Source: http://cybertelecom.org/ci/cpni.htm
Timestamp: 2019-04-22 10:32:27+00:00

Document:
CPNI originated as a Computer Inquiry safeguard of competition in the information services market. The safeguard acknowledged that telephone company (monopolies), upon which information services depended for telecommunications, possessed certain sensitive customer information that could be used for unfair commercial benefit. The knowledge of what telecommunications a customer might be consuming gave the telephone companies an opportunity to market new products to customers. If the telephone company knew that a customer was ordering DSL, but not getting internet service from the telephone company, the telephone company (frequently through the guy who showed up at the door of the customer with a truck in order to install the service) could market the telephone company's service over the independent ISPs. The FCC concluded that this was anticompetitive, and indicated that telephone companies could use information acquired from the sale of telephone service only for the purpose of marketing telephone service; the telephone company could not use that information to market non-regulated information services.
CPNI was codified by the Telecommunications Act of 1996, but as with many things, not exactly as it had been in the Computer Inquiries. CPNI became privacy regulation - not for the benefit of competitive services - but for the benefit of the customer.
CPNI rules have been applied to VoIP.
to (1) make CPNI available, upon customer request, to unaffiliated enhanced service vendors, on the same terms and conditions that are available to their own enhanced services personnel; (2) limit their enhanced services personnel from obtaining access to a customer's CPNI if the customer so requests; and (3) notify multi-line business customers annually of their CPNI rights.
In addition, the Commission prohibited BOCs and GTE from providing to its affiliated ESP "any customer proprietary information unless such information is available to any member of the public on the same terms and conditions." 47 C.F.R. § 64.702(d)(3).
In 1996, Congress passed the new Privacy of Customer Information provision, codified as Section 222 of the Communications Act. 47 U.S.C. § 222. Section 222 contains the restrictions on the use of customer information by all carriers, not just BOCs. This includes Customer Proprietary Network Information and Carrier Information.
The FCC concluded that Section 222 replaced "the Computer III CPNI framework in all material respects," however, the Order where the FCC made that conclusion was vacated by a federal appeals court.
(B) information contained in the bills pertaining to telephone exchange service or telephone toll service received by a customer of a carrier.
Compare "subscriber list information" to WHOIS and ECPA "Basic Subscriber Information."
47 U.S.C. § 222(c)(1). In other words, information gathered in order to provide telecommunications service can be used only for the provision of that service. A carrier could not use the information it has gathered from providing telephone service in order to market Internet services. The key exception is whether the carrier has the approval of the customer to use that information for other purposes.
It is important to understand that these rules only apply where information is derived from the provision of telecommunications services; it does not apply where the LEC is providing non-telecommunications services such as Internet services.
47 U.S.C. § 222(b). In 1998, the Commission promulgated rules implementing Section 222 of the Communication Act. See 47 C.F.R. § 64.2005. U.S. West filed an appeal concerning the FCC rules with the Tenth Circuit Court of Appeals, which vacated the FCC rules as violating the First Amendment. U S WEST, Inc. v. FCC, 182 F.3d 1224 (10th Cir. 1999), cert. denied, 120 S.Ct. 2215 (2000).
Where does this leave CPNI? The FCC rules implementing Section 222 have been vacated; Section 222 has not been vacated and remains binding. Furthermore, since the FCC's Section 222 rules were vacated, the previous FCC's Computer III CPNI rules remain in place.
 Joint Petition, ¶ 46. See also Ameritech's CEI Plan, ¶ 41; GTE ONA, Bell Atlantic's CEI Plan;ONA Review, ¶ 25, 398-447.
 US West v. FCC, Docket 98-9518, 182 F.3d 1224 (10th Cir. Aug 18, 1999), cert. denied sub. nom Competition Policy Institute v. U.S. West, Docket 99-1427, 120 S. Ct. 2215 (S.Ct. June 2000).
 See CPNI, supra note 2; In re Implementation of the Telecommunications Act of 1996 Telecommunications Carriers' Use of Customer Proprietary Network Information and Other Customer Information; CC Docket No. 96-115, CC Docket No. 96-149, Order on Recon and Petitions for Forbearance, 46-47 (September 3, 1999) (hereinafter CPNI Recon) (concluding that the provision of Internet services is not necessary to the provision of telecommunications service).
See CPNI Recon, supra note 3, ¶ 159; In re Implementation of the Telecommunications Act of 1996: Telecommunications Carriers' Use of Customer Proprietary Network Information and Other Customer Information, CC Docket No. 96-115, Order ¶ 1 (CCB May 21, 1998).
The FCC's Broadband Privacy rules were promulgated in 2016. The FCC's vote was along party lines (3 democrats; 2 republicans).
The Congressional Resolution repealing the FCC's Broadband Privacy rules was along party lines.
Congress decided that there should be different agencies regulating different segments of the economy.
The FCC regulates common carriers (Verizon, AT&T, Charter, Sprint, Centurylink, Frontier...) pursuant to the Communications Act of 1934.
The FTC regulates general firms in the market except for those specifically regulated by other agencies - like common carriers regulated by the FCC.
This means there are different rules for different firms because of the laws and agencies Congress created. The agencies promulgate regulation pursuant to the authority given to them by Congress (they dont create the jurisdictional difference).
The FCC promulgated Broadband Privacy rules that covered Broadband Internet Access Service providers; other companies like Facebook, Twitter, Microsoft and other Internet companies continue to fall under different FTC authority. Having different rules for different categories of firms is not uncommon, particularly given the different authorities enacted by Congress.
It is not uncommon to have a government attempt to solve part of a problem even though it cannot solve an entire problem.
The FTC lacks jurisdiction over firms with the status of common carriers. In other words, if a firm has common carriage as some part of its business plan, the FTC lacks jurisdiction, even if that is not the conduct in question. If AT&T is selling hotdogs out of a cart, the FTC lacks jurisdiction because AT&T is a common carrier in some other part of its business plan. Verizon, AT&T, Charter, Sprint, Centurylink, Frontier... are common carriers in other parts of their business plans beyond Broadband Internet Access Service, therefore are outside FTC jursdiction.
The Broadband Privacy rules did not declare that Broadband Internet Access Service providers were common carriers and did not remove jurisdiction from the FTC.
The 2015 Open Internet rules did rule that Broadband Internet Access Service providers were telecom services (aka common carriers). However, this did not remove jurisdiction from the FTC. Most Broadband Internet Access Service Providers are also telecom services. Since they have telecom services as some part of their business plan, the FTC lacks jurisdiction over them. The only agency that could exercise jurisdiction over these broadband Internet Access Services is the FCC.
Providing for congressional disapproval under chapter 8 of title 5, United States Code, of the rule submitted by the Federal Communications Commission relating to ``Protecting the Privacy of Customers of Broadband and Other Telecommunications Services''.
Resolved by the Senate and House of Representatives of the United States of America in Congress assembled, That Congress disapproves the rule submitted by the Federal Communications Commission relating to ``Protecting the Privacy of Customers of Broadband and Other Telecommunications Services'' (81 Fed. Reg. 87274 (December 2, 2016)), and such rule shall have no force or effect.
FCC TAKES STEP TOWARDS ENSURING CONSUMERS HAVE UNIFORM ONLINE PRIVACY PROTECTIONS.
PROTECTING THE PRIVACY OF CUSTOMERS OF BROADBAND AND OTHER TELECOMMUNICATIONS SERVICES/FCC GRANTS TEMPORARY STAY OF DATA SECURITY REGULATION FROM BROADBAND PRIVACY ORDER. Grants the Stay Petition in part, and stays on an interim basis one aspect of the requirements adopted in the 2016 Privacy Order related to data security. (Dkt No. 16-106 ). Action by: the Commission. Adopted: 03/01/2017 by ORDER. (FCC No. 17-19).
THE WIRELINE COMPETITION AND CONSUMER AND GOVERNMENTAL AFFAIRS BUREAUS SCHEDULE PUBLIC WORKSHOP ON BROADBAND CONSUMER PRIVACY. News Release.
1. We resolve in this Order several issues in connection with carriers' use of customer proprietary network information ("CPNI") pursuant to section 222 of the Telecommunications Act of 1996.1 Through section 222, Congress recognized both that telecommunications carriers are in a unique position to collect sensitive personal information including to whom, where and when their customers call and that customers maintain an important privacy interest in protecting this information from disclosure and dissemination. The rules we adopt today focus on the nature of the customer approval needed before a carrier can use, disclose or permit access to CPNI. In formulating the required approval mechanism described below, we carefully balance carriers' First Amendment rights and consumers' privacy interests so as to permit carriers flexibility in their communications with their customers while providing the level of protection to consumers' privacy interests that Congress envisioned under section 222.
4. Finally, we accompany this Order with a Further Notice of Proposed Rulemaking ("Further NPRM") to refresh the record on two issues raised in the CPNI Order Further NPRM: foreign storage of and access to domestic CPNI, and CPNI safeguards and enforcement mechanisms. We additionally request comment on what, if any, appropriate regulations should govern the CPNI held by carriers that go out of business, sell all or part of their customer base, or seek bankruptcy protection.
US West v. FCC, Docket 98-9518, 182 F.3d 1224 (10th Cir. Aug 18, 1999), cert. denied sub. nom Competitive Policy Institute v. U.S. West Docket 99-1427, 530 U.S. 1213 (S.Ct. June 2000).
AT&T Petition for Review, AT&T v. FCC, No. 99 1413 (D.C. Cir., July 25, 2000) .
On May 17, 1999, the Common Carrier Bureau issued an Order extending the date on which the petitions requesting forbearance filed shall be granted in absence of a Commission decision that petitions fail to meet the standards for forbearance under section 10(a) of the Act, until 8/16/1999.
"On September 3, 1999, the Commission released an Order on Reconsideration and Petitions for Forbearance [Text Version][Word Perfect Version] that simplified the rules that telecommunications carriers (both wireline and wireless companies) must follow to use customer proprietary network information (CPNI), while retaining the privacy protections for carriers' customers. CPNI is the information a telecommunications carrier obtains about a customer that relates to the quantity, technical configuration, type, destination, and amount of use of a telecommunications service subscribed to by that customer. In other words, information about whom you call, when you call, how long you talk and how you communicate."Section 222 of the Communications Act of 1934, as amended, establishes CPNI privacy requirements by restricting all telecommunications carriers' use or disclosure of a customer's CPNI. To implement section 222, the FCC adopted regulations in the CPNI Second Report and Order on February 26, 1998. Some companies argued that these regulations were overly burdensome and requested that the FCC reconsider, clarify, and/or forbear from enforcing parts of those regulations. The Commission adopted the Order on Reconsideration to address those arguments.
"The Order on Reconsideration lessened the regulatory burden of various CPNI safeguards, while continuing to require that carriers protect customer privacy. Specifically, the FCC reduced the restriction on telecommunications companies' use of CPNI to market services and equipment to their own customers. For example, telephone companies will be able to use CPNI to market to their customers equipment that is necessary to, or used in, the provision of their telephone service, such as telephones and caller ID units, without first obtaining customer permission. The FCC allowed wireline telephone carriers to use CPNI without customer approval to market related information services. Wireless carriers were awarded broader discretion to use CPNI without customer approval to market all information services that are necessary to, or used in, the provision of their telecommunications services. The FCC also allowed all telecommunications companies to use CPNI in their efforts to "win back" customers lost to competitors, reasoning that "winback" campaigns are good for competition and consistent with the Act.
"The Commission also modified its requirement that carriers develop and implement software that indicates a customer's CPNI approval status within the first few lines of the first screen of a customer's service record. Now, carriers must clearly establish the status of a customer's CPNI approval prior to the use of CPNI, but the specific details of compliance are l eft to the carriers. In so doing, the FCC allowed the carriers the flexibility to adapt their record keeping systems in a manner most conducive to their individual size, capital resources, culture and technological capabilities. The FCC also eliminated the requirement that carriers maintain an electronic audit mechanism that tracks access to customer accounts. Instead, the FCC required carriers to maintain a record of their sales and marketing campaigns that use CPNI. "The FCC addressed various issues concerning a customer's approval to use CPNI consistent with section 222, including authorizations obtained by carriers from customers prior to the release of the FCC's CPNI rules. The FCC also eliminated that section of its rules that required a carrier's solicitation for approval, if written, to be on the same document as the carrier's notification. Further, the FCC affirmed its decision to exercise its preemption authority on a case-by-case basis for state rules that conflict with the FCC's rules.
On September 24, 1998, the Commission extended the deadline for implementation of electronic safeguards to protect against unauthorized access to CPNI until six months after release of a FCC order on reconsideration addressing this issue.
On May 21, 1998, the Common Carrier Bureau issued an Order clarifying that (1) independently-derived information regarding customer premises equipment and information services is not CPNI and may be used to market CPE and information services to customers in conjunction with bundled offerings; (2) a customer's name, address and telephone numbers are not CPNI; and (3) a carrier is deemed to have met the notice and approval requirements when it provided annual notification, and obtained prior written authorization, pursuant to the FCC's former CPNI rules.
In an FNPRM released on February 26, 1998, the Commission asked for additional comment on three issues involving carrier duties and obligations established under sections 222: whether a customer may restrict carrier use of CPNI for all marketing purposes; the appropriate protections for carrier information and additional enforcement mechanisms the Commission may apply; and the foreign storage of, and access to, domestic CPNI. This phase of the proceeding remains pending.
In the Matter of Implementation of the Telecommunications Act of 1996: Telecommunications Carriers' Use of Customer Proprietary Network Information and Other Customer Information, Notice of Proposed Rulemaking, 11 FCC Rcd 12513 (1996).
"In the Order, the Commission also resolved certain issues relating to telephone directory publishing, including extending rights to subscriber list information at nondiscriminatory and reasonable rates to publishers of telephone directories on the Internet. The Commission also concluded that publishers of telephone directories on the Internet should not be restricted in the manner in which they display or allow customers to access the data."
"12. The third remaining issue concerns itself with the privacy and security of data stored in computers that are interconnected with common carrier communications lines. As indicated in our Supplemental Notice of Inquiry, we do not believe that the Commission's concern is coextensive with the entire range of problems which stem from the potential invasion of privacy, where information can be stored and illicitly retrieved from a computer, even though the storage and retrieval through communications facilities (Supplemental Notice of Inquiry, 7 FCC 2d 19, Paragraph 11, at 22 (1967)). The privacy issue in its broadest sense has numerous social and public policy implications which go well beyond the pale of our jurisdiction over communications and which have already been the subject of Congressional studies and hearings, as well as a matter of concern and analysis by social scientists, lawyers and computer engineers. In this connection, we note that the National Academy of Sciences is conducting an investigation of public and private data banks to determine the magnitude of the threat to individual privacy.
"13. The Commission, of course, does have a fixed and continuing responsibility with respect to the privacy and integrity of intelligence traversing the communications networks of this country, as well as with the possible use of such facilities for unlawful purposes. As we indicated in our First Report, we intend to give further consideration to the needs which may exist in this area and to the regulatory actions which may be required. We also recognized the need to obtain more information regarding present and future needs and the technical, operational and economic implications, as a basis for such further consideration. "
L.I. Krause, Analysis of Policy Issues in the Responses to the FCC Computer Inquiry, Report No. 7379B-2, Stanford Research Institute (Feb. 1969) (p. 15: "Technological and procedural methods for maintaining information privacy are in use and under development. Such methods can raise the costs of invading privacy but will also raise the costs of protected information services.
47 CFR § 64.2005 (1999) (vacated) Use of customer proprietary network information without customer approval.

References: § 64
 § 222
 § 222
 § 222
 § 64
 v. 
 v. 
 v. 
 v. 
 v. 
 v. 
 § 64