Telecom Law Monitor : Washington D.C. Telecom Lawyer & Attorney : Kelley Drye & Warren Law Firm : New York, Chicago, Connecticut, New Jersey, Brussels

Public Notice Seeking Comments. While the FCC has been active in protecting CPNI both from a rulemaking and enforcement perspective, it has not taken significant action on the policy/rulemaking front since its 2007 rule changes to address pretexting (pretending to be a customer or other authorized person to obtain access to that customer’s private communication records).  At that time, the FCC adopted a Further Notice of Proposed Rulemaking to address the obligations of mobile carriers to secure the privacy of customer information stored on mobile devices.  At the time, most carriers indicated that consumers control the information residing on their devices.  However, late last year several large wireless carriers responded to inquiries from Senator Al Franken and acknowledged using software embedded or pre-installed on wireless devices to collect information about the performance of the devices and the provider’s network. 

Although several large wireless carriers have stated that the information gathering is used to collect information about their networks from the perspective of users’ devices, the FCC is concerned about whether consumers are given meaningful notice and choice with respect to the collection of this data.  In the Public Notice, the FCC is seeking input from industry and consumers on a series of questions designed to refresh the record for the purpose of potentially issuing a declaratory ruling clarifying carriers’ obligations with respect to information collected from and stored on mobile devices. The specific questions the FCC on which the FCC seeks comment include a set of broad questions that carry themes reflective of recent Administration and FTC activity with respect to mobile applications privacy. These themes, include transparency, notice and consent, data security, as well as “privacy by design”.  The FCC also asks for comment on how the following factors, if at all, impact a mobile carrier’s obligations under the CPNI rules to protect the privacy of customer information:

• Whether the device is sold by the service provider;
• Whether the device is locked to the service provider’s network;
• The degree of control that the service provider exercises over the software that collects or stores information from the device;
• The service provider’s role in connection with the device’s operating system, pre-installed software or security capabilities;
• The manner in which the information is used;
• Whether the information pertains to voice service, data service, or both; and
• The role of third parties in collecting and storing data.

Comments will be due 30 days after publication in the Federal Register and replies will be due 15 days later. 

FCC Staff Report on Location-Based Services. On Friday, the FCC also released its long-anticipated report on LBS. The Staff Report notes that the FCC has decades of experience in protecting consumer privacy, and that, as the expert agency on communications and broadband networks, the agency in conjunction with its federal partners in the Executive Branch and at other independent agencies, has an important role in protecting consumer privacy in the future. LBS offer many conveniences to consumers and are gaining in popularity. However, it cautions that LBS “have the inherent ability to create accurate snapshots of their users’ activities that can contain very personal information.”  As such, the Staff Report expresses caution in the use and monitoring of LBS. It identifies the FCC’s goals in monitoring LBS to be three-fold: ensuring that personal information is protected from misuse and mishandling, requiring providers to be transparent about their practices, and enabling consumer control and choice.

The Staff Report does not make any specific recommendations or propose best practices for carriers.  Instead, it offers a useful overview of the FCC’s role in privacy regulation and enforcement, the LBS market, the FCC’s June 2011 Forum on LBS, and privacy issues for LBS, and provides commentary on issues it will be monitoring:

• Consideration of Privacy Issues at Earliest Stages of Product Development. What are the most effective means to ensure privacy considerations become an integral part of the product design and development process for all players in the LBS industry? What should consumers be told?
• Security of data. What are the rights, duties, and obligations of the parties that generate, aggregate, or hold LBS-related data to secure such data from unauthorized disclosure or access? Do they vary as a result of a party’s relationship with the customer?
• Timing and sufficiency of notice. How much information should be pushed to consumers at different points in their interaction with an LBS, mobile, application or other provider and how should it be presented? Must the information be provided each time an application or service is used? Should there always be an opt out?
• Data Minimization. Should parties be encouraged to collect the minimal amount of data technically required to provide a location-based service and retain that data for the minimum amount of time necessary?

The Staff Report concludes with the admonishment that the FCC may take action, “if privacy issues are not met as effectively and comprehensively as possible or within reasonable time frames.”

The FTC case was initiated in May of 2011 against Millennium Telecard, Inc. and related entities.  The FTC complaint alleged that Millennium made inaccurate claims about the number of minutes calling cards provided to a wide range of international locations, including Argentina, Brazil, the Dominican Republic, Ecuador, Mexico, Pakistan, Poland, Vietnam, Ghana, Nigeria, and El Salvador.  But the FTC alleged that consumers didn't receive the number of minutes advertised. Much of the FTC's case was based on test calls made by the agency, which, it claimed, showed that consumers received only 45% of the advertised minutes. 

The FTC asserted that Millennium violated the FTC act by failing to provide the advertised minutes and (in a claim similar to that made by the FCC in its section 201(b) cases) that Millennium failed to adequately disclose the fees applicable to the cards.  The FTC complaint did not explain in detail the failure to disclose claim, but its discussion of Millennium posters and cards suggested that the statements of fees were in fonts that were too small and were not prominently placed. 

In the settlement agreement, Millennium agrees to two injunctive provisions that require it to clearly and conspicuously disclose all material fees.  It also agrees to pay a fine of $2.32 million to resolve the case.  However, Millennium pays only a $500,000 installment now, and is obligated to pay the remaining $1.82 million over ten years, in ten annual installments (plus interest).  The ten year installment is quite unusual, as is the defendants' grant of a lien on property as collateral for the installment payment. 

This case serves as a reminder that prepaid calling card providers and marketers should closely review their marketing practices to ensure that all material terms are clearly and conspicuously disclosed in their marketing materials.

 According to the FTC, not all businesses abide by the these Caller ID requirements. Recent FTC cases have charged telemarketers pitching fraudulent extended auto warranties and credit card interest rate reduction programs with violating the Caller ID requirements. The FTC’s request for comments notes that “spoofing” or manipulating Caller ID names and numbers may become more common as telemarketers increasingly use advanced telecommunications technologies. The FTC’s Notice details specific areas of inquiry but does not propose specific rule changes. It can be found here. Those interested in filing public comments on the issue must do so by Friday, January 28, 2011.

Truth in Caller ID Act.  On December 22, President Obama signed into law the Truth in Caller ID Act of 2009 [sic].  The Act makes it unlawful for any person to cause any caller ID system "to knowingly transmit misleading or inaccurate caller identification information with the intent to defraud, cause harm, or wrongfully obtain anything of value."  The prohibition applies to caller ID used in connection with both telecommunications services and IP-enabled services (VoIP).

The FCC has 6 months to enact regulations to implement the prohibition.  In addition, the FCC must submit a recommendation whether additional legislation is necessary to prohibit the provision of inaccurate caller ID information in technologies that are successors to traditional telecommunications or VoIP.

FTC Rulemaking to Strengthen Caller ID.  On December 7, the FTC released a public notice seeking comment on ways to strengthen the caller ID provisions of its Telemarketing Sales Rule (TSR).  According to the FTC, "spoofing" has become more common and it is seeking comment on ways to strengthen the rules to prohibit the practice.  The FTC specifically identified the following issues for comment:

* How widespread is consumer use of Caller ID services to screen unwanted calls, and do consumers use other services that rely on the transmission of calling party numbers (CPN), such as call-blocking equipment, to avoid unwelcome telemarketing calls?
* Would changes to the Telemarketing Sales Rule improve the ability of Caller ID services to accurately disclose the source of telemarketing calls or improve the ability of service providers to block calls in which information on the source of the call is not available, or has been spoofed?
* Should the FTC amend the Caller ID provisions of the Rule to recognize or anticipate specific developments in telecommunications technologies relating to the transmission and use of Caller ID information, and if so, how?
* Should the FTC amend the Caller ID provisions of the Rule to further specify the characteristics of the phone number that a telemarketer must transmit to a Caller ID service? For example, should the Rule require that the phone number transmitted be one that is listed in publicly available phone directories, a number with an area code and prefix that are associated with the physical location of the telemarketer’s place of business, a number that is answered by a live representative, or automated service that identifies the telemarketer by name?
* Should the FTC amend the Caller ID provisions to allow a seller or telemarketer to use trade names or product names, rather than the actual name of the seller or telemarketer, in the name information displayed by Caller ID services?
 

Comments are due before the FTC by January 28.  Links to relevant FTC sites are available in our Resource Center.

The proposed legislation is one of several pieces of proposed data security legislation in play on the Hill.  It would require a broad array of commercial and nonprofit entities to (a) implement reasonable data security policies and procedures, and (b) notify consumers of a security breach involving electronic records. It also would require covered entities to offer credit reports and monitoring services to consumers impacted by a data breach.  The proposed legislation also would give general concurrent enforcement authority to the FTC and state attorneys general.

At yesterday’s hearing, subcommittee members and hearing witnesses discussed the proposed legislation’s “exemption” provision and the manner in which it might address potential redundancy with other federal data protection statutes such as the HIPPA, FCRA and the Gramm-Leach-Bliley Act.  The FTC proposed the following revision:

Second, as the proposed legislation is currently drafted, its requirements do not apply to telecommunications common carriers, many of which maintain significant quantities of highly personal information.  The Commission believes that the legislation should cover these entities and that the Commission should have authority to enforce the legislation as to them.

Notably, in making its recommendation to extend the reach of the proposed legislation to telecommunications common carriers, the FTC made no mention of Section 222 of the Communications Act and the FCC’s related CPNI rules which require such entities to comply with a complex data security requirements and also require breach notification to consumers, as well as to the FBI and Secret Service.

For more information on the scope of FTC jurisdiction over broadband service providers, see this earlier post on broadband provider privacy obligations.

FCC investigations are not disclosed publicly, so I cannot publish any documents for this entry.  However, we understand that identical letters were sent to several carriers that provide prepaid calling card services.  The letters seek broad classes of documents, including advertisements for prepaid cards, contracts with distributors and rate decks for the carrier's services. The letters also ask for detailed information about the provisioning of prepaid card services, and an identification of which entities perform certain functions related to the marketing, distribution and use of prepaid calling cards.  Carriers are given 30 days from the date of the letter to provide the requested documents and information.  All responses must include a sworn declaration from an officer confirming that all requested information was provided.

It is clear from the letters that the FCC seeks to examine the content and sufficiency of a carrier's disclosures to prepaid card consumers.  While FCC enforcement of misleading carrier marketing is rare, the Commission has asserted jurisdiction over marketing practices under Section 201's requirement that carrier practices be "just and reasonable."   Notably, however, the investigation letters do not cite to this line of cases, nor do they rely on the Commission's Truth in Billing regulations.   The letters cite only to the Communications Act as a whole for the agency's authority.