THE FCC SEEKS COMMENT REGARDING PRIVACY RULES FOR BROADBAND ISPs
April 11, 2016
The Federal Communications Commission (“FCC” or “Commission”) recently released a Notice of Proposed Rulemaking and Declaratory Ruling (“NPRM”) that proposes privacy guidelines for broadband Internet Service Providers (“ISPs”). The FCC’s efforts follow in the wake of its reclassification last year of Broadband Internet Access Service from an information service to a more heavily regulated telecommunications service. The NPRM’s proposed rules would implement the privacy requirements of Section 222 of the Communications Act for broadband ISPs. However, this proceeding will also be of interest to other telecommunications service providers as well because the Commission has proposed an eventual harmonization of the Customer Proprietary Network Information (“CPNI”) rules for phone and interconnected VoIP service with the NPRM’s new broadband privacy rules.
Specifically, the NPRM identified the following three goals as its primary focus:
- Transparency requirements intended to require ISPs to provide customers with notice about what information they collect, use and share with third parties, and how customers can change their privacy preferences;
- Data security requirements for broadband providers that include requirements to adopt risk management practices; institute personnel training practices; implement strong customer authentication requirements; identify a senior manager responsible for data security; and take responsibility for the use and protection of customer information when shared with third parties; and
- Data breach notification requirements to encourage ISPs to protect the confidentiality of customer data, and to give consumers and law enforcement notice of failures to protect such information.
To implement these goals, the NPRM provides clarification as what level of authorization a broadband ISP must obtain from its customers before using their proprietary information. First, the NPRM proposes rules that broadband providers will always be allowed to use and share customer proprietary information in order to provide broadband services, and for certain other broadband service related purposes (e.g., disclosing a customer’s location information for public safety purposes) without specific approval from the customer. Second, the NPRM proposes to allow broadband providers themselves (or through their affiliates that provide communications-related services) to use customer proprietary information to market other communications-related services subject to opt-out approval of the customer. Third, the NPRM proposes to require broadband providers to receive opt-in approval from their customers before sharing customer proprietary information with non-communications-related affiliates or third parties or before using customer proprietary information themselves (or through their communications-related affiliates) for any purpose outside of the first two described above.
The NPRM also provides several proposals regarding how and when consumers should be notified about data breaches involving broadband ISPs. The Commission acknowledged the existence of the numerous state laws already requiring data breach notification and noted the potential for over-notification or “notice fatigue.” However, the NPRM still proposes a requirement that broadband providers notify affected customers within ten (10) days of the discovery of a breach. It also proposes a requirement that the Commission be notified of all data breaches, and that other federal law enforcement be notified of breaches that impact more than five thousand (5,000) customers.
Comments are due by May 27, 2016 and reply comments are due by June 27, 2016. The full text of the NPRM can be found here. As noted above, given the likelihood that these new requirements will be extended to traditional telecommunications carriers and interconnected VoIP service providers, all telecommunications providers have a vested interest in this proceeding and should follow it closely.
If you have any additional questions regarding the above or if you are interested in further advocacy with respect to these issues, please contact Rob Gastner at 202.695.6674.