Additional Comments of Public Counsel Washington Attorney General May 20, 1998 Washington Utilities and Transportation Commission Preproposal Notice of Inquiry (CR 101) Customer Proprietary Network Information (CPNI) UT-971514 Introduction Public Counsel files these comments pursuant to the Commission’s Notice of April 13, 1998. Public Counsel filed comments and proposed rule language on January 8, 1998, took part in the workshop on January 21, and participated in the Commission’s prior rulemaking which addressed customer information privacy issues, UT 960942. The Commission’s notice asks participants to comment in light of the Federal Communication Commission’s (FCC) adoption of rules in February 1998. In the Matter of the Implementation of the Telecommunications Act of 1996: Telecommunications Carriers’ Use of Customer Proprietary Network Information and Other Customer Information; Implementation of the Non-Accounting Safeguards of Sections 271 and 272 of the Communications Act of 1934 As Amended, CC Docket No. 96-115, CC Docket 96-149, Second Report and Order and Further Notice of Proposed Rulemaking, February 26, 1998 (FCC CPNI Rules Order). As we noted in our prior comments, the handling of customer information by telecommunications companies raises two significant issues: protection of customer privacy and competitive fairness. For a good general discussion of both aspects of customer information, see Utility Customer Information: Privacy and Competitive Implications, National Regulatory Research Institute, NRRI 92-11 (September 1992) While the genesis of this particular proceeding to reevaluate the existing rule lies in telecommunications companies’ concerns about their ability to use information for marketing, Public Counsel urges the Commission to keep these two preeminent policy goals in mind in any reexamination of the rule and of proposed new provisions. Public Counsel notes that the CR 101 Preproposal Statement of Inquiry and the Notice of December 16, 1997, both refer to the Commission’s intention to explore the need for rulemaking regarding “privacy protection.” Public Counsel urges the Commission not to consider amending the rule solely to accommodate industry concerns about marketing. If any changes are made to the rule, improvements to the protection of customer privacy and the advancement of competitive fairness should be achieved. Comments The FCC Rules Status The FCC rules contained at Appendix B of the FCC CPNI Rules Order are final rules effective 30 days after publication in the Federal Register. The FCC has received motions and responses on the issue of whether to delay the effective date of the rule. To Public Counsel’s knowledge the request is still under consideration. In addition to adopting rules, the FCC CPNI Rules Order contained a Further Notice of Proposed Rulemaking on three issues: 1whether a customer may restrict carrier use of CPNI for all marketing purposes 1the appropriate protections for carrier information and additional enforcement mechanisms 1foreign storage of, and access to, domestic CPNI Comment deadlines in the Further NPRM were March 30 and April 14, 1998. Federal Preemption The FCC CPNI Rules Order concludes that: [I]n connection with CPNI regulation, the commission may preempt state regulation of intrastate telecommunications matters where such regulation would negate the Commission’s exercise of its lawful authority because regulation of the interstate aspects of the matter cannot be severed from regulation of the intrastate aspects. FCC CPNI Rules Order, para. 16 The order’s determination on preemption, however, is subject to important limitations. First, the Commission does not actually preempt any state regulation in the order. Rather, states are given an opportunity to react to the requirements set out in the rules. Conflicts will be examined on a case-by-case basis. FCC CPNI Rules Order, para. 18 Second, as the above-quoted language indicates, the FCC preempts only as to state regulations which negate the Commission’s lawful exercise of interstate authority. The FCC specifically acknowledges that other state rules which do not conflict with Congressional goals would be permissible. Id. Entirely apart from whether the FCC’s determination of its jurisdiction is correct, The FCC’s application of the jurisdictional allocation in 47 USC Section 152(b) has been overturned in other settings. States, of course, have the option of adopting CPNI rules which impose greater limitations on the use of CPNI, and of seeking a judicial determination should any preemption be sought by the FCC. Given the new statutory goal of confidentiality protection announced in Section 222 of the Telecommunications Act of 1996, the reasoning of the Ninth Circuit’s California III decision on CPNI, rendered prior to the Act, may no longer be applicable. as a practical matter, the WUTC in this rulemaking may still adopt different or additional rules within the parameters laid out above and we recommend that it do so in several areas, as discussed below. Previous Public Counsel Comments Public Counsel recommended in its prior comments that any revised rule contain at least the following elements, as contained in the proposed rules previously submitted: 1A statement of the duty of telecommunications companies to protect privacy of “customer proprietary network information” and “subscriber personal information”; 1A prohibition on disclosure of customer information without prior written authorization; 1A requirement that customers be given annual notice of their privacy rights, and the ability to place their names on a “do not call” list; 1A statement of reasonable exceptions (e.g. for directory publishing, emergency assistance) and the permissible use of aggregate CPNI; 1Limits on a company’s use of CPNI to market to its own customers; and 1Definitions of “customer proprietary network information” and “subscriber personal information.” Of the items on this list, the FCC rules do not include the duty of privacy statement, the written authorization requirement, annual notice of rights, or limitations on use of CPNI to market to a company’s own customers. In addition to the foregoing recommendations, Public Counsel recommended in its prior comments that the Commission address fair competitive use of CPNI. Privacy: Customer Rights and Company Duties Neither the current Washington rule nor the FCC rules contain an express statement of a customer’s right to information privacy or of a telecommunications company’s duty to protect privacy . Public Counsel recommends adoption in the rule of a statement of principles regarding protection of customer information. At a minimum, the rules should contain a provision modeled on Section 222(a) of the Telecommunications Act of 1996, but expanded to include protection for subscriber personal information not included in the definition of CPNI. Subscriber personal information includes personal calling pattern, credit or personal financial information, services that are purchased and demographic information (see Appendix A, Public Counsel Comments, January 8, 1998) . In addition to the need for a general statement of rights and obligations, there is a need for specific rule language regarding non-disclosure of CPNI outside the company which collects the information. The FCC rules focus almost exclusively on the internal use of CPNI by carriers for marketing purposes. There is no specific rule language limiting disclosure of CPNI to third parties, nor is there language allowing disclosure only on affirmative written request, as contemplated by 47 USC Sec. 222(c)(2). Finally, the FCC rules are silent as to use by one carrier of CPNI from another carrier obtained in providing service. Section 222(b) prohibits use of such information for marketing purposes. These omissions should be remedied in the Washington rule. Prohibition On Disclosure Of Information Without Authorization While Public Counsel has advocated a written authorization requirement, except where inbound marketing is concerned, the new FCC rules allow oral, electronic, or written authorization for the use of CPNI. If the WUTC adopts this approach, Public Counsel recommends the following improvements be made to the rules. First, it is not clear whether the FCC rules preclude the use of negative option written authorization. Washington rules should include a specific prohibition on use of “negative option” approval. Second, the telecommunications carrier only has the burden of proof of compliance with respect to oral authorizations. Public Counsel recommends that the carrier be expressly given the burden of proof in all cases where the compliance with authorization rules is at issue. This will provide an incentive for the companies to comply and to maintain records of compliance. This should not be burdensome since such record-keeping is required in any event. 47 CFR Sec. 64.2007(e). Annual Notice of Rights It is critical that subscribers understand the type of information retained by carriers, what rights they have with respect to the information, and how to give and rescind authorization for use of the information. Without such knowledge, ability of customers to protect their privacy is seriously impaired. The FCC rules require that “prior to any solicitation for customer approval” the telecommunications carrier must provide a “one-time notification” to the customer of the customer’s right to restrict the use of CPNI. 47 CFR Sec. 64.2007(f). Public Counsel recommends that the WUTC improve on these notice requirements by requiring annual written notice of CPNI rights, whether or not the company wishes to seek approval for CPNI use. In our prior comments Public Counsel has recommended that customers should receive individual written notice on an annual basis. A bill insert could be used for this purpose. It should be accompanied by a postcard to be returned if the customer wishes to authorize use or disclosure of his or her information. A complete notice of privacy rights with regard to CPNI should also be included in the directory published by the telecommunications company. These protections would not conflict with the FCC rules, but would be supplemental to them. Carriers wishing to solicit approval for CPNI use would still have to provide a notification proximate in time and place to the solicitation. as provided in the FCC rules. In addition, as we recommend below, as part of all required notices, customers should be notified of their right to place their name on a “do not call” list if they do not wish to receive marketing solicitations from their own or other companies. Customer Right to Place Limits on Use of CPNI for Marketing Perhaps the single most common complaint from telecommunications customers since the divestiture of ATT has involved marketing, particularly telemarketing, of phone services. This proceeding provides the Commission an opportunity to address at least part of this problem. Public Counsel strongly urges the Commission to adopt rules in this proceeding which give customers the right to restrict a telecommunications carrier from using, disclosing, or permitting access to CPNI for all marketing purposes, even within the customer’s existing service offering. Cf., FCC CPNI Rules Order, paras. 204-205. The CPNI provided to companies by customers belongs to the customer. The customer has a privacy interest in the information, and a privacy interest in being free from marketing intrusions. The customer, therefore, has a right to determine how and whether that information is used for marketing by the customer’s service provider. One practical means to address this issue is the “do not call” list. Public Counsel recommends that the Commission establish a Commission-maintained “do not call” list. Customers who did not wish to receive telemarketing calls from their own carrier could place their name on the list. Carriers would be required to check the list on a regular basis and to incorporate it in their marketing practices and record keeping systems. In addition, all notices regarding CPNI rights would include notice regarding the “do not call” list. If the Commission decides to adopt rules along the lines of the FCC version, the “do not call” mechanism could be built in to the “safeguards” provisions. 47 CFR Sec. 64.2009. Alternatively, if the Commission does not wish to create and administer the list, it could require each carrier to maintain a carrier-specific list (see below). Customers with nonpublished or unlisted numbers already have the option of requesting that they not receive solicitation or telemarketing calls from their carrier. WAC 480-120-139(5)(c). This option should be extended to all customers, even if the Commission does not wish to establish and maintain its own general “do not call” list. Company “Do Not Call” Practices - Staff Data Request. In response to a Staff data request, a number of companies provided descriptions of their “do not call” list practices. AT&T’s experience reflects the importance of privacy to customers. Approximately one-third of AT&T’s residential customers are on company maintained “do not call” lists or have non-published numbers. AT&T Response to Data Request, April 16, 1998, p.1. Given the existence of these rules, one reasonable approach for rulemaking would be to require that telecommunications companies maintain such lists, and to adopt general requirements for such lists, while leaving companies some flexibility for designing their own internal procedures. This approach would ensure consistency between companies and protection for all customers, regardless of provider. Conclusion While Public Counsel understands that Staff is inclined to accept the FCC rule language for adoption in Washington, we urge that the Commission consider the modifications proposed in these comments. Finally, Public Counsel recommends that the Washington CPNI rules be contained in a rule separate from the Commission slamming rule where they are currently located. DATED this 20th day of May, 1998. CHRISTINE O. GREGOIRE Attorney General Simon J. ffitch Assistant Attorney General Public Counsel Section