02-23199. Implementation of the Telecommunications Act of 1996: Telecommunications Carriers' Use of Customer Proprietary Network Information and Other Customer Information; Implementation of the Non-Accounting Safeguards of Sections 271 and 272 of ...

AGENCY:

Federal Communications Commission.

ACTION:

Final rule.

SUMMARY:

This document adopts rules to implement section 222 of the Communications Act of 1934 (as amended by the Telecommunications Act of 1996), which governs carriers' use and disclosure of customer proprietary network information (CPNI). This document affirms the continued use of the total service approach to define what carriers may do under section 222(c)(1) without notice to customers, and allows a carrier to choose whether to use an opt-out or opt-in approval method for obtaining customer approval for a carrier to use its customer's individually identifiable CPNI for the purpose of marketing communications-related services to that customer. Specifically, this document allows the use of CPNI by carriers or disclosure to their affiliated entities providing communications-related services, as well as third-party agents and joint venture partners providing communications-related services, only after a carrier receives a customer's knowing consent in the form of notice and “opt-out” approval. This document also permits disclosure of CPNI to unrelated third parties or to carrier affiliates that do not provide communications-related services requires express customer consent, described as “opt-in” approval. This document also further refines the rules governing the process by which carriers provide notification to customers of their CPNI rights. Specifically, it clarifies the form, content and frequency of carrier notices. Additionally, this document affirms the Federal Communications Commission's conclusion that customers' preferred carrier (PC) freeze information constitutes CPNI and thereby warrants privacy protection pursuant to section 222, and announces the Commission's decision to forbear from imposing the express consent requirements announced in this document with respect to PC-freezes. This document also reaffirms existing Commission rules addressing winback and retention marketing, and declines to adopt further rules regarding a carrier's denial of CPNI to another carrier with customer authorization.

DATES:

Effective October 21, 2002, except §§ 64.2007, 64.2008, and 64.2009, which contain information collection requirements that are not effective until approved by the Office of Management and Budget. The Federal Communications Commission will publish a document in the Federal Register announcing the effective date of these rules.

FOR FURTHER INFORMATION CONTACT:

Marcy Greene, Attorney-Advisor, Competition Policy Division, Wireline Competition Bureau, at [phone], or via the Internet at [e-mail].

SUPPLEMENTARY INFORMATION:

This is a summary of the Commission's Third Report and Order in CC Docket Nos. 96-115 and 96-149, adopted July 16, 2002, and released July 25, 2002. The complete text of this Report and Order is available for inspection and copying during normal business hours in the FCC Reference Information Center, Portals II, 445 12th Street, SW., Room CY-A257, Washington, DC, 20554. This document may also be purchased from the Commission's duplicating contractor, Qualex International, Portals II, 445 12th Street, SW., Room CY-A257, Washington, DC 20554, telephone [phone], facsimile 202-863-2898, or via e-mail at [e-mail]. It is also available on the Commission's Web site at http://www.fcc.gov.

Synopsis of the Report and Order

1. The Commission resolves in this Order several issues in connection with carriers' use of customer proprietary network information (“CPNI”) pursuant to section 222 of the Telecommunications Act of 1996. Through section 222, Congress recognized both that telecommunications carriers are in a unique position to collect sensitive personal information and that customers maintain an important privacy interest in protecting this information from disclosure and dissemination. The rules adopted by the Commission focus on the nature of the customer approval needed before a carrier can use, disclose or permit access to CPNI.

2. Background. This proceeding was initiated in 1996 to implement section 222 of the Communications Act of 1934 (as amended), which governs carriers' use and disclosure of CPNI. On February 26, 1998, the Commission adopted regulations implementing section 222 in its CPNI Order. [63 FR 20236, April 24, 1998]. In particular, it concluded that section 222(c)(1) of the Act allows a carrier to use a customer's CPNI, derived from the complete service subscribed to from that carrier, for marketing purposes within the existing service relationship. This is known as the “total service approach.” The Commission also concluded that carriers must notify the customer of the customer's rights under section 222 and then obtain express written, oral or electronic customer approval—a “notice and opt-in” approach—before a carrier may use CPNI to market services outside the customer's existing service relationship with that carrier. On September 3, 1999, the Commission released an Order on Reconsideration [64 FR 53242, Oct. 1, 1999] that affirmed the opt-in approach, but streamlined the CPNI rules so that carriers could use CPNI to market customer premises equipment and information services without customer approval, and lessened carriers' CPNI record-keeping responsibilities. It also eliminated restrictions on a carrier's ability to use CPNI to regain customers that switched to another carrier, known as “winbacks.”

3. After the Commission adopted the Order on Reconsideration, but prior to its release, the Court of Appeals for the Tenth Circuit vacated portions of the 1998 CPNI Order. The court found that the Commission did not show that the opt-in form of consent protected privacy and promoted competition in a manner consistent with the First Amendment of the U.S. Constitution.

4. In an October 6, 2000 Order, AT&T v. Bell Atlantic (denying a complaint by AT&T regarding the manner in which Bell Atlantic markets the services of its long distance affiliate to its local exchange customers), the Commission interpreted the Tenth Circuit's vacatur as applying only to the discrete issue that was before the court. On September 7, 2001, the Commission released a Clarification Order and Second Further Notice of Proposed Rulemaking [66 FR 50140, Oct. 2, 2001] that determined that all CPNI rules except those relating to opt-in remained in effect, and that carriers may choose to obtain customer approval by means of an opt-out approach until the Commission adopted final rules. This Order sought comment on adopting either an opt-in or opt-out approach.

5. On July 16, 2002, the Commission adopted a Third Report and Order that allows a carrier to choose whether to use an opt-out or opt-in approval method for obtaining customer approval for a carrier to use its customer's individually identifiable CPNI for the purpose of marketing communications-related services to that customer. The Order allows a carrier—subject to opt-out or opt-in approval—to disclose its customer's individually identifiable CPNI, for the purpose of marketing communications-related services to that customer, to (i) Its agents, (ii) its affiliates that provide communications-related services, and (iii) its joint venture partners and independent contractors. Carriers must obtain opt-in customer approval for all other uses and disclosures of CPNI to which other exceptions do not apply.

6. Discussion. This document allows carriers to choose the method(s) by which consumers may express their opt-out or opt-in choices. However, carriers are required to make available to all customers a method to opt-out that is of no cost to the customer and that is available 24 hours a day, seven days a week. This document confirms the previous determination that preferred carrier freezes (PC freezes) fit within the statutory definition of CPNI, and forbears from imposing the affirmative approval requirements in the CPNI rules so that preferred carrier freeze information can be disclosed among carriers.

Final Paperwork Reduction Act Analysis

7. This Order contains new and modified information collections subject to the Paperwork Reduction Act of 1995 (PRA), Public Law 104-13. It will be submitted to the Office of Management and Budget (OMB) for review under Section 3507(d) of the PRA. OMB, the general public, and other Federal agencies are invited to comment on the new or modified information collection(s) contained in this proceeding. Implementation of these new or modified reporting and/or recordkeeping requirements will be subject to approval by the OMB, as prescribed by the Act, and will go into effect upon announcement in the Federal Register of OMB approval.

Final Regulatory Flexibility Analysis

8. As required by the Regulatory Flexibility Act, as amended, (RFA), an Initial Regulatory Flexibility Analysis (IRFA) was incorporated in the Clarification Order and Second Further Notice of Proposed Rulemaking issued in CC Docket No. 96-115 and CC Docket No. 96-149. The Commission sought written public comment on the proposals in the Second FNPRM, including comment on the IRFA. This present Final Regulatory Flexibility Analysis (FRFA) conforms to the RFA.

Need for, and Objectives of, the Third Report and Order

9. The initial need for the proceeding of which this Report and Order is a part is that on May 17, 1996, the Commission initiated a rulemaking in response to requests for guidance from the telecommunications industry regarding the obligations of telecommunications carriers under section 222 of the Act and related issues. The Commission released the CPNI Order on February 26, 1998, in which it addressed the scope and meaning of section 222 and promulgated implementing regulations. On August 18, 1999, the Tenth Circuit issued an opinion vacating a portion of the CPNI Order in U S WEST v. FCC. That left the Commission with a need to clarify the CPNI rules and their future operation. The Commission does so herein.

10. On August 28, 2001, the Commission adopted an order (CPNI Clarification Order) clarifying the status of its CPNI rules in light of the Tenth Circuit order and issuing a Further Notice of Proposed Rulemaking (Clarification Order Further NPRM). Specifically, the Commission sought comment on (1) Its interpretation of the scope of the Tenth Circuit order; (2) what type of approval (opt-in or opt-out) would best serve the government's goals while respecting constitutional limits; (3) ways in which consumers can consent to a carrier's use of their CPNI; (4) what methods of approval would serve the governmental interests at issue and afford informed consent, while also satisfying the First Amendment's requirement that any restrictions on speech be narrowly tailored; (5) the interests and policies underlying section 222 that are relevant to formulating an approval requirement, including an analysis of the privacy interests that are at issue, and on the extent to which it should take competitive concerns into account; (6) the likely difference in competitive harms under opt-in and opt-out approvals; and (7) whether adoption of an opt-out mechanism is consistent with the rationale for the total service approach set forth in the CPNI Order. In addition, the Commission sought comment on whether its consent mechanism would affect its previous findings on the interplay between sections 222 and 272.

11. In this Order, the Commission reaches the objective of resolving several issues in connection with carriers' use of customer proprietary network information pursuant to section 222 of the Telecommunications Act of 1996. In formulating the required approval mechanism described below, we carefully balance carriers' First Amendment rights and consumers' privacy interests so as to permit carriers flexibility in their communications with their customers while providing the level of protection to consumers' privacy interests that Congress envisioned under section 222.

12. More specifically, The Commission adopts an approach that comports with the decision of the United States Court of Appeals for the Tenth Circuit vacating the Commission's requirement that carriers obtain express customer consent for all sharing between a carrier and its affiliates, as well as unaffiliated entities. The Commission adopts today an approach that is derived from a careful balancing of harms, benefits, and governmental interests. First, use of CPNI by carriers or disclosure to their affiliated entities providing communications-related services, as well as third-party agents and joint venture partners providing communications-related services, requires a customer's knowing consent in the form of notice and “opt-out” approval. Second, disclosure of CPNI to unrelated third parties or to carrier affiliates that do not provide communications-related services requires express customer consent, described as “opt-in” approval. Finally, the Commission reaffirms its “total services approach,” which permits the carrier to use CPNI to market new product offerings within the carrier-customer service relationship, on the basis of the customer's implied consent.

13. In this Order, the Commission also further refines the rules governing the process by which carriers provide notification to customers of their CPNI rights. Specifically, clarifying the form, content and frequency of carrier notices. In addition, although the Commission decline to reconsider its conclusion that customers' preferred carrier (PC) freeze information constitutes CPNI and thereby continue to accord it privacy protection pursuant to section 222, the Commission chooses to forbear from imposing the express consent requirements announced in this Order with respect to PC-freezes. Through its limited exercise of forbearance, the Commission balances customers' privacy concerns with carriers' meaningful commercial interests, resulting in PC-freeze information being made more readily available among competing carriers, consistent with the public interest. The Commission also affirms its previous determination that the word “information” in section 272 does not include CPNI, which is governed instead by section 222 of the Act.

14. Finally, the Commission accompanies this Order with a Further Notice of Proposed Rulemaking (“Further NPRM”) to refresh the record on two issues raised in the CPNI Order Further NPRM: foreign storage of and access to domestic CPNI, and CPNI safeguards and enforcement mechanisms. The Commission additionally requests comment on what, if any, appropriate regulations should govern the CPNI held by carriers that go out of business, sell all or part of their customer base, or seek bankruptcy protection.

Summary of Significant Issues Raised by Public Comments in Response to the IRFA

15. One party, the Organization for the Promotion and Advancement of Small Telecommunications Companies (“OPASTCO”), commented specifically in response to the IRFA. OPASTCO argues that the IRFA was “deficient” for two reasons. First, OPASTCO notes that the IRFA “reverts to language which incorrectly suggests that small ILECs are not “small entities” under the Regulatory Flexibility Act.” Further, OPASTCO takes issue with the IRFA's determination that whatever consent rules are ultimately adopted will be applicable to all carriers. OPTASCO argues that “the Commission has not considered any alternatives, contrary to the requirements of 5 U.S.C. 603(c).”

16. The Commission confirms OPASTCO's assumption that the Clarification Order's IRFA did contain a clerical error regarding the classification of small ILECs. Accordingly, we affirm that Commission practice is to discuss small ILECs as “small entities” within our IRFAs, under the RFA. However, we note that no party was prejudiced or harmed by this error because the IRFA put potentially affected entities on notice by affirmatively stating that the Commission was “consider[ing] small ILECs within this analysis and us[ing] the term “small LECs” to refer to any ILECs that arguably might be defined by SBA as “small business concerns. ” Hence, the clerical error was cured in the very document in which it was alleged to be present.

17. OPASTCO's concern, therefore, that “if the rulemaking body itself has no preconceived idea of what the final rules might be, there is no way it can make the prejudgment that its final rules will be appropriate for all entities,” takes a statement from the IRFA out of context. Furthermore, OPASTCO's contention inaccurately describes the Commission's decision-making process and outcome in this proceeding.

18. First, although the Clarification Order did not propose specific consent requirements, the Clarification Order did “seek comment on ways in which carriers can obtain their customers' consent and the extent to which an opt-in or opt-out approach would satisfy both sections 222 and the Tenth Circuit's concerns that any restrictions on speech be no more than necessary to serve the asserted state interests.” Accordingly, although specific consent rules were not proposed, the only two potential types of consent (opt-in and opt-out) were explicitly mentioned and offered to interested parties for consideration and comment. In an instance such as this, where the Commission has previously considered what type of consent to require, and where the Order in question mentions the only two potential options for obtaining consent, it is unreasonable to claim that the Commission or any interested party had and has no idea what the final rules might be. Clearly, the Commission knew and adequately advised interested parties that the final rules would involve opt-in approval, opt-out approval, or some combination of the two. In fact, every commenter, including OPASTCO, focused extensively on whether the Commission should adopt opt-in or opt-out consent requirements. The Commission also notes that the IRFA went on to state that “[w]e have, however, taken the limited resources of small entities into account in promulgating certain existing CPNI rules, and intend to do so again in addressing the customer consent requirements.” The omission of ILECs, whether or not evidence of Commission oversight, is rendered moot by its inclusion of this statement.

19. Furthermore, the previously adopted opt-in approval rules were subject to, and complied with, the requirements of the RFA. Accordingly, the Commission has previously undertaken an analysis of opt-in and potential alternatives with respect to small carriers. Although such analysis does not supplant the analysis that the Commission must perform in this Order and in this FRFA, it provides meaningful guidance. In previous CPNI Orders, the Commission has received comment from several parties on the impact of proposed rules on small carriers. After extensive analysis, the Commission found that “[a]fter consideration of possible alternatives, we have concluded that our rules should apply equally to all carriers.” Thus any argument that the Commission ever neglected the interests of small carriers is thereby rendered invalid. The Commission's reasoning remains valid today. The Commission stated: “we are unpersuaded that customers of small businesses have less meaningful privacy interests in their CPNI.” Additionally, the weight added by Congressional intent is critical in this context and deserves comment. In drafting section 222, Congress determined that CPNI protections should apply to consumers of “[e]very telecommunications carrier.” Finally, the Commission notes that the rules it adopts today are less burdensome on all carriers, including small carriers, than the Commission's original opt-in rules.

Description and Estimate of the Number of Small Entities to Which Rules Will Apply

20. The RFA directs agencies to provide a description of and, where feasible, an estimate of the number of small entities that will be affected by the proposed rules, if adopted. The RFA generally defines the term “small entity” as having the same meaning as the terms “small business,” “small organization,” and “small governmental jurisdiction.” In addition, the term “small business” has the same meaning as the term “small business concern” under the Small Business Act. A “small business concern” is one that: (1) Is independently owned and operated; (2) is not dominant in its field of operation; and (3) satisfies any additional criteria established by the Small Business Administration (SBA).

21. The most reliable source of information regarding the total numbers of certain common carrier and related providers nationwide appears to be data the Commission publishes annually in its Telecommunications Provider Locator report, derived from filings made in connection with the Telecommunications Relay Service (TRS). According to data in the most recent report, there are 5,679 interstate service providers. These providers include, inter alia, local exchange carriers, wireline carriers and service providers, interexchange carriers, competitive access providers, operator service providers, pay telephone operators, providers of telephone service, providers of telephone exchange service, and resellers.

22. The Commission has included small incumbent local exchange carriers (ILECs) in this present RFA analysis. As noted above, a “small business” under the RFA is one that inter alia, meets the pertinent small business size standard (e.g., a telephone communications business having 1,500 or fewer employees), and “is not dominant in its field of operation.” The SBA's Office of Advocacy contends that, for RFA purposes, small incumbent LECs are not dominant in their field of operation because any such dominance is not “national” in scope. The Commission therefore included small incumbent LECs in this RFA analysis, although it emphasizes that this RFA action has no effect on FCC analyses and determinations in other, non-RFA contexts.

23. Total Number of Telephone Companies Affected. The U.S. Bureau of Census (Census Bureau) reports that, at the end of 1992, there were 3,497 firms engaged in providing telephone services, as defined therein, for at least one year. This number contains a variety of different categories of carriers, including LECs, interexchange carriers, competitive access providers, operator service providers, pay telephone operators, and resellers. It seems certain that some of these 3,497 telephone service firms may not qualify as small entities or small incumbent LECs because they are not “independently owned and operated.” It seems reasonable to conclude that fewer than 3,497 telephone service firms are small entity telephone service firms that may be affected by these rules.

24. Wireline Carriers and Service Providers. The SBA has developed a definition of small entities for telephone communications companies other than radiotelephone (wireless) companies. The Census Bureau reports that there were 2,321 such telephone companies in operation for at least one year at the end of 1992. According to the SBA's definition, a small business telephone company other than a radiotelephone (wireless) company is one employing no more than 1,500 persons. All but 26 of the 2,321 non-radiotelephone (wireless) companies listed by the Census Bureau were reported to have fewer than 1,000 employees. Even if all 26 of the remaining companies had more than 1,500 employees, there would still be 2,295 non-radiotelephone (wireless) companies that might qualify as small entities or small incumbent LECs. Although it seems certain that some of these carriers are not independently owned and operated, the Commission is unable at this time to estimate with greater precision the number of wireline carriers and service providers that would qualify as small business concerns under SBA's definition. Therefore, the Commission estimates that fewer than 2,295 small telephone communications companies other than radiotelephone (wireless) companies are small entities that may be affected by these rules.

25. Local Exchange Carriers. Neither the Commission nor the SBA has developed a definition of small providers of local exchange services. The closest applicable definition under the SBA's rules is for telephone communications companies other than radiotelephone (wireless) companies. According to the SBA's definition, a small business telephone company other than a radiotelephone (wireless) company is one employing no more than 1,500 persons. The most reliable source of information regarding the number of LECs nationwide of which the Commission is aware appears to be the data collected annually in connection with the Telecommunications Relay Service (TRS). According to the Commission's most recent data, there are 1,329 local exchange carriers, including incumbent LECs. Although it seems certain that some of these carriers are not independently owned and operated, or have more than 1,500 employees, the Commission is unable at this time to estimate with greater precision the number of LECs that would qualify as small business concerns under the SBA's definition. Consequently, the Commission estimates that they are fewer than 1, 329 small entity LECs that may be affected by the proposals in the Second Further Notice.

26. Interexchange Carriers. Neither the Commission nor the SBA has developed a definition of small entities specifically applicable to providers of interexchange services (IXCs). The closest applicable definition under the SBA's rules is for telephone communications companies other than radiotelephone (wireless) companies. The most reliable source of information regarding the number of IXCs nationwide of which we are aware appears to be the data that the Commission collects annually in connection with TRS. According to its most recent data, 229 companies reported that they were engaged in the provision of interexchange services. Although it seems certain that some of these carriers are not independently owned and operated, or have more than 1,500 employees, the Commission are unable at this time to estimate with greater precision the number of IXCs that would qualify as small business concerns under the SBA's definition. Consequently, the Commission estimates that there are fewer than 229 small entity IXCs that may be affected by this order.

27. Competitive Access Providers. Neither the Commission nor the SBA has developed a definition of small entities specifically applicable to providers of competitive access services (CAPs). The closest applicable definition under the SBA's rules is for telephone communications companies other than radiotelephone (wireless) companies. According to the SBA's definition, a small business telephone company other than a radiotelephone (wireless) company is one employing no more than 1,500 persons. The most reliable source of information regarding the number of CAPs nationwide of which the Commission is are aware appears to be the data that it collect annually in connection with the TRS. According to the Commission's most recent data, 532 companies reported that they were engaged in the provision of either competitive access services or competitive local exchange service. Although it seems certain that some of these carriers are not independently owned and operated, or have more than 1,500 employees, the Commission is unable at this time to estimate with greater precision the number of CAPs that would qualify as small business concerns under the SBA's definition. Consequently, the Commission estimates that there are fewer than 532 small entity CAPs that may be affected by this order.

28. Operator Service Providers. Neither the Commission nor the SBA has developed a definition of small entities specifically applicable to providers of operator services. The closest applicable definition under the SBA's rules is for telephone communications companies other than radiotelephone (wireless) companies. The most reliable source of information regarding the number of operator service providers nationwide of which the Commission is aware appears to be the data that it collects annually in connection with the TRS. According to the Commission's most recent data, 22 companies reported that they were engaged in the provision of operator services. Although it seems certain that some of these companies are not independently owned and operated, or have more than 1,500 employees, the Commission is unable at this time to estimate with greater precision the number of operator service providers that would qualify as small business concerns under the SBA's definition. Consequently, the Commission estimates that there are fewer than 22 small entity operator service providers that may be affected by this order.

29. Pay Telephone Providers. Neither the Commission nor the SBA has developed a definition of small entities specifically applicable to pay telephone providers. The closest applicable definition under the SBA's rules is for telephone communications companies other than radiotelephone (wireless) companies. The most reliable source of information regarding the number of pay telephone operators nationwide of which the Commission is aware appears to be the data that it collects annually in connection with the TRS. According to the Commission's most recent data, 936 companies reported that they were engaged in the provision of pay telephone services. Although it seems certain that some of these carriers are not independently owned and operated, or have more than 1,500 employees, the Commission is unable at this time to estimate with greater precision the number of pay telephone operators that would qualify as small business concerns under the SBA's definition. Consequently, the Commission estimates that there are fewer than 936 small entity pay telephone operators that may be affected by this order.

30. Wireless Carriers. Wireless telephony includes cellular, personal communications services (PCS) or specialized mobile radio (SMR) service providers. The SBA has developed a definition of small entities for radiotelephone (wireless) companies; however, neither the Commission nor the SBA has developed a definition of small entities applicable to cellular licensees, or to providers of paging and messaging services. Though categorized under the same size standard as other wireless services discussed in this paragraph, paging is now considered a separate industry. The closest applicable definition under the SBA's rules is for telephone communications companies other than radiotelephone (wireless) companies. According to the SBA's definition, a small business radiotelephone company is one employing no more than 1,500 persons. The Commission considers paging and messaging services to fall within this category. According to the most recent Provider Locator data, 858 carriers reported that they were engaged in the provision of wireless telephony and 576 companies reported that they were engaged in the provision of paging and messaging services. Although it seems certain that some of these carriers are not independently owned and operated, the Commission is unable at this time to estimate with greater precision the number of radiotelephone carriers and service providers that would qualify as small business concerns under the SBA's definition. Consequently, the Commission estimates that there are fewer than 858 small carriers providing wireless telephony services and fewer than 576 small companies providing paging and messaging services that may be affected by these rules.

31. Resellers. Neither the Commission nor the SBA has developed a definition of small entities specifically applicable to resellers. The closest applicable definition under the SBA's rules is for all telephone communications companies. The most reliable source of information regarding the number of toll resellers nationwide of which the Commission is aware appears to be the data that it collects annually in connection with the TRS. According to the Commission's most recent data, 710 companies reported that they were engaged in the resale of telephone services. Although it seems certain that some of these carriers are not independently owned and operated, or have more than 1,500 employees, the Commission is unable at this time to estimate with greater precision the number of resellers that would qualify as small business concerns under the SBA's definition. Consequently, the Commission estimates that there are fewer than 710 small entity resellers that may be affected by this order.

Description of Projected Reporting, Recordkeeping, and Other Compliance Requirements for Small Entities

32. In this Order, the Commission takes a number of steps that may affect small entities that use customers' CPNI outside of the total service approval or statutory exceptions in section 222. Some of the approval and notice requirements discussed herein will require additional reporting, recordkeeping or compliance requirements for service providers; however, certain approval and notice requirements discussed herein will also decrease certain reporting, recordkeeping or compliance requirements for service providers. The Commission believes that, overall, these new requirements will lessen the regulatory burden on small carriers by allowing carriers to obtain customers' consent through an opt-out approval mechanism to use customers' CPNI for marketing communications-related services.

33. This Order imposes the following additional reporting, recordkeeping or compliance requirements on all carriers. None of these requirements should affect small carriers disproportionately or require special professional skills. First, carriers must obtain opt-in CPNI approval for certain CPNI uses, and have the choice of obtaining opt-out or opt-in approval for other CPNI uses. As discussed in section III.C.1, supra, a carrier may determine whether to use one notice or multiple notices, and may request and provide notice relevant only to the CPNI uses the carriers proposes to make. Accordingly, if, as OPASTCO claims, its members only intend to use CPNI internally for marketing communications-related services, its member small carriers will only have to obtain opt-out approval from their customers.

34. Carriers who use opt-out approval must provide notice to their customers every two years. This requirement, while an added burden on all carriers, is counterbalanced by the fact that carriers who choose to use the opt-out method will be able to use and disclose more CPNI for marketing than under the opt-in method. Accordingly, a carrier that finds the burden of biennial notices to outweigh the benefit of expanded CPNI access can choose to obtain opt-in approval from its customers and avoid the biennial notice requirement. Additionally, notice requirements are common in the telecommunications industry and the requirements adopted here allow carriers flexibility in determining how to provide such notices. Accordingly, all carriers, including small carriers, should already have resources in place to provide notices required by such regulations to their customers.

35. The Commission requires carriers who use e-mail notices to advise their customers of their opt-out CPNI choices to abide by certain requirements. These requirements are not burdensome. To the degree that any carrier could seriously argue that these requirements are burdensome, carriers are not required to use e-mail to notify their customers of CPNI policies. Accordingly, a carrier can choose the least burdensome notification method allowed under our rules, based on the carrier's individual circumstances.

36. In addition, the Commission adds minor content requirements to our notice rules to synchronize the rules with the newly adopted consent requirements. These requirements should require minimal effort on the part of carriers, large and small, to implement. Furthermore, the Commission also streamlines the notice requirements for carriers to obtain limited, one-time use of consumers' CPNI for the duration of an inbound or outbound call with the customer, which will benefit small carriers.

37. The Commission adopts a 30-day minimum period of time that carriers must wait after giving customers' opt-out notice before assuming customer approval. Every carrier commenter supported the 30-day time period. Such a time period imposes minimal burden on carriers. This is especially true because the 30-day waiting period has been the interim rule since we adopted the CPNI Clarification Order and has been the subject of no carrier complaints or concerns.

38. The Commission adopts a requirement that carriers make available to every customer a method to opt-out that is of no additional cost and available 24 hours a day, seven days a week. This requirement can be satisfied through a combination of methods, so long as all customers have the ability to opt-out at no cost and are able to effectuate that choice whenever they choose. To the degree that carriers find that the burden of meeting this requirement outweigh the value of using an opt-out approval method, carriers are free to use opt-in. Carriers are otherwise free to determine what methods to use to allow customer to effectuate their CPNI elections. Although this requirement will impose a burden on small and large carriers alike, the Commission strongly believes that two factors mitigate against allowing small carriers to utilize less burdensome alternatives. First, as the Commission has previously held, there is nothing in this record that convinces it that customers of small carriers are entitled to lesser protection of the privacy of their calling records than those customers of larger carriers. Accordingly, it would be inappropriate to allow small carriers to provide less effective methods for customers to effectuate their CPNI choices. Second, to the degree that these requirements impose burdens on carriers, those burdens are outweighed by the value of using an opt-out approval mechanism to obtain customer approval to use CPNI for marketing communications-related services. Should carriers find that not to be the case in their individual situations, they can avoid the 24/7 requirement by adopting an opt-in approval mechanism.

39. The Commission forbears from applying our CPNI approval regulations to preferred carrier (“PC”) freezes, allowing small and large carriers alike easier access to PC-freeze information.

Steps Taken to Minimize Significant Economic Impact on Small Entities, and Significant Alternatives Considered

40. The RFA requires an agency to describe any significant alternatives that it has considered in reaching its proposed approach, which may include the following four alternatives (among others): “(1) The establishment of differing compliance or reporting requirements or timetables that take into account the resources available to small entities; (2) the clarification, consolidation, or simplification of compliance or reporting requirements under the rule for small entities; (3) the use of performance, rather than design, standards; and (4) an exemption from coverage of the rule, or any part thereof, for small entities.”

41. While the approval and related notice measures adopted in this Order apply similarly to both small and large entities, the Commission expects that small entities are likely to benefit to the extent such firms have fewer or reduced resources available, as compared to large firms. The Commission's previously adopted rules required all carriers to obtain opt-in approval from their customers to use CPNI outside of the total service approach. Although the Commission allowed carriers to use opt-out as an interim measure in light of the Tenth Circuit's opinion, that approach was never codified or adopted as a permanent rule. As discussed above, this Order adopts an approach that is derived from a careful balancing of harms, benefits, and governmental interests. First, use of CPNI by carriers or disclosure to their affiliated entities providing communications-related services, as well as third-party agents and joint venture partners providing communications-related services, requires a customer's knowing consent in the form of notice and “opt-out” approval. Second, disclosure of CPNI to unrelated third parties or to carrier affiliates that do not provide communications-related services requires express customer consent, described as “opt-in” approval. Finally, the Commission reaffirms its “total services approach,” which permits the carrier to use CPNI to market new product offerings within the carrier-customer service relationship, on the basis of the customer's implied consent.

42. Accordingly, the Commission concludes that the measures adopted and described in this Order would reduce regulatory burdens for small carriers including resellers, by allowing carriers access to CPNI for marketing communications-related services to their customers via an opt-out mechanism. Further, the Order specifically allows carriers to use opt-in approval for all CPNI uses should a carrier determine that opt-in is more appropriate for its individual circumstances, allowing carriers to make decisions regarding their customers and resources.

43. Furthermore, as noted above, the previously adopted opt-in rules were subject to and complied with the requirements of the RFA. Accordingly, the Commission has previously undertaken an analysis of opt-in and potential alternatives with respect to small carriers. Although such analysis does not replace the analysis that the Commission must perform in this Order, it provides meaningful guidance. In previous CPNI Orders, the Commission received comment from several parties on the impact of proposed rules on small carriers. After extensive analysis, the Commission found that “[a]fter consideration of possible alternatives, we have concluded that our rules should apply equally to all carriers.” The Commission's reasoning remains valid today. Of special importance in this context, the Commission's consistent determination, made throughout this proceeding, that “we are unpersuaded that customers of small businesses have less meaningful privacy interests in their CPNI.” This is especially true because, in drafting section 222, Congress determined that CPNI protections should apply to consumers of “[e]very telecommunications carrier.”

44. In this Order, the Commission also describes commenters' positions regarding other appropriate approval methods and related notice issues and states why those alternatives that the Commission does not adopt would not serve the public interest. For example, many carriers, including small carriers, proposed that we allow carriers to use opt-out approval for all CPNI uses. However, as it points out in this Order, the Commission must fulfill its statutorily imposed duty to protect consumers' CPNI, while balancing those interests with carriers' First Amendment interests. Therefore, as discussed in detail in the Order, the Commission concludes that the CPNI rules it adopts—which balance in an equitable fashion all consumers” privacy rights with carriers' First Amendment rights—strike the right balance for small and large carriers alike. Moreover, the Commission gains assurance from knowing that the rules it adopts benefit small carriers and serve the public interest by allowing carriers with expanded access to consumers' CPNI from its original opt-in rules.

45. Report to Congress. The Commission will send a copy of this Order, including this FRFA, in a report to be sent to Congress pursuant to the Congressional Review Act. In addition, the Commission will send a copy of this Order, including this FRFA, to the Chief Counsel for Advocacy of the SBA. A copy of this Order and FRFA (or summaries thereof) will also be published in the Federal Register.

Ordering Clauses

46. Accordingly, it is ordered, pursuant to sections 1, 4(i), 222 and 303(r) of the Communications Act of 1934, as amended, 47 U.S.C. 151, 154(i), 222 and 303(r ), that the Third Report and Order and Third Further Notice of Proposed Rulemaking in CC Docket Nos. 96-115, 96-149, and 00-257 are adopted, and that part 64 of the Commission's rules, 47 CFR part 64, is amended as set forth in the rule changes. The requirements of this Order shall become effective October 21, 2002, except §§ 64.2007, 64.2008, and 64.2009 which contain information collection requirements that have not been approved by OMB. The Commission will publish a document in the Federal Register announcing the effective date of these rules.

47. It is further ordered that the collection of information contained herein is contingent upon approval by the Office of Management and Budget.

48. It is further ordered that the California Public Utilities Commission's Motion to Accept Late-Filed Comments is hereby granted.

49. It is further ordered that, pursuant to sections 1, 4(i), 10 and 222 of the Communications Act of 1934, as amended, 47 U.S.C. 151, 154(i), 160 and 222, MCI WorldCom's Petition for Further Reconsideration is granted to the extent indicated herein and otherwise denied.

50. It is further ordered that the Commission's Consumer and Governmental Affairs Bureau, Reference Information Center, shall send a copy of this Third Report and Order, including the Final Regulatory Flexibility Analysis, to the Chief Counsel for Advocacy of the Small Business Administration.

List of Subjects in 47 CFR Part 64

• Communications common carriers

Federal Communications Commission.

Marlene H. Dortch,

Secretary.

Rule Changes

For the reasons discussed in the preamble, the Federal Communications Commission amends 47 CFR part 64 as follows:

PART 64—MISCELLANEOUS RULES RELATING TO COMMON CARRIERS

1. The authority citation for part 64 continues to read as follows:

Authority: 47 U.S.C. 154.

1a. Revise § 64.2003 to read as follows:

§ 64.2003

Definitions.

Terms in this subpart have the following meanings:

(a) Affiliate. The term “affiliate” has the same meaning given such term in section 3(1) of the Communications Act of 1934, as amended, 47 U.S.C. 153(1).

(b) Communications-related services. The term “communications-related services” means telecommunications services, information services typically provided by telecommunications carriers, and services related to the provision or maintenance of customer premises equipment.

(c) Customer. A customer of a telecommunications carrier is a person or entity to which the telecommunications carrier is currently providing service.

(d) Customer proprietary network information (CPNI). The term “customer proprietary network information (CPNI)” has the same meaning given to such term in section 222(h)(1) of the Communications Act of 1934, as amended, 47 U.S.C. 222(h)(1).

(e) Customer premises equipment (CPE). The term “customer premises equipment (CPE)” has the same meaning given to such term in section 3(14) of the Communications Act of 1934, as amended, 47 U.S.C. 153(14).

(f) Information services typically provided by telecommunications carriers. The phrase “information services typically provided by telecommunications carriers” means only those information services (as defined in section 3(20) of the Communications Act of 1934, as amended, 47 U.S.C. 153(2)) that are typically provided by telecommunications carriers, such as Internet access or voice mail services. Such phrase “information services typically provided by telecommunications carriers,” as used in this subpart, shall not include retail consumer services provided using Internet websites (such as travel reservation services or mortgage lending services), whether or not such services may otherwise be considered to be information services.

(g) Local exchange carrier (LEC). The term “local exchange carrier (LEC)” has the same meaning given to such term in section 3(26) of the Communications Act of 1934, as amended, 47 U.S.C. 153(26).

(h) Opt-in approval. The term “opt-in approval” refers to a method for obtaining customer consent to use, disclose, or permit access to the customer's CPNI. This approval method requires that the carrier obtain from the customer affirmative, express consent allowing the requested CPNI usage, disclosure, or access after the customer is provided appropriate notification of the carrier's request consistent with the requirements set forth in this subpart.

(i) Opt-out approval. The term “opt-out approval” refers to a method for obtaining customer consent to use, disclose, or permit access to the customer's CPNI. Under this approval method, a customer is deemed to have consented to the use, disclosure, or access to the customer's CPNI if the customer has failed to object thereto within the waiting period described in § 64.2009(d)(1) after the customer is provided appropriate notification of the carrier's request for consent consistent with the rules in this subpart.

(j) Subscriber list information (SLI). The term “subscriber list information (SLI)” has the same meaning given to such term in section 222(h)(3) of the Communications Act of 1934, as amended, 47 U.S.C. 222(h)(3).

(k) Telecommunications carrier or carrier. The terms “telecommunications carrier” or “carrier” shall have the same meaning as set forth in section 3(44) of the Communications Act of 1934, as amended, 47 U.S.C. 153(44).

(l) Telecommunications service. The term “telecommunications service” has the same meaning given to such term in section 3(46) of the Communications Act of 1934, as amended, 47 U.S.C. 153(46).

4. Amend § 64.2005 by revising paragraphs (a) introductory text, and (a)(2); (b) introductory text, and (b)(1) to read as follows:

§ 64.2005

Use of customer proprietary network information without customer approval.

(a) Any telecommunications carrier may use, disclose, or permit access to CPNI for the purpose of providing or marketing service offerings among the categories of service (i.e., local, interexchange, and CMRS) to which the customer already subscribes from the same carrier, without customer approval.

* * * * *

(2) If a telecommunications carrier provides different categories of service, but a customer does not subscribe to more than one offering by the carrier, the carrier is not permitted to share CPNI with its affiliates, except as provided in § 64.2007(b).

(b) A telecommunications carrier may not use, disclose, or permit access to CPNI to market to a customer service offerings that are within a category of service to which the subscriber does not already subscribe from that carrier, unless that carrier has customer approval to do so, except as described in paragraph (c) of this section.

(1) A wireless provider may use, disclose, or permit access to CPNI derived from its provision of CMRS, without customer approval, for the provision of CPE and information service(s). A wireline carrier may use, disclose or permit access to CPNI derived from its provision of local exchange service or interexchange service, without customer approval, for the provision of CPE and call answering, voice mail or messaging, voice storage and retrieval services, fax store and forward, and protocol conversion.

* * * * *

5. Revise § 64.2007 to read as follows:

§ 64.2007

Approval required for use of customer proprietary network information.

(a) A telecommunications carrier may obtain approval through written, oral or electronic methods.

(1) A telecommunications carrier relying on oral approval shall bear the burden of demonstrating that such approval has been given in compliance with the Commission's rules in this part.

(2) Approval or disapproval to use, disclose, or permit access to a customer's CPNI obtained by a telecommunications carrier must remain in effect until the customer revokes or limits such approval or disapproval.

(3) A telecommunications carrier must maintain records of approval, whether oral, written or electronic, for at least one year.

(b) Use of Opt-Out and Opt-In Approval Processes. (1) A telecommunications carrier may, subject to opt-out approval or opt-in approval, use its customer's individually identifiable CPNI for the purpose of marketing communications-related services to that customer. A telecommunications carrier may, subject to opt-out approval or opt-in approval, disclose its customer's individually identifiable CPNI, for the purpose of marketing communications-related services to that customer, to its agents; its affiliates that provide communications-related services; and its joint venture partners and independent contractors. A telecommunications carrier may also permit such persons or entities to obtain access to such CPNI for such purposes. Any such disclosure to or access provided to joint venture partners and independent contractors shall be subject to the safeguards set forth in paragraph (b)(2) of this section.

(2) Joint Venture/Contractor Safeguards. A telecommunications carrier that discloses or provides access to CPNI to its joint venture partners or independent contractors shall enter into confidentiality agreements with independent contractors or joint venture partners that comply with the following requirements. The confidentiality agreement shall:

(i) Require that the independent contractor or joint venture partner use the CPNI only for the purpose of marketing or providing the communications-related services for which that CPNI has been provided;

(ii) Disallow the independent contractor or joint venture partner from using, allowing access to, or disclosing the CPNI to any other party, unless required to make such disclosure under force of law; and

(iii) Require that the independent contractor or joint venture partner have appropriate protections in place to ensure the ongoing confidentiality of consumers' CPNI.

(3) Except for use and disclosure of CPNI that is permitted without customer approval under section § 64.2005, or that is described in paragraph (b)(1) of this section, or as otherwise provided in section 222 of the Communications Act of 1934, as amended, a telecommunications carrier may only use, disclose, or permit access to its customer's individually identifiable CPNI subject to opt-in approval.

6. Add § 64.2008 to subpart U to read as follows:

§ 64.2008

Notice required for use of customer proprietary network information.

(a) Notification, Generally. (1) Prior to any solicitation for customer approval, a telecommunications carrier must provide notification to the customer of the customer's right to restrict use of, disclosure of, and access to that customer's CPNI.

(2) A telecommunications carrier must maintain records of notification, whether oral, written or electronic, for at least one year.

(b) Individual notice to customers must be provided when soliciting approval to use, disclose, or permit access to customers' CPNI.

(c) Content of Notice. Customer notification must provide sufficient information to enable the customer to make an informed decision as to whether to permit a carrier to use, disclose, or permit access to, the customer's CPNI.

(1) The notification must state that the customer has a right, and the carrier has a duty, under federal law, to protect the confidentiality of CPNI.

(2) The notification must specify the types of information that constitute CPNI and the specific entities that will receive the CPNI, describe the purposes for which CPNI will be used, and inform the customer of his or her right to disapprove those uses, and deny or withdraw access to CPNI at any time.

(3) The notification must advise the customer of the precise steps the customer must take in order to grant or deny access to CPNI, and must clearly state that a denial of approval will not affect the provision of any services to which the customer subscribes. However, carriers may provide a brief statement, in clear and neutral language, describing consequences directly resulting from the lack of access to CPNI.

(4) The notification must be comprehensible and must not be misleading.

(5) If written notification is provided, the notice must be clearly legible, use sufficiently large type, and be placed in an area so as to be readily apparent to a customer.

(6) If any portion of a notification is translated into another language, then all portions of the notification must be translated into that language.

(7) A carrier may state in the notification that the customer's approval to use CPNI may enhance the carrier's ability to offer products and services tailored to the customer's needs. A carrier also may state in the notification that it may be compelled to disclose CPNI to any person upon affirmative written request by the customer.

(8) A carrier may not include in the notification any statement attempting to encourage a customer to freeze third-party access to CPNI.

(9) The notification must state that any approval, or denial of approval for the use of CPNI outside of the service to which the customer already subscribes from that carrier is valid until the customer affirmatively revokes or limits such approval or denial.

(10) A telecommunications carrier's solicitation for approval must be proximate to the notification of a customer's CPNI rights.

(d) Notice Requirements Specific to Opt-Out. A telecommunications carrier must provide notification to obtain opt-out approval through electronic or written methods, but not by oral communication (except as provided in paragraph (f) of this section). The contents of any such notification must comply with the requirements of paragraph (c) of this section.

(1) Carriers must wait a 30-day minimum period of time after giving customers notice and an opportunity to opt-out before assuming customer approval to use, disclose, or permit access to CPNI. A carrier may, in its discretion, provide for a longer period. Carriers must notify customers as to the applicable waiting period for a response before approval is assumed.

(i) In the case of an electronic form of notification, the waiting period shall begin to run from the date on which the notification was sent; and

(ii) In the case of notification by mail, the waiting period shall begin to run on the third day following the date that the notification was mailed.

(2) Carriers using the opt-out mechanism must provide notices to their customers every two years.

(3) Telecommunications carriers that use e-mail to provide opt-out notices must comply with the following requirements in addition to the requirements generally applicable to notification:

(i) Carriers must obtain express, verifiable, prior approval from consumers to send notices via e-mail regarding their service in general, or CPNI in particular;

(ii) Carriers must allow customers to reply directly to e-mails containing CPNI notices in order to opt-out;

(iii) Opt-out e-mail notices that are returned to the carrier as undeliverable must be sent to the customer in another form before carriers may consider the customer to have received notice;

(iv) Carriers that use e-mail to send CPNI notices must ensure that the subject line of the message clearly and accurately identifies the subject matter of the e-mail; and

(v) Telecommunications carriers must make available to every customer a method to opt-out that is of no additional cost to the customer and that is available 24 hours a day, seven days a week. Carriers may satisfy this requirement through a combination of methods, so long as all customers have the ability to opt-out at no cost and are able to effectuate that choice whenever they choose.

(e) Notice Requirements Specific to Opt-In. A telecommunications carrier may provide notification to obtain opt-in approval through oral, written, or electronic methods. The contents of any such notification must comply with the requirements of paragraph (c) of this section.

(f) Notice Requirements Specific to One-Time Use of CPNI. (1) Carriers may use oral notice to obtain limited, one-time use of CPNI for inbound and outbound customer telephone contacts for the duration of the call, regardless of whether carriers use opt-out or opt-in approval based on the nature of the contact.

(2) The contents of any such notification must comply with the requirements of paragraph (c) of this section, except that telecommunications carriers may omit any of the following notice provisions if not relevant to the limited use for which the carrier seeks CPNI:

(i) Carriers need not advise customers that if they have opted-out previously, no action is needed to maintain the opt-out election;

(ii) Carriers need not advise customers that they may share CPNI with their affiliates or third parties and need not name those entities, if the limited CPNI usage will not result in use by, or disclosure to, an affiliate or third party;

(iii) Carriers need not disclose the means by which a customer can deny or withdraw future access to CPNI, so long as carriers explain to customers that the scope of the approval the carrier seeks is limited to one-time use; and

(iv) Carriers may omit disclosure of the precise steps a customer must take in order to grant or deny access to CPNI, as long as the carrier clearly communicates that the customer can deny access to his CPNI for the call.

7. Amend § 64.2009 by revising paragraphs (c) and (d) and by adding paragraph (f) to read as follows:

§ 64.2009

Safeguards required for use of customer proprietary network information.

* * * * *

(c) All carriers shall maintain a record, electronically or in some other manner, of their own and their affiliates' sales and marketing campaigns that use their customers' CPNI. All carriers shall maintain a record of all instances where CPNI was disclosed or provided to third parties, or where third parties were allowed access to CPNI. The record must include a description of each campaign, the specific CPNI that was used in the campaign, and what products and services were offered as a part of the campaign. Carriers shall retain the record for a minimum of one year.

(d) Telecommunications carriers must establish a supervisory review process regarding carrier compliance with the rules in this subpart for outbound marketing situations and maintain records of carrier compliance for a minimum period of one year. Specifically, sales personnel must obtain supervisory approval of any proposed outbound marketing request for customer approval.

* * * * *

(f) Carriers must provide written notice within five business days to the Commission of any instance where the opt-out mechanisms do not work properly, to such a degree that consumers' inability to opt-out is more than an anomaly.

(1) The notice shall be in the form of a letter, and shall include the carrier's name, a description of the opt-out mechanism(s) used, the problem(s) experienced, the remedy proposed and when it will be/was implemented, whether the relevant state commission(s) has been notified and whether it has taken any action, a copy of the notice provided to customers, and contact information.

(2) Such notice must be submitted even if the carrier offers other methods by which consumers may opt-out.