06-2423. Customer Proprietary Network Information

AGENCY:

Federal Communications Commission.

ACTION:

Proposed rule.

SUMMARY:

In this document the Commission considers whether to take additional steps to protect the privacy of customer proprietary network information (CPNI) that is collected and held by telecommunications carriers. The Commission has long been committed to safeguarding customer privacy, and its rules requiring carriers to take specific steps to ensure that CPNI is adequately protected from unauthorized disclosure.

DATES:

Comments are due April 14, 2006. Reply comments are due May 15, 2006. Written comments on the Paperwork Reduction Act proposed information collection requirements must be submitted by the public, Office of Management and Budget (OMB), and other interested parties on or before May 15, 2006.

ADDRESSES:

You may submit comments, identified by CC Docket No. 96-115, by any of the following methods:

• Federal eRulemaking Portal: http://www.regulations.gov. Follow the instructions for submitting comments.
• Federal Communications Commission's Web site: http://www.fcc.gov/​cgb/​ecfs/​. Follow the instructions for submitting comments.
• People with Disabilities: Contact the FCC to request reasonable accommodations (accessible format documents, sign language interpreters, CART, etc.) by e-mail: [e-mail] or phone: [phone] or TTY: 202-418-0432.

For detailed instructions for submitting comments and additional information on the rulemaking process, see the SUPPLEMENTARY INFORMATION section of this document.

FOR FURTHER INFORMATION CONTACT:

Tim Stelzig, [phone], Competition Policy Division, Wireline Competition Bureau. For additional information concerning the Paperwork Reduction Act information collection requirements contained in this document, contact Judith B. Herman at 202-418-0214, or via the Internet at [e-mail].

SUPPLEMENTARY INFORMATION:

Pursuant to §§ 1.415 and 1.419 of the Commission's rules, 47 CFR 1.415 and 1.419, interested parties may file comments and reply comments regarding the NPRM. All filings related to this Notice of Proposed Rulemaking should refer to CC Docket No. 96-115. Comments may be filed using: (1) The Commission's Electronic Comment Filing System (ECFS), (2) the Federal Government's eRulemaking Portal, or (3) by filing paper copies. See Electronic Filing of Documents in Rulemaking Proceedings, 63 FR 24121, May 1, 1998. The public may view a full copy of this document at http://hraunfoss.fcc.gov/​edocs_​public/​attachmatch/​FCC-06-10A1.pdf.

• Electronic Filers: Comments may be filed electronically using the Internet by accessing the ECFS: http://www.fcc.gov/​cgb/​ecfs/​ or the Federal eRulemaking Portal: http://www.regulations.gov. Filers should follow the instructions provided on the Web site for submitting comments.
• For ECFS filers, in completing the transmittal screen, filers should include their full name, U.S. Postal Service mailing address, and the applicable docket or rulemaking number. Parties may also submit an electronic comment by Internet e-mail. To get filing instructions, filers should send an e-mail to [e-mail], and include the following words in the body of the message, “get form.” A sample form and directions will be sent in response.
• Paper Filers: Parties who choose to file by paper must file an original and four copies of each filing. Filings can be sent by hand or messenger delivery, by commercial overnight courier, or by first-class or overnight U.S. Postal Service mail (although we continue to experience delays in receiving U.S. Postal Service mail). All filings must be addressed to the Commission's Secretary, Marlene H. Dortch, Office of the Secretary, Federal Communications Commission, 445 12th Street, SW., Washington, DC 20554.
• The Commission's contractor will receive hand-delivered or messenger-delivered paper filings for the Commission's Secretary at 236 Massachusetts Avenue, NE, Suite 110, Washington, DC 20002. The filing hours at this location are 8 a.m. to 7 p.m. All hand deliveries must be held together with rubber bands or fasteners. Any envelopes must be disposed of before entering the building.
• Commercial overnight mail (other than U.S. Postal Service Express Mail and Priority Mail) must be sent to 9300 East Hampton Drive, Capitol Heights, MD 20743.
• U.S. Postal Service first-class, Express, and Priority mail should be addressed to 445 12th Street, SW., Washington, DC 20554.
• Parties should send a copy of their filings to Janice Myles, Competition Policy Division, Wireline Competition Bureau, Federal Communications Commission, Room 5-C140, 445 12th Street, SW., Washington, DC 20554, or by e-mail to [e-mail]. Parties should also serve one copy with the Commission's copy contractor, Best Copy and Printing, Inc. (BCPI), Portals II, 445 12th Street, SW., Room CY-B402, Washington, DC 20554, [phone], or via e-mail to [e-mail].
• Documents in CC Docket No. 96-115 will be available for public inspection and copying during business hours at the FCC Reference Information Center, Portals II, 445 12th Street, SW., Room CY-A257, Washington, DC 20554. The documents may also be purchased from BCPI, telephone [phone], facsimile [phone], TTY [phone], e-mail [e-mail].
• People with Disabilities: Contact the FCC to request materials in accessible formats (Braille, large print, electronic files, audio format, etc.) by e-mail at [e-mail] or call the Consumer and Governmental Affairs Bureau at [phone] (voice), [phone] (TTY).

I. Paperwork Reduction Act

This document contains proposed information collection requirements. The Commission, as part of its continuing effort to reduce paperwork burden, invites the general public and the Office of Management and Budget (OMB) to comment on the information collection requirements contained in this document, as required by the Paperwork Reduction Act of 1995, Public Law 104-13. Public and agency comments are due May 15, 2006. Comments should address: (a) Whether the proposed collection of information is necessary for the proper performance of the functions of the Commission, including whether the information shall have practical utility; (b) the accuracy of the Commission's burden estimates; (c) ways to enhance the quality, utility, and clarity of the information collected; and (d) ways to minimize the burden of the collection of information on the respondents, including the use of automated collection techniques or other forms of information technology. In addition, pursuant to the Small Business Paperwork Relief Act of 2002, Public Law 107-198, see 44 U.S.C. 3506(c)(4), the Commission seeks specific comment on how the Commission might “further reduce the information collection burden for small business concerns with fewer than 25 employees.”

II. Notice of Proposed Rulemaking

In this Notice of Proposed Rulemaking (NPRM), CC Docket No. 96-115 and RM-11277, FCC 06-10, released February 14, 2006, the Commission seeks comment on what additional steps, if any, the Commission should take to further protect the privacy of customer proprietary network information (CPNI) that is collected and held by telecommunications carriers. This NPRM directly responds to the petition filed by the Electronic Privacy Information Center (EPIC) expressing concerns about the sufficiency of carrier practices related to CPNI. As the EPIC petition points out, numerous websites advertise the sale of personal telephone records for a price. Specifically, data brokers advertise the availability of cell phone records, which include calls to and/or from a particular cell phone number, the duration of such calls, and may even include the physical location of the cell phone. In addition to selling cell phone call records, many data brokers also claim to provide calling records for landline and voice over Internet protocol, as well as non-published phone numbers. In many cases, the data brokers claim to be able to provide this information within fairly quick time frames, ranging from a few hours to a few days. The Commission finds this conduct to be very disturbing and, accordingly, the Commission grants EPIC's request and initiates a rulemaking to determine whether enhanced security and authentication standards for access to customer telephone records are warranted.

In the NPRM, the Commission seeks comment, pursuant to the Commission's authority under section 222 of the Act, on the nature and scope of the problem identified by EPIC. The Commission seeks comment generally on how CPNI is maintained and secured by carriers and how data brokers are able to obtain CPNI from carriers. The Commission also seeks comment on whether the Commission's existing opt-out regime sufficiently protects the privacy of CPNI in the context of CPNI disclosed to telecommunications carriers' joint venture partners and independent contractors. The Commission also seeks comment on carriers' current practices regarding the disclosure of CPNI and whether they are sufficient. In particular, EPIC proposes five forms of security measures that it maintains would more adequately protect access to CPNI: consumer-set passwords, audit trails, encryption, limiting data retention, and notice procedures. The Commission seeks comment about the feasibility and advisability of these and other measures. The Commission also seeks comment on whether it should take steps to enhance its ability to enforce the requirements of section 222 and the Commission's regulations relating to CPNI.

III. Procedural Matters

Ex Parte Presentations

The rulemaking this NPRM initiates shall be treated as a “permit-but-disclose” proceeding in accordance with the Commission's ex parte rules. Persons making oral ex parte presentations are reminded that memoranda summarizing the presentations must contain summaries of the substance of the presentations and not merely a listing of the subjects discussed. More than a one or two sentence description of the views and arguments presented generally is required. Other requirements pertaining to oral and written presentations are set forth in § 1.1206(b) of the Commission's rules.

Initial Regulatory Flexibility Analysis

1. As required by the Regulatory Flexibility Act of 1980, as amended (RFA), see 5 U.S.C. 603, the Commission has prepared the present Initial Regulatory Flexibility Analysis (IRFA) of the possible significant economic impact on small entities that might result from this NPRM. Written public comments are requested on this IRFA. Comments must be identified as responses to the IRFA and must be filed by the deadlines for comments on the NPRM. Comments are due April 14, 2006. Reply comments are due May 15, 2006. The Commission will send a copy of the NPRM, including this IRFA, to the Chief Counsel for Advocacy of the Small Business Administration. In addition, the NPRM and IRFA (or summaries thereof) will be published in the Federal Register.

A. Need for, and Objectives of, the Proposed Rules

2. In the NPRM, the Commission grants EPIC's petition for rulemaking and seeks comment on what security measures telecommunications carriers currently have in place for verifying the identity of people requesting CPNI; what inadequacies currently exist in those measures that allow third parties such as online data brokers and private investigators to access CPNI without the customer's knowledge or authorization; and what kind of security measures may be warranted to better protect telecommunications customers from unauthorized access to CPNI. In particular, the Commission seeks comment on EPIC's five proposals to address the unauthorized means of obtaining CPNI: (1) Consumer-set passwords; (2) audit trails; (3) encryption; (4) limiting data retention; and (5) procedures for notice to the customer on release of CPNI data. The Commission also seeks comment on what steps the Commission should take to enforce its CPNI rules and whether carriers should be required to report further on the release of CPNI.

B. Legal Basis

3. The legal basis for any action that may be taken pursuant to the NPRM is contained in sections 1, 4(i), 4(j), and 222 of the Communications Act of 1934, as amended, 47 U.S.C. 151, 154(i)-(j), 222.

C. Description and Estimate of the Number of Small Entities to Which the Proposed Rules May Apply

4. The RFA directs agencies to provide a description of and, where feasible, an estimate of the number of small entities that may be affected by the proposed rules. The RFA generally defines the term “small entity” as having the same meaning as the terms “small business,” “small organization,” and “small governmental jurisdiction.” In addition, the term “small business” has the same meaning as the term “small business concern” under the Small Business Act. A small business concern is one which: (1) Is independently owned and operated; (2) is not dominant in its field of operation; and (3) satisfies any additional criteria established by the Small Business Administration (SBA).

5. Small Businesses. Nationwide, there are a total of approximately 22.4 million small businesses, according to SBA data.

6. Small Organizations. Nationwide, there are approximately 1.6 million small organizations.

7. Small Governmental Jurisdictions. The term “small governmental jurisdiction” is defined generally as “governments of cities, towns, townships, villages, school districts, or special districts, with a population of less than fifty thousand.” Census Bureau data for 2002 indicate that there were 87,525 local governmental jurisdictions in the United States. The Commission estimates that, of this total, 84,377 entities were “small governmental jurisdictions.” Thus, the Commission estimates that most governmental jurisdictions are small.

1. Telecommunications Service Entities

a. Wireline Carriers and Service Providers

8. The Commission has included small incumbent local exchange carriers in this present RFA analysis. As noted above, a “small business” under the RFA is one that, inter alia, meets the pertinent small business size standard (e.g., a telephone communications business having 1,500 or fewer employees), and “is not dominant in its field of operation.” The SBA's Office of Advocacy contends that, for RFA purposes, small incumbent local exchange carriers are not dominant in their field of operation because any such dominance is not “national” in scope. The Commission has therefore included small incumbent local exchange carriers in this RFA analysis, although the Commission emphasizes that this RFA action has no effect on Commission analyses and determinations in other, non-RFA contexts.

9. Incumbent Local Exchange Carriers (LECs). Neither the Commission nor the SBA has developed a small business size standard specifically for incumbent local exchange services. The appropriate size standard under SBA rules is for the category Wired Telecommunications Carriers. Under that size standard, such a business is small if it has 1,500 or fewer employees. According to Commission data, 1,303 carriers have reported that they are engaged in the provision of incumbent local exchange services. Of these 1,303 carriers, an estimated 1,020 have 1,500 or fewer employees and 283 have more than 1,500 employees. Consequently, the Commission estimates that most providers of incumbent local exchange service are small businesses that may be affected by the Commission's action.

10. Competitive Local Exchange Carriers, Competitive Access Providers (CAPs), “Shared-Tenant Service Providers,” and “Other Local Service Providers.” Neither the Commission nor the SBA has developed a small business size standard specifically for these service providers. The appropriate size standard under SBA rules is for the category Wired Telecommunications Carriers. Under that size standard, such a business is small if it has 1,500 or fewer employees. According to Commission data, 769 carriers have reported that they are engaged in the provision of either competitive access provider services or competitive local exchange carrier services. Of these 769 carriers, an estimated 676 have 1,500 or fewer employees and 93 have more than 1,500 employees. In addition, 12 carriers have reported that they are “Shared-Tenant Service Providers,” and all 12 are estimated to have 1,500 or fewer employees. In addition, 39 carriers have reported that they are “Other Local Service Providers.” Of the 39, an estimated 38 have 1,500 or fewer employees and one has more than 1,500 employees. Consequently, the Commission estimates that most providers of competitive local exchange service, competitive access providers, “Shared-Tenant Service Providers,” and “Other Local Service Providers” are small entities that may be affected by the Commission's action.

11. Local Resellers. The SBA has developed a small business size standard for the category of Telecommunications Resellers. Under that size standard, such a business is small if it has 1,500 or fewer employees. According to Commission data, 143 carriers have reported that they are engaged in the provision of local resale services. Of these, an estimated 141 have 1,500 or fewer employees and two have more than 1,500 employees. Consequently, the Commission estimates that the majority of local resellers are small entities that may be affected by the Commission's action.

12. Toll Resellers. The SBA has developed a small business size standard for the category of Telecommunications Resellers. Under that size standard, such a business is small if it has 1,500 or fewer employees. According to Commission data, 770 carriers have reported that they are engaged in the provision of toll resale services. Of these, an estimated 747 have 1,500 or fewer employees and 23 have more than 1,500 employees. Consequently, the Commission estimates that the majority of toll resellers are small entities that may be affected by the Commission's action.

13. Payphone Service Providers (PSPs). Neither the Commission nor the SBA has developed a small business size standard specifically for payphone services providers. The appropriate size standard under SBA rules is for the category Wired Telecommunications Carriers. Under that size standard, such a business is small if it has 1,500 or fewer employees. According to Commission data, 613 carriers have reported that they are engaged in the provision of payphone services. Of these, an estimated 609 have 1,500 or fewer employees and four have more than 1,500 employees. Consequently, the Commission estimates that the majority of payphone service providers are small entities that may be affected by the Commission's action.

14. Interexchange Carriers (IXCs). Neither the Commission nor the SBA has developed a small business size standard specifically for providers of interexchange services. The appropriate size standard under SBA rules is for the category Wired Telecommunications Carriers. Under that size standard, such a business is small if it has 1,500 or fewer employees. According to Commission data, 316 carriers have reported that they are engaged in the provision of interexchange service. Of these, an estimated 292 have 1,500 or fewer employees and 24 have more than 1,500 employees. Consequently, the Commission estimates that the majority of IXCs are small entities that may be affected by the Commission's action.

15. Operator Service Providers (OSPs). Neither the Commission nor the SBA has developed a small business size standard specifically for operator service providers. The appropriate size standard under SBA rules is for the category Wired Telecommunications Carriers. Under that size standard, such a business is small if it has 1,500 or fewer employees. According to Commission data, 23 carriers have reported that they are engaged in the provision of operator services. Of these, an estimated 20 have 1,500 or fewer employees and three have more than 1,500 employees. Consequently, the Commission estimates that the majority of OSPs are small entities that may be affected by the Commission's action.

16. Prepaid Calling Card Providers. Neither the Commission nor the SBA has developed a small business size standard specifically for prepaid calling card providers. The appropriate size standard under SBA rules is for the category Telecommunications Resellers. Under that size standard, such a business is small if it has 1,500 or fewer employees. According to Commission data, 89 carriers have reported that they are engaged in the provision of prepaid calling cards. Of these, 88 are estimated to have 1,500 or fewer employees and one has more than 1,500 employees. Consequently, the Commission estimates that all or the majority of prepaid calling card providers are small entities that may be affected by the Commission's action.

17. 800 and 800-Like Service Subscribers. Neither the Commission nor the SBA has developed a small business size standard specifically for 800 and 800-like service (“toll free”) subscribers. The appropriate size standard under SBA rules is for the category Telecommunications Resellers. Under that size standard, such a business is small if it has 1,500 or fewer employees. The most reliable source of information regarding the number of these service subscribers appears to be data the Commission collects on the 800, 888, and 877 numbers in use. According to the Commission's data, at the end of January 1999, the number of 800 numbers assigned was 7,692,955; the number of 888 numbers assigned was 7,706,393; and the number of 877 numbers assigned was 1,946,538. The Commission does not have data specifying the number of these subscribers that are not independently owned and operated or have more than 1,500 employees, and thus is unable at this time to estimate with greater precision the number of toll free subscribers that would qualify as small businesses under the SBA size standard. Consequently, the Commission estimates that there are 7,692,955 or fewer small entity 800 subscribers; 7,706,393 or fewer small entity 888 subscribers; and 1,946,538 or fewer small entity 877 subscribers.

b. International Service Providers

18. The Commission has not developed a small business size standard specifically for providers of international service. The appropriate size standards under SBA rules are for the two broad census categories of “Satellite Telecommunications” and “Other Telecommunications.” Under both categories, such a business is small if it has $12.5 million or less in average annual receipts.

19. The first category of Satellite Telecommunications “comprises establishments primarily engaged in providing point-to-point telecommunications services to other establishments in the telecommunications and broadcasting industries by forwarding and receiving communications signals via a system of satellites or reselling satellite telecommunications.” For this category, Census Bureau data for 2002 show that there were a total of 371 firms that operated for the entire year. Of this total, 307 firms had annual receipts of under $10 million, and 26 firms had receipts of $10 million to $24,999,999. Consequently, the Commission estimates that the majority of Satellite Telecommunications firms are small entities that might be affected by the Commission's action.

20. The second category of Other Telecommunications “comprises establishments primarily engaged in (1) Providing specialized telecommunications applications, such as satellite tracking, communications telemetry, and radar station operations; or (2) providing satellite terminal stations and associated facilities operationally connected with one or more terrestrial communications systems and capable of transmitting telecommunications to or receiving telecommunications from satellite systems.” For this category, Census Bureau data for 2002 show that there were a total of 332 firms that operated for the entire year. Of this total, 259 firms had annual receipts of under $10 million and 15 firms had annual receipts of $10 million to $24,999,999. Consequently, the Commission estimates that the majority of Other Telecommunications firms are small entities that might be affected by the Commission's action.

c. Wireless Telecommunications Service Providers

21. Below, for those services subject to auctions, the Commission notes that, as a general matter, the number of winning bidders that qualify as small businesses at the close of an auction does not necessarily represent the number of small businesses currently in service. Also, the Commission does not generally track subsequent business size unless, in the context of assignments or transfers, unjust enrichment issues are implicated.

22. Wireless Service Providers. The SBA has developed a small business size standard for wireless firms within the two broad economic census categories of “Paging” and “Cellular and Other Wireless Telecommunications.” Under both SBA categories, a wireless business is small if it has 1,500 or fewer employees. For the census category of Paging, Census Bureau data for 2002 show that there were 807 firms in this category that operated for the entire year. Of this total, 804 firms had employment of 999 or fewer employees, and three firms had employment of 1,000 employees or more. Thus, under this category and associated small business size standard, the majority of firms can be considered small. For the census category of Cellular and Other Wireless Telecommunications, Census Bureau data for 2002 show that there were 1,397 firms in this category that operated for the entire year. Of this total, 1,378 firms had employment of 999 or fewer employees, and 19 firms had employment of 1,000 employees or more. Thus, under this second category and size standard, the majority of firms can, again, be considered small.

23. Cellular Licensees. The SBA has developed a small business size standard for wireless firms within the broad economic census category “Cellular and Other Wireless Telecommunications.” Under this SBA category, a wireless business is small if it has 1,500 or fewer employees. For the census category of Cellular and Other Wireless Telecommunications, Census Bureau data for 2002 show that there were 1,397 firms in this category that operated for the entire year. Of this total, 1,378 firms had employment of 999 or fewer employees, and 19 firms had employment of 1,000 employees or more. Thus, under this category and size standard, the great majority of firms can be considered small. Also, according to Commission data, 437 carriers reported that they were engaged in the provision of cellular service, Personal Communications Service (PCS), or Specialized Mobile Radio (SMR) Telephony services, which are placed together in the data. The Commission has estimated that 260 of these are small, under the SBA small business size standard.

24. Common Carrier Paging. The SBA has developed a small business size standard for wireless firms within the broad economic census category, “Cellular and Other Wireless Telecommunications.” Under this SBA category, a wireless business is small if it has 1,500 or fewer employees. For the census category of Paging, Census Bureau data for 2002 show that there were 807 firms in this category that operated for the entire year. Of this total, 804 firms had employment of 999 or fewer employees, and three firms had employment of 1,000 employees or more. Thus, under this category and associated small business size standard, the majority of firms can be considered small. In the Paging Third Report and Order, the Commission developed a small business size standard for “small businesses” and “very small businesses” for purposes of determining their eligibility for special provisions such as bidding credits and installment payments. A “small business” is an entity that, together with its affiliates and controlling principals, has average gross revenues not exceeding $15 million for the preceding three years. Additionally, a “very small business” is an entity that, together with its affiliates and controlling principals, has average gross revenues that are not more than $3 million for the preceding three years. The SBA has approved these small business size standards. An auction of Metropolitan Economic Area licenses commenced on February 24, 2000, and closed on March 2, 2000. Of the 985 licenses auctioned, 440 were sold. Fifty-seven companies claiming small business status won. Also, according to Commission data, 375 carriers reported that they were engaged in the provision of paging and messaging services. Of those, the Commission estimates that 370 are small, under the SBA-approved small business size standard.

25. Wireless Telephony. Wireless telephony includes cellular, personal communications services (PCS), and specialized mobile radio (SMR) telephony carriers. As noted earlier, the SBA has developed a small business size standard for “Cellular and Other Wireless Telecommunications” services. Under that SBA small business size standard, a business is small if it has 1,500 or fewer employees. According to Commission data, 445 carriers reported that they were engaged in the provision of wireless telephony. The Commission has estimated that 245 of these are small under the SBA small business size standard.

26. Broadband Personal Communications Service. The broadband Personal Communications Service (PCS) spectrum is divided into six frequency blocks designated A through F, and the Commission has held auctions for each block. The Commission defined “small entity” for Blocks C and F as an entity that has average gross revenues of $40 million or less in the three previous calendar years. For Block F, an additional classification for “very small business” was added and is defined as an entity that, together with its affiliates, has average gross revenues of not more than $15 million for the preceding three calendar years.” These standards defining “small entity” in the context of broadband PCS auctions have been approved by the SBA. No small businesses, within the SBA-approved small business size standards bid successfully for licenses in Blocks A and B. There were 90 winning bidders that qualified as small entities in the Block C auctions. A total of 93 small and very small business bidders won approximately 40 percent of the 1,479 licenses for Blocks D, E, and F. On March 23, 1999, the Commission re-auctioned 347 C, D, E, and F Block licenses. There were 48 small business winning bidders. On January 26, 2001, the Commission completed the auction of 422 C and F Broadband PCS licenses in Auction No. 35. Of the 35 winning bidders in this auction, 29 qualified as “small” or “very small” businesses. Subsequent events, concerning Auction 35, including judicial and agency determinations, resulted in a total of 163 C and F Block licenses being available for grant.

27. Narrowband Personal Communications Services. To date, two auctions of narrowband personal communications services (PCS) licenses have been conducted. For purposes of the two auctions that have already been held, “small businesses” were entities with average gross revenues for the prior three calendar years of $40 million or less. Through these auctions, the Commission has awarded a total of 41 licenses, out of which 11 were obtained by small businesses. To ensure meaningful participation of small business entities in future auctions, the Commission has adopted a two-tiered small business size standard in the Narrowband PCS Second Report and Order. A “small business” is an entity that, together with affiliates and controlling interests, has average gross revenues for the three preceding years of not more than $40 million. A “very small business” is an entity that, together with affiliates and controlling interests, has average gross revenues for the three preceding years of not more than $15 million. The SBA has approved these small business size standards. In the future, the Commission will auction 459 licenses to serve Metropolitan Trading Areas (MTAs) and 408 response channel licenses. There is also one megahertz of narrowband PCS spectrum that has been held in reserve and that the Commission has not yet decided to release for licensing. The Commission cannot predict accurately the number of licenses that will be awarded to small entities in future auctions. However, four of the 16 winning bidders in the two previous narrowband PCS auctions were small businesses, as that term was defined. The Commission assumes, for purposes of this analysis that a large portion of the remaining narrowband PCS licenses will be awarded to small entities. The Commission also assumes that at least some small businesses will acquire narrowband PCS licenses by means of the Commission's partitioning and disaggregation rules.

28. Rural Radiotelephone Service. The Commission has not adopted a size standard for small businesses specific to the Rural Radiotelephone Service. A significant subset of the Rural Radiotelephone Service is the Basic Exchange Telephone Radio System (BETRS). The Commission uses the SBA's small business size standard applicable to “Cellular and Other Wireless Telecommunications,” i.e., an entity employing no more than 1,500 persons. There are approximately 1,000 licensees in the Rural Radiotelephone Service, and the Commission estimates that there are 1,000 or fewer small entity licensees in the Rural Radiotelephone Service that may be affected by the rules and policies adopted herein.

29. Air-Ground Radiotelephone Service. The Commission has not adopted a small business size standard specific to the Air-Ground Radiotelephone Service. The Commission will use SBA's small business size standard applicable to “Cellular and Other Wireless Telecommunications,” i.e., an entity employing no more than 1,500 persons. There are approximately 100 licensees in the Air-Ground Radiotelephone Service, and the Commission estimates that almost all of them qualify as small under the SBA small business size standard.

30. Offshore Radiotelephone Service. This service operates on several UHF television broadcast channels that are not used for television broadcasting in the coastal areas of states bordering the Gulf of Mexico. There are presently approximately 55 licensees in this service. The Commission is unable to estimate at this time the number of licensees that would qualify as small under the SBA's small business size standard for “Cellular and Other Wireless Telecommunications” services. Under that SBA small business size standard, a business is small if it has 1,500 or fewer employees.

2. Cable and OVS Operators

31. Cable and Other Program Distribution. This category includes cable systems operators, closed circuit television services, direct broadcast satellite services, multipoint distribution systems, satellite master antenna systems, and subscription television services. The SBA has developed a small business size standard for this census category, which includes all such companies generating $12.5 million or less in revenue annually. According to Census Bureau data for 2002, there were a total of 1,191 firms in this category that operated for the entire year. Of this total, 1,087 firms had annual receipts of under $10 million, and 43 firms had receipts of $10 million or more but less than $25 million. Consequently, the Commission estimates that the majority of providers in this service category are small businesses that may be affected by the rules and policies adopted herein.

32. Cable System Operators. The Commission has developed its own small business size standards for cable system operators, for purposes of rate regulation. Under the Commission's rules, a “small cable company” is one serving fewer than 400,000 subscribers nationwide. In addition, a “small system” is a system serving 15,000 or fewer subscribers.

33. Cable System Operators (Telecom Act Standard). The Communications Act of 1934, as amended, also contains a size standard for small cable system operators, which is “a cable operator that, directly or through an affiliate, serves in the aggregate fewer than 1 percent of all subscribers in the United States and is not affiliated with any entity or entities whose gross annual revenues in the aggregate exceed $250,000,000.” The Commission has determined that there are approximately 67,700,000 subscribers in the United States. Therefore, an operator serving fewer than 677,000 subscribers shall be deemed a small operator, if its annual revenues, when combined with the total annual revenues of all its affiliates, do not exceed $250 million in the aggregate. Based on available data, the Commission estimates that the number of cable operators serving 677,000 subscribers or fewer, totals 1,450. The Commission neither requests nor collects information on whether cable system operators are affiliated with entities whose gross annual revenues exceed $250 million, and therefore is unable, at this time, to estimate more accurately the number of cable system operators that would qualify as small cable operators under the size standard contained in the Communications Act of 1934.

34. Open Video Services. Open Video Service (OVS) systems provide subscription services. The SBA has created a small business size standard for Cable and Other Program Distribution. This standard provides that a small entity is one with $12.5 million or less in annual receipts. The Commission has certified approximately 25 OVS operators to serve 75 areas, and some of these are currently providing service. Affiliates of Residential Communications Network, Inc. (RCN) received approval to operate OVS systems in New York City, Boston, Washington, DC, and other areas. RCN has sufficient revenues to assure that they do not qualify as a small business entity. Little financial information is available for the other entities that are authorized to provide OVS and are not yet operational. Given that some entities authorized to provide OVS service have not yet begun to generate revenues, the Commission concludes that up to 24 OVS operators (those remaining) might qualify as small businesses that may be affected by the rules and policies adopted herein.

3. Internet Service Providers

35. Internet Service Providers. The SBA has developed a small business size standard for Internet Service Providers (ISPs). ISPs “provide clients access to the Internet and generally provide related services such as Web hosting, Web page designing, and hardware or software consulting related to Internet connectivity.” Under the SBA size standard, such a business is small if it has average annual receipts of $21 million or less. According to Census Bureau data for 2002, there were 2,529 firms in this category that operated for the entire year. Of these, 2,437 firms had annual receipts of under $10 million, and 47 firms had receipts of $10 million or more but less then $25 million. Consequently, the Commission estimates that the majority of these firms are small entities that may be affected by the Commission's action.

36. All Other Information Services. “This industry comprises establishments primarily engaged in providing other information services (except new syndicates and libraries and archives).” The Commission's action pertains to VoIP services, which could be provided by entities that provide other services such as e-mail, online gaming, Web browsing, video conferencing, instant messaging, and other, similar IP-enabled services. The SBA has developed a small business size standard for this category; that size standard is $6 million or less in average annual receipts. According to Census Bureau data for 1997, there were 195 firms in this category that operated for the entire year. Of these, 172 had annual receipts of under $5 million, and an additional nine firms had receipts of between $5 million and $9,999,999. Consequently, the Commission estimates that the majority of these firms are small entities that may be affected by the Commission's action.

D. Description of Projected Reporting, Recordkeeping and Other Compliance Requirements

37. Should the Commission decide to adopt any regulations to ensure that all providers of telecommunications services meet consumer protection needs in regard to CPNI, the associated rules potentially could modify the reporting and recordkeeping requirements of certain telecommunications providers. The Commission could, for instance, require that telecommunications providers require customer password-related security procedures to access CPNI data and/or encrypt CPNI data. The Commission could also require that telecommunications providers maintain more extensive records regarding CPNI data and report additional CPNI information to their customers and the Commission. The Commission tentatively concludes that the Commission should amend its rules to require carriers to certify as to established operating procedures no later than January 1st (or other date specified by the Commission) of each year, covering the preceding calendar year, and to file the compliance certificate with the Commission within 30 days. The Commission further tentatively concludes that carriers should attach to this annual § 64.2009(e) certification an explanation of any actions taken against data brokers and a summary of all consumer complaints received in the past year concerning the unauthorized release of CPNI. These proposals may impose additional reporting or recordkeeping requirements on entities. The Commission seeks comment on the possible burden these requirements would place on small entities. Also, the Commission seeks comment on whether a special approach toward any possible compliance burdens on small entities might be appropriate. Entities, especially small businesses, are encouraged to quantify the costs and benefits of any reporting requirement that may be established in this proceeding.

E. Steps Taken to Minimize Significant Economic Impact on Small Entities, and Significant Alternatives Considered

38. The RFA requires an agency to describe any significant alternatives that it has considered in reaching its proposed approach, which may include (among others) the following four alternatives: (1) The establishment of differing compliance or reporting requirements or timetables that take into account the resources available to small entities; (2) the clarification, consolidation, or simplification of compliance or reporting requirements under the rule for small entities; (3) the use of performance, rather than design, standards; and (4) an exemption from coverage of the rule, or any part thereof, for small entities.

39. The Commission's primary objective is to develop a framework for protecting a customer's CPNI, regardless of the customer's underlying technology. The Commission seeks comment here on the effect the various proposals described in the NPRM will have on small entities, and on what effect alternative rules would have on those entities. The Commission invites comment on ways in which the Commission can achieve its goal of protecting consumers while at the same time impose minimal burdens on small telecommunications service providers. With respect to any of the Commission's consumer protection regulations already in place, has the Commission adopted any provisions for small entities that the Commission should similarly consider here? Specifically, the Commission invites comment on whether the problems identified by EPIC are better or worse at smaller carriers. The Commission invites comment on whether small carriers should be exempt from password-related security procedures to protect CPNI. The Commission invites comment on the benefits and burdens of recording audit trails for the disclosure of CPNI on small carriers. The Commission invites comment on whether requiring a small carrier to encrypt its stored data would be unduly burdensome. The Commission solicits comment on the cost to a small carrier of notifying a customer upon release of CPNI. The Commission seeks comment on whether the Commission should amend its rules to require carriers to file annual certifications concerning CPNI and whether this requirement should extend to only telecommunications carriers that are not small telephone companies as defined by the Small Business Administration, and whether small carriers should be subject to different CPNI-related obligations.

F. Federal Rules that May Duplicate, Overlap, or Conflict with the Proposed Rules

40. None.

Ordering Clauses

Accordingly, it is ordered, pursuant to sections 1, 4(i), 4(j), and 222 of the Communications Act of 1934, as amended, 47 U.S.C. 151, 154(i)-(j), 222, that this NPRM in CC Docket No. 96-115 and RM-11277 is adopted.

It is further ordered that the Petition for Rulemaking of the Electronic Privacy Information Center is granted to the extent described herein.

It is further ordered that the proceeding in RM-11277 is hereby terminated.

It is further ordered that the Commission's Consumer & Governmental Affairs Bureau, Reference Information Center, shall send a copy of this NPRM, including the Initial Regulatory Flexibility Analysis, to the Chief Counsel for Advocacy of the Small Business Administration.

Federal Communications Commission.

Marlene H. Dortch,

Secretary.