[Federal Register Volume 63, Number 79 (Friday, April 24, 1998)]
[Rules and Regulations]
[Pages 20326-20339]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 98-10740]


=======================================================================
-----------------------------------------------------------------------

FEDERAL COMMUNICATIONS COMMISSION

47 CFR Parts 22 and 64

[CC Docket No. 96-115; FCC 98-27]


Telecommunications Carriers' Use of Customer Proprietary Network 
Information and Other Customer Information

AGENCY: Federal Communications Commission.

ACTION: Final rule.

-----------------------------------------------------------------------

SUMMARY: The Second Report and Order (Order) released February 26, 1998 
promulgates regulations to implement the statutory obligations of 
section 222 of the Telecommunications Act of 1996 relating to 
telecommunications carriers' use of Customer Proprietary Network 
Information (CPNI) and other customer information. The Order resolves 
CPNI issues raised in other proceedings that have been deferred to this 
proceeding, including obligations in connection with sections 272 and 
274 of the 1996 Act.

EFFECTIVE DATE: May 26, 1998.

FOR FURTHER INFORMATION CONTACT: Lisa Choi, Attorney, Common Carrier 
Bureau, Policy and Program Planning Division, (202) 418-1580. For 
additional information concerning the information collections contained 
in this Order, contact Judy Boley at (202) 418-0214, or via the 
Internet at [email protected].

SUPPLEMENTARY INFORMATION: This is a summary of the Commission's Order 
adopted February 19, 1998, and released February 26, 1998. The full 
text of this Order is available for inspection and copying during 
normal business hours in the FCC Reference Center, 1919 M St., N.W., 
Room 239, Washington, D.C. The complete text also may be obtained 
through the World Wide Web, at http://www.fcc.gov/Bureaus/Common 
Carrier/Orders/fcc98-27.wp, or may be purchased from the Commission's 
copy contractor, International Transcription Service, Inc., (202) 857-
3800, 1231 20th St., N.W., Washington, D.C. 20036. This Report and 
Order contains new or modified information collections subject to the 
Paperwork Reduction Act of 1995 (PRA). It has been submitted to the 
Office of Management and Budget (OMB) for review under the PRA. OMB, 
the general public, and other federal agencies are invited to comment 
on the new or modified information collections contained in this 
proceeding.

Regulatory Flexibility Certification

    As required by the Regulatory Flexibility Act, the Order contains a 
Final Regulatory Flexibility Analysis which is set forth in the Order. 
A brief description of the analysis follows.
    Pursuant to section 604 of the Regulatory Flexibility Act, the 
Commission performed a comprehensive analysis of the Order with regard 
to small entities. This analysis includes: (1) a succinct statement of 
the need for, and objectives of, the Commission's decisions in the 
Order; (2) a summary of the significant issues raised by the public 
comments in response to the initial regulatory flexibility analysis, a 
summary of the Commission's assessment of these issues, and a statement 
of any changes made in the Order as a result of the comments; (3) a 
description of and an estimate of the number of small entities to which 
the Order will apply; (4) a description of the projected reporting, 
recordkeeping and other compliance requirements of the Order, including 
an estimate of the classes of small entities which will be subject to 
the requirement and the type of professional skills necessary for 
compliance with the requirement; (5) a description of the steps the 
Commission has taken to minimize the significant economic impact on 
small entities consistent with the stated objectives of applicable 
statutes, including a statement of the

[[Page 20327]]

factual, policy, and legal reasons for selecting the alternative 
adopted in the Order and why each one of the other significant 
alternatives to each of the Commission's decisions which affect small 
entities was rejected.

Paperwork Reduction Act

    This Report and Order contains either a new or modified information 
collection. The Commission, as part of its continuing effort to reduce 
paperwork burdens, invites the general public and the Office of 
Management and Budget (OMB) to comment on the information collections 
contained in this Order, as required by the Paperwork Reduction Act of 
1995, Public Law 104-12. Written comments by the public on the 
information collections are due 30 days after date of publication in 
the Federal Register. OMB notification of action is due July 6, 1998. 
Comments should address: (1) whether the new or modified collection of 
information is necessary for the proper performance of the functions of 
the Commission, including whether the information shall practical 
utility; (b) the accuracy of the Commission's burden estimates; (c) 
ways to enhance the quality, utility, and clarity of the information 
collected; and (d) ways to minimize the burden of the collection of 
information on the respondents including the use of automated 
collection techniques or other forms of information technology.
    OMB Control Number: 3060-0715.
    Title: Implementation of the Telecommunications Act of 1996: 
Telecommunications Carriers' Use of customer proprietary Network 
Information and Other Customer Information.
    Form No.: N/A.
    Type of Review: Revised collection.
    Respondents: Business or other for-profit.
    Public reporting burden for the collection of information is 
estimated as follows:

----------------------------------------------------------------------------------------------------------------
                                         Number of                                                              
       Information collection           respondents       Annual hour burden per         Total annual burden    
                                      (approximately)            response                                       
----------------------------------------------------------------------------------------------------------------
Customer Approval (47 CFR 64.2007)..          4,832    78 hours...................  376,896 hours.              
Customer Approval Documentation and           4,832    30 minutes.................  2,416 hours.                
 Recordkeeping (47 CFR 64.2007(e)                                                                               
 and 64.2009).                                                                                                  
Notification of CPNI Rights (47 CFR           4,832    78 hours...................  376,896 hours.              
 64.2007(f)).                                                                                                   
Notification Recordkeeping (47 CFR            4,832    30 minutes.................  2,416 hours.                
 64.2007(e)).                                                                                                   
Audit Mechanism (47 CFR 64.2009)....          4,832    30 minutes.................  2,416 hours.                
Event Histories Recordkeeping (47             4,832    30 minutes.................  2,416 hours.                
 CFR 64.2009(d)).                                                                                               
Corporate Compliance Certification            4,832    1 hour.....................  4,832 hours.                
 (47 CFR 64.2009(e)).                                                                                           
Aggregate customer Information                1,400    1 hour.....................  1,400 hours.                
 Disclosure Requirements for LECs.                                                                              
Subscriber List Information                   1,400    4 hours....................  5,600 hours.                
 Disclosure Requirement for                                                                                     
 Providers of Telephone Exchange                                                                                
 Service*.                                                                                                      
CPNI Disclosure to Third Parties*...            500    5 hours....................  2,500 hours.                
----------------------------------------------------------------------------------------------------------------
*These requirements are imposed pursuant to statute. See 47 U.S.C. 222.                                         

    Total Annual Burden: 777,788 burden hours.
    Estimated Costs Per Respondents: $47,500 (avg.); Total cost to 
industry: $229,520,000.
    Needs and Uses: The Second Report and Order implements the 
statutory obligations of section 222 of the Telecommunications Act of 
1996. Among other things, carriers are permitted to use CPNI, without 
customer aproval, to market offerings that are related to, but limited 
by, the customer's existing service relationship with their carrier. 
Carriers must obtain express customer approval to use CPNI to market 
service outside the customer's existing service relationship. Carriers 
must provide a one-time notification of customers' CPNI rights prior to 
any solicitation for approval. All of the collections would be used to 
ensure that telecommunications carriers comply with the CPNI 
requirements the Commission promulgates in the Order and to implement 
section 222 of the statute.

Synopsis of Second Report and Order

I. Commission Authority

    1. We conclude that we have authority to promulgate regulations 
implementing section 222.

II. Carrier's Right to Use CPNI Without Customer Approval

A. Scope of a Carrier's Right Pursuant to Section 222(c)(1)(A): the 
``Total Service Approach''
    2. The statutory language makes clear that Congress did not intend 
for the implied customer approval to use, disclose, or permit access to 
CPNI under section 222(c)(1)(A) to extend to all of the categories of 
telecommunications services offered by the carrier, as proposed by 
advocates of the single category approach. First, Congress' repeated 
use of the singular ``telecommunications service'' must be given 
meaning. Section 222(c)(1) prohibits a carrier from using CPNI obtained 
from the provision of ``a telecommunications service'' for any purpose 
other than to provide ``the telecommunications service from which such 
information is derived'' or services necessary to, or used in, 
provision of ``such telecommunications service.'' We agree with many 
commenters that this language plainly indicates that Congress both 
contemplated the possible existence of more than one carrier service 
and made a deliberate decision that section 222(c)(1)(A) not extend to 
all. Indeed, Congress' reference to plural ``telecommunications 
services'' in sections 222(a) and 222(d)(1) demonstrates a clear 
distinction between the singular and plural forms of the term. Under 
well-established principles of statutory construction, ``where Congress 
has chosen different language in proximate subsections of the same 
statute,'' we are ``obligated to give that choice effect.'' Consistent 
with this, section 222(c)(1)'s explicit restriction of a carrier's 
``use'' of CPNI ``in the provision of'' service further evidences 
Congress' intent that carriers' own use of CPNI be limited to the 
service provided to the particular customer, and not be expanded to all 
the categories of telecommunications services available from the 
carrier.
    3. We therefore reject the single category approach as contrary to 
the statutory language.
    4. We likewise reject parties' suggestions that we interpret 
section 222(c)(1)(A) based on prior Commission decisions, including the 
McCaw orders, various Computer III orders, as well as the Common 
Carrier Bureau's opinion in BankAmerica v. AT&T, which permitted the 
sharing of customer information among affiliated companies based on the 
existing business relationship and the perceived benefits

[[Page 20328]]

of integrated marketing. We similarly reject parties' reliance on other 
statutes, particularly the Cable Television Consumer Protection and 
Competition Act (1992 Cable Act) and the Telephone Consumer Protection 
Act of 1991 (TCPA), as well as the Commission's implementation of those 
Acts. Neither of these statutes contains the specific and unique 
language of section 222 which expressly limits a carrier's ``use'' of 
customer information. Again, to the extent other provisions are 
probative, they indicate that Congress was clear when it intended to 
exempt information sharing within the context of the existing business 
relationship from general consumer protection provisions, but chose not 
to in section 222.
    5. We also conclude, contrary to the suggestion of its proponents, 
that the discrete offering approach is not required by the language of 
section 222(c)(1)(A).
    Our rejection of the discrete category approach, and support for 
the total service approach, is also informed by our understanding of 
the relationship between sections 222(c)(1)(A) and (d)(1). Had Congress 
intended to permit carriers to use CPNI only for ``rendering'' service, 
as suggested under the discrete offering approach, and as explicitly 
provided in section 222(d)(1), it would not have needed to create the 
exception in section 222(c)(1)(A). In contrast, by interpreting section 
222(c)(1)(A) as we do, to permit some use of CPNI for marketing 
purposes, we give meaning to both statutory provisions. Indeed, in 
contrast with the various parties' views concerning the scope of 
section 222(c)(1)(A), commenters that addressed the meaning of section 
222(d)(1) uniformly suggest that it does not extend to a carrier's use 
of CPNI for marketing purposes.
    6. The legislative history confirms our view that in section 222 
Congress intended neither to allow carriers unlimited use of CPNI for 
marketing purposes as they moved into new service avenues opened 
through the 1996 Act, nor to restrict carrier use of CPNI for marketing 
purposes altogether.
    7. Finally, we also reject the various arguments advanced by GTE, 
PacTel, USTA, and U S WEST that our adoption of an interpretation more 
limited than the single or two category approaches raises 
Constitutional concern.
    8. We reject the Constitutional takings arguments because, to the 
extent CPNI is property, we agree that it is better understood as 
belonging to the customer, not the carrier.
    9. We likewise reject parties' Equal Protection challenges based on 
section 222's limitation to telecommunications carriers alone.
    10. Non-Telecommunications Offerings. Several carriers argue that 
certain non-telecommunications offerings, in addition to being covered 
by section 222(c)(1)(B), also should be included within any service 
distinctions we adopt pursuant to section 222(c)(1)(A), including 
inside wiring, customer premises equipment (CPE), and certain 
information services. Based on the statutory language, however, we 
conclude that inside wiring, CPE, and information services do not fall 
within the scope of section 222(c)(1)(A) because they are not 
``telecommunications services.'' More specifically, section 
222(c)(1)(A) refers expressly to carrier use of CPNI in the provision 
of a ``telecommunications service.''
    11. We conclude that carriers may not use CPNI derived from the 
provision of a telecommunications service for the provision or 
marketing of information services pursuant to section 222(c)(1)(A). We 
likewise conclude that inside wiring and CPE do not fall within the 
definition of ``telecommunications service,'' and thus do not fall 
within the scope of section 222(c)(1)(A).
    12. We also conclude that, to the extent that services formerly 
described as adjunct-to-basic are offered by CMRS providers, these 
should be considered either within the provision of CMRS under section 
222(c)(1)(A), or as services necessary to, or used in, CMRS under 
section 222(c)(1)(B). In addition, we agree with the result advocated 
by WTR, and conclude that a reasonable interpretation of section 
222(c)(1)(A) permits carriers to use, disclose, or permit access to 
CPNI for the limited purpose of conducting research on the health 
effects of their service.
    13. Special Treatment for Certain Carriers. We conclude that 
Congress did not intend to, and we should not at this time, distinguish 
among carriers for the purpose of applying section 222(c)(1). Based on 
the statutory language, it is clear that section 222 applies to all 
carriers equally and, with few exceptions, does not distinguish among 
classes of carriers.
    14. We also decline to forbear from applying section 222(c)(1), or 
any of our associated rules, to small or competitive carriers, as SBT 
requests.
    15. We also agree with a number of parties that there should be no 
restriction on the sharing of CPNI among a carrier's various 
telecommunications-related entities that provide different service 
offerings to the same customer.
    16. In addition to finding that the total service approach is most 
consistent with the statutory language and legislative history, we are 
persuaded that, as a policy matter, the total service approach also 
best advances the principles of customer control and convenience 
implicitly embodied in sections 222(c)(1) and (c)(2).
    17. Customers do not expect that carriers will need their approval 
to use CPNI for offerings within the existing total service to which 
they subscribe. We believe it reasonable to conclude that, where a 
customer subscribes to a diverse service offering--a mixture of local, 
long distance, and CMRS--from the same carrier or its subsidiary or 
affiliated companies, the customer views its telecommunications service 
as the total service offering that it has purchased, and can be 
presumed to have given implied consent to its carrier to use its CPNI 
for all aspects of that service.
    18. By contrast, neither the discrete offering approach nor the 
three category approach serves the statutory principle of customer 
convenience or reasonably reflects customers' expectations of what 
constitutes their telecommunications service.
    19. We also reject the discrete offering and three category 
approaches because we share the concern expressed by many parties that 
such restrictive interpretations may be difficult to implement as 
service distinctions, and corresponding customer subscriptions, become 
blurred with market and technological advances.
    20. Customers do not expect that carriers will use CPNI to market 
offerings outside the total service to which they subscribe.
    21. Second, even if the Westin survey accurately shows that 
customers desire ``one-stop shopping,'' and would permit carriers to 
share information in order to offer improved service, our 
interpretation of section 222(c)(1) does not foreclose carriers' 
ability to offer integrated packages nor the beneficial marketing uses 
to which CPNI can be made.
    22. To be sure, under the total service approach carriers may not 
use CPNI without prior customer approval to target customers they 
believe would be receptive to new categories of service.
    23. Finally, we reject the claim put forth by several proponents of 
the single category approach that narrower interpretations of section 
222(c)(1)(A) would result in significant administrative burdens for 
carriers. On the contrary, we conclude that the total service approach 
is the least onerous administratively.

[[Page 20329]]

B. Scope of Carrier's Right Pursuant to Section 222(c)(1)(B)
    24. As a threshold matter, given the wide range of views on the 
interpretation of section 222(c)(1)(B), we reject U S WEST's assertion 
that we simply craft rules repeating, verbatim, the statutory language. 
We clarify, however, that we do not attempt here to catalogue every 
service included within the scope of section 222(c)(1)(B), but rather 
address the specific offerings that have been proposed in the record as 
falling within that section, in particular, CPE, certain information 
services, and installation, maintenance, and repair services. We 
likewise believe that section 222(c)(1)(B) most appropriately is 
interpreted as recognizing that customers impliedly approve their 
carrier's use of CPNI in connection with certain non-telecommunications 
services. This implied approval, however, is expressly limited to those 
services ``necessary to, or used in, the provision of such 
telecommunications service.'' Through this limiting language, we 
believe carriers' CPNI use is confined only to certain non-
telecommunications services (i.e. those ``services'' either ``necessary 
to'' or ``used in''), as well as to those services that comprise the 
customer's total service offering (i.e. ``such [section 222(c)(1)(A)] 
telecommunications service'').
    25. CPE and Certain Information Services. Based on the statutory 
language we conclude that, contrary to the position advanced by several 
parties, a carrier may not use, disclose, or permit access to CPNI, 
without customer approval, for the provision of CPE and most 
information services because, as other commenters assert, they are not 
``services necessary to, or used in, the provision of such 
telecommunications service'' under section 222(c)(1)(B).
    26. Contrary to NYNEX's argument, we conclude that Congress' 
designation of the publishing of directories as ``necessary to, or used 
in'' the provision of a telecommunications service does not require a 
broad reading of section 222(c)(1)(B) that encompasses all information 
services. We are persuaded that section 222(c)(1)(B) covers services 
like those formerly characterized as ``adjunct-to-basic,'' in contrast 
to the information services such as call answering, voice mail or 
messaging, voice storage and retrieval services, fax store and forward, 
and Internet access services, that the parties identified in the 
record.
    27. Our interpretation is supported by Congress' example of the 
publishing of directories. The publishing of directories, like those 
services formerly described as adjunct-to-basic, can appropriately be 
viewed as necessary to and used in the provision of complete and 
adequate telecommunication service.
    28. As a matter of statutory construction, we find that the 
language of section 222(c)(1)(B) is clear and unambiguous, and does not 
permit the interpretation that CPE and most information services are 
``services necessary to, or used in, the provision of such 
telecommunications service.'' But even if that language is ambiguous, 
we are unpersuaded by parties' contrary arguments based on the 
legislative history and policy considerations.
    29. We also reject suggestions that restrictions on CPNI sharing in 
the context of CPE and information services would be contrary to 
customer expectations, as well as detrimental to the goals of customer 
convenience and one-stop shopping. As ITAA notes, CPNI is not required 
for one-stop shopping.
    30. Finally, we reject parties' contentions that we should permit 
carriers to use CPNI in connection with CPE and information services 
because the Commission in the past permitted more information sharing.
    31. Installation, Maintenance, and Repair Service. We conclude 
that, pursuant to section 222(c)(1)(B), a carrier may use, disclose, or 
permit access to CPNI, without customer approval, in its provision of 
inside wiring installation, maintenance, and repair services.
    32. Specifically, we are persuaded that installation, maintenance, 
and repair of inside wiring is a service both ``necessary to'' and 
``used in'' a carrier's provision of wireline telecommunications 
service. As such, carriers may use, without customer approval, CPNI 
derived from wireline service for the provision of inside wiring 
installation, maintenance, and repair services.
    33. We further believe that our conclusion is fully consistent with 
customer expectation, and thereby furthers the statutory principles of 
customer control and convenience embodied in section 222.
C. Scope of Carrier's Right Pursuant to Section 222(d)(1)
    34. In the context of installation, maintenance, and repair of 
inside wiring, we conclude that section 222(d)(1), as well as section 
222(c)(1)(B), permit carrier use of CPNI without customer approval for 
the provision of such services. We agree with virtually all commenters 
that section 222(d)(1)'s permission for carriers to use CPNI ``to 
initiate, render, bill, and collect for telecommunications services'' 
includes the actual installation, maintenance, and repair of inside 
wiring.
    35. Our conclusion is consistent with Equifax's concerns that we 
not interpret sections 222(d)(1) as well as 222(d)(2) in a manner that 
impedes carriers' access to information for the purpose of billing, 
fraud prevention, and related services, as well as the carriers' 
ability to provide the required information.
    36. Contrary to the claims of AT&T and MCI, we further conclude, 
however, that the term ``initiate'' in section 222(d)(1) does not 
require that CPNI be disclosed by carriers when competing carriers have 
``won'' the customer. We agree with GTE that section 222(d)(1) applies 
only to carriers already possessing the CPNI, within the context of the 
existing service relationship, and not to carriers seeking access to 
CPNI.
    37. Furthermore, a carrier's failure to disclose CPNI to a 
competing carrier that seeks to initiate service to a customer that 
wishes to subscribe to the competing carrier's service, may well, 
depending upon the circumstances, constitute an unreasonable practice 
in violation of section 201(b). We also do not believe, contrary to the 
position suggested by AT&T, that section 222(d)(1) permits the former 
(or soon-to-be former) carrier to use the CPNI of its former customer 
(i.e., a customer that has placed an order for service from a competing 
provider) for ``customer retention'' purposes.

III. ``Approval'' Under Section 222(c)(1)

A. Express Versus Notice and Opt-Out
    38. We conclude, contrary to the position of a number of parties, 
that an express approval mechanism is the best means to implement this 
provision because it will minimize any unwanted or unknowing disclosure 
of CPNI. In addition, such a mechanism will limit the potential for 
untoward competitive advantages by incumbent carriers. In contrast, 
under an opt-out approach, as even its proponents admit, because 
customers may not read their CPNI notices, there is no assurance that 
any implied consent would be truly informed.
    39. We are not persuaded by the statutory argument raised by the 
BOCs, AT&T, and GTE that Congress' requirement of an ``affirmative 
written request'' in section 222(c)(2) means that Congress intended to 
permit notice and opt-out when it required only ``approval'' in section 
222(c)(1).

[[Page 20330]]

    40. We likewise reject U S WEST's claim that the earliest versions 
of what became H.R. 1555 requires that we interpret ``approval'' to 
permit notice and opt-out.
    41. We believe that, although the legislative history offers no 
specific guidance on the meaning of ``approval'' in section 222(c)(1), 
the language in the Conference Report, explaining that section 222 
strives to ``balance both competitive and consumer privacy interests 
with regard to CPNI,'' strongly supports our conclusion that express 
approval is the better reading of the statutory language.
    42. We also reject the arguments that Congress' express provision 
for a notice and opt-out mechanism in section 551 of the Act somehow 
compels that result here even though the language of section 222 
contains no similar express reference to such a mechanism. To the 
contrary, section 551 confirms that Congress knew how to draft a notice 
and opt-out provision when it determined that such an approach was 
appropriate. For all these reasons we reject commenters' arguments that 
notice and opt-out is in some manner required by the language of 
section 222, or other precedent.
    43. We reject PacTel's and U S WEST's contention that customers do 
not expect carriers to seek affirmative approval for the use of 
information to market services to which they do not subscribe, and that 
to do so would confuse them. To the contrary, based on the results of U 
S WEST's affirmative approval market trial, as well as those of a 
similar trial reported by Ameritech, we believe that, when customers 
wish to do so, they have no problem understanding a carrier's 
solicitation for approval and granting consent for the use of CPNI 
outside the scope of their total service offering.
    44. We reject the argument that imposing an express approval 
requirement will ``effectively eliminate integrated marketing'' and 
thwart the development of one stop shopping. While section 222 
precludes carriers from jointly marketing certain services through the 
use of CPNI, nothing in section 222 prevents carriers from jointly 
marketing services without relying on CPNI, as CPI and Cox point out. 
Moreover, while the use of CPNI may facilitate the marketing of 
telecommunications services to which a customer does not subscribe, 
such use is not necessary for carriers to engage in joint marketing. We 
thus reject PacTel's contention that an express approval requirement 
would vitiate section 601(d) of the 1996 Act, which allows carriers to 
market CMRS services jointly with other telecommunications services, 
and section 272(g) of the Act, which permits BOC joint marketing of 
telephone exchange service and in-region interLATA service, under 
certain conditions. To the contrary, carriers are free to market 
jointly telecommunications services without using CPNI to the extent 
such marketing is otherwise permissible under other provisions. In 
addition, as TRA points out, a customer desiring an integrated 
telecommunications service offering tailored to its needs simply may 
give approval to allow its carrier to access CPNI for purposes outside 
of sections 222(c)(1)(A) and (B).
    45. We reject U S WEST's argument that an express approval 
requirement under section 222(c)(1) would impermissibly infringe upon a 
carrier's First Amendment rights. At the outset, we think there is a 
substantial question as to whether CPNI restrictions even implicate 
constitutionally protected ``speech.'' Carriers remain free to 
communicate with present or potential customers about the full range of 
services that they offer, and section 222 therefore does not prevent a 
carrier from engaging in protected speech with customers regarding its 
business or its products. What carriers cannot do is use confidential 
CPNI in a manner that is not permitted by the statute. While section 
222 may constrain carriers' ability to more easily ``target'' certain 
customers for marketing by limiting in some circumstances their 
internal use of confidential customer information, we question whether 
that of itself constitutes a restriction on protected ``speech'' within 
the purview of the First Amendment. Nevertheless, to the extent that it 
were concluded that CPNI restrictions under section 222 did affect 
carrier communications with their customers or unrelated third parties 
in such a way as to implicate the First Amendment, at most commercial 
speech would be at issue since any limitations under section 222 relate 
solely to the economic interests of the speaker and its audience. But 
any governmental restrictions on commercial speech will be upheld 
where, as here, the government asserts a substantial interest in 
support of the regulation, the regulation advances that interest, and 
the regulation is narrowly drawn. As the Supreme Court has observed, it 
has never deemed it an abridgement of freedom of speech to make a 
course of conduct illegal merely because the conduct was initiated or 
conducted in part through language; to the contrary, similar regulation 
of business activity has been held not to violate the first Amendment.
    46. We further conclude that an express approval requirement would 
not violate the free speech rights of customers. To the extent a 
customer wishes to receive information on offerings outside the scope 
of its total service offering, it simply may grant approval under 
section 222(c)(1). As we previously noted, to the extent customers are 
engaged in communications with their carrier regarding the servicing of 
their account, they are more likely to grant approval.
B. Written, Oral and/or Electronic Approval
    47. We conclude that carriers should be permitted to obtain such 
approval through written, oral, or electronic means, as several 
commenters contend.
    48. We disagree with parties arguing that section 222 mandates 
written approval. We find nothing in the language or design of section 
222 that limits carriers to obtaining only written approval, despite 
arguments advanced by some of these commenters.
    49. We also reject the contention that section 222(d)(3) of the Act 
supports a written approval requirement. While section 222(d)(3) 
contemplates oral approval in creating an exception for CPNI use during 
an inbound call, section 222(d)(3) also may be interpreted simply to 
permit a carrier to use CPNI to provide a customer with information for 
the duration of an inbound call, based on oral approval, even if the 
customer otherwise has restricted the carrier's use of its CPNI, as 
Ameritech points out.
    50. We conclude that a carrier relying on oral customer approval 
should be required to notify customers of their CPNI rights, and should 
bear the burden of demonstrating that a customer has granted approval 
subsequent to such notification pursuant to the rules we adopt in this 
order.
C. Duration, Frequency, and Scope of Approval
    51. We conclude that approval obtained by a carrier for the use of 
CPNI outside of section 222(c)(1), whether oral, written, or 
electronic, should remain in effect until the customer revokes or 
limits such approval, as some parties suggest. We do not require 
carriers to renew customer approval periodically, for example, annually 
or semi-annually, or to presume that customer approval is valid only 
for the duration of the transaction, if the customer has not otherwise 
specified the time period during which the approval remains valid.

[[Page 20331]]

    52. We decline to establish at this time a restriction on the 
number of times a carrier may contact a customer to obtain approval for 
the use of CPNI outside of section 222(c)(1), despite arguments raised 
by some parties.
    53. We conclude that allowing a customer to grant partial use of 
CPNI is consistent with one of the underlying principles of section 222 
to ensure that customers maintain control over CPNI. A carrier could 
obtain partial use by virtue of its ability to view customer records 
for a limited duration, notwithstanding the customer's restriction of 
CPNI use.
D. Verification of Approval
    54. We conclude that a carrier relying on oral approval under 
section 222(c)(1) should bear the burden of demonstrating that such 
approval has been given in compliance with the rules we adopt in this 
order, as a number of parties contend.
    55. Because carriers must bear the burden of demonstrating that 
they have obtained oral approval under section 222(c)(1), we find it 
unnecessary to mandate specific verification mechanisms at this time. 
In general, we agree with those commenters arguing that a carrier 
relying on oral approval should be able to meet its burden by, for 
example, audiotaping customer conversations, or by demonstrating that a 
qualified independent third party operating in a location physically 
separate from the carrier's telemarketing representative has obtained 
customer approval under section 222(c)(1) subsequent to adequate 
notification of its CPNI rights, and has confirmed the appropriate 
verification data, e.g., the customer's date of birth or social 
security number. In contrast, we would likely not consider the mere 
absence of any CPNI restriction in the customer's database or other 
account record sufficient to verify that a customer has given express 
approval in accordance with section 222(c)(1), despite SBC's 
suggestion. In addition, because carriers are required under our rules 
to notify customers of their CPNI rights prior to soliciting approval, 
we do not require them to send follow-up letters to customers 
confirming approval, contrary to some parties' contentions.
    56. Finally, we require that carriers maintain records of 
notification and approval, whether written, oral, or electronic, and be 
capable of producing them if the sufficiency of a customer's 
notification and approval is challenged. Maintenance of such records 
will facilitate the disposition of individual complaint proceedings. We 
thus require that carriers maintain such records for a period of at 
least one year in order to ensure a sufficient evidentiary record for 
CPNI compliance and verification purposes.
E. Informed Approval Through Notification
    57. We require carriers to provide their customers notification if 
the carrier wishes to use, disclose or permit access to CPNI beyond the 
purposes specified in sections 222(c)(1)(A) and (B); at this time, 
however, we make no decision on whether notice is required for use of 
CPNI within the scope of sections 222(c)(1)(A) and (B).
    58. We agree with the majority of commenters that customers must be 
made aware of their CPNI rights before they can be deemed to have 
``waived'' those rights.
    59. We reject BellSouth's contention that customers reasonably 
expect businesses with whom they have a pre-existing relationship to 
use CPNI to offer new services, and that therefore carrier use of CPNI 
for the development and marketing of services should be deemed to be 
permitted or invited, in the absence of specific notification to the 
customer. Specific notification of the customer's CPNI rights, as a 
component of informed ``approval'' under section 222(c)(1), is 
warranted for uses of CPNI outside the customer's total service 
offering.
F. Form and Content of Notification
    60. Form of Notification. We conclude that a carrier should be 
permitted to provide either written or oral notification, as a number 
of parties contend. Such notification, for example, may take the form 
of a bill insert, an individual letter, or an oral presentation that 
advises the customer of his or her right to restrict carrier access to 
CPNI.
    61. We are not persuaded by parties' assertions that oral 
notification is necessarily less verifiable than written, will result 
in abuses, create greater disputes and confuse customers, is too 
difficult to accomplish successfully, or could be used to dissuade 
customers from releasing CPNI to a competitor. We therefore conclude 
that a carrier providing verbal notification of a customer's CPNI 
rights must carry the burden of showing that such notice has been 
given, in compliance with the requirements we adopt in this order. We 
further find that carriers may use any reasonable method for verifying 
oral notification that adequately confirms that such notification has 
been given, including, but not limited to, audiotaping customer 
conversations or using an independent third party verification process.
    62. We find no reason to impose different notification requirements 
on large and small carriers, as some commenters suggest.
    63. Content of Notification. At a minimum, customer notification, 
whether oral or written, must provide sufficient information to enable 
the customer to make an informed decision as to whether to permit a 
carrier to use, disclose, or permit access to CPNI. If a carrier 
intends to share CPNI with an affiliate (or non-affiliate) outside the 
scope of section 222(c)(1), the notice must state that the customer has 
a right, and the carrier a duty, under federal law, to protect the 
confidentiality of CPNI. In addition, the notice must specify the types 
of information that constitute CPNI and the specific entities that will 
receive the CPNI, describe the purposes for which the CPNI will be 
used, and inform the customer of his or her right to disapprove those 
uses, and to deny or withdraw access to CPNI at any time. The 
notification also must advise customers of the precise steps they must 
take in order to grant or deny access to CPNI, and must clearly state 
that a denial of approval will not affect the provision of any services 
to which the customer subscribes. Any notification that does not 
provide the customer the option of denying access, or implies that 
approval is necessary to ensure the continuation of services to which 
the customer subscribes, or the proper servicing of the customer's 
account, would violate our notification requirements.
    64. We also require that any notification provided by a carrier for 
uses of CPNI outside of section 222(c)(1) be reasonably comprehensible 
and non-misleading. In this regard, a notification that uses, for 
example, legal or technical jargon could be deemed not to be 
``reasonably comprehensible'' under our requirements. If written notice 
is provided, the notice must be clearly legible, use sufficiently large 
type, and be placed in an area so as to be readily apparent to a 
customer. Finally, we require that, if any portion of a notification is 
translated into another language, then all portions of the notification 
must be translated into that language.
    65. We agree with CWI that a carrier should not be prohibited from 
stating in the notice that the customer's approval to use CPNI may 
enhance the carrier's ability to offer products and services tailored 
to the customer's needs. We also do not preclude a carrier from 
addressing the rights of unaffiliated third parties to obtain access to 
the customer's CPNI. Consequently, a carrier would not be prohibited 
from,

[[Page 20332]]

for example, informing a customer that it may direct the carrier to 
disclose CPNI to unaffiliated third parties upon submission to the 
carrier of an affirmative written request, pursuant to section 
222(c)(2) of the Act. However, a carrier would be prohibited from 
including any statement attempting to encourage a customer to freeze 
third party access to CPNI.
    66. We also conclude that carriers must provide notification of a 
customer's CPNI rights, whether oral or written, prior to any 
solicitation for approval. A customer must be fully informed of its 
right to restrict carrier access to sensitive information before it can 
waive that right. Any notification that is provided subsequent to a 
solicitation for customer approval under section 222(c)(1) is 
inadequate to inform a customer of such right. The notification may be 
in the same conversation or document as the solicitation for approval, 
as long as the customer would hear or read the notification prior to 
the solicitation for approval. Finally, we conclude that the 
solicitation for approval to use CPNI, whether in the form of a 
signature line, check-off box or other form, should be proximate to the 
written or oral notification, rather than at the end of a long document 
that the customer might sign for other purposes, or at the conclusion 
of a lengthy conversation with the customer, for example. Similarly, 
the solicitation for approval, if written, should not be on a document 
separate from the notification, even if such document is included 
within the same envelope or package. The notice should state that any 
customer approval, or denial of approval, for the use of CPNI outside 
of section 222(c)(1) is valid until the customer affirmatively revokes 
or limits such approval or denial.
    67. We conclude that carriers need only provide one-time 
notification to customers of their CPNI rights, as suggested by some 
parties.

IV. Aggregate Customer Information

    68. We reject the claim that our interpretation of sections 
222(c)(1) and 222(c)(3) would constitute an unlawful taking. Even 
assuming carriers have a property interest in either CPNI or aggregate 
customer information, our interpretation of sections 222(c)(1) and 
222(c)(3) does not ``deny all economically beneficial'' use of 
property, as it must, to establish a successful claim.
    69. Although LECs face certain obligations when they use aggregate 
customer information under section 222(c)(3), Congress did not require 
that LECs give aggregate customer information to their competitors upon 
request in all circumstances. Rather, when LECs use this aggregate 
information only to tailor their service offering to better suit the 
needs of their existing customers--that is, within the scope of 
sections 222(c)(1)(A) and (B), LECs do not need to disclose the 
aggregate information. Moreover, LECs are permitted to use the 
aggregate information when targeting new service customers--that is, 
for purposes beyond the scope of section 222(c)(1)(A) and (B). When 
they do so, LECs simply must give that information to others upon 
request.
    70. We also reject parties' Equal Protection challenge. In order to 
sustain an equal protection challenge, parties challenging the law must 
prove that the law has no rational relation to any conceivable 
legitimate legislative purpose. Making LEC aggregate customer 
information available on nondiscriminatory terms, when used for 
purposes beyond those in sections 222(c)(1)(A) and (B), is reasonably 
related to the legitimate goal of promoting open competition in 
telecommunications markets.
    71. Finally, regarding the LECs' notice obligations, the 
nondiscrimination requirement in section 222(c)(3) protects competitors 
from anticompetitive behavior by requiring that LECs make aggregate 
customer information available ``upon reasonable request.'' We 
interpret these terms to permit a requirement that LECs honor standing 
requests for disclosure of aggregate customer information at the same 
time and same price as when disclosed to, or used on behalf of, their 
affiliates.

V. Section 222 and Other Act Provisions

    72. We recognize an apparent conflict between sections 222 and 272. 
Because Congress did not make its intent clear, our resolution of the 
apparent conflict must therefore be guided by the interpretation that, 
in our judgment, best furthers the policies of these two provisions, 
and thereby, best reflects the statutory design. On this policy basis, 
we believe that interpreting section 272 to impose no additional 
obligations on the BOCs when they share CPNI with their statutory 
affiliates according to the requirements of section 222, as implemented 
in this order, most reasonably reconciles the goals of these two 
provisions.
    73. We are persuaded here that we should interpret section 274 to 
impose no additional CPNI requirements regarding the BOCs' use of CPNI 
in connection with their provision of electronic publishing. Thus, as 
in the case of section 272, where section 222 appropriately balances 
the potentially competing interests in the specific context of 
carriers' use and disclosure of CPNI, we conclude that we should not 
upset the balance by ``superimposing'' nondiscrimination standards in 
section 274.

VI. Commission's Existing CPNI Regulations

    74. We conclude that retaining the Computer III CPNI requirements, 
applicable solely to the BOCs, AT&T and GTE, would produce no 
discernable competitive protection, and would be confusing to both 
carriers and customers.
A. BOC Cellular CPNI Rule 22.903(f) and Computer II Rule 64.702(d)(3)
    75. We conclude that we should eliminate both rules 22.903(f) and 
64.702(d)(3).
B. Safeguards Under Section 222
    76. We confirm our tentative conclusion that the Computer III 
safeguards, as they currently operate, should not be applied to other 
carriers. Insofar as the statutory scheme we implement in this order 
fully supplants our Computer III CPNI framework, we are further 
persuaded that we should likewise not retain the CPNI safeguards 
designed to ensure compliance within the Computer III framework. The 
record nevertheless supports the need to specify safeguards to prevent 
unapproved use, disclosure, and access to customer CPNI by carrier 
personnel and unaffiliated entities under the new scheme.
    77. Although we believe different rules are not generally necessary 
for small or rural carriers, we note that such carriers may seek a 
waiver of our new CPNI rules if they can show that our rules would be 
unduly burdensome, and propose alternative methods for safeguarding the 
privacy of their customers, consistent with section 222.
    78. Access Restrictions. We decline to require restrictions that 
would prohibit carrier personnel from accessing CPNI of customers who 
have either failed, or expressly declined, to give requisite approval 
for carrier use of CPNI for marketing purposes.
    79. Use Restrictions and Personnel Training. We specifically 
require that carriers develop and implement software systems that 
``flag'' customer service records in connection with CPNI. Carriers 
have indicated that their systems could be modified relatively easily 
to accommodate such CPNI ``flags.'' The flag must be conspicuously 
displayed within a box or comment

[[Page 20333]]

field within the first few lines of the first computer screen. The flag 
must indicate whether the customer has approved the marketing use of 
his or her CPNI, and reference the existing service subscription. In 
conjunction with such software systems, we require that all employees 
with access to customer records be trained as to when they can and 
cannot access the customer's CPNI. Carriers must also maintain internal 
procedures to handle employees that misuse CPNI contrary to the 
carriers' stated policy. These requirements represent minimum 
guidelines that we believe most carriers can readily implement and that 
are not overly burdensome.
    80. Access Documentation. We require that carriers maintain an 
electronic audit mechanism that tracks access to customer accounts. The 
system must be capable of recording whenever customer records are 
opened, by whom, and for what purpose. We believe awareness of this 
``audit trail'' will discourage unauthorized, ``casual'' perusal of 
customer accounts, as well as afford a means of documentation that 
would either support or refute claimed deliberate carrier CPNI 
violations. We further require that carriers maintain such contact 
histories for a period of at least one year to ensure a sufficient 
evidentiary record for CPNI compliance and verification purposes.
    81. Supervisory Review for Outbound Marketing Campaigns. We require 
carriers to establish a supervisory review process that ensures 
compliance with CPNI restrictions when conducting outbound marketing. 
Although supervisory review would neither be convenient nor practical 
when customers initiate a service call (i.e., in the inbound marketing 
context), we believe that such review is fully warranted in connection 
with outbound marketing campaigns. There is both less likelihood that 
customers will detect CPNI violations and greater incentive for sales 
employees to misuse CPNI when the dialogue with the customer is 
initiated by the carrier. Indeed, a major focus of outbound sales 
representatives is on the acquisition of new customers rather than on 
the retention of, and service to, current customers. Accordingly, we 
require that sales personnel obtain supervisory review of any proposed 
request to use CPNI for outbound marketing purposes. We require 
carriers to maintain a record of the ``event histories'' (like contact 
histories) for at least one year from the date of the marketing 
campaign.
    82. Corporate Certification. We require each carrier to submit a 
certification signed by a current corporate officer, as an agent of the 
corporation, attesting that he or she has personal knowledge that the 
carrier is in compliance with our CPNI requirements on an annual basis. 
This certification must be made publicly available, and be accompanied 
by a statement explaining how the carrier is implementing our CPNI 
rules and safeguards.
    83. Additional requirements. The Commission will enforce all rules 
announced in this order upon their effective date. Because carriers may 
need time to conform their data systems and operations to comply with 
the software flags and electronic audit mechanisms required under this 
order, however, we will not seek enforcement of these specific 
safeguard rules for a period of eight months from the date these rules 
become effective. After that time, we authorize the Chief of the Common 
Carrier Bureau to undertake enforcement actions when necessary and 
appropriate, and, to the extent that carrier behavior justifies 
requirements beyond those outlined herein, to establish additional 
safeguards. This delegation to the Common Carrier Bureau will 
facilitate the handling of CPNI compliance issues in an expedited 
manner.

VII. Procedural Issues

A. Second Report and Order
1. Final Regulatory Flexibility Analysis
    84. As required by the Regulatory Flexibility Act (RFA), 5 U.S.C. 
603, an Initial Regulatory Flexibility Analysis (IRFA) was incorporated 
in the Notice. The Commission sought written public comment on the 
proposals in the Notice, including the IRFA. The Commission's Final 
Regulatory Flexibility Analysis (FRFA) in this Second Report and Order 
conforms to the RFA, as amended by the Contract With America 
Advancement Act of 1996 (CWAAA), Public Law No. 104-121, 110 Stat. 847 
(1996).
a. Need for and Objectives of the Proposed Rules
    85. The Commission, in compliance with section 222 of the 1996 Act, 
promulgates rules in this order to reflect Congress' directive to 
balance the competitive and customer privacy interests associated with 
the use and protection of customer proprietary network information 
(CPNI), while fully considering the impact of these requirements on 
small carriers. This order reflects the statutory principle that 
customers must have the opportunity to protect the information they 
view as sensitive and personal from use and disclosure by carriers. As 
a general matter, we find that customer approval for carriers to use, 
disclose, or permit access to CPNI is inferred from the existing 
customer-carrier relationship; therefore, we conclude that such consent 
should be limited to the ``total service offering'' to which the 
customer subscribes from a carrier. To preserve the customer's control 
over the dissemination of sensitive information, we require an express 
approval requirement for the use of CPNI beyond the total service 
offering to which the customer subscribes from a carrier. While these 
rules permit customers to decide whether and to what extent their CPNI 
is used, they also restrict carriers' anticompetitive use of CPNI.
b. Summary of Significant Issues Raised by the Public Comments in 
Response to the IRFA
    86. In the IRFA, the Commission generally stated that any rule 
changes that might occur as a result of this proceeding could impact 
small business entities. Specifically, in the IRFA, the Commission 
indicated there were no reporting, recordkeeping, or other compliance 
requirements. The IRFA solicited comment on alternatives to our 
proposed rules that would minimize the impact on small entities 
consistent with the objectives of this proceeding. In response we 
received no comments specifically directed to the IRFA. As noted infra 
Part X.A.1.e of this FRFA, in making the determinations reflected in 
this order, we have given consideration to those comments of the 
parties that addressed the impact of our proposed rules on small 
entities.
c. Description and Estimate of the Number of Small Entities to Which 
Rules Will Apply
    87. The RFA directs agencies to provide a description of and, where 
feasible, an estimate of the number of small entities that will be 
affected by our rules. The RFA generally defines the term ``small 
entity'' as having the same meaning as the terms ``small business,'' 
``small organization,'' and ``small governmental jurisdiction.'' For 
the purposes of this order, the RFA defines a ``small business'' to be 
the same as a ``small business concern'' under the Small Business Act, 
15 U.S.C. 632, unless the Commission has developed one or more 
definitions that are appropriate to its activities. Under the Small 
Business Act, a ``small business concern'' is one that: (1) Is 
independently owned and operated; (2) is not dominant in its field of 
operation; and (3) meets any additional criteria established by the 
Small Business Administration (SBA). The SBA has defined a small 
business for Standard

[[Page 20334]]

Industrial Classification (SIC) categories 4812 (Radiotelephone 
Communications) and 4813 (Telephone Communications, Except 
Radiotelephone) to be small entities when they have no more than 1,500 
employees. We first discuss generally the total number of small 
telephone companies falling within both of those SIC categories. Then, 
we discuss the number of small businesses within the two subcategories, 
and attempt to refine further those estimates to correspond with the 
categories of telephone companies that are commonly used under our 
rules.
    88. Although affected incumbent local exchange carriers (ILECs) may 
have no more than 1,500 employees, we do not believe that such entities 
should be considered small entities within the meaning of the RFA 
because they either are dominant in their field of operations or are 
not independently owned and operated, and are therefore by definition 
not ``small entities'' or ``small business concerns'' under the RFA. 
Accordingly, our use of the terms ``small entities'' and ``small 
businesses'' does not encompass small ILECs. Out of an abundance of 
caution, however, for regulatory flexibility analysis purposes, we will 
separately consider small ILECs within this analysis and use the term 
``small ILECs'' to refer to any ILECs that arguably might be defined by 
SBA as ``small business concerns.''
    89. Total Number of Telephone Companies Affected. The United States 
Bureau of the Census (the Census Bureau) reports that at the end of 
1992, there were 3,497 firms engaged in providing telephone services, 
as defined therein, for at least one year. This number contains a 
variety of different categories of carriers, including local exchange 
carriers, interexchange carriers, competitive access providers, 
cellular carriers, mobile service carriers, operator service providers, 
pay telephone operators, PCS providers, covered SMR providers, and 
resellers. It seems certain that some of those 3,497 telephone service 
firms may not qualify as small entities because they are not 
``independently owned and operated.'' For example, a PCS provider that 
is affiliated with an interexchange carrier having more than 1,500 
employees would not meet the definition of a small business. It seems 
reasonable to conclude, therefore, that fewer than 3,497 telephone 
service firms are either small entities or small incumbent LECs that 
may be affected by this order.
    90. Wireline Carriers and Service Providers. The SBA has developed 
a definition of small entities for telephone communications companies 
other than radiotelephone (wireless) companies. The Census Bureau 
reports there were 2,321 such telephone companies in operation for at 
least one year at the end of 1992. According to the SBA's definition, a 
small business telephone company other than a radiotelephone company is 
one employing fewer than 1,500 persons. All but 26 of the 2,321 non-
radiotelephone companies listed by the Census Bureau were reported to 
have fewer than 1,000 employees. Thus, even if all 26 of those 
companies had more than 1,500 employees, there would still be 2,295 
non-radiotelephone companies that might qualify as small entities or 
small incumbent LECs. Although it seems certain that some of these 
carriers are not independently owned and operated, we are unable at 
this time to estimate with greater precision the number of wireline 
carriers and service providers that would qualify as small business 
concerns under the SBA's definition. Consequently, we estimate that 
fewer than 2,295 small entity telephone communications companies other 
than radiotelephone companies are small entities or small ILECs that 
may be affected by this order.
    91. Local Exchange Carriers. Neither the Commission nor the SBA has 
developed a definition of small providers of local exchange services. 
The closest applicable definition under the SBA's rules is for 
telephone communications companies other than radiotelephone (wireless) 
companies. The most reliable source of information regarding the number 
of LECs nationwide of which we are aware appears to be the data that we 
collect annually in connection with the Telecommunications Relay 
Service (TRS). According to our most recent data, 1,371 companies 
reported that they were engaged in the provision of local exchange 
services. Although it seems certain that some of these carriers are not 
independently owned and operated, or have more than 1,500 employees, or 
are dominant we are unable at this time to estimate with greater 
precision the number of LECs that would qualify as small business 
concerns under the SBA's definition. Consequently, we estimate that 
fewer than 1,371 small providers of local exchange service are small 
entities or small ILECs that may be affected by this order.
    92. Interexchange Carriers. Neither the Commission nor the SBA has 
developed a definition of small entities specifically applicable to 
providers of interexchange services (IXCs). The closest applicable 
definition under the SBA's rules is for telephone communications 
companies other than radiotelephone (wireless) companies. The most 
reliable source of information regarding the number of IXCs nationwide 
of which we are aware appears to be the data that we collect annually 
in connection with TRS. According to our most recent data, 143 
companies reported that they were engaged in the provision of 
interexchange services. Although it seems certain that some of these 
carriers are not independently owned and operated, or have more than 
1,500 employees, we are unable at this time to estimate with greater 
precision the number of IXCs that would qualify as small business 
concerns under the SBA's definition. Consequently, we estimate that 
there are fewer than 143 small entity IXCs that may be affected by this 
order.
    93. Competitive Access Providers. Neither the Commission nor the 
SBA has developed a definition of small entities specifically 
applicable to providers of competitive access services (CAPs). The 
closest applicable definition under the SBA's rules is for telephone 
communications companies other than radiotelephone (wireless) 
companies. The most reliable source of information regarding the number 
of CAPs nationwide of which we are aware appears to be the data that we 
collect annually in connection with the TRS. According to our most 
recent data, 109 companies reported that they were engaged in the 
provision of competitive access services. Although it seems certain 
that some of these carriers are not independently owned and operated, 
or have more than 1,500 employees, we are unable at this time to 
estimate with greater precision the number of CAPs that would qualify 
as small business concerns under the SBA's definition. Consequently, we 
estimate that there are fewer than 109 small entity CAPs that may be 
affected by this order.
    94. Operator Service Providers. Neither the Commission nor the SBA 
has developed a definition of small entities specifically applicable to 
providers of operator services. The closest applicable definition under 
the SBA's rules is for telephone communications companies other than 
radiotelephone (wireless) companies. The most reliable source of 
information regarding the number of operator service providers 
nationwide of which we are aware appears to be the data that we collect 
annually in connection with the TRS. According to our most recent data, 
27 companies reported that they were engaged in the provision of 
operator services. Although it seems certain that some of these 
companies are not independently owned and operated, or

[[Page 20335]]

have more than 1,500 employees, we are unable at this time to estimate 
with greater precision the number of operator service providers that 
would qualify as small business concerns under the SBA's definition. 
Consequently, we estimate that there are fewer than 27 small entity 
operator service providers that may be affected by this order.
    95. Pay Telephone Operators. Neither the Commission nor the SBA has 
developed a definition of small entities specifically applicable to pay 
telephone operators. The closest applicable definition under the SBA's 
rules is for telephone communications companies other than 
radiotelephone (wireless) companies. The most reliable source of 
information regarding the number of pay telephone operators nationwide 
of which we are aware appears to be the data that we collect annually 
in connection with the TRS. According to our most recent data, 441 
companies reported that they were engaged in the provision of pay 
telephone services. Although it seems certain that some of these 
carriers are not independently owned and operated, or have more than 
1,500 employees, we are unable at this time to estimate with greater 
precision the number of pay telephone operators that would qualify as 
small business concerns under the SBA's definition. Consequently, we 
estimate that there are fewer than 441 small entity pay telephone 
operators that may be affected by this order.
    96. Wireless Carriers. The SBA has developed a definition of small 
entities for radiotelephone (wireless) companies. The Census Bureau 
reports that there were 1,176 such companies in operation for at least 
one year at the end of 1992. According to the SBA's definition, a small 
business radiotelephone company is one employing no more than 1,500 
persons. The Census Bureau also reported that 1,164 of those 
radiotelephone companies had fewer than 1,000 employees. Thus, even if 
all of the remaining 12 companies had more than 1,500 employees, there 
would still be 1,164 radiotelephone companies that might qualify as 
small entities if they are independently owned are operated. Although 
it seems certain that some of these carriers are not independently 
owned and operated, we are unable at this time to estimate with greater 
precision the number of radiotelephone carriers and service providers 
that would qualify as small business concerns under the SBA's 
definition. Consequently, we estimate that there are fewer than 1,164 
small entity radiotelephone companies that may be affected by this 
order.
    97. Cellular Service Carriers. Neither the Commission nor the SBA 
has developed a definition of small entities specifically applicable to 
providers of cellular services. The closest applicable definition under 
the SBA's rules is for telephone communications companies other than 
radiotelephone (wireless) companies. The most reliable source of 
information regarding the number of cellular service carriers 
nationwide of which we are aware appears to be the data that we collect 
annually in connection with the TRS. According to our most recent data, 
804 companies reported that they were engaged in the provision of 
cellular services. Although it seems certain that some of these 
carriers are not independently owned and operated, or have more than 
1,500 employees, we are unable at this time to estimate with greater 
precision the number of cellular service carriers that would qualify as 
small business concerns under the SBA's definition. Consequently, we 
estimate that there are fewer than 804 small entity cellular service 
carriers that may be affected by this order.
    98. Mobile Service Carriers. Neither the Commission nor the SBA has 
developed a definition of small entities specifically applicable to 
mobile service carriers, such as paging companies. The closest 
applicable definition under the SBA's rules is for telephone 
communications companies other than radiotelephone (wireless) 
companies. The most reliable source of information regarding the number 
of mobile service carriers nationwide of which we are aware appears to 
be the data that we collect annually in connection with the TRS. 
According to our most recent data, 172 companies reported that they 
were engaged in the provision of mobile services. Although it seems 
certain that some of these carriers are not independently owned and 
operated, or have more than 1,500 employees, we are unable at this time 
to estimate with greater precision the number of mobile service 
carriers that would qualify under the SBA's definition. Consequently, 
we estimate that there are fewer than 172 small entity mobile service 
carriers that may be affected by this order.
    99. Broadband PCS Licensees. The broadband PCS spectrum is divided 
into six frequency blocks designated A through F, and the Commission 
has held auctions for each block. The Commission has defined small 
entity in the auctions for Blocks C and F as an entity that has average 
gross revenues of less than $40 million in the three previous calendar 
years. For Block F, an additional classification for ``very small 
business'' was added and is defined as an entity that, together with 
its affiliates, has average gross revenue of not more than $15 million 
for the preceding three calendar years. These regulations defining 
small entity in the context of broadband PCS auctions have been 
approved by the SBA. No small business within the SBA-approved 
definition bid successfully for licenses in Blocks A and B. There were 
90 winning bidders that qualified as small entities in the Block C 
auctions. A total of 93 small and very small businesses won 
approximately 40 percent of the 1,479 licenses for Blocks D, E, and F. 
However, licenses for Blocks C through F have not been awarded fully; 
therefore, there are few, if any, small businesses currently providing 
PCS services. Based on this information, we conclude that the number of 
small broadband PCS licensees will include the 90 winning bidders and 
the 93 qualifying bidders in the D, E, and F Blocks, for a total of 183 
small PCS providers as defined by the SBA and the Commission's auction 
rules.
    100. Narrowband PCS Licensees. The Commission does not know how 
many narrowband PCS licenses will be granted or auctioned, as it has 
not yet determined the size or number of such licenses. Two auctions of 
narrowband PCS licenses have been conducted for a total of 41 licenses, 
out of which 11 were obtained by small businesses owned by members of 
minority groups and/or women. Small businesses were defined as those 
with average gross revenues for the prior three fiscal years of $40 
million or less. For purposes of this FRFA, the Commission is utilizing 
the SBA definition applicable to radiotelephone companies, i.e., an 
entity employing no more than 1,500 persons. Not all of the narrowband 
PCS licenses have yet been awarded. There is therefore no basis to 
determine the number of licenses that will be awarded to small entities 
in future auctions. Given the facts that nearly all radiotelephone 
companies have fewer than 1,000 or fewer employees and that no reliable 
estimate of the number of prospective narrowband PCS licensees can be 
made, we assume, for purposes of the evaluations and conclusions in 
this FRFA, that all the remaining narrowband PCS licenses will be 
awarded to small entities.
    101. SMR Licensees. Pursuant to 47 CFR 90.814(b)(1), the Commission 
has defined ``small entity'' in auctions for geographic area 800 MHz 
and 900 MHz SMR licenses as a firm that had average annual gross 
revenues of less than $15 million in the three previous calendar years. 
This definition of a ``small entity''

[[Page 20336]]

in the context of 800 MHz and 900 MHz SMR has been approved by the SBA. 
The rules adopted in this order may apply to SMR providers in the 800 
MHz and 900 MHz bands that either hold geographic area licenses or have 
obtained extended implementation authorizations. We do not know how 
many firms provide 800 MHz or 900 MHz geographic area SMR service 
pursuant to extended implementation authorizations, nor how many of 
these providers have annual revenues of less than $15 million. We 
assume, for purposes of this FRFA, that all of the extended 
implementation authorizations may be held by small entities, which may 
be affected by this order.
    102. The Commission recently held auctions for geographic area 
licenses in the 900 MHz SMR band. There were 60 winning bidders who 
qualified as small entities in the 900 MHz auction. Based on this 
information, we conclude that the number of geographic area SMR 
licensees affected by the rule adopted in this order includes these 60 
small entities. No auctions have been held for 800 MHz geographic area 
SMR licenses. Thus, no small entities currently hold these licenses. A 
total of 525 licenses will be awarded for the upper 200 channels in the 
800 MHz geographic area SMR auction. The Commission, however, has not 
yet determined how many licenses will be awarded for the lower 230 
channels in the 800 MHz geographic area SMR auction. Moreover, there is 
no basis on which to estimate how many small entities will win these 
licenses. Given that nearly all radiotelephone companies have fewer 
than 1,000 employees and that no reliable estimate of the number of 
prospective 800 MHz licensees can be made, we assume, for purposes of 
this FRFA, that all of the licenses may be awarded to small entities 
who, thus, may be affected by this order.
    103. Resellers. Neither the Commission nor the SBA has developed a 
definition of small entities specifically applicable to resellers. The 
closest applicable definition under the SBA's rules is for all 
telephone communications companies. The most reliable source of 
information regarding the number of resellers nationwide of which we 
are aware appears to be the data that we collect annually in connection 
with the TRS. According to our most recent data, 339 companies reported 
that they were engaged in the resale of telephone services. Although it 
seems certain that some of these carriers are not independently owned 
and operated, or have more than 1,500 employees, we are unable at this 
time to estimate with greater precision the number of resellers that 
would qualify as small business concerns under the SBA's definition. 
Consequently, we estimate that there are fewer than 339 small entity 
resellers that may be affected by this order.
d. Description of Projected Reporting, Recordkeeping and Other 
Compliance Requirements
    104. In this Second Report and Order, if carriers choose to use 
CPNI to market service offerings outside the customer's existing 
service, we obligate these carriers to (1) obtain customer approval; 
(2) provide their customers a one-time notification of their CPNI 
rights prior to any solicitation for approval; and (3) maintain records 
of customer notification and approval, whether oral, written, or 
electronic.
    105. We require carriers to develop and implement software systems 
that ``flag'' customer service records in connection with CPNI. The 
flag must be conspicuously displayed within a box or comment field 
within the first few lines of the first computer screen, and the flag 
must indicate whether the customer has approved the marketing use of 
his or her CPNI, and reference the existing service subscription.
    Also in connection with the software systems, carriers must 
implement internal standards and procedures informing employees when 
they are authorized to utilize CPNI. In addition, they must develop 
standards and procedures to handle employees who misuse CPNI.
    106. We further require that carriers maintain an electronic audit 
mechanism that tracks access to customer accounts and is capable of 
recording whenever customer records are opened, by whom, and for what 
purpose. Carriers must maintain these ``contact histories'' for a 
period of at least one year to ensure a sufficient evidentiary record 
for CPNI compliance and verification purposes. Additionally, sales 
personnel must obtain supervisory review of any proposed request to use 
CPNI for outbound marketing purposes, to ensure compliance with CPNI 
restrictions when conducting such campaigns.
    107. Finally, carriers must submit on an annual basis a 
certification signed by a current corporate officer, as an agent of the 
corporation, attesting that he or she has personal knowledge that the 
carrier has complied with the rules adopted in this order. The 
certification must be made publicly available, and be accompanied by a 
statement explaining how the carrier is implementing our CPNI rules and 
safeguards.
e. Significant Alternatives and Steps Taken by Agency to Minimize 
Significant Economic Impact on a Substantial Number of Small Entities 
Consistent With Stated Objectives
    108. After consideration of possible alternatives, we have 
concluded that our rules should apply equally to all carriers. Several 
parties in their comments address the impact of possible changes in our 
CPNI rules on small entities. As a general matter, various small 
entities express concern that, having never been required to comply 
with CPNI regulations in the past, any regulation that extends to them 
will impose immediate costs. Specifically, SBT argues that we should 
forbear from applying section 222(c)(1) to small businesses, and 
thereby permit their use of CPNI for all marketing purposes, because 
small entities need more flexibility to use CPNI to be competitive in 
the marketplace. SBT likewise opposes a three category approach, 
claiming it gives large carriers flexibility to develop and meet 
customers' needs, but may unnecessarily limit small business as 
competition grows. SBT maintains that small carriers could be 
competitively disadvantaged by any interpretation of section 
222(c)(1)(A) other than the single category approach because a large 
carrier can base the design of a new offering on statistical customer 
data and market widely, while a small business can best meet 
specialized subscriber needs if it offers local, interexchange, and 
CMRS tailored to the specific subscriber. ALLTEL and SBC agree with 
USTA that a multiple category definition of telecommunications service 
would specifically burden small companies.
    109. As we discussed in this order, we decline to forbear from 
applying section 222(c)(1) to small carriers because we are unpersuaded 
that customers of small businesses have less meaningful privacy 
interests in their CPNI. We believe that the total service approach 
furthers the balance of privacy and competitive considerations for all 
carriers and provides all carriers with flexibility in marketing their 
telecommunications products and services. Indeed, if SBT is accurate in 
its claim that small businesses typically have closer personal 
relationships with their customers, then small businesses likely would 
have less difficulty in obtaining customer approval to market services 
outside of a customer's existing service. Under the total service 
approach, carriers are able to use the customer's entire customer 
record in the course of providing the customer service, and no

[[Page 20337]]

business is prohibited from meeting customer needs by offering tailored 
packages of local, interexchange, and CMRS with customer approval. 
Moreover, to the extent carriers do not choose to use CPNI for 
marketing purposes, or do not want to market new service categories, 
they do not need to comply with our approval or notice requirements. 
Finally, given our decisions to permit oral, written, or electronic 
approval under section 222(c)(1), and impose use rather than access 
restrictions, the total service approach addresses any concern that 
CPNI restrictions will disrupt the customer-carrier dialogue or the 
carriers' ability to provide full customer service.
    110. Some commenters urge the Commission to adopt notification 
rules which would require dominant carriers to give their customers 
written notification of their CPNI rights, while smaller carriers or 
carriers in competitive markets would be permitted to give oral 
notification to its customers. We find no reason to impose a written 
notification requirement only on incumbent carriers. While competitive 
concerns may justify different regulatory treatment for certain 
carriers, we believe all customers, despite the size or identity of 
their carrier, have similar and important privacy concerns.
    111. We also reject the suggestion by Arch, LDDS WorldCom, MCI, 
Sprint, and TCG that our rules in connection with CPNI safeguards be 
limited to large or incumbent carriers, as they had been previously. 
Rather, we maintain that Congress intended for all carriers to 
safeguard customer information, and that the safeguards we adopt today 
do not impose a greater administrative burden on small carriers. We 
remain unconvinced that the burdens of section 222 are so great on 
small carriers that they cannot comply with reasonable restrictions. 
Indeed, the mechanisms we require expressly factor commercial 
feasibility and practice into an appropriate regulatory framework, and 
represent minimum general requirements. We also find that the use of an 
electronic audit mechanism to track access to customer accounts is not 
overly burdensome because many carriers already maintain such 
capabilities for a variety of business purposes unrelated to CPNI. 
Carriers have indicated that such capabilities are important, for 
example, to track employee use of company resources, including 
computers and databases, as well as for personnel disciplinary 
purposes. The contact histories that we require carriers to maintain 
for a period of at least one year also should not be burdensome to 
carriers because carriers routinely evaluate these contact histories to 
determine the success of marketing campaigns. As we discuss in this 
order, we believe the safeguards we adopt in this order will afford 
carriers the flexibility in conforming their systems, operations, and 
procedures to assure compliance with our rules. Furthermore, in an 
effort to reduce, for all carriers, the administrative burden of 
compliance with our rules, we specifically decline to impose a password 
access restriction on carrier use of CPNI. We also conclude that use 
restrictions are less burdensome to all carriers, including medium and 
small sized carriers. We decline at this time to impose a requirement 
of separate marketing personnel on the basis that such a rule may 
produce inefficiencies particularly for small carriers, and thereby may 
dampen competition by increasing the costs of entry into 
telecommunications markets.
2. Paperwork Reduction Act Analysis
    112. This Second Report and Order contains several new information 
collections. We describe our collections as follows:
    113. In this order, if carriers choose to use CPNI to market 
service offerings outside the customer's existing service, we obligate 
these carriers to obtain customer approval and document such approval 
through software ``flags'' on customer service records indicating 
whether the customer has approved or declined the marketing use of his 
or her CPNI when solicited. These requirements constitute new 
``collections of information'' within the meaning of the Paperwork 
Reduction Act of 1995, 44 U.S.C. 3501-3520. Implementation of this 
requirement is subject to approval by the Office of Management and 
Budget as prescribed by the Paperwork Reduction Act.
    114. Additionally, we require all telecommunications carriers that 
choose to solicit customer approval to provide their customers a one-
time notification of their CPNI rights prior to any such solicitation. 
Pursuant to this one-time notification requirement, these carriers must 
maintain a record of such notifications. This requirement constitutes a 
new ``collection of information'' within the meaning of the Paperwork 
Reduction Act of 1995, 44 U.S.C. 3501-3520. Implementation of this 
requirement is subject to approval by the Office of Management and 
Budget as prescribed by the Paperwork Reduction Act.
    115. All carriers must record whenever customer records are opened, 
by whom, and for what purpose, and maintain these contact histories for 
a period of at least one year. These requirements constitute new 
``collections of information'' within the meaning of the Paperwork 
Reduction Act of 1995, 44 U.S.C. 3501-3520. Implementation of this 
requirement is subject to approval by the Office of Management and 
Budget as prescribed by the Paperwork Reduction Act.
    116. Finally, we have adopted rules in this order requiring all 
telecommunications carriers to submit on an annual basis a 
certification signed by a current corporate officer attesting that he 
or she has personal knowledge that the carrier is in compliance with 
the rules we promulgated in this order, and to create an accompanying 
statement explaining how the carriers are implementing our rules and 
safeguards. Pursuant to this recordkeeping requirement, all 
telecommunications carriers must maintain in a publicly available file 
the compliance certificates and accompanying statements. This 
requirement constitutes a new ``collection of information'' within the 
meaning of the Paperwork Reduction Act of 1995, 44 U.S.C. 3501-3520. 
Implementation of all of these recordkeeping requirements are subject 
to approval by the Office of Management and Budget as prescribed by the 
Paperwork Reduction Act.

VIII. Ordering Clauses

    117. Accordingly, It Is Ordered that pursuant to sections 1, 4(i), 
222 and 303(r) of the Communications Act of 1934, as amended, 47 U.S.C. 
151, 154(i), 222 and 303(r), a Report and Order is hereby Adopted.
    118. It is further ordered that, pursuant to our own motion, 
paragraph 222 of In the Matter of Implementation of the Non-Accounting 
Safeguards of Section 271 and 272 of the Communications Act of 1934, as 
amended, CC Docket No. 96-149, First Report and Order and Further 
Notice of Proposed Rulemaking, 11 FCC Rcd 21905 (1996), is hereby 
Overruled.
    119. It Is Further Ordered that the Commission's Office of Public 
Affairs, Reference Operations Division, Shall Send a copy of this 
Second Report and Order, including the associated Final Regulatory 
Flexibility Analysis, to the Chief Counsel for Advocacy of the Small 
Business Administration, in accordance with paragraph 605(b) of the 
Regulatory Flexibility Act, 5 U.S.C. 601 et seq. (1981).
    120. It Is Further Ordered that part 22 of the Commission's rules, 
47 CFR 22.903 and part 64 of the Commission's

[[Page 20338]]

rules, 47 CFR 64.702(d)(3) are Removed as set forth in the Rule 
Changes.
    121. It Is Further Ordered that part 64 of the Commission's rules, 
47 CFR part 64 is Amended as set forth in Rule Changes, effective 30 
days after publication of the text thereof in the Federal Register.

List of Subjects

47 CFR Part 22

    Communications common carriers, Reporting and recordkeeping 
requirements.

47 CFR Part 64

    Communications common carriers, Reporting and recordkeeping 
requirements, Telephone.

Federal Communications Commission.
Magalie Roman Salas,
Secretary.

Rule Changes

    For the reasons set out in the preamble, 47 CFR parts 22 and 64 are 
amended as follows:

PART 22--PUBLIC MOBILE SERVICES

    1. The authority citation for part 22 is revised to read as 
follows:

    Authority: 47 U.S.C. 154, 222, 303, 309 and 332.


Sec. 22.903  [Removed].

    2. Remove Sec. 22.903.

PART 64--MISCELLANEOUS RULES RELATING TO COMMON CARRIERS

    3. The authority citation for part 64 is revised to read as 
follows:

    Authority: 47 U.S.C. 154, 222, 254(k).


Sec. 64.702  [Amended]

    4. In Sec. 64.702 remove and reserve paragraph (d)(3).
    5. Subpart U is added to part 64 to read as follows:

Subpart U--Customer Proprietary Network Information

Sec.
64.2001  Basis and purpose.
64.2003  Definitions.
64.2005  Use of customer proprietary network information without 
customer approval.
64.2007  Notice and approval required for use of customer 
proprietary network information.
64.2009  Safeguards required for use of customer proprietary network 
information.

Subpart U--Customer Proprietary Network Information


Sec. 64.2001  Basis and purpose.

    (a) Basis. The rules in this subpart are issued pursuant to the 
Communications Act of 1934, as amended.
    (b) Purpose. The purpose of the rules in this subpart is to 
implement section 222 of the Communications Act of 1934, as amended, 47 
U.S.C. 222.


Sec. 64.2003  Definitions.

    Terms used in this subpart have the following meanings:
    (a) Affiliate. An affiliate is an entity that directly or 
indirectly owns or controls, is owned or controlled by, or is under 
common ownership or control with, another entity.
    (b) Customer. A customer of a telecommunications carrier is a 
person or entity to which the telecommunications carrier is currently 
providing service.
    (c) Customer proprietary network information (CPNI).
    (1) Customer proprietary network information (CPNI) is:
    (i) Information that relates to the quantity, technical 
configuration, type, destination, and amount of use of a 
telecommunications service subscribed to by any customer of a 
telecommunications carrier, and that is made available to the carrier 
by the customer solely by virtue of the customer-carrier relationship; 
and
    (ii) Information contained in the bills pertaining to telephone 
exchange service or telephone toll service received by a customer of a 
carrier.
    (2) Customer proprietary network information does not include 
subscriber list information.
    (d) Customer premises equipment (CPE). Customer premises equipment 
(CPE) is equipment employed on the premises of a person (other than a 
carrier) to originate, route, or terminate telecommunications.
    (e) Information service. Information service is the offering of a 
capability for generating, acquiring, storing, transforming, 
processing, retrieving, utilizing, or making available information via 
telecommunications, and includes electronic publishing, but does not 
include any use of any such capability for the management, control, or 
operation of a telecommunications system or the management of a 
telecommunications service.
    (f) Local exchange carrier (LEC). A local exchange carrier (LEC) is 
any person that is engaged in the provision of telephone exchange 
service or exchange access. For purposes of this subpart, such term 
does not include a person insofar as such person is engaged in the 
provision of commercial mobile service under 47 U.S.C. 332(c).
    (g) Subscriber list information (SLI). Subscriber list information 
(SLI) is any information:
    (1) Identifying the listed names of subscribers of a carrier and 
such subscribers' telephone numbers, addresses, or primary advertising 
classifications (as such classifications are assigned at the time of 
the establishment of such service), or any combination of such listed 
names, numbers, addresses, or classifications; and
    (2) That the carrier or an affiliate has published, caused to be 
published, or accepted for publication in any directory format.
    (h) Telecommunications carrier. A telecommunications carrier is any 
provider of telecommunications services, except that such term does not 
include aggregators of telecommunications services (as defined in 47 
U.S.C. 226(a)(2)).


Sec. 64.2005  Use of customer proprietary network information without 
customer approval.

    (a) Any telecommunications carrier may use, disclose, or permit 
access to CPNI for the purpose of providing or marketing service 
offerings among the categories of service (i.e., local, interexchange, 
and CMRS) already subscribed to by the customer from the same carrier, 
without customer approval.
    (1) If a telecommunications carrier provides different categories 
of service, and a customer subscribes to more than one category of 
service offered by the carrier, the carrier is permitted to share CPNI 
among the carrier's affiliated entities that provide a service offering 
to the customer.
    (2) If a telecommunications carrier provides different categories 
of service, but a customer does not subscribe to more than one offering 
by the carrier, the carrier is not permitted to share CPNI among the 
carrier's affiliated entities.
    (b) A telecommunications carrier may not use, disclose, or permit 
access to CPNI to market to a customer service offerings that are 
within a category of service to which the customer does not already 
subscribe to from that carrier, unless the carrier has customer 
approval to do so, except as described in paragraph (c) of this 
section.
    (1) A telecommunications carrier may not use, disclose, or permit 
access to CPNI derived from its provision of local service, 
interexchange service, or CMRS, without customer approval, for the

[[Page 20339]]

provision of CPE and information services, including call answering, 
voice mail or messaging, voice storage and retrieval services, fax 
store and forward, and Internet access services. For example, a carrier 
may not use its local exchange service CPNI to identify customers for 
the purpose of marketing to those customers related CPE or voice mail 
service.
    (2) A telecommunications carrier may not use, disclose or permit 
access to CPNI to identify or track customers that call competing 
service providers. For example, a local exchange carrier may not use 
local service CPNI to track all customers that call local service 
competitors.
    (3) A telecommunications carrier may not use, disclose or permit 
access to a former customer's CPNI to regain the business of the 
customer who has switched to another service provider.
    (c) A telecommunications carrier may use, disclose, or permit 
access to CPNI, without customer approval, as described in this 
paragraph (c).
    (1) A telecommunications carrier may use, disclose, or permit 
access to CPNI, without customer approval, in its provision of inside 
wiring installation, maintenance, and repair services.
    (2) CMRS providers may use, disclose, or permit access to CPNI for 
the purpose of conducting research on the health effects of CMRS.
    (3) LECs and CMRS providers may use CPNI, without customer 
approval, to market services formerly known as adjunct-to-basic 
services, such as, but not limited to, speed dialing, computer-provided 
directory assistance, call monitoring, call tracing, call blocking, 
call return, repeat dialing, call tracking, call waiting, caller I.D., 
call forwarding, and certain centrex features.


Sec. 64.2007  Notice and approval required for use of customer 
proprietary network information.

    (a) A telecommunications carrier must obtain customer approval to 
use, disclose, or permit access to CPNI to market to a customer service 
to which the customer does not already subscribe to from that carrier.
    (b) A telecommunications carrier may obtain approval through 
written, oral or electronic methods.
    (c) A telecommunications carrier relying on oral approval must bear 
the burden of demonstrating that such approval has been given in 
compliance with the Commission's rules in this part.
    (d) Approval obtained by a telecommunications carrier for the use 
of CPNI outside of the customer's total service relationship with the 
carrier must remain in effect until the customer revokes or limits such 
approval.
    (e) A telecommunications carrier must maintain records of 
notification and approval, whether oral, written or electronic, for at 
least one year.
    (f) Prior to any solicitation for customer approval, a 
telecommunications carrier must provide a one-time notification to the 
customer of the customer's right to restrict use of, disclosure of, and 
access to that customer's CPNI.
    (1) A telecommunications carrier may provide notification through 
oral or written methods.
    (2) Customer notification must provide sufficient information to 
enable the customer to make an informed decision as to whether to 
permit a carrier to use, disclose or permit access to, the customer's 
CPNI.
    (i) The notification must state that the customer has a right, and 
the carrier a duty, under federal law, to protect the confidentiality 
of CPNI.
    (ii) The notification must specify the types of information that 
constitute CPNI and the specific entities that will receive the CPNI, 
describe the purposes for which CPNI will be used, and inform the 
customer of his or her right to disapprove those uses, and deny or 
withdraw access to CPNI at any time.
    (iii) The notification must advise the customer of the precise 
steps the customer must take in order to grant or deny access to CPNI, 
and must clearly state that a denial of approval will not affect the 
provision of any services to which the customer subscribes.
    (iv) The notification must be comprehensible and not be misleading.
    (v) If written notification is provided, the notice must be clearly 
legible, use sufficiently large type, and be placed in an area so as to 
be readily apparent to a customer.
    (vi) If any portion of a notification is translated into another 
language, then all portions of the notification must be translated into 
that language.
    (vii) A carrier may state in the notification that the customer's 
approval to use CPNI may enhance the carrier's ability to offer 
products and services tailored to the customer's needs. A carrier also 
may state in the notification that it may be compelled to disclose CPNI 
to any person upon affirmative written request by the customer.
    (viii) A carrier may not include in the notification any statement 
attempting to encourage a customer to freeze third party access to 
CPNI.
    (ix) The notification must state that any approval, or denial of 
approval for the use of CPNI outside of the service to which the 
customer already subscribes to from that carrier is valid until the 
customer affirmatively revokes or limits such approval or denial.
    (3) A telecommunications carrier's solicitation for approval must 
be proximate to the notification of a customer's CPNI rights.
    (4) A telecommunications carrier's solicitation for approval, if 
written, must not be on a document separate from the notification, even 
if such document is included within the same envelope or package.


Sec. 64.2009  Safeguards required for use of customer proprietary 
network information.

    (a) Telecommunications carriers must develop and implement software 
that indicates within the first few lines of the first screen of a 
customer's service record the CPNI approval status and reference the 
customer's existing service subscription.
    (b) Telecommunications carriers must train their personnel as to 
when they are and are not authorized to use CPNI, and carriers must 
have an express disciplinary process in place.
    (c) Telecommunications carriers must maintain an electronic audit 
mechanism that tracks access to customer accounts, including when a 
customer's record is opened, by whom, and for what purpose. Carriers 
must maintain these contact histories for a minimum period of one year.
    (d) Telecommunications carriers must establish a supervisory review 
process regarding carrier compliance with the rules in this subpart for 
outbound marketing situations and maintain records of carrier 
compliance for a minimum period of one year. Specifically, sales 
personnel must obtain supervisory approval of any proposed outbound 
marketing request.
    (e) A telecommunications carrier must have a corporate officer, as 
an agent of the carrier, sign a compliance certificate on an annual 
basis that the officer has personal knowledge that the carrier is in 
compliance with the rules in this subpart. A statement explaining how 
the carrier is in compliance with the rules in this subpart must 
accompany the certificate.

[FR Doc. 98-10740 Filed 4-23-98; 8:45 am]
BILLING CODE 6712-01-P