to maintain a record of

the ‘‘event histories’’ (like contact

histories) for at least one year from the

date of the marketing campaign.

82. Corporate Certification. We

require each carrier to submit a

certification signed by a current

corporate officer, as an agent of the

corporation, attesting that he or she has

personal knowledge that the carrier is in

compliance with our CPNI requirements

on an annual basis. This certification

must be made publicly available, and be

accompanied by a statement explaining

how the carrier is implementing our

CPNI rules and safeguards.

83. Additional requirements. The

Commission will enforce all rules

announced in this order upon their

effective date. Because carriers may

need time to conform their data systems

and operations to comply with the

software flags and electronic audit

mechanisms required under this order,

however, we will not seek enforcement

of these specific safeguard rules for a

period of eight months from the date

these rules become effective. After that

time, we authorize the Chief of the

Common Carrier Bureau to undertake

enforcement actions when necessary

and appropriate, and, to the extent that

carrier behavior justifies requirements

beyond those outlined herein, to

establish additional safeguards. This

delegation to the Common Carrier

Bureau will facilitate the handling of

CPNI compliance issues in an expedited

manner.

VII. Procedural Issues

A. Second Report and Order

1. Final Regulatory Flexibility Analysis

84. As required by the Regulatory

Flexibility Act (RFA), 5 U.S.C. 603, an

Initial Regulatory Flexibility Analysis

(IRFA) was incorporated in the Notice.

The Commission sought written public

comment on the proposals in the Notice,

including the IRFA. The Commission’s

Final Regulatory Flexibility Analysis

(FRFA) in this Second Report and Order

conforms to the RFA, as amended by the

Contract With America Advancement

Act of 1996 (CWAAA), Public Law No.

104–121, 110 Stat. 847 (1996).

a. Need for and Objectives of the

Proposed Rules

85. The Commission, in compliance

with section 222 of the 1996 Act,

promulgates rules in this order to reflect

Congress’ directive to balance the

competitive and customer privacy

interests associated with the use and

protection of customer proprietary

network information (CPNI), while fully

considering the impact of these

requirements on small carriers. This

order reflects the statutory principle that

customers must have the opportunity to

protect the information they view as

sensitive and personal from use and

disclosure by carriers. As a general

matter, we find that customer approval

for carriers to use, disclose, or permit

access to CPNI is inferred from the

existing customer-carrier relationship;

therefore, we conclude that such

consent should be limited to the ‘‘total

service offering’’ to which the customer

subscribes from a carrier. To preserve

the customer’s control over the

dissemination of sensitive information,

we require an express approval

requirement for the use of CPNI beyond

the total service offering to which the

customer subscribes from a carrier.

While these rules permit customers to

decide whether and to what extent their

CPNI is used, they also restrict carriers’

anticompetitive use of CPNI.

b. Summary of Significant Issues Raised

by the Public Comments in Response to

the IRFA

86. In the IRFA, the Commission

generally stated that any rule changes

that might occur as a result of this

proceeding could impact small business

entities. Specifically, in the IRFA, the

Commission indicated there were no

reporting, recordkeeping, or other

compliance requirements. The IRFA

solicited comment on alternatives to our

proposed rules that would minimize the

impact on small entities consistent with

the objectives of this proceeding. In

response we received no comments

specifically directed to the IRFA. As

noted infra Part X.A.1.e of this FRFA, in

making the determinations reflected in

this order, we have given consideration

to those comments of the parties that

addressed the impact of our proposed

rules on small entities.

c. Description and Estimate of the

Number of Small Entities to Which

Rules Will Apply

87. The RFA directs agencies to

provide a description of and, where

feasible, an estimate of the number of

small entities that will be affected by

our rules. The RFA generally defines the

term ‘‘small entity’’ as having the same

meaning as the terms ‘‘small business,’’

‘‘small organization,’’ and ‘‘small

governmental jurisdiction.’’ For the

purposes of this order, the RFA defines

a ‘‘small business’’ to be the same as a

‘‘small business concern’’ under the

Small Business Act, 15 U.S.C. 632,

unless the Commission has developed

one or more definitions that are

appropriate to its activities. Under the

Small Business Act, a ‘‘small business

concern’’ is one that: (1) Is

independently owned and operated; (2)

is not dominant in its field of operation;

and (3) meets any additional criteria

established by the Small Business

Administration (SBA). The SBA has

defined a small business for Standard
20334 Federal Register / Vol. 63, No. 79 / Friday, April 24, 1998 /Rules and Regulations

Industrial Classification (SIC) categories

4812 (Radiotelephone Communications)

and 4813 (Telephone Communications,

Except Radiotelephone) to be small

entities when they have no more than

1,500 employees. We first discuss

generally the total number of small

telephone companies falling within both

of those SIC categories. Then, we

discuss the number of small businesses

within the two subcategories, and

attempt to refine further those estimates

to correspond with the categories of

telephone companies that are commonly

used under our rules.

88. Although affected incumbent local

exchange carriers (ILECs) may have no

more than 1,500 employees, we do not

believe that such entities should be

considered small entities within the

meaning of the RFA because they either

are dominant in their field of operations

or are not independently owned and

operated, and are therefore by definition

not ‘‘small entities’’ or ‘‘small business

concerns’’ under the RFA. Accordingly,

our use of the terms ‘‘small entities’’ and

‘‘small businesses’’ does not encompass

small ILECs. Out of an abundance of

caution, however, for regulatory

flexibility analysis purposes, we will

separately consider small ILECs within

this analysis and use the term ‘‘small

ILECs’’ to refer to any ILECs that

arguably might be defined by SBA as

‘‘small business concerns.’’

89. Total Number of Telephone

Companies Affected. The United States

Bureau of the Census (the Census

Bureau) reports that at the end of 1992,

there were 3,497 firms engaged in

providing telephone services, as defined

therein, for at least one year. This

number contains a variety of different

categories of carriers, including local

exchange carriers, interexchange

carriers, competitive access providers,

cellular carriers, mobile service carriers,

operator service providers, pay

telephone operators, PCS providers,

covered SMR providers, and resellers. It

seems certain that some of those 3,497

telephone service firms may not qualify

as small entities because they are not

‘‘independently owned and operated.’’

For example, a PCS provider that is

affiliated with an interexchange carrier

having more than 1,500 employees

would not meet the definition of a small

business. It seems reasonable to

conclude, therefore, that fewer than

3,497 telephone service firms are either

small entities or small incumbent LECs

that may be affected by this order.

90. Wireline Carriers and Service

Providers. The SBA has developed a

definition of small entities for telephone

communications companies other than

radiotelephone (wireless) companies.

The Census Bureau reports there were

2,321 such telephone companies in

operation for at least one year at the end

of 1992. According to the SBA’s

definition, a small business telephone

company other than a radiotelephone

company is one employing fewer than

1,500 persons. All but 26 of the 2,321

non-radiotelephone companies listed by

the Census Bureau were reported to

have fewer than 1,000 employees. Thus,

even if all 26 of those companies had

more than 1,500 employees, there

would still be 2,295 non-radiotelephone

companies that might qualify as small

entities or small incumbent LECs.

Although it seems certain that some of

these carriers are not independently

owned and operated, we are unable at

this time to estimate with greater

precision the number of wireline

carriers and service providers that

would qualify as small business

concerns under the SBA’s definition.

Consequently, we estimate that fewer

than 2,295 small entity telephone

communications companies other than

radiotelephone companies are small

entities or small ILECs that may be

affected by this order.

91. Local Exchange Carriers. Neither

the Commission nor the SBA has

developed a definition of small

providers of local exchange services.

The closest applicable definition under

the SBA’s rules is for telephone

communications companies other than

radiotelephone (wireless) companies.

The most reliable source of information

regarding the number of LECs

nationwide of which we are aware

appears to be the data that we collect

annually in connection with the

Telecommunications Relay Service

(TRS). According to our most recent

data, 1,371 companies reported that

they were engaged in the provision of

local exchange services. Although it

seems certain that some of these carriers

are not independently owned and

operated, or have more than 1,500

employees, or are dominant we are

unable at this time to estimate with

greater precision the number of LECs

that would qualify as small business

concerns under the SBA’s definition.

Consequently, we estimate that fewer

than 1,371 small providers of local

exchange service are small entities or

small ILECs that may be affected by this

order.

92. Interexchange Carriers. Neither

the Commission nor the SBA has

developed a definition of small entities

specifically applicable to providers of

interexchange services (IXCs). The

closest applicable definition under the

SBA’s rules is for telephone

communications companies other than

radiotelephone (wireless) companies.

The most reliable source of information

regarding the number of IXCs

nationwide of which we are aware

appears to be the data that we collect

annually in connection with TRS.

According to our most recent data, 143

companies reported that they were

engaged in the provision of

interexchange services. Although it

seems certain that some of these carriers

are not independently owned and

operated, or have more than 1,500

employees, we are unable at this time to

estimate with greater precision the

number of IXCs that would qualify as

small business concerns under the

SBA’s definition. Consequently, we

estimate that there are fewer than 143

small entity IXCs that may be affected

by this order.

93. Competitive Access Providers.

Neither the Commission nor the SBA

has developed a definition of small

entities specifically applicable to

providers of competitive access services

(CAPs). The closest applicable

definition under the SBA’s rules is for

telephone communications companies

other than radiotelephone (wireless)

companies. The most reliable source of

information regarding the number of

CAPs nationwide of which we are aware

appears to be the data that we collect

annually in connection with the TRS.

According to our most recent data, 109

companies reported that they were

engaged in the provision of competitive

access services. Although it seems

certain that some of these carriers are

not independently owned and operated,

or have more than 1,500 employees, we

are unable at this time to estimate with

greater precision the number of CAPs

that would qualify as small business

concerns under the SBA’s definition.

Consequently, we estimate that there are

fewer than 109 small entity CAPs that

may be affected by this order.

94. Operator Service Providers.

Neither the Commission nor the SBA

has developed a definition of small

entities specifically applicable to

providers of operator services. The

closest applicable definition under the

SBA’s rules is for telephone

communications companies other than

radiotelephone (wireless) companies.

The most reliable source of information

regarding the number of operator service

providers nationwide of which we are

aware appears to be the data that we

collect annually in connection with the

TRS. According to our most recent data,

27 companies reported that they were

engaged in the provision of operator

services. Although it seems certain that

some of these companies are not

independently owned and operated, or
Federal Register / Vol. 63, No. 79 / Friday, April 24, 1998 /Rules and Regulations 20335

have more than 1,500 employees, we are

unable at this time to estimate with

greater precision the number of operator

service providers that would qualify as

small business concerns under the

SBA’s definition. Consequently, we

estimate that there are fewer than 27

small entity operator service providers

that may be affected by this order.

95. Pay Telephone Operators. Neither

the Commission nor the SBA has

developed a definition of small entities

specifically applicable to pay telephone

operators. The closest applicable

definition under the SBA’s rules is for

telephone communications companies

other than radiotelephone (wireless)

companies. The most reliable source of

information regarding the number of

pay telephone operators nationwide of

which we are aware appears to be the

data that we collect annually in

connection with the TRS. According to

our most recent data, 441 companies

reported that they were engaged in the

provision of pay telephone services.

Although it seems certain that some of

these carriers are not independently

owned and operated, or have more than

1,500 employees, we are unable at this

time to estimate with greater precision

the number of pay telephone operators

that would qualify as small business

concerns under the SBA’s definition.

Consequently, we estimate that there are

fewer than 441 small entity pay

telephone operators that may be affected

by this order.

96. Wireless Carriers. The SBA has

developed a definition of small entities

for radiotelephone (wireless)

companies. The Census Bureau reports

that there were 1,176 such companies in

operation for at least one year at the end

of 1992. According to the SBA’s

definition, a small business

radiotelephone company is one

employing no more than 1,500 persons.

The Census Bureau also reported that

1,164 of those radiotelephone

companies had fewer than 1,000

employees. Thus, even if all of the

remaining 12 companies had more than

1,500 employees, there would still be

1,164 radiotelephone companies that

might qualify as small entities if they

are independently owned are operated.

Although it seems certain that some of

these carriers are not independently

owned and operated, we are unable at

this time to estimate with greater

precision the number of radiotelephone

carriers and service providers that

would qualify as small business

concerns under the SBA’s definition.

Consequently, we estimate that there are

fewer than 1,164 small entity

radiotelephone companies that may be

affected by this order.

97. Cellular Service Carriers. Neither

the Commission nor the SBA has

developed a definition of small entities

specifically applicable to providers of

cellular services. The closest applicable

definition under the SBA’s rules is for

telephone communications companies

other than radiotelephone (wireless)

companies. The most reliable source of

information regarding the number of

cellular service carriers nationwide of

which we are aware appears to be the

data that we collect annually in

connection with the TRS. According to

our most recent data, 804 companies

reported that they were engaged in the

provision of cellular services. Although

it seems certain that some of these

carriers are not independently owned

and operated, or have more than 1,500

employees, we are unable at this time to

estimate with greater precision the

number of cellular service carriers that

would qualify as small business

concerns under the SBA’s definition.

Consequently, we estimate that there are

fewer than 804 small entity cellular

service carriers that may be affected by

this order.

98. Mobile Service Carriers. Neither

the Commission nor the SBA has

developed a definition of small entities

specifically applicable to mobile service

carriers, such as paging companies. The

closest applicable definition under the

SBA’s rules is for telephone

communications companies other than

radiotelephone (wireless) companies.

The most reliable source of information

regarding the number of mobile service

carriers nationwide of which we are

aware appears to be the data that we

collect annually in connection with the

TRS. According to our most recent data,

172 companies reported that they were

engaged in the provision of mobile

services. Although it seems certain that

some of these carriers are not

independently owned and operated, or

have more than 1,500 employees, we are

unable at this time to estimate with

greater precision the number of mobile

service carriers that would qualify

under the SBA’s definition.

Consequently, we estimate that there are

fewer than 172 small entity mobile

service carriers that may be affected by

this order.

99. Broadband PCS Licensees. The

broadband PCS spectrum is divided into

six frequency blocks designated A

through F, and the Commission has held

auctions for each block. The

Commission has defined small entity in

the auctions for Blocks C and F as an

entity that has average gross revenues of

less than $40 million in the three

previous calendar years. For Block F, an

additional classification for ‘‘very small

business’’ was added and is defined as

an entity that, together with its affiliates,

has average gross revenue of not more

than $15 million for the preceding three

calendar years. These regulations

defining small entity in the context of

broadband PCS auctions have been

approved by the SBA. No small business

within the SBA-approved definition bid

successfully for licenses in Blocks A

and B. There were 90 winning bidders

that qualified as small entities in the

Block C auctions. A total of 93 small

and very small businesses won

approximately 40 percent of the 1,479

licenses for Blocks D, E, and F.

However, licenses for Blocks C through

F have not been awarded fully;

therefore, there are few, if any, small

businesses currently providing PCS

services. Based on this information, we

conclude that the number of small

broadband PCS licensees will include

the 90 winning bidders and the 93

qualifying bidders in the D, E, and F

Blocks, for a total of 183 small PCS

providers as defined by the SBA and the

Commission’s auction rules.

100. Narrowband PCS Licensees. The

Commission does not know how many

narrowband PCS licenses will be

granted or auctioned, as it has not yet

determined the size or number of such

licenses. Two auctions of narrowband

PCS licenses have been conducted for a

total of 41 licenses, out of which 11

were obtained by small businesses

owned by members of minority groups

and/or women. Small businesses were

defined as those with average gross

revenues for the prior three fiscal years

of $40 million or less. For purposes of

this FRFA, the Commission is utilizing

the SBA definition applicable to

radiotelephone companies, i.e., an

entity employing no more than 1,500

persons. Not all of the narrowband PCS

licenses have yet been awarded. There

is therefore no basis to determine the

number of licenses that will be awarded

to small entities in future auctions.

Given the facts that nearly all

radiotelephone companies have fewer

than 1,000 or fewer employees and that

no reliable estimate of the number of

prospective narrowband PCS licensees

can be made, we assume, for purposes

of the evaluations and conclusions in

this FRFA, that all the remaining

narrowband PCS licenses will be

awarded to small entities.

101. SMR Licensees. Pursuant to 47

CFR 90.814(b)(1), the Commission has

defined ‘‘small entity’’ in auctions for

geographic area 800 MHz and 900 MHz

SMR licenses as a firm that had average

annual gross revenues of less than $15

million in the three previous calendar

years. This definition of a ‘‘small entity’’
20336 Federal Register / Vol. 63, No. 79 / Friday, April 24, 1998 /Rules and Regulations

in the context of 800 MHz and 900 MHz

SMR has been approved by the SBA.

The rules adopted in this order may

apply to SMR providers in the 800 MHz

and 900 MHz bands that either hold

geographic area licenses or have

obtained extended implementation

authorizations. We do not know how

many firms provide 800 MHz or 900

MHz geographic area SMR service

pursuant to extended implementation

authorizations, nor how many of these

providers have annual revenues of less

than $15 million. We assume, for

purposes of this FRFA, that all of the

extended implementation

authorizations may be held by small

entities, which may be affected by this

order.

102. The Commission recently held

auctions for geographic area licenses in

the 900 MHz SMR band. There were 60

winning bidders who qualified as small

entities in the 900 MHz auction. Based

on this information, we conclude that

the number of geographic area SMR

licensees affected by the rule adopted in

this order includes these 60 small

entities. No auctions have been held for

800 MHz geographic area SMR licenses.

Thus, no small entities currently hold

these licenses. A total of 525 licenses

will be awarded for the upper 200

channels in the 800 MHz geographic

area SMR auction. The Commission,

however, has not yet determined how

many licenses will be awarded for the

lower 230 channels in the 800 MHz

geographic area SMR auction. Moreover,

there is no basis on which to estimate

how many small entities will win these

licenses. Given that nearly all

radiotelephone companies have fewer

than 1,000 employees and that no

reliable estimate of the number of

prospective 800 MHz licensees can be

made, we assume, for purposes of this

FRFA, that all of the licenses may be

awarded to small entities who, thus,

may be affected by this order.

103. Resellers. Neither the

Commission nor the SBA has developed

a definition of small entities specifically

applicable to resellers. The closest

applicable definition under the SBA’s

rules is for all telephone

communications companies. The most

reliable source of information regarding

the number of resellers nationwide of

which we are aware appears to be the

data that we collect annually in

connection with the TRS. According to

our most recent data, 339 companies

reported that they were engaged in the

resale of telephone services. Although it

seems certain that some of these carriers

are not independently owned and

operated, or have more than 1,500

employees, we are unable at this time to

estimate with greater precision the

number of resellers that would qualify

as small business concerns under the

SBA’s definition. Consequently, we

estimate that there are fewer than 339

small entity resellers that may be

affected by this order.

d. Description of Projected Reporting,

Recordkeeping and Other Compliance

Requirements

104. In this Second Report and Order,

if carriers choose to use CPNI to market

service offerings outside the customer’s

existing service, we obligate these

carriers to (1) obtain customer approval;

(2) provide their customers a one-time

notification of their CPNI rights prior to

any solicitation for approval; and (3)

maintain records of customer

notification and approval, whether oral,

written, or electronic.

105. We require carriers to develop

and implement software systems that

‘‘flag’’ customer service records in

connection with CPNI. The flag must be

conspicuously displayed within a box

or comment field within the first few

lines of the first computer screen, and

the flag must indicate whether the

customer has approved the marketing

use of his or her CPNI, and reference the

existing service subscription.

Also in connection with the software

systems, carriers must implement

internal standards and procedures

informing employees when they are

authorized to utilize CPNI. In addition,

they must develop standards and

procedures to handle employees who

misuse CPNI.

106. We further require that carriers

maintain an electronic audit mechanism

that tracks access to customer accounts

and is capable of recording whenever

customer records are opened, by whom,

and for what purpose. Carriers must

maintain these ‘‘contact histories’’ for a

period of at least one year to ensure a

sufficient evidentiary record for CPNI

compliance and verification purposes.

Additionally, sales personnel must

obtain supervisory review of any

proposed request to use CPNI for

outbound marketing purposes, to ensure

compliance with CPNI restrictions when

conducting such campaigns.

107. Finally, carriers must submit on

an annual basis a certification signed by

a current corporate officer, as an agent

of the corporation, attesting that he or

she has personal knowledge that the

carrier has complied with the rules

adopted in this order. The certification

must be made publicly available, and be

accompanied by a statement explaining

how the carrier is implementing our

CPNI rules and safeguards.

e. Significant Alternatives and Steps

Taken by Agency to Minimize

Significant Economic Impact on a

Substantial Number of Small Entities

Consistent With Stated Objectives

108. After consideration of possible

alternatives, we have concluded that our

rules should apply equally to all

carriers. Several parties in their

comments address the impact of

possible changes in our CPNI rules on

small entities. As a general matter,

various small entities express concern

that, having never been required to

comply with CPNI regulations in the

past, any regulation that extends to

them will impose immediate costs.

Specifically, SBT argues that we should

forbear from applying section 222(c)(1)

to small businesses, and thereby permit

their use of CPNI for all marketing

purposes, because small entities need

more flexibility to use CPNI to be

competitive in the marketplace. SBT

likewise opposes a three category

approach, claiming it gives large carriers

flexibility to develop and meet

customers’ needs, but may

unnecessarily limit small business as

competition grows. SBT maintains that

small carriers could be competitively

disadvantaged by any interpretation of

section 222(c)(1)(A) other than the

single category approach because a large

carrier can base the design of a new

offering on statistical customer data and

market widely, while a small business

can best meet specialized subscriber

needs if it offers local, interexchange,

and CMRS tailored to the specific

subscriber. ALLTEL and SBC agree with

USTA that a multiple category

definition of telecommunications

service would specifically burden small

companies.

109. As we discussed in this order, we

decline to forbear from applying section

222(c)(1) to small carriers because we

are unpersuaded that customers of small

businesses have less meaningful privacy

interests in their CPNI. We believe that

the total service approach furthers the

balance of privacy and competitive

considerations for all carriers and

provides all carriers with flexibility in

marketing their telecommunications

products and services. Indeed, if SBT is

accurate in its claim that small

businesses typically have closer

personal relationships with their

customers, then small businesses likely

would have less difficulty in obtaining

customer approval to market services

outside of a customer’s existing service.

Under the total service approach,

carriers are able to use the customer’s

entire customer record in the course of

providing the customer service, and no
Federal Register / Vol. 63, No. 79 / Friday, April 24, 1998 /Rules and Regulations 20337

business is prohibited from meeting

customer needs by offering tailored

packages of local, interexchange, and

CMRS with customer approval.

Moreover, to the extent carriers do not

choose to use CPNI for marketing

purposes, or do not want to market new

service categories, they do not need to

comply with our approval or notice

requirements. Finally, given our

decisions to permit oral, written, or

electronic approval under section

222(c)(1), and impose use rather than

access restrictions, the total service

approach addresses any concern that

CPNI restrictions will disrupt the

customer-carrier dialogue or the

carriers’ ability to provide full customer

service.

110. Some commenters urge the

Commission to adopt notification rules

which would require dominant carriers

to give their customers written

notification of their CPNI rights, while

smaller carriers or carriers in

competitive markets would be permitted

to give oral notification to its customers.

We find no reason to impose a written

notification requirement only on

incumbent carriers. While competitive

concerns may justify different regulatory

treatment for certain carriers, we believe

all customers, despite the size or

identity of their carrier, have similar

and important privacy concerns.

111. We also reject the suggestion by

Arch, LDDS WorldCom, MCI, Sprint,

and TCG that our rules in connection

with CPNI safeguards be limited to large

or incumbent carriers, as they had been

previously. Rather, we maintain that

Congress intended for all carriers to

safeguard customer information, and

that the safeguards we adopt today do

not impose a greater administrative

burden on small carriers. We remain

unconvinced that the burdens of section

222 are so great on small carriers that

they cannot comply with reasonable

restrictions. Indeed, the mechanisms we

require expressly factor commercial

feasibility and practice into an

appropriate regulatory framework, and

represent minimum general

requirements. We also find that the use

of an electronic audit mechanism to

track access to customer accounts is not

overly burdensome because many

carriers already maintain such

capabilities for a variety of business

purposes unrelated to CPNI. Carriers

have indicated that such capabilities are

important, for example, to track

employee use of company resources,

including computers and databases, as

well as for personnel disciplinary

purposes. The contact histories that we

require carriers to maintain for a period

of at least one year also should not be

burdensome to carriers because carriers

routinely evaluate these contact

histories to determine the success of

marketing campaigns. As we discuss in

this order, we believe the safeguards we

adopt in this order will afford carriers

the flexibility in conforming their

systems, operations, and procedures to

assure compliance with our rules.

Furthermore, in an effort to reduce, for

all carriers, the administrative burden of

compliance with our rules, we

specifically decline to impose a

password access restriction on carrier

use of CPNI. We also conclude that use

restrictions are less burdensome to all

carriers, including medium and small

sized carriers. We decline at this time to

impose a requirement of separate

marketing personnel on the basis that

such a rule may produce inefficiencies

particularly for small carriers, and

thereby may dampen competition by

increasing the costs of entry into

telecommunications markets.

2. Paperwork Reduction Act Analysis

112. This Second Report and Order

contains several new information

collections. We describe our collections

as follows:

113. In this order, if carriers choose to

use CPNI to market service offerings

outside the customer’s existing service,

we obligate these carriers to obtain

customer approval and document such

approval through software ‘‘flags’’ on

customer service records indicating

whether the customer has approved or

declined the marketing use of his or her

CPNI when solicited. These

requirements constitute new

‘‘collections of information’’ within the

meaning of the Paperwork Reduction

Act of 1995, 44 U.S.C. 3501–3520.

Implementation of this requirement is

subject to approval by the Office of

Management and Budget as prescribed

by the Paperwork Reduction Act.

114. Additionally, we require all

telecommunications carriers that choose

to solicit customer approval to provide

their customers a one-time notification

of their CPNI rights prior to any such

solicitation. Pursuant to this one-time

notification requirement, these carriers

must maintain a record of such

notifications. This requirement

constitutes a new ‘‘collection of

information’’ within the meaning of the

Paperwork Reduction Act of 1995, 44

U.S.C. 3501–3520. Implementation of

this requirement is subject to approval

by the Office of Management and

Budget as prescribed by the Paperwork

Reduction Act.

115. All carriers must record

whenever customer records are opened,

by whom, and for what purpose, and

maintain these contact histories for a

period of at least one year. These

requirements constitute new

‘‘collections of information’’ within the

meaning of the Paperwork Reduction

Act of 1995, 44 U.S.C. 3501–3520.

Implementation of this requirement is

subject to approval by the Office of

Management and Budget as prescribed

by the Paperwork Reduction Act.

116. Finally, we have adopted rules in

this order requiring all

telecommunications carriers to submit

on an annual basis a certification signed

by a current corporate officer attesting

that he or she has personal knowledge

that the carrier is in compliance with

the rules we promulgated in this order,

and to create an accompanying

statement explaining how the carriers

are implementing our rules and

safeguards. Pursuant to this

recordkeeping requirement, all

telecommunications carriers must

maintain in a publicly available file the

compliance certificates and

accompanying statements. This

requirement constitutes a new

‘‘collection of information’’ within the

meaning of the Paperwork Reduction

Act of 1995, 44 U.S.C. 3501–3520.

Implementation of all of these

recordkeeping requirements are subject

to approval by the Office of

Management and Budget as prescribed

by the Paperwork Reduction Act.

VIII. Ordering Clauses

117. Accordingly, It Is Ordered that

pursuant to sections 1, 4(i), 222 and

303(r) of the Communications Act of

1934, as amended, 47 U.S.C. 151, 154(i),

222 and 303(r), a Report and Order is

hereby Adopted.

118. It is further ordered that,

pursuant to our own motion, paragraph

222 of In the Matter of Implementation

of the Non-Accounting Safeguards of

Section 271 and 272 of the

Communications Act of 1934, as

amended, CC Docket No. 96–149, First

Report and Order and Further Notice of

Proposed Rulemaking, 11 FCC Rcd

21905 (1996), is hereby Overruled.

119. It Is Further Ordered that the

Commission’s Office of Public Affairs,

Reference Operations Division, Shall

Send a copy of this Second Report and

Order, including the associated Final

Regulatory Flexibility Analysis, to the

Chief Counsel for Advocacy of the Small

Business Administration, in accordance

with paragraph 605(b) of the Regulatory

Flexibility Act, 5 U.S.C. 601 et seq.

(1981).

120. It Is Further Ordered that part 22

of the Commission’s rules, 47 CFR

22.903 and part 64 of the Commission’s
20338 Federal Register / Vol. 63, No. 79 / Friday, April 24, 1998 /Rules and Regulations

rules, 47 CFR 64.702(d)(3) are Removed

as set forth in the Rule Changes.

121. It Is Further Ordered that part 64

of the Commission’s rules, 47 CFR part

64 is Amended as set forth in Rule

Changes, effective 30 days after

publication of the text thereof in the

Federal Register.

List of Subjects

47 CFR Part 22

Communications common carriers,

Reporting and recordkeeping

requirements.

47 CFR Part 64

Communications common carriers,

Reporting and recordkeeping

requirements, Telephone.

Federal Communications Commission.

Magalie Roman Salas,

Secretary.

Rule Changes

For the reasons set out in the

preamble, 47 CFR parts 22 and 64 are

amended as follows:

PART 22—PUBLIC MOBILE SERVICES

1. The authority citation for part 22 is

revised to read as follows:

Authority: 47 U.S.C. 154, 222, 303, 309 and

332.

§ 22.903 [Removed].

2. Remove § 22.903.

PART 64—MISCELLANEOUS RULES

RELATING TO COMMON CARRIERS

3. The authority citation for part 64 is

revised to read as follows:

Authority: 47 U.S.C. 154, 222, 254(k).

§ 64.702 [Amended]

4. In § 64.702 remove and reserve

paragraph (d)(3).

5. Subpart U is added to part 64 to

read as follows:

Subpart U—Customer Proprietary Network

Information

Sec.

64.2001 Basis and purpose.

64.2003 Definitions.

64.2005 Use of customer proprietary

network information without customer

approval.

64.2007 Notice and approval required for

use of customer proprietary network

information.

64.2009 Safeguards required for use of

customer proprietary network

information.

Subpart U—Customer Proprietary

Network Information

§ 64.2001 Basis and purpose.

(a) Basis. The rules in this subpart are

issued pursuant to the Communications

Act of 1934, as amended.

(b) Purpose. The purpose of the rules

in this subpart is to implement section

222 of the Communications Act of 1934,

as amended, 47 U.S.C. 222.

§ 64.2003 Definitions.

Terms used in this subpart have the

following meanings:

(a) Affiliate. An affiliate is an entity

that directly or indirectly owns or

controls, is owned or controlled by, or

is under common ownership or control

with, another entity.

(b) Customer. A customer of a

telecommunications carrier is a person

or entity to which the

telecommunications carrier is currently

providing service.

(c) Customer proprietary network

information (CPNI).

(1) Customer proprietary network

information (CPNI) is:

(i) Information that relates to the

quantity, technical configuration, type,

destination, and amount of use of a

telecommunications service subscribed

to by any customer of a

telecommunications carrier, and that is

made available to the carrier by the

customer solely by virtue of the

customer-carrier relationship; and

(ii) Information contained in the bills

pertaining to telephone exchange

service or telephone toll service

received by a customer of a carrier.

(2) Customer proprietary network

information does not include subscriber

list information.

(d) Customer premises equipment

(CPE). Customer premises equipment

(CPE) is equipment employed on the

premises of a person (other than a

carrier) to originate, route, or terminate

telecommunications.

(e) Information service. Information

service is the offering of a capability for

generating, acquiring, storing,

transforming, processing, retrieving,

utilizing, or making available

information via telecommunications,

and includes electronic publishing, but

does not include any use of any such

capability for the management, control,

or operation of a telecommunications

system or the management of a

telecommunications service.

(f) Local exchange carrier (LEC). A

local exchange carrier (LEC) is any

person that is engaged in the provision

of telephone exchange service or

exchange access. For purposes of this

subpart, such term does not include a

person insofar as such person is engaged

in the provision of commercial mobile

service under 47 U.S.C. 332(c).

(g) Subscriber list information (SLI).

Subscriber list information (SLI) is any

information:

(1) Identifying the listed names of

subscribers of a carrier and such

subscribers’ telephone numbers,

addresses, or primary advertising

classifications (as such classifications

are assigned at the time of the

establishment of such service), or any

combination of such listed names,

numbers, addresses, or classifications;

and

(2) That the carrier or an affiliate has

published, caused to be published, or

accepted for publication in any

directory format.

(h) Telecommunications carrier. A

telecommunications carrier is any

provider of telecommunications

services, except that such term does not

include aggregators of

telecommunications services (as defined

in 47 U.S.C. 226(a)(2)).

§ 64.2005 Use of customer proprietary

network information without customer

approval.

(a) Any telecommunications carrier

may use, disclose, or permit access to

CPNI for the purpose of providing or

marketing service offerings among the

categories of service (i.e., local,

interexchange, and CMRS) already

subscribed to by the customer from the

same carrier, without customer

approval.

(1) If a telecommunications carrier

provides different categories of service,

and a customer subscribes to more than

one category of service offered by the

carrier, the carrier is permitted to share

CPNI among the carrier’s affiliated

entities that provide a service offering to

the customer.

(2) If a telecommunications carrier

provides different categories of service,

but a customer does not subscribe to

more than one offering by the carrier,

the carrier is not permitted to share

CPNI among the carrier’s affiliated

entities.

(b) A telecommunications carrier may

not use, disclose, or permit access to

CPNI to market to a customer service

offerings that are within a category of

service to which the customer does not

already subscribe to from that carrier,

unless the carrier has customer approval

to do so, except as described in

paragraph (c) of this section.

(1) A telecommunications carrier may

not use, disclose, or permit access to

CPNI derived from its provision of local

service, interexchange service, or CMRS,

without customer approval, for the
Federal Register / Vol. 63, No. 79 / Friday, April 24, 1998 /Rules and Regulations 20339

provision of CPE and information

services, including call answering, voice

mail or messaging, voice storage and

retrieval services, fax store and forward,

and Internet access services. For

example, a carrier may not use its local

exchange service CPNI to identify

customers for the purpose of marketing

to those customers related CPE or voice

mail service.

(2) A telecommunications carrier may

not use, disclose or permit access to

CPNI to identify or track customers that

call competing service providers. For

example, a local exchange carrier may

not use local service CPNI to track all

customers that call local service

competitors.

(3) A telecommunications carrier may

not use, disclose or permit access to a

former customer’s CPNI to regain the

business of the customer who has

switched to another service provider.

(c) A telecommunications carrier may

use, disclose, or permit access to CPNI,

without customer approval, as described

in this paragraph (c).

(1) A telecommunications carrier may

use, disclose, or permit access to CPNI,

without customer approval, in its

provision of inside wiring installation,

maintenance, and repair services.

(2) CMRS providers may use, disclose,

or permit access to CPNI for the purpose

of conducting research on the health

effects of CMRS.

(3) LECs and CMRS providers may

use CPNI, without customer approval, to

market services formerly known as

adjunct-to-basic services, such as, but

not limited to, speed dialing, computerprovided directory assistance, call

monitoring, call tracing, call blocking,

call return, repeat dialing, call tracking,

call waiting, caller I.D., call forwarding,

and certain centrex features.

§ 64.2007 Notice and approval required for

use of customer proprietary network

information.

(a) A telecommunications carrier must

obtain customer approval to use,

disclose, or permit access to CPNI to

market to a customer service to which

the customer does not already subscribe

to from that carrier.

(b) A telecommunications carrier may

obtain approval through written, oral or

electronic methods.

(c) A telecommunications carrier

relying on oral approval must bear the

burden of demonstrating that such

approval has been given in compliance

with the Commission’s rules in this

part.

(d) Approval obtained by a

telecommunications carrier for the use

of CPNI outside of the customer’s total

service relationship with the carrier

must remain in effect until the customer

revokes or limits such approval.

(e) A telecommunications carrier must

maintain records of notification and

approval, whether oral, written or

electronic, for at least one year.

(f) Prior to any solicitation for

customer approval, a

telecommunications carrier must

provide a one-time notification to the

customer of the customer’s right to

restrict use of, disclosure of, and access

to that customer’s CPNI.

(1) A telecommunications carrier may

provide notification through oral or

written methods.

(2) Customer notification must

provide sufficient information to enable

the customer to make an informed

decision as to whether to permit a

carrier to use, disclose or permit access

to, the customer’s CPNI.

(i) The notification must state that the

customer has a right, and the carrier a

duty, under federal law, to protect the

confidentiality of CPNI.

(ii) The notification must specify the

types of information that constitute

CPNI and the specific entities that will

receive the CPNI, describe the purposes

for which CPNI will be used, and inform

the customer of his or her right to

disapprove those uses, and deny or

withdraw access to CPNI at any time.

(iii) The notification must advise the

customer of the precise steps the

customer must take in order to grant or

deny access to CPNI, and must clearly

state that a denial of approval will not

affect the provision of any services to

which the customer subscribes.

(iv) The notification must be

comprehensible and not be misleading.

(v) If written notification is provided,

the notice must be clearly legible, use

sufficiently large type, and be placed in

an area so as to be readily apparent to

a customer.

(vi) If any portion of a notification is

translated into another language, then

all portions of the notification must be

translated into that language.

(vii) A carrier may state in the

notification that the customer’s approval

to use CPNI may enhance the carrier’s

ability to offer products and services

tailored to the customer’s needs. A

carrier also may state in the notification

that it may be compelled to disclose

CPNI to any person upon affirmative

written request by the customer.

(viii) A carrier may not include in the

notification any statement attempting to

encourage a customer to freeze third

party access to CPNI.

(ix) The notification must state that

any approval, or denial of approval for

the use of CPNI outside of the service to

which the customer already subscribes

to from that carrier is valid until the

customer affirmatively revokes or limits

such approval or denial.

(3) A telecommunications carrier’s

solicitation for approval must be

proximate to the notification of a

customer’s CPNI rights.

(4) A telecommunications carrier’s

solicitation for approval, if written,

must not be on a document separate

from the notification, even if such

document is included within the same

envelope or package.

§ 64.2009 Safeguards required for use of

customer proprietary network information.

(a) Telecommunications carriers must

develop and implement software that

indicates within the first few lines of the

first screen of a customer’s service

record the CPNI approval status and

reference the customer’s existing service

subscription.

(b) Telecommunications carriers must

train their personnel as to when they are

and are not authorized to use CPNI, and

carriers must have an express

disciplinary process in place.

(c) Telecommunications carriers must

maintain an electronic audit mechanism

that tracks access to customer accounts,

including when a customer’s record is

opened, by whom, and for what

purpose. Carriers must maintain these

contact histories for a minimum period

of one year.

(d) Telecommunications carriers must

establish a supervisory review process

regarding carrier compliance with the

rules in this subpart for outbound

marketing situations and maintain

records of carrier compliance for a

minimum period of one year.

Specifically, sales personnel must

obtain supervisory approval of any

proposed outbound marketing request.

(e) A telecommunications carrier must

have a corporate officer, as an agent of

the carrier, sign a compliance certificate

on an annual basis that the officer has

personal knowledge that the carrier is in

compliance with the rules in this

subpart. A statement explaining how the

carrier is in compliance with the rules

in this subpart must accompany the

certificate.

[FR Doc. 98–10740 Filed 4–23–98; 8:45 am]

BILLING CODE 6712–01–P