Item: Date: October 28, 1998 Docket: UT-971514 Company: Telecommunications-General Customer Privacy Rulemaking Staff: Vincent Pollina, Computer Information Consultant Rebecca Beaton, Regulatory Consultant Vicki Elliott, Consumer Affairs Manager Bob Wallis, Review Judge David Griffith, Senior Engineer Glenn Blackmon, Assistant Director-Telecommunications Recommendation Direct the Secretary to file an Order of Adoption with the Office of the Code Reviser in Docket UT-971514, repealing section (5) of WAC 480-120-139 and adopting WAC 480-120-144, -151, -152, -153 and -154. Discussion The purpose of this rulemaking is to maintain the ability of telecommunications consumers to protect their privacy even as competition increases in the telecommunications. This proposal provides explicit privacy safeguards. Without explicit safeguards, companies could seek competitive advantage through the use or disclosure of private information about consumers and their use of telecommunications services. To protect consumers from unwarranted invasion of privacy, Staff recommends that the Commission adopt, with minor changes as noted in Appendix A, the rules as proposed in the Notice of Proposed Rulemaking (CR-102) in this proceeding. The Commission has received numerous comments on the issue of privacy rules. The latest round of comments on the proposed rule itself are summarized in Appendix B. Staff recommends incorporating several of the proposed changes. Overview The proposed rules would provide for consistency between the requirements imposed on telecommunications carriers at the federal and state level. Proposed WAC sections 480-120-151 through -154 are the same rules adopted by the Federal Communications Commission. The only difference is an exception in the definition of “telecommunications carrier” to exclude wireless carriers from the state rules, because wireless carriers are generally not subject to state regulation in Washington state. Proposed WAC section 480-120-144 is not part of the federal rules. It re-codified an existing rule adopted that protects the privacy of customers who subscribe to unlisted or non-published telephone numbers. The rule prohibits telephone companies from telemarketing using their list of customers with privacy service, unless the company has notified the customers at least annually of their right to be removed from such a solicitation list. Issues 1. Need for separate state rules In general, comments from the telecommunications industry oppose adoption of state rules on customer privacy and argue that the same information is adequately protected by federal privacy rules. If state rules are to be adopted, the industry comments support the recommendation to conform state rules to federal rules. The cementers noted several minor inconsistencies, which have been corrected in the draft rules proposed for adoption. Staffs disagrees with the suggestion that federal rules are sufficient. Both federal and state law give consumers a right to privacy, and neither law delegates the responsibility for privacy to a single federal agency. To the extent the WUTC regulates the rates and practices of telecommunications companies in this state, it has a responsibility to implement privacy safeguards. Nonetheless, it also is important that state and federal enforcement not conflict with each other, and this is a primary reason for the recommendation to adopt state rules that match federal rules. Industry cementers also argue that the federal rules are incomplete and subject to reconsideration. As Public Counsel notes, the federal rules are final. The Federal Communications Commission has issued a further notice and may well adopt additional rules in the future. The FCC also has received several petitions for reconsideration of the adopted rules. Moreover, at least one company has appealed the federal rules. Staff recommends that the Commission monitor these developments and, should the federal rules change, consider whether corresponding changes in state rules are appropriate. 2. Enforcement of Software Flagging and Electronic Monitoring Rules The proposed rules include a provision in the federal rules to require that carriers implement software flagging of customer privacy information and electronic monitoring of carrier access to these records. GST Telecommunications, CenturyTel, WITA, and AT&T note that after the WUTC issued its proposed rules, the FCC stayed enforcement of the flagging and monitoring provisions. The FCC rules would have become effective January 26, 1998. The FCC stayed enforcement until six months after it has issued an order on reconsideration of these requirements. Staff recommends that the Commission adopt rules without the flagging and monitoring provisions. When the FCC acts on reconsideration, the Commission should consider whether that decision should be incorporated into the state rules. 3. Telemarketing to customers with privacy service The proposed rules make no change to the requirement that customers who subscribe to a privacy service get the opportunity at least once a year to ask that their names be removed from any telemarketing list. GST and CenturyTel argue that this conflicts with federal rules, because an unlisted telephone number is not defined as part of “customer proprietary network information.” They argue that this rule creates inconsistent requirements between customers with unlisted numbers and other customers. Staff agrees that it creates different requirements; indeed, this was the purpose of the rule. This rule protects consumers from paying for a privacy service and not getting the privacy they should reasonably expect. A customer should not pay for privacy (in the form of an unlisted number) only to have that privacy violated (in the form of telemarketing calls from the phone company itself, using its list of customers who value privacy enough to pay the extra charges for an unlisted number). On the other side, Public Counsel suggests that the protections for customers with private numbers be extended to all customers. Staff believes that this would create a conflict with the more general rules. Customers who do not pay for a private number can reasonably expect to receive telemarketing calls, and existing law already allows them to tell the telemarketer (including their own phone company) not to call them. 4. Adequacy of Recent Notices US West has included notices about “telephone account information” on recent mailings to its customers. In its comments, Public Counsel contends that this notice does not comply with the rule. Staff intends to work with the FCC on this issue as well as any other compliance issues that arise. Further Work Staff believes that adoption of the proposed rules should not end the Commission’s efforts to protect consumers from violations of their privacy. As discussed above, we will need to coordinate our requirements with federal requirements, should they change. In addition, Staff is considering a broader inquiry into the fair use of information. Attachments: Appendix A: Proposed rule for adoption Appendix B: Summary of comments on proposed rule Appendix A Proposed Rule (with redline and strikeout to show changes from CR-102) NEW SECTION WAC 480-120-144 Use of privacy listings for telephone solicitation. A telecommunications company may not make telephone solicitation or telemarketing calls using its list of customers with non-published or unlisted numbers unless it has notified each such customer at least once in the past year that the company makes such calls to its customers with non-published or unlisted numbers and that the customer has a right to request that the company make no such calls. NEW SECTION WAC 480-120-151 Telecommunications carriers' use of customer proprietary network information (CPNI). (1) Any telecommunications carrier may use, disclose, or permit access to CPNI for the purpose of providing or marketing service offerings among the categories of service (i.e., local, interexchange, and CMRS) already subscribed to by the customer from the same carrier, without customer approval. (a) If a telecommunications carrier provides different categories of service, and a customer subscribes to more than one category of service offered by the carrier, the carrier is permitted to share CPNI among the carrier's affiliated entities that provide a service offering to the customer. (b) If a telecommunications carrier provides different categories of service, but a customer does not subscribe to more than one offering by the carrier, the carrier is not permitted to share CPNI among the carrier's affiliated entities. (2) A telecommunications carrier may not use, disclose or permit access to CPNI to market to a customer service offerings that are within a category of service to which the customer does not already subscribe to from that carrier, unless the carrier has customer approval to do so, except as described in (c) (3) of this subsection. (a) A telecommunications carrier may not use, disclose, or permit access to CPNI derived from its provision of local service, interexchange service, or CMRS, without customer approval, for the provision of customer premises equipment and information services, including call answering, voice mail or messaging, voice storage and retrieval services, fax store and forward, and Internet access services. For example, a carrier may not use its local exchange service CPNI to identify customers for the purpose of marketing to those customers related CPE or voice mail service. (b) A telecommunications carrier may not use, disclose, or permit access to CPNI to identify or track customers who call competing service providers. For example, a local exchange carrier may not use local service CPNI to track all customers who call local service competitors. (c) A telecommunications carrier may not use, disclose, or permit access to a former customer's CPNI to regain the business of the customer who has switched to another service provider. (3) A telecommunications carrier may use, disclose, or permit access to CPNI, without customer approval, as described in this subsection. (a) A telecommunications carrier may use, disclose, or permit access to CPNI, without customer approval, in its provision of inside wiring installation, maintenance, and repair services. (b) CMRS (wireless telecommunications service) providers may use, disclose, or permit access to CPNI for the purpose of conducting research on the health effects of CMRS. (c) Local exchange companies and CMRS providers may use CPNI, without customer approval, to market services formerly known as adjunct-to-basic services, such as, but not limited to, speed dialing, computer-provided directory assistance, call monitoring, call tracing, call blocking, call return, repeat dialing, call tracking, call waiting, caller I.D., call forwarding, and certain centrex features. NEW SECTION WAC 480-120-152 Notice and approval required for use of customer proprietary network information (CPNI). (1) A telecommunications carrier must obtain customer approval to use, disclose, or permit access to CPNI to market a customer service to which the customer does not already subscribe from that carrier. (2) A telecommunications carrier may obtain approval through written, oral or electronic methods. (3) A telecommunications carrier relying on oral approval must bear the burden of demonstrating that such approval has been given in compliance with the commission's rules. (4) Approval obtained by a telecommunications carrier for the use of CPNI outside of the customer's total service relationship with the carrier may must remain in effect until the customer revokes or limits such approval, so long as the carrier maintains the records of customer notification and approval required in this rule. (5) A telecommunications carrier must maintain records of notification and approval, whether oral, written or electronic, for at least one year. (6) Prior to any solicitation for customer approval, a telecommunications carrier must provide a one-time notification to the customer of the customer's right to restrict use of, disclosure of, and access to that customer's CPNI. (a) A telecommunications carrier may provide notification through oral or written methods. (b) Customer notification must provide sufficient information to enable the customer to make an informed decision as to whether to permit a carrier to use, disclose, or permit access to, the customer's CPNI. (i) The notification must state that the customer has a right, and the carrier a duty, under federal and state law, to protect the confidentiality of CPNI. (ii) The notification must specify the types of information that constitute CPNI and the specific entities that will receive CPNI, describe the purposes for which CPNI will be used, and inform the customer of his or her right to disapprove those uses, and deny or withdraw access to CPNI at any time. (iii) The notification must advise the customer of the precise steps the customer must take in order to grant or deny access to CPNI, and must clearly state that a denial of approval will not affect the provision of any services to which the customer subscribes. (iv) The notification must be comprehensible and must not be misleading. (v) If written notification is provided, the notice must be clearly legible, use sufficiently large type, and be placed so as to be readily apparent to a customer. (vi) If any portion of a notification is translated into another language, then all portions of the notification must be translated into that language. (vii) A carrier may state in the notification that the customer's approval to use CPNI may enhance the carrier's ability to offer products and services tailored to the customer's needs. A carrier also may state in the notification that the customer upon affirmative written request may compel the carrier to disclose CPNI to any person. (viii) A carrier may not include in the notification any statement attempting to encourage a customer to freeze third party access to CPNI. (viiiix) The notification must state that any approval, or denial of approval for the use of CPNI outside of the service to which the customer already subscribes to from that carrier is valid until the customer affirmatively revokes or limits the approval or denial. (7) A telecommunications carrier's solicitation for approval must be proximate to the notification of a customer's CPNI rights. (8) A telecommunications carrier's solicitation for approval, if written, must not be a document separate from the notification, even if both documents are included within the same envelope or package. NEW SECTION WAC 480-120-153 Safeguards required for use of customer proprietary network information (CPNI). (1) Telecommunications carriers must implement software that indicates within the first few lines of the first screen of a customer's service record the customer's CPNI approval status and reference the customer’s existing service subscription. (2) Telecommunications carriers must train all personnel who have access to CPNI as to when they are and are not authorized to use CPNI, and carriers must implement an express disciplinary process to deal with violations of the requirement. (3) Telecommunications carriers must maintain an electronic audit mechanism that tracks access to customer accounts, including when a customer's record is opened, by whom, and for what purpose. Carriers must maintain these contact histories for a minimum period of one year. (42) Telecommunications carriers must establish a supervisory review process regarding carrier compliance with rules governing outbound marketing situations and must maintain records of carrier compliance for at least one year. Specifically, sales personnel must obtain supervisory approval of any proposed outbound marketing request. (53) A telecommunications carrier must have a corporate officer, as an agent of the carrier, sign a compliance certificate on an annual basis that the officer has personal knowledge that the carrier is in compliance with the rules of this subpart. A statement explaining how the carrier is in compliance with the rules in this subpart must accompany the certificate. NEW SECTION WAC 480-120-154 Definitions. For purposes of WAC 480-120-150151 through 480-120-152154, terms have the following meaning: (1) Affiliate. An affiliate is an entity that directly or indirectly owns or controls, is owned or controlled by, or is under common ownership or control with, another entity. (2) Customer. A customer of a telecommunications carrier is a person or entity to which the telecommunications carrier is currently providing service. (3) Commercial mobile radio service (CMRS). Commercial mobile radio service means any mobile (wireless) telecommunications service that is provided for profit that makes interconnected service available to the public or to such classes of eligible users as to be effectively available to a substantial portion of the public. (4) Customer proprietary network information (CPNI). Customer proprietary network information (CPNI) is either: (a) Information that relates to the quantity, technical configuration, type, destination, and amount of use of a telecommunications service subscribed to by a customer of a telecommunications carrier, and that is made available to the carrier by the customer solely by virtue of the customer-carrier relationship; or and (b) Information contained in a customer’s bill pertaining to telephone exchange service or telephone toll service received by a customer of a carrier. Customer proprietary network information does not include subscriber list information. (5) Customer premises equipment (CPE). Customer premises equipment (CPE) is equipment employed on the premises of a person (other than a carrier) to originate, route, or terminate telecommunications. (6) Information service. Information service is the offering of a capability for generating, acquiring, storing, transforming, processing, retrieving, utilizing, or making available information via telecommunications, and includes electronic publishing, but does not include any use of any such capability for the management, control, or operation of a telecommunications system or the management of a telecommunications service. (7) Local exchange carrier (LEC). A local exchange carrier (LEC) is any person that is engaged in the provision of telephone exchange service or exchange access. For purposes of these rules, the term does not include a person insofar as such person is engaged in the provision of commercial mobile service under 47 U.S.C. 332 (c). (8) Subscriber list information (SLI). Subscriber list information (SLI) is any information: (a) Identifying the listed names of subscribers of a carrier and those subscribers’ telephone numbers, addresses, or primary advertising classifications (as such classifications are assigned when service is established), or any combination of listed names, numbers, addresses, or classifications; and (b) That the carrier or an affiliate has published, caused to be published, or accepted for publication in any directory format. (9) Telecommunications carrier. A telecommunications carrier is any provider of telecommunications services, except that such term does not include aggregators of telecommunications services (as defined in 47 U.S.C. 226(a)(2)). The definition of telecommunications carrier for purposes of these rules does not include CMRS providers, except as a substitute for wire line telecommunications in locations where wire line services are not available. Appendix B Summary of Comments on Proposed Rules Received on (or near) October 2, 1998 1. U S WEST Communications Inc. a. Company has appealed the existing FCC CPNI rules with the US Court of Appeals for the Tenth Circuit - requests the Commission refrain from adopting these rules until a court decision is rendered. b. Deems Rule 480-120-144 "Use of privacy listings for telephone solicitation" to be unconstitutional in that they violate: First Amendment freedom of speech Fifth Amendment takings/due process clauses. c. Company currently notifies customers of non-published/unlisted service, upon initial order, of their ability to be removed from telemarketing lists. Requirements for annual notice is unnecessary. 2. GTE a. Proposed rules are unnecessary and premature; contain unexplained differences from the FCC rules. FCC intends to reconsider some of its rules and has stayed enforcement of portions of its rules. FCC rules apply to both interstate and intrastate uses of CPNI. CPNI rights are already protected under federal rules. Where state's rules differ from FCC rules, extra expense and uncertainty are introduced, impairing competitive marketing efforts. Exact mirroring of wording in the future is difficult, inconsistencies would arise -- unexplained wording differences from the FCC rules could later be interpreted to indicate substantive differences between the two sets of rules Commission rules can not apply to wireless carriers, thus cannot be competitively neutral. FCC rules cover both wireline and wireless. Consistency with FCC rules cannot be attained until the FCC's rules are finalized. Company cites FCC suspension of enforcement of system safeguards and audits effective September 24, 1998. b. Cites these internal inconsistencies, errors and differences between FCC and Commission proposed rule : 480-120-151 subsection (2)(a) includes the phrase "voice mail messaging" while FCC rules use "voice mail or messaging." Subsection (2) includes reference to "(c) of this subsection", should be "(3)" 480-120-153 is missing the word 'develop" from subsection (1). Subsection (2) contains wording on the training requirement not contained in the FCC's rule. 480-120-154 subsection (4) definition of CPNI is an "either/or" while the FCC's rule is a (1) "and" (2) approach. Also, the Commission rule excepts wireless carriers from subsection (9) definition of "telecommunications carrier". c. Conclusion: Commission should not adopt proposed rules; should repeal existing CPNI rules that duplicate FCC. If proposed rules were to be adopted, the wording should precisely mirror the FCC's rules or the Commission should clearly state the intent of any differences. 3. Sprint a. The addition of any consequential state-specific variations from federal rules would be extremely burdensome to a company that operates throughout the country. b. Washington should not adopt any new CPNI rules until the FCC docket is closed. Comments also cite Sept. 24, 1998 FCC suspension of enforcement. Sprint's position is that the systematic safeguards ordered by the FCC are excessive, burdensome, unnecessary, and cost millions of dollars to implement. c. Recommends the Washington rules be adopted after FCC docket is concluded and suggests that clarifying language be included in proposed rules, describing the intent to be internally consistent with FCC rules. (see comments for language). 4. Public Counsel, Washington Attorney General a. Summarizes FCC Rules status as being final, with three issues contained in a Further Notice of Proposed Rulemaking. A significant number of petitions for reconsideration are pending, with no indication of when the FCC will rule on the reconsiderations. Cites the September 24, 1998 order extending the deadline for enforcement of electronic safeguards provisions. b. WAC 480-120-144 - should be amended to allow any customer, not just unlisted/non-published numbers, to ask that the serving telco refrain from solicitation. Provides suggested language. c. WAC 480-120-151 - paragraph (2) reference to subsection "(c)" should read as "(3)". d. WAC 480-120-152 - recommends that the notification of customer rights and carrier duties be amended to note the applicability of state as well as federal laws. Provides suggested language. Notes that: Approval by a customer for use of CPNI amounts to a waiver of the customer's right to privacy. For such a waiver to be effective it must be knowing and voluntary. PC attaches as Appendix A a copy of a notice USWC is currently giving customers regarding "customer privacy." Suggests that the notice does not comply with rules, as it does not clearly state that the customer has a right and the carrier a duty to protect CPNI. The notice appears slanted towards obtaining approval. e. PC supports adoption of the rules, broadening of "no-solicitation" rule to include all customers, and recommends that the adopting order address the good faith implementation of the notification requirement and require Staff review of notice language. - Also supports the Commission's announced intent to examine privacy issues in a separate docket. 5. GST Telecom, Inc. a. WUTC's proposed rules will invariably conflict with FCC rules. Inconsistent interpretations and conflicting enforcement will impose expensive, new burdens on carriers, preventing uniform implementation of the federal Act. The inconsistencies will arise instantaneously upon enactment of the proposed regulations. b. The FCC Rulemaking in incomplete and subject to reconsideration. Cites outstanding "Further Notice of Proposed Rulemaking". c. Commission should not adopt proposed CPNI rules. FCC concluded that it had jurisdiction to enact CPNI rules which cover both interstate and intrastate services. (cites Second Report, 11 FCC Rcd. at 8074) -state does not need parallel protections, all CPNI in covered by federal rule. Only if FCC rules are held to be inapplicable to local service should the WUTC consider adopting rules. d. WUTC enactment of the FCC software flagging and electronic monitoring rules would create inconsistent and burdensome obligations. Cites Sept. 24, 1998 FCC order staying enforcement of electronic safeguards provisions. WUTC should not enact rules the FCC has deferred. e. WUTC proposed "unpublished number" rule (480-120-144) directly conflicts with the federal balance between privacy, competition and interstate commerce. FCC has determined that the customer's name, address and phone number are not CPNI, and can be used to offer new services. WUTC proposed rule subjects carriers to inconsistent requirements - annual contact for non-published numbers customers, while other notifications and approval requirements continue until modified by customer. Customers changing their listings will create added confusion and risks that carriers would violate state Rules. WUTC should not enact this conflicting rules, but should participate in the FCC's rulemaking to resolve any conflicts and disagreements. 6. Century Telephone Enterprises, Inc. Century Telephone Enterprises concurs with the comments of GST Telecom. 7. WITA a. Generally supports the commission proposal. The issues WITA has objected to at the federal level are under appeal. WITA asks that the WUTC rules reflect the outcome of those appeals and maintain consistency with FCC provisions. b. Three specific comments: WAC 480-120-151 - paragraph (2) reference to subsection "(c)" should read as "(3)". WAC 480-120-144 - protections already covered in WAC 480-120-152, this is duplicative and the annual notice requirement in costly and not needed. This section should be deleted. WAC 480-120-153 - these safeguards have been stayed by FCC order, Sept. 24, 1998. The Commission should not adopt those rules while the stay is in effect. 8. AT&T a. WAC 480-120-151 - paragraph (2) reference to subsection "(c)" should read as "(3)". b. Washington rules omit subsection contained in FCC rule. Should include: WAC 480-120-152 (6)(b)(vi) If any portion of a notification is translated into another language, then all portions of the notification must be translated into that language.. If inserted, remainder of rules need to be renumbered appropriately. c. Company agrees that Washington rules exclude CMRS, d. Cites FCC suspension of enforcement of system safeguards and audits effective September 24, 1998. Recommends the Commission modify Washington rules, as appropriate, to conform with whatever electronic safeguards are deemed appropriate by the FCC.