Source: https://www.jdsupra.com/post/documentViewer.aspx?fid=de752e03-3f2d-41e0-bab2-7eda48a1835d
Timestamp: 2017-11-23 03:52:13
Document Index: 224973444

Matched Legal Cases: ['§ 222', '§ 222', '§ 222', '§ 222', '§ 222', '§ 222']

Petition of EPIC for Rulemaking to Enhance Security & Authentication Standards for Access to Customer Proprietary Network Information | In the Matter of Implementation of the Telecommunications Act of 1996 | Electronic Privacy Information Center - JDSupra
In the Matter of Implementation of the Telecommunications Act of 1996
In this proceeding, EPIC and 17 other civil liberties and consumer protection groups filed comments with the FCC urging it to protect the privacy of telephone customers by adopting an opt-in policy towards use of customer information by telecommunications carriers.
The FCC's request for public comments relates to the use by telecommunications carriers of "customer proprietary network information" (CPNI), which includes the name, telephone number, call information and services subscribed to by a telephone customer. In 1998, the FCC promulgated its initial rule regarding CPNI, which required telecommunication carriers to obtain explicit customer approval (opt-in) before using such information in any manner inconsistent with provision of services (for example, building detailed profiles based on personal information obtained through private telephone calls). An alternative approach is opt-out, which enables the carrier to use CPNI until a customer informs it otherwise. The FCC rejected an opt-out approach as insufficiently protective of customer privacy, because opting-out places the burden on the customer, many of whom are wholly unaware of their right to opt-out.
On 04-30-02, EPIC met with representatives of the FCC regarding the pending CPNI rulemaking. Upon the FCC’s request, EPIC provided supplemental materials strengthening the argument that (1) opt-out has failed to protect consumer privacy when implemented in similar regimes, specifically Gramm-Leach-Bliley, and (2) opt-out permits aggrandized information sharing, which can lead to real harms (such as identity theft) to consumers. The FCC released the new CPNI rulemaking on July 16. The Order provides for opt-in—or express consent—customer approval for carriers' release of customer information to third parties, but permits opt-out consent for release of information to affiliated parties and that the Commission will not block or preempt state efforts to further protect CPNI.
Before the Federal Communications Commission Washington, D.C. 20554 In the matter of Implementation of the Telecommunications Act of 1996: Petition for Rulemaking to Enhance Security and Authentication Standards For Access to Customer Proprietary Network Information CC Docket No. 96-115 PETITION OF THE ELECTRONIC PRIVACY INFORMATION CENTER FOR RULEMAKING TO ENHANCE SECURITY AND AUTHENTICATION STANDARDS FOR ACCESS TO CUSTOMER PROPRIETARY NETWORK INFORMATION SUMMARY The Electronic Privacy Information Center (“EPIC”) hereby petitions the Federal Communications Commission initiate a rulemaking proceeding to establish more stringent security standards for telecommunications carriers in releasing Consumer Proprietary Network Information (“CPNI”). CPNI is sensitive information collected by carriers that includes logs of calls that individuals initiate and receive on their phones. Section 222 of the Telecommunications Act makes clear that carriers have the duty of protecting CPNI, with particular emphasis on privacy concerns for personal, individualized data.[1] In implementing Section 222, the Commission has focused on the notice and disclosure requirements necessary to disseminate CPNI data to carrier affiliates and third parties for marketing purposes.[2] However, these efforts did not adequately address third party data brokers and private investigators that have been accessing CPNI without authorization. Data brokers and private investigators are taking advantage of inadequate security through pretexting, the practice of pretending to have authority to access protected records; through cracking consumers' online accounts with communications carriers; and possibly through dishonest insiders at carriers.[3] Prompt Commission action is necessary to insure that individualized CPNI is adequately protected from unauthorized third parties as required by Section 222. In support, EPIC shows the following: 1. That online data brokers and private investigators widely advertise their ability to obtain CPNI without the account holder's knowledge and consent. 2. That strong evidence exists showing the information was not acquired through legal channels. This evidence includes data brokers' advertising guarantees that they can obtain individuals' CPNI in a matter of hours, and that ELECTRONIC PRIVACY INFORMATION CENTER Telecommunications Act of 1996: to Customer Proprietary OF THE ELECTRONIC PRIVACY INFORMATION CENTER TO ENHANCE SECURITY AND AUTHENTICATION TO CUSTOMER PROPRIETARY ("EPIC") hereby petitions the a proceeding for ("CPNI"). CPNI is sensitive information collected by carriers the duty on privacy concerns for personal, individualized data.[ Section 222, the has to disseminate CPNI data to carrier affiliates third 21 these not adequately CPNI without have to access with insiders at carriers.[] Prompt Commission action is necessary CPNI is adequately unauthorized parties Section 222. following: private to obtain CPNI without the account holder's knowledge and consent. showing evidence that they can obtain individuals' Document hosted at http://www.jdsupra.com/post/documentViewer.aspx?fid=de752e03-3f2d-41e0-bab2-7eda48a1835d3. That this unauthorized release of information suggests that the security and identification requirements carriers use to validate the identity of the CPNI requestor is insufficient to prevent unauthorized third parties from acquiring CPNI. 4. That the prevalence of this current practice and the possibility of further exploitation of lenient security standards create a significant privacy and security risk to carrier customers, one that must be addressed by prompt action by the FCC. As a result of these concerns, the Commission should immediately initiate a rulemaking proceeding to (a) conduct an inquiry into the current method of security measures being used to verify the identities of those requesting individual CPNI, (b) to hear public comments in developing a security standard that would adequately address the privacy risks, and (c) establish a security standard by rule that heightens privacy of CPNI. I. Section 222 of the Telecommunications Act requires that telecommunications carriers protect the privacy rights of customers by limiting access to CPNI Congress enacted the Telecommunications Act of 1996, 47 U.S.C. § 222 et. seq., in part to protect consumer privacy.[4] Section 222 of the Act obligates telecommunications carriers to protect the confidentiality of Consumer Proprietary Network Information (“CPNI”).[5] Specifically, section 222(c)(1) states: Except as required by law or with the approval of the customer, a telecommunications carrier that receives or obtains customer proprietary network information by virtue of its provision of a telecommunications service shall only use, disclose, or permit access to individually identifiable customer proprietary network information in its provision of (A) the telecommunications service from which such information is derived, or (B) services necessary to, or used in, the provision of such telecommunications service, including the publishing of directories.[6] CPNI includes calling history and activity, billing records, and unlisted telephone numbers of service subscribers.[7] The Act therefore prohibits carriers from using, disclosing, or permitting access to CPNI without approval of the customer or as otherwise required by law if the use or disclosure is not in connection with the provided service, or listed as one of the exceptions provided for in Section 222(d). In implementing Section 222, the Commission has focused on the notice and disclosure requirements necessary to disseminate CPNI data to carrier affiliates and third parties for marketing purposes.[8] Since the passage of the Telecommunications Act, the Commission has invited public comment and published orders regarding the extent to which carriers can provide aggregate CPNI to company affiliates and third parties, and what amount of customer notice and approval is necessary for providing this information.[9] However, the security standards necessary to protect against unauthorized solicitors pretending to be the customers themselves is an issue that deserves equal scrutiny, but has been inadequately addressed by the Commission thus far. once obtained, the CPNI cannot be used in court. suggests to validate the identity is insufficient of this practice and the possibility of lenient security standards significant carrier customers, by the Commission should immediately the current method of security measures individual by privacy 1. 222 of the Telecommunications Act that telecommunications carriers protect the rights of customers by limiting access to CPNI the Telecommunications Act privacy.L41 confidentiality Proprietary Network Information ("CPNI"). [section 222(c)(1) states: the the customer, or obtains customer proprietary network information of a telecommunications service shall only use, disclose, permit access identifable customer from services to, or used in, the provision of directories.[) and billing records, and unlisted telephone numbers 71 access the the service, as Section 222, the Commission has focused to disseminate CPNI data to carrier affiliates third purposes.[) Since the passage CPNI of approval is necessary for providing this information.[91 to protect against unauthorized solicitors equal scrutiny, by Document hosted at http://www.jdsupra.com/post/documentViewer.aspx?fid=de752e03-3f2d-41e0-bab2-7eda48a1835dII. Congress accorded personal, individualized CPNI the greatest level of protection The Telecommunications Act affects three categories of customer information to which different privacy protections and carrier obligations apply: (a) individually identifiable CPNI (b) aggregate customer information and (c) subscriber list information.[10] Congress afforded personal, individually identifiable information the greatest protection, and only allowed a carrier to disclose or permit access to such information, without customer approval, where necessary for providing telecommunications services, with four exceptions: 1. to initiate, render, bill and collect for telecommunications services 2. to protect the rights or property of the carrier, or to protect users and other carriers from fraudulent or illegal use of, or subscription to, such services 3. to provide inbound marketing, referral or administrative services to the customer for the duration of the call, if the call was initiated by the customer and the customer approves of the carrier’s use to provide such service 4. To provide call location information concerning the user of a commercial mobile service in certain specified emergency situations.[11] III. Unauthorized third parties are taking advantage of inadequate security and identity verification methods at the telecommunications carriers to access and sell individualized CPNI. It is not disputed that carriers can provide individualized CPNI to the customer itself. In fact, every month, customers receive billing statements from carriers outlining their call history and rate charges. Many carriers now even have online account access, designed for customers to conveniently review their past or current account activity, billing information, addresses, etc. Carriers also have toll-free customer service numbers, which customers can call to request lost or misplaced statements and call records. However, the security standards that carriers use to verify the identity of the CPNI requestor have been insufficient to prevent unauthorized third parties from acquiring and exploiting such data for personal and financial gain, providing a significant security loophole through which other privacy and security violations flow. Telecommunications carriers are not responsible for actively disseminating information to unauthorized third parties. Rather, unauthorized third parties have been exploiting security standards at the carriers to access and sell the information acquired through illegal means. Online data brokers are firms that offer private investigation and other data services through Internet websites. These firms charge customers fees based on a graduated scale for the research services they provide, depending on the details of the data sought. Some offer to search for long-lost friends, relatives, or lovers. Others provide services specifically for spouses to spy on each other. Though some of the information these data brokers offer to retrieve and sell are available through public records, other information comes from proprietary sources, some of which is protected from disclosure by privacy statute or regulation. accorded personal, individualized the greatest level of protection of customer information protections information IOA Congress individually information the greatest to such information, for providing and for telecommunications services to protect the rights or property of the carrier, or to protect users use or subscription to, such services to provide inbound marketing, referral or administrative services of carrier's To provide call location information concerning the user a in certain specified emergency situations.[] third parties are taking of inadequate security and identity verification at the telecommunications carriers to access and individualized CPNI. can provide individualized CPNI customer itself. receive billing from carriers outlining carriers now even have online account access, to conveniently review their or current account activity, billing etc. toll-statements that carriers use to verify identity insufficient third from for and financial gain, providing significant fow. Telecommunications carriers are Rather, parties have security standards at the carriers to access means. and other These firms charge customers fees based services they provide, on the details of data sought. for long-or lovers. specifically to spy on each other. of information of Document hosted at http://www.jdsupra.com/post/documentViewer.aspx?fid=de752e03-3f2d-41e0-bab2-7eda48a1835dFor instance, some of these data brokers offer services to retrieve telephone call records. Some will retrieve it with only the telephone number provided, sometimes with turnaround times of 1-2 hours. For example, Intelligent e-Commerce, Inc. (“IEI”), a company that runs the online investigation website bestpeoplesearch.com, will provide detailed call records for the past 100 calls of either a business or residential phone line if the requestor provides the telephone number, name, and address of the account holder. (Attachment A and B are complaints to the Federal Trade Commission concerning this company.) Though IEI specifies 1 to 5 days as necessary to retrieve the records, another data broker, Infonowusa.com offers a 1 to 3 hour turnaround time for detailed cell phone call records. (Attachment C is a list of an additional 40 web sites offering to sell CPNI to third parties.) These telephone call records are protected as CPNI under the Telecommunications Act, and particularly protected as individually identifiable CPNI (as opposed to aggregate customer information or subscriber list information). These online private investigators do not reveal how they actually obtain this information. However, EPIC is aware of no legal way to reliably and quickly obtain call detail information. Nor does it appear possible for them to reliably obtain this information within the time frames they claim without making misrepresentations (pretexting) to telecommunications carriers or soliciting the carriers to violate the Telecommunications Act. Additionally, two professional licensed investigators were quoted agreeing with EPIC’s assessment in recent media reports: [Francie] Koehler, who was part of a project to research online private investigations services, said, “I know that many of them claim to get the information legally. I don’t understand how that happens.” When she’s tried to get someone’s phone records via subpoena, she said, “Every time you try, they send the telephone company lawyer in to quash the subpoena.”[12] Washington Post journalist Jonathan Krim quoted Robert Townsend, an advocate of investigator licensure and best practices: “I do not know of any legal way to obtain a person’s telephonic history,” Robert Townsend, head of the National Association of Legal Investigators, said in an interview. Townsend added that he thinks only a small minority of licensed investigators engage in the practice of acquiring and selling the data. [13] In addition to providing suspiciously fast "turn around times," many also represent that the information provided is “confidential” and not admissible in courts. In some cases, the sites specify that the client must employ a legal method, such as a subpoena, for obtaining the same data if the client wants to use the information in court. These practices suggest that no official process is being employed to obtain the records legally. It also appears that these violations are occurring at an alarming rate. The cost building the infrastructure to offer call record data is substantial, yet many companies offer to sell this data. These companies must maintain a website, have contacts with investigators in many states, and process transactions quickly (some as quickly as 1-2 hours). There is a risk that there will be no “hit,” resulting in the online data broker performing services without compensation. Many sites offer this service through “sponsored links” on popular search brokers will only the telephone ("IEI"), a company that com, will or Though JET phone records. offering call protected as CPNI under the Telecommunications protected identifiable CPNI (as opposed to aggregate These online private investigators However, EPIC is aware Nor does it appear possible the misrepresentations (pretexting) to telecommunications carriers or soliciting the carriers to Additionally, two professional licensed investigators were quoted agreeing with EPIC's in "I don't understand how that happens." she's someone's she said, "Every time subpoena."[of and "any person's history," of National Townsend he thinks only a small minority of the data. I providing suspiciously fast "turn around times," many also represent "confdential" and not admissible in courts. In some cases, the sites a legal method, such for data if the information These practices suggest process that these violations are occurring at an alarming rate. call record data contacts with and process transactions quickly (some as quickly as 1-2 hours). "hit," resulting in the online data service "sponsored links" on popular search Document hosted at http://www.jdsupra.com/post/documentViewer.aspx?fid=de752e03-3f2d-41e0-bab2-7eda48a1835dengines and other forms of online advertising, further adding to the cost of offering the data. Combined, these factors and the large number of entities offering call records online suggests that many individuals’ phone records are being illegally access and sold every day to simply cover the cost of doing business. Telecommunications carriers are the primary source of CPNI; therefore, they should be the first line of defense against these practices of illegitimately accessing and selling CPNI. Through Section 222, Congress specifically placed the burden of protecting CPNI in their hands.[14] The Commission has recognized the importance of CPNI security, particularly with regards to the requirements for customer notification in releasing such information to allowed parties under Section 222. It is therefore alarming that these online data brokers are gaining access to these call records without the customers’ consent or even knowledge. Regardless of how illegitimate the practices of the online data brokers may be, they would not be possible were it not for loopholes in the security measures that telecommunications carriers use to verify the identity of the CPNI requestor. Carriers may be contributing to this practice by only requiring a few pieces of easily-obtained biographical information (such as date of birth, mothers maiden name, or the Social Security number) to change the addresses on the phone records or requesting call history data. This type of biographical information can be easily obtained by a third party through public records and used to gain access to CPNI. Many different websites have millions of records on date of birth. And online data brokers often have access to other databases to purchase Social Security numbers or dossiers that would contain the mother's maiden name. IV. The prevalence of this practice poses a significant privacy and security risk for telecommunications customers. Individuals are likely to suffer injury as a result of these ongoing practices of selling CPNI. The release of such information without a customer’s knowledge can lead to devastating results and create serious consequences in the area of personal privacy. With the advent of cellular phones, call records contain some of the most sensitive and private information an individual may have. Phone records can be used to track an individual’s daily habits, to spy on a person’s communications with others, or to stalk another person. We are also aware of data brokers who offer location tracking services for wireless phone users, even though this information, under Section 222(d), is only supposed to be used for authorized emergency purposes (See services of CSI, Attachment C).[15] Furthermore, if online data brokers are acquiring their information by accessing customers’ online accounts, they might also have access to the individual’s billing address, credit card information, and even their social security number. These pieces of personal information are so often used in security verification for other services that possessing this information would put the online data broker in complete control of the individual’s electronic identity. Individual phone records are not the only ones at risk. Some websites claim to be able to access any phone record with only a phone number, name, and address. Some even boast the ability to provide business telephone records (See Attachment C). Given the prevalence of phones, both wired and wireless, used for business purposes, these services could be (and most likely are being) used for industrial espionage and other illicit business activities. Business phone records yield sensitive information about client lists and contact information, resulting in privacy violations both for the businesses and the people that those and other forms of online large number of entities offering that many individuals' phone access cover the cost doing business. of defense of illegitimately accessing specifically the burden of protecting CPNI 141 recognized the importance of CPNI security, particularly for notification information It is therefore alarming that these online data call without customers' of the security measures to verify biographical information of on the phone records or requesting call history data. This type can records and to CPNI. millions on date of birth. ofen have access other databases Social prevalence of this practice poses a privacy and security risk for customers. to suffer injury as a result of these of information a customer's can serious consequences in the area of personal privacy. With of and private information may have. Phone records to track an individual's person's tracking services for wireless phone users, under Section 222(d), is only supposed be (services of CSI, Attachment C).[15] online data brokers by accessing customers' accounts, also to the individual's address, These are for other services this information individual's phone records Some any phone record with to provide business Attachment C). the and wireless, used business purposes, are espionage illicit business records yield information resulting in privacy violations both for the businesses and the people that Document hosted at http://www.jdsupra.com/post/documentViewer.aspx?fid=de752e03-3f2d-41e0-bab2-7eda48a1835dbusinesses have contacted. While the Commission has tried to balance competition, access, and privacy rights in determining the best method with which to enforce Section 222, the types of privacy violations described here are unauthorized, unwarranted, and serve more to promote security breaches and industrial sabotage than competition. Furthermore, these business are operating online, and provide these data brokerage services readily at the submission of an Internet form and upon receipt of payment. They do not actually meet their clients and assess the clients’ intent in trying to access these records. They have no way of screening out clients who desire access to such phone records for malicious purposes. Therefore, weak security standards may also pose as a security threat to the very customers whose privacy the Commission is striving to protect. V. The Federal Communications Commission should immediately initiate a rulemaking proceeding to address the CPNI protection measures used by telecommunications carriers and invite comment to develop adequate safeguards for verifying the identity of parties trying to access CPNI. Given the privacy and security issues at stake in this matter, the Commission should immediately initiate a rulemaking proceeding to investigate the following issues: 1. What security measures telecommunications carriers currently have in place for verifying the identity of people requesting CPNI. 2. What inadequacies currently exist in those measures that allow third parties outside of the realm of Section 222, such as online data brokers and private investigators, to access individual CPNI without the customer’s knowledge or authorization. 3. What kind of security measures are warranted to better protect telecommunications customers from unauthorized access to personal and individualized CPNI. Some forms of security measures that would more adequately protect access to CPNI might include the following: 1. Consumer-set passwords. Currently, there is a reliance on biographic identifiers, such as the Social Security Number and date of birth, to authenticate individuals. These biographic identifiers are inadequate for authentication, because, unlike passwords, they do not change, and they are widely available. A unique and separate password chosen by the account holder at the time of phone activation would greatly increase security of CPNI. 2. Audit trails. Carriers should be under a duty to record all instances where a customer's record is accessed, whether there has been a disclosure of information, and to whom the information has been disclosed. Audit trails deter insiders from selling personal information, and once data is accessed without authorization, audit trails aid in investigating the security breach. 3. Encryption. When stored at the carrier, data should be encrypted. While audit trails help protect against insider abuse, encryption assists in protecting data have contacted. has balance access, the to enforce violations described here are unwarranted, these of clients and assess clients' in trying to access these who desire access Therefore, weak security standards may also pose privacy Federal Communications Commission immediately initiate a rulemaking proceeding to the CPNI protection measures used by carriers and invite comment to adequate safeguards for verifying the identity of trying to access CPNI. in a proceeding issues: telecommunications currently the of people requesting What inadequacies currently exist in those measures individual customer's What kind of security measures are warranted customers unauthorized access to CPNI passwords. such These biographic identifiers are inadequate unlike they widely and by the account holder at the time Audit trails. Carriers should be under a duty to record all instances where been a disclosure of disclosed. personal and once data is accessed aid in investigating the security breach. Encryption. When stored at the carrier, data Document hosted at http://www.jdsupra.com/post/documentViewer.aspx?fid=de752e03-3f2d-41e0-bab2-7eda48a1835dfrom security threats outside the corporation. 4. Notice to affected individuals and the Commission when there is a security breach. In many other sectors, companies must notify individuals if a security breach results in their personal information being accessed by an unauthorized person. This allows individuals to mitigate harm from the breach, and assists in the public in understanding whether data are actually secure. 5. Limiting Data retention. Call detail records should be deleted after they are no longer needed for billing or dispute purposes. Alternatively, carriers should be required to deidentify records, that is, divorce identification data from the transactional records. This will allow carriers to maintain call records for data analysis, but reduce the risk that the same records will be associated with an account holder and used to invade privacy. Respectfully Submitted, Chris Jay Hoofnagle Senior Counsel August 30, 2005 [ 1] 47 U.S.C. § 222 et. seq. [2] See, e.g., Third Report and Order and Third Further Notice of Proposed Rulemaking, 17 F.C.C. Rcd 14860 (July 25, 2002). [3] Jonathan Krim, Online Data Gets Personal: Cell Phone Records for Sale, Washington Post, Jul. 8, 2005, available at http://www.washingtonpost.com/wpdyn/content/article/2005/07/07/AR2005070701862_pf.html. [4] SeeThird Report and Order and Third Further Notice of Proposed Rulemaking, 17 F.C.C. Rcd 14860, 14862 (2002). [5] 47 U.S.C. 222(c). [6] 47 U.S.C. § 222(c)(1). [7] Section 222(f)(1) of the Telecommunications Act defines CPNI as follows: (A) Information that relates to the quantity, technical configuration, type, destination, and amount of use in a telecommunications service subscribed to by an customer of a telecommunications carrier, and that is made available to the carrier by the customer solely by virtue of its carrier-customer relationship; and (B) Information contained in the bills pertaining to telephone exchange service or telephone toll service received by a customer of a carrier; [ 8] See, e.g.,Third Report and Order and Third Further Notice of Proposed Rulemaking, 17 F.C.C. Rcd 14860, 14862 (2002). threats Notice to affected individuals and the Commission when there must notify individuals being accessed allows individuals to mitigate harm from the breach, and assists understanding whether data are secure. Limiting Data retention. Call detail records should be deleted after they are for billing carriers should allow carriers to maintain call records records will et. seq. 21 e.g., Third Report and Order and Third 31 Krim, Phone Post, Jul. 8, 2005, available at http://www.washingtonpost.com/wpdyn/07/07/AR2005070701862pf 5147 L6] 47 U.S.C. § 222(c)(1). 71 222(f)(Act defnes Information that relates to the quantity, confguration, Information contained in the bills pertaining to telephone exchange 8 1 See, e.g.,Third Report and Order and Third Further Notice of Rulemaking, Document hosted at http://www.jdsupra.com/post/documentViewer.aspx?fid=de752e03-3f2d-41e0-bab2-7eda48a1835d[9] Id. [10] See 47 U.S.C. 222(h) (providing specific definitions of each category of information). [11] 47 U.S.C. § 222(d). [12] Susan Kuchinskas, EPIC Fighting Online Phone Record Sales, InternetNews, July 8, 2005, available at http://www.internetnews.com/ent-news/article.php/3518851. [13] Jonathan Krim, Online Data Gets Personal: Cell Phone Records for Sale, Washington Post, Jul. 8, 2005, available at http://www.washingtonpost.com/wpdyn/content/article/2005/07/07/AR2005070701862_pf.html. [ 14] See 47 U.S.C. § 222(c)(1). [15] Section 222(d)(4) of the Telecommunications Act provides that the location of a cellular phone should only be revealed in the following instances: (A) to a public safety answering point, emergency medical service provider or emergency dispatch provider, public safety, fire service, or law enforcement official, or hospital emergency or trauma care facility, in order to respond to the user's call for emergency services; (B) to inform the user's legal guardian or members of the user's immediate family of the user's location in an emergency situation that involves the risk of death or serious physical harm; or (C) to providers of information or database management services solely for purposes of assisting in the delivery of emergency services in response to an emergency. EPIC Privacy Page | EPIC Home Page Last Updated: August 29, 2005 Page URL: http://www.epic.org/privacy/iei/cpnipet.html 91 Id. LUO See 47 U.S.C. 222(h) (providing specific definitions of L U2 Susan Kuchinskas, EPIC Fighting internetnews.[13] Jonathan Krim, Online Data Gets Personal: Cell Phone Records for Sale, Washington available at http://p£47 U.J Section 222(d)(4) of the Telecommunications Act provides that the instances: safety dispatch provider, public fre or hospital emergency in order to respond the user's guardian members of the user's situation that involves risk information or database solely of emergency services response Page I August 29, 2005 URL: http://cpnipet.htmI Document hosted at http://www.jdsupra.com/post/documentViewer.aspx?fid=de752e03-3f2d-41e0-bab2-7eda48a1835d