[Senate Report 109-253]
[From the U.S. Government Publishing Office]
109th Congress Report
SENATE
2d Session 109-253
_______________________________________________________________________
Calendar No. 425
PROTECTING CONSUMER PHONE RECORDS ACT
__________
R E P O R T
of the
COMMITTEE ON COMMERCE, SCIENCE, AND TRANSPORTATION
on
S. 2389
together with
ADDITIONAL VIEWS
May 9, 2006--Ordered to be printed
SENATE COMMITTEE ON COMMERCE, SCIENCE, AND TRANSPORTATION
one hundred ninth congress
second session
TED STEVENS, Alaska, Chairman
DANIEL K. INOUYE, Hawaii, Co-Chairman
JOHN McCAIN, Arizona JOHN D. ROCKEFELLER IV, West
CONRAD BURNS, Montana Virginia
TRENT LOTT, Mississippi JOHN F. KERRY, Massachusetts
KAY BAILEY HUTCHISON, Texas BYRON L. DORGAN, North Dakota
OLYMPIA J. SNOWE, Maine BARBARA BOXER, California
GORDON H. SMITH, Oregon BILL NELSON, Florida
JOHN ENSIGN, Nevada MARIA CANTWELL, Washington
GEORGE ALLEN, Virginia FRANK LAUTENBERG, New Jersey
JOHN E. SUNUNU, New Hampshire E. BENJAMIN NELSON, Nebraska
JIM DeMINT, South Carolina MARK PRYOR, Arkansas
DAVID VITTER, Louisiana
Lisa Sutherland, Staff Director
Christine Kurth, Deputy Staff Director
Kenneth Nahigian, Chief Counsel
Margaret Cummisky, Democratic Staff Director and Chief Counsel
Samuel Whitehorn, Democratic Deputy Staff Director and General Counsel
Calendar No. 425
109th Congress Report
SENATE
2d Session 109-253
======================================================================
_____
PROTECTING CONSUMER PHONE RECORDS ACT
_______
May 9, 2006.--Ordered to be printed
_______
Mr. Stevens, from the Committee on Commerce, Science, and
Transportation, submitted the following
R E P O R T
together with
ADDITIONAL VIEWS
[To accompany S. 2389]
The Committee on Commerce, Science, and Transportation, to
which was referred the bill (S. 2389) to amend the
Communications Act of 1934 to prohibit the unlawful acquisition
and use of confidential customer proprietary network
information, and for other purposes, having considered the
same, reports favorably thereon with an amendment (in the
nature of a substitute) and recommends that the bill (as
amended) do pass.
Purpose of the Bill
The purpose of S. 2389 is to make it illegal to acquire, use,
sell, or solicit a third party to unlawfully obtain a person's
confidential phone records without that person's consent. The
Federal Communications Commission (FCC) would be required to
enhance the confidentiality procedures of telecommunications
carriers and IP-enabled voice providers with access to such
information to the extent existing protections are inconsistent
with standards set forth in the Gramm-Leach-Bliley Act (P.L.
106-102) (GLBA). The bill also would provide the FCC and the
Federal Trade Commission (FTC) with strengthened enforcement
authority to ensure that confidential phone records are not
accessible by bad actors. Under the bill, a carrier or an IP-
enabled voice provider would be required to notify a customer
if someone without authorization gains access to a customer's
phone records. The bill's provisions would cover wireless,
wireline, and IP telephone services. Furthermore, the bill
would require the FCC and FTC to educate the public on various
protections and enforcement efforts used to prevent
unauthorized access of consumers' phone records.
Background and Needs
Personal phone records are confidential consumer information,
but have recently become targets of data brokers who buy and
sell customer phone records for a fee over the Internet. Data
brokers sometimes use what is called ``pretexting,'' whereby a
person impersonates a phone customer to obtain confidential
customer phone records from a carrier. The broker then sells
the records on a website to anyone willing to pay a small fee.
Certain websites, like ``www.locatecell.com,'' have offered for
sale to the public a full cell phone record of a consumer's
incoming and outgoing calls for $110.00. In a recent stunt by
an online blogger, the cell phone records of former
Presidential candidate, Wesley Clark, were purchased from
``www.celltolls.com'' for $89.95. The relative ease by which
individuals can obtain and sell these records has led to public
calls for government action to prevent such personal
information from becoming public.
Investigations currently are underway by both the FCC and the
FTC as to how phone records are being divulged to third party
data brokers without a customer's consent. Several methods are
possible, but the use of pretexting likely is a primary method
through which phone records are obtained by impersonating the
authorized user. Pretexting is made even easier if unauthorized
third parties obtain personal information such as a customer's
password, Social Security number, or identifying information
that can be used to convince the carrier that release of the
true customer's phone records is legitimate and appropriate.
Other methods and means by which unauthorized third parties
obtain and sell personal phone records in the public domain
include hacking and compromised employees.
In addition to recent actions taken by Federal regulators
against pretexters, the FCC also issued a Notice of Proposed
Rulemaking in February to consider what additional steps, if
any, should be taken by the Commission to further protect the
confidentiality of customer proprietary network information
(CPNI).
Telecommunications carriers are already under an affirmative
obligation to protect and safeguard a customer's proprietary
information, and to refrain from distributing this information
to a third party without the customer's consent or as permitted
by law (e.g., emergency purposes, law enforcement purposes) (47
U.S.C. Sec. 1A222). CPNI includes such data as quantity of
phone calls by a customer, destination of the phone call,
location, and amount of use of a telecommunications service.
For example, if a customer purchases basic local telephone
service, the local telephone company and its affiliates do not
need the customer's approval to use CPNI to try to sell voice
mail or caller ID services to the customer. The local telephone
company, however, may not use or share CPNI with an affiliate
to try to sell wireless service without the customer's
approval, because wireless telephone service is a different
category of service than local telephone service.
With such an affirmative obligation regime in place, the
carrier must still be able to provide a customer with personal
account information upon request. Carriers, therefore, are
required to balance a customer's expectation of privacy that
phone records remain closed to public inquiry, while
concurrently providing a level of service that does not impede
access for a customer in obtaining the customer's own
information.
Currently, under rules adopted pursuant to GLBA, specific
prohibitions on prextexting are limited to cases where
pretexting is used to obtain financial records. Current law
does not specifically outlaw pretexting for phone records. (15
U.S.C. Sec. 1A45(a) and Sec. 1A6801-09). The FTC has taken the
position that it has the power to pursue actions against phone
record pretexters based on its general authority to prevent
deceptive and unfair business practices, but without this
explicit ban, such practices may be more difficult to
prosecute. Even if FTC's authority to pursue actions against
pretexters of phone records is assumed, the Federal Trade
Commission Act (FTC Act) does not authorize the immediate
imposition of civil penalties against third party data brokers.
An action filed in a Federal district court against the accused
party would be the only way for the FTC to obtain injunctive or
equitable relief.
Summary of Provisions
The bill, S. 2389, would make it illegal to acquire or use a
person's phone records without that person's written consent;
to acquire a person's phone records by misrepresenting that
person's consent to such acquisition; to obtain unauthorized
access to data; or to sell or solicit data that was or will be
obtained without authorization. The bill would provide
exceptions for phone companies using customer information for
legitimate uses not currently prohibited by section 222 of the
Communications Act. IP-enabled voice providers, which are not
currently covered by law, would be specifically treated as
phone companies for the purpose of allowing them to benefit
from the same course of business exemption.
The bill would require the FCC to issue rules enhancing
confidentiality procedures for phone companies or IP-enabled
voice service providers to the extent the FCC determines that
changes in its rules are necessary to bring confidentiality
protections in line with these regulations adopted by the FTC
under GLBA, taking into consideration the differences between
financial information and CPNI.
The bill would increase penalties and extend the FCC's
statute of limitations under section 509 of the Communications
Act from one year to two years. The bill also would extend
phone record protection requirements under section 222 of the
Communications Act of 1934 (1934 Act) to IP-enabled voice
service providers. Within 14 calendar days of a breach, phone
companies and IP-enabled service providers would be required to
notify a customer whose records were improperly given out.
The bill also would provide for service provider enforcement
as if the violations of the bill were an unfair or deceptive
act or practice, and would give the FCC concurrent jurisdiction
with the FTC in that respect to enforce the illegal acquisition
provisions of the bill. The bill would provide that venue for
any action shall be in the place of business of the service
provider rather than the bad actor. It would preempt State laws
regulating the treatment of CPNI by telecommunications carriers
and IP-enabled voice service providers except those of general
applicability, tort or contract law, and other fraud or
computer crime laws. It also would require the FTC and the FCC
to jointly establish and implement a public education campaign.
Legislative History
The Protecting Consumer Phone Records Act was introduced by
Senator Allen on March 8, 2006, and is cosponsored by Senators
Stevens, Inouye, Burns, Dorgan, Hutchison, Bill Nelson, Pryor,
Vitter, Coleman, Martinez, Santorum, Talent, Thune, and Warner.
On Wednesday, February 8, 2006, the Subcommittee on Consumer
Affairs, Product Safety, and Insurance held a hearing to
examine privacy implications arising from the distribution of
personal phone records without a customer's prior
authorization. The subsequent sale of these phone records over
the Internet by third party data brokers/website operators was
the focus of the hearing. The Subcommittee heard testimony on
available methods for preventing third parties from obtaining
consumers' phone records without consent.
On March 30, 2006, the Committee held an Executive Session
during which S. 2389 was considered. Chairman Stevens and
Senator Inouye offered an amendment in the nature of a
substitute that would clarify that consent to acquire phone
records may be granted electronically; clarify that the general
prohibitions against the acquisition, use or sale of CPNI do
not extend to the current business practices by voice providers
(including IP-enabled voice service providers), or third
parties that lawfully obtain CPNI from a carrier or provider
that are not prohibited by section 222; and maintain the status
quo with respect to the acquisition and use of CPNI for law
enforcement, homeland security, or similar purposes already
authorized by law. The substitute amendment was adopted by
voice vote.
An amendment to the substitute was offered by Senators
Stevens and Burns that would expand the group of entities that
may carry out State enforcement to include State Public Utility
Commissions or other State agencies in States, which have
delegated enforcement of such matters to such officials. The
amendment to the substitute was adopted by voice vote.
Senator Boxer offered an amendment to the substitute that
would preclude wireless telephone companies from including
customer numbers in any wireless directory assistance database
without providing prior notice to customers of their right not
to be listed and without obtaining express prior authorization
from the customer to include his or her number in such
database. The amendment also would prohibit wireless companies
from charging customers for the removal of their number from a
wireless directory and would preempt inconsistent State and
local laws. The amendment to the substitute was adopted by
voice vote.
Senator Pryor offered an amendment to the substitute that
would allow a consumer harmed by a violation of section 2 to
bring a civil action in a Federal district court or other court
of competent jurisdiction against the person who caused the
harm. The consumer would be able to obtain damages of up to
$11,000 per violation or treble damages if it is proven that
the defendant knowingly or willfully violated section 2 of this
bill. The Court would be permitted to assess against any party
the costs of such an action, including reasonable attorney's
fees. Although the Committee has not recently adopted a private
right of action in other consumer legislation, the amendment
was offered in this case because of the special type of
physical and psychological harm that potentially could be
caused if a consumer's CPNI is inappropriately obtained and
used. Senator Pryor's amendment was adopted by a rollcall vote
of 11 to 10 (Senator Rockefeller was recorded as necessarily
absent).
The Committee, without objection, ordered that S. 2389 be
reported with amendments.
Estimated Costs
In accordance with paragraph 11(a) of rule XXVI of the
Standing Rules of the Senate and section 403 of the
Congressional Budget Act of 1974, the Committee provides the
following cost estimate, prepared by the Congressional Budget
Office:
May 8, 2006.
Hon. Ted Stevens,
Chairman, Committee on Commerce, Science, and Transportation,
U.S. Senate, Washington, DC.
Dear Mr. Chairman: The Congressional Budget Office has
prepared the enclosed cost estimate for S. 2389, the Protecting
Consumer Phone Records Act.
If you wish further details on this estimate, we will be
pleased to provide them. The CBO staff contacts are Melissa Z.
Petersen (for federal costs), Sarah Puro (for the impact on
state, local, and tribal governments), and Fatimot Ladipo (for
the impact on the private sector).
Sincerely,
Donald B. Marron,
Acting Director.
Enclosure.
S. 2389--Protecting Consumer Phone Records Act
Summary: S. 2389 would prohibit obtaining or selling the
personal information of telecommunications customers--including
phone records--without the consumer's consent. The bill also
would require telecommunications carriers to take precautions
to safeguard customers' personal information and to notify
customers whenever there is a breach in the security of this
information. Under S. 2389, the Federal Communications
Commission (FCC) and the Federal Trade Commission (FTC) would
enforce restrictions and requirements related to the security
of this information, including assessing and collecting civil
penalties for violations of the bill's provisions. Finally, the
FCC and the FTC would conduct an outreach campaign to inform
consumers of the security issues involving telecommunications
information. Assuming appropriation of the necessary amounts,
CBO estimates that implementing the bill would cost less than
$500,000 in 2006 and about $10 million over the 2007-2011
period.
Enacting S. 2389 could increase federal revenues and direct
spending as a result of the collection of additional civil,
criminal, and forfeiture penalties assessed for violations of
the new laws and regulations. Collections of civil penalties
and forfeiture penalties are recorded in the budget as
revenues. Collections of criminal penalties are recorded in the
budget as revenues, deposited in the Crime Victims Fund, and
later spent. CBO estimates, however, that any additional
revenues and direct spending that would result from enacting
the bill would not be significant because of the relatively
small number of cases likely to be involved.
S. 2389 contains intergovernmental mandates as defined in
the Unfunded Mandates Reform Act (UMRA), but CBO estimates
costs to state, local, and tribal governments, if any, would be
small and would not exceed the threshold established in UMRA
($64 million in 2006, adjusted annually for inflation).
S. 2389 would impose new private-sector mandates, as
defined in UMRA, on telecommunications carriers and providers
of Internet protocol (IP)-enabled voice service. The bill would
require the FCC to prescribe more stringent confidentiality
requirements for customer proprietary network information and
require telecommunications carriers and IP-enabled voice
service providers to certify on an annual basis that they are
in compliance with those regulations. Additionally, the bill
would require such providers to notify customers on a timely
basis if their customer information has been disclosed, and
prohibit wireless telephone providers from listing subscribers'
numbers in any directory assistance database or written
directory without prior authorization. The costs of several
mandates depend on regulations that have not been established;
therefore, CBO cannot determine whether the costs of the
mandates in the bill would exceed the annual threshold for
private-sector mandates ($128 million in 2006, adjusted
annually for inflation).
Estimated cost to the Federal Government: The estimated
budgetary impact of S. 2389 is shown in the following table.
The costs of this legislation fall within budget function 370
(commerce and housing credit). For this estimate, CBO assumes
that the bill will be enacted in 2006 and that the necessary
amounts will be appropriated for each year. Based on
information from the FTC and the FCC, CBO estimates that
implementing the bill would cost each agency less than $250,000
in 2006 and about $5 million over the 2007-2011 period. In
total, CBO estimates that implementing the bill would cost less
than $500,000 in 2006 and about $10 million over the 2007-2011
period for the FCC and the FTC to enforce the bill's provisions
regarding the personal information of telecommunications
customers.
----------------------------------------------------------------------------------------------------------------
By fiscal year, in millions of dollars--
-----------------------------------------------------------
2006 2007 2008 2009 2010 2011
----------------------------------------------------------------------------------------------------------------
CHANGES IN SPENDING SUBJECT TO APPROPRIATION
Estimated Authorization Level....................... * 2 2 2 2 2
Estimated Outlays................................... * 2 2 2 2 2
----------------------------------------------------------------------------------------------------------------
Note: *=Less than $500,000.
Estimated impact on State, local, and tribal governments:
Provisions in section 7 would require State Attorneys General
to notify the FTC and the FCC of any action taken under the
bill, allow either federal agency to intervene in those
actions, and limit the actions that Attorneys General may take
in certain circumstances. Also, provisions in sections 4 and 8
would preempt state laws regarding the protection and
disclosure of certain phone records. Those provisions
constitute intergovernmental mandates as defined in UMRA. CBO
estimates that the aggregate costs, if any, to state, local,
and tribal governments of complying with the mandates in the
bill would be small and would not exceed the threshold
established in UMRA ($64 million in 2006, adjusted for
inflation).
Estimated impact on the private sector: S. 2389 would
impose new private-sector mandates, as defined in UMRA, on
telecommunications carriers and IP-enabled voice service
providers. As the cost of many of the provisions in the bill
depend on the rules to be prescribed by the FCC, CBO cannot
determine whether the costs of the mandates in the bill would
exceed the annual threshold for private-sector mandates ($128
million in 2006, adjusted annually for inflation).
Section 3 of the bill would require the FCC to prescribe
regulations adopting more stringent confidentiality procedures
for protecting customer proprietary network information. The
FCC regulations would require telecommunications carriers and
IP-enabled voice service providers to:
Protect the security and confidentiality of
customer proprietary network information;
Certify annually that they are in compliance
with the current FCC regulations on protecting customer
proprietary information; and
Notify a customer within 14 days if their
information was disclosed in violation of FCC
regulations.
According to government sources, some of the requirements
are currently practiced by the telecommunications industry. In
addition, according to industry sources the direct cost for
carriers to comply with these new notification requirements
would be nominal. The cost of providing such additional
security would depend on the rules to be prescribed by the FCC.
Since the regulations have not been established, CBO cannot
estimate the direct cost to comply with those mandates.
Additionally, the bill would prohibit wireless
communications providers from including their customers'
wireless phone numbers in any wireless directory assistance
service database or written directory without prior
authorization. According to industry sources, wireless
communications providers have not made this service available,
however, some carriers may be exploring this service for their
business subscribers. Those carriers have indicated that the
cost of complying with this mandate would be small.
Previous CBO estimates: On March 15, 2006, CBO transmitted
a cost estimate for H.R. 4943, the Prevention of Fraudulent
Access to Phone Records Act, as ordered reported by the House
Committee on Energy and Commerce on March 8, 2006. The two
bills contain similar provisions related to the security of the
personal information of telecommunications customers. CBO
estimates that both bills would have similar costs for the FCC,
but that S. 2389 would have slightly higher costs for the FTC
to enforce the new laws and regulations and to conduct the
media campaign in conjunction with the FCC.
H.R. 4943 is similar in scope to S. 2389 but does not
contain any preemptions of state and local laws. The
intergovernmental mandates statements reflect that difference.
The private-sector mandates contained in H.R. 4943 are very
similar to some of the mandates in S. 2389. Both bills require
telecommunications carriers to increase the protection of
customer proprietary network information, provide timely notice
to each customer upon breach of customer proprietary network
information. Because the cost of mandates in both bills depends
on rules to be prescribed by the FCC, CBO could not determine
whether those costs would exceed UMRA's annual threshold for
private-sector mandates.
Estimate prepared by: Federal Costs: Melissa Z. Petersen;
Impact on State, Local, and Tribal governments: Sarah Puro;
Impact on the Private Sector: Fatimot Ladipo.
Estimate approved by: Peter H. Fontaine, Deputy Assistant
Director for Budget Analysis.
Regulatory Impact Statement
In accordance with paragraph 11(b) of rule XXVI of the
Standing Rules of the Senate, the Committee provides the
following evaluation of the regulatory impact of the
legislation, as reported:
NUMBER OF PERSONS COVERED
The FCC may issue regulations to implement the requirement
set forth in the reported bill that it be illegal to acquire,
use, sell, or solicit a person's confidential phone records
without that person's consent. The reported bill also would
require the FCC to promulgate rules to the extent it determines
necessary, to require regulated entities to enhance their
procedures for protecting consumer records and ensure that its
rules regarding the security of confidential phone records are
consistent with those protections adopted under GLBA, taking
into account the differences between financial information and
CPNI. The FCC would be required to develop regulations to
implement these requirement, so individuals or businesses that
handle relevant consumer records subject to the legislation
would become subject to new or modified regulations.
ECONOMIC IMPACT
S. 2389 would not have an adverse economic impact on the
nation's economy. The Act would require that the FCC impose
additional safeguards and procedures on phone companies if they
are determined to be necessary.
PRIVACY
The reported bill would enhance the personal privacy of U.S.
citizens.
PAPERWORK
The reported bill should not increase paperwork requirements
significantly for individuals and businesses.
Section-by-Section Analysis
Section 1. Short title; Table of contents
This section sets forth the short title ``Protecting Consumer
Phone Records Act'' and the table of contents.
Section 2. Unauthorized acquisition, use, or sale of confidential
customer proprietary network telephone information
Subsection (a) would make it unlawful for any person to
acquire, use, or sell another person's customer proprietary
network information or CPNI, which is already defined in
section 222(i)(1) of the 1934 Act and includes phone records
and certain other information made available to carriers based
on the customer's use of the service, without that person's
affirmative written consent (which may be given
electronically). This subsection would outlaw the sale of CPNI
and specifically would outlaw misrepresenting that a person has
given authorization to another person to obtain their phone
records, often referred to as pretexting.
Subsection (b) would ensure that prohibitions under
subsection 2(a) do not apply to legitimate business practices
currently not prohibited by section 222 of the 1934 Act. This
subsection would preserve law enforcement's ability to obtain
phone records, require that IP-enabled voice service providers
be treated like telecommunications carriers for purposes of
section 2 of this bill, and clarify continued legality of using
caller ID to identify calls received. Nothing in subsection
2(b)(4) prohibits the use of caller identification services to
identify the originator of telephone calls or requirements
enabling a person to conceal their telephone number from caller
ID devices and services. In addition, the Committee is aware
that under current law telecommunications carriers and IP-
enabled voice service providers engage third parties in
activities that involve CPNI in the normal course of business.
For instance, a carrier or provider might contract out its
billing functions, which necessarily involves CPNI, or may
allow a company that is considering purchasing it to review its
books and assets, including CPNI. In other examples, aggregate
data containing phone numbers may be provided to third parties
in a secure manner. Under each of these sharing scenarios,
third parties agree via contract to be bound in their handling
of such data by the laws applicable to carriers handling and
use of such information. In still other cases, call data may be
shared in connection with the provision of in-vehicle emergency
communications in order to provide emergency services to
consumers. Thus, to the extent that certain disclosures of CPNI
data are permitted under current law, the Committee does not
intend that anything in this Act would change the
permissiveness of such practices. The Committee drafted the
exception for legitimate business practices in subsection 2(b)
with the intent of preserving such business practices that
currently are not prohibited under section 222 of the 1934 Act
or under the FCC's rules. The Committee does not intend for the
exception to extend beyond normal business practices related to
provisioning voice service. For instance, acquiring CPNI from
another carrier in violation of section 2 is not intended to be
covered by this exception.
Subsection (c) would allow phone companies to initiate a
private right of action against data brokers or others who
illegally acquire, use, sell, or solicit phone records. This
subsection would boost enforcement because a carrier may be in
a better position than consumers to figure out who is obtaining
this information and also may have more resources to litigate
such claims. Similar authority has been helpful with respect to
enforcing the anti-spam law. This subsection would provide for
treble damages and for inflation adjustment.
Subsection (d) would allow a consumer who was harmed by a
violation of section 2 to bring a civil action in a Federal
district court or other court of competent jurisdiction, but
would not allow a consumer to bring a civil action against a
telecommunications carrier. The consumer would be able to
obtain damages of up to $11,000 per violation or treble damages
if the defendant is proved to have knowingly or willfully
violated section 2. The district court would be permitted to
assess against any party the costs of such an action, including
reasonable attorney's fees.
Subsection (e) would provide for civil penalty of $11,000 for
each violation or each day of a continuing violation, but caps
penalty for single act or failure to act at $11,000,000.
Subsection (f) would clarify that nothing under this Act or
section 222 of the 1934 Act authorizes a customer to bring a
private right of action against a telecommunications carrier or
an IP-enabled voice service provider.
Subsection (g) would provide definitions for the terms
``Customer Proprietary Network Information,'' ``IP-enabled
voice service,'' and ``Telecommunications Carrier.''
Section 3. Enhanced confidentiality procedures
Subsection (a) would require the FCC to review its
regulations and revise them, if necessary, to ensure that the
regulations meet the three directives set forth in GLBA for
financial institutions. To the extent the FCC revises its
regulations, the Commission is directed to adopt rules similar
in scope and structure to the regulations adopted by the FTC
pursuant to GLBA. This is intended to help standardize industry
practices for protecting consumer information.
Subsection (b) would require phone companies to annually
certify that such carriers are in compliance with section 222
of the 1934 Act, as well as any regulations issued pursuant to
this section.
Section 4. Penalties; Extension of confidentiality requirements to
other entities
Subsection (a) would establish a $30,000 penalty per
violation for any person found to have violated section 2 of
this Act, with a limit of $90,000 per day for any continuing
violation, and a cap of $3 million for any single act or
failure to act. This section also would add additional criminal
penalties under the 1934 Act of $30,000 per violation or
$90,000 per day for any continuing violation.
Subsection (b) would extend FCC's phone record and CPNI rules
to IP-enabled voice services. As a result, all wireline,
wireless and IP based phone companies would be covered by
comparable rights and obligations.
Subsection (c) would define IP-enabled voice service. The
Committee notes that the definition of IP-enabled voice service
provider is different in this bill than the definition used in
the context of 911 calls over IP-enabled voice services. This
bill would propose a definition that would capture one-way
services that only allow calls to or from the public switched
telephone network. In the context of 911, the Committee
believed that consumers who purchase a voice service with
limited capabilities and features would not necessarily expect
to be able to call 911, so the definition in that context only
included two-way services. However, the Committee believes that
consumers still would have an expectation of privacy relative
to the records of any phone calls they make or receive even in
connection with a one-way service.
Subsection (d) would require telecommunications carriers and
IP-enabled voice service providers to notify customers within
14 calendar days if they realize that the customers information
has been provided to unauthorized third parties. This section
also would provide an exception for delay consistent with law
enforcement or homeland security determinations.
Subsection (e) would provide for a two-year statute of
limitations for FCC enforcement under title V of the 1934 Act.
Subsection (f) would exempt cable VOIP service from the
privacy requirements of title VI to the extent such service is
covered by the Protecting Consumer Phone Records Act to provide
competitive neutrality and to prevent conflicting regulatory
requirements.
Subsection (g) prohibits commercial mobile service providers
from including the wireless telephone number information of any
customer in a wireless directory assistance service database
unless the provider first provides notice to the customer of
the right not to be listed, and then obtains separate, express
authorization from the customer to be included in the directory
upon request on a cost-free basis. Finally, this subsection
preempts any State or local laws that are inconsistent with its
requirements.
Section 5. Enforcement by the FTC
This section would provide authority for FTC enforcement of
section 2 of the Protecting Consumer Phone Records Act as if a
violation of that section were a violation of the FTC Act.
Section 6. Concurrent enforcement by the FCC
This section would give the FCC concurrent jurisdiction with
the FTC to enforce section 2, and would provide that for
enforcement purposes a violation of section 2 would be deemed a
violation of the 1934 Act.
Section 7. Enforcement by States
Subsection 7(a) would allow States to sue in Federal district
court to enforce section 2 or to impose civil penalties if
State has reason to believe its citizens are threatened or
adversely affected.
Subsection 7(b) would require that before initiating a civil
action under subsection 7(a), a State must serve written notice
on the FTC and the FCC.
Subsection 7(c) would allow the FTC and the FCC to intervene
in a civil action under subsection 7(a) and to be heard on all
matters therein and to file petitions for appeal of a decision
in such civil action.
Subsection 7(d) would clarify that subsection 7(a) would not
prevent a State from conducting investigations or administering
oaths or affirmations, or compelling the attendance of
witnesses or the production of documentary and other evidence.
Subsection 7(e) would provide that venue for an action
brought under subsection 7(a) lies in Federal district court
pursuant to 28 U.S.C. 1391, and that process may be served
without regard to territorial limits of the district or State
where the action is instituted. Subsection 7(e) also would
provide that a person who participated in an alleged violation
may be joined in the civil action without regard to the
residence of that person.
Subsection 7(f) would provide that if either the FTC or the
FCC has instituted a proceeding for violation of section 2, the
State in which the violation has occurred may not bring an
action under section 2 against the same alleged violator during
pendency of such proceeding.
Section 8. Preemption of State law
Section 8 would provide that sections 2 and any regulations
prescribed pursuant to section 3 of this bill and section 222
of the 1934 Act shall preempt (1) any State or local statute,
regulation or rule that requires a telecommunications carrier
or provider of IP-enabled voice service to develop, implement,
maintain, or restrict customer proprietary network information
or other individually identifiable customer information held by
that telecommunications carrier or provider of IP-enabled voice
service, and (2) any such statute, regulation, or rule, or
judicial precedent of any State court under which liability is
imposed on a telecommunications carrier or provider of IP-
enabled voice service for failure to comply with the
requirements of section 2 or 3 of this Act, or section 222 of
the 1934 Act. The Committee intends that Federal preemption
under this section will extend to State laws that are
inconsistent with the provisions of sections 2 or 3 of this Act
and section 222 of the 1934 Act.
Section 9. Consumer outreach and education
Section 9 would require that within 180 days after the date
of enactment of this Act, the FTC and the FCC shall jointly
establish and implement a campaign to educate the public about
the protection afforded under this Act as well as under the FTC
Act and the 1934 Act. Subsection 9(b) would require such public
education campaign to inform the public about the theft and
misuse of customer proprietary network information, methods to
protect such information, and Federal prevention and
enforcement efforts. In carrying out this education
requirement, the FTC and FCC must explore the use of various
distribution platforms.
Rollcall Votes in Committee
Senator Pryor offered an amendment to the substitute that
would allow a consumer who was harmed by a violation of section
2 to bring a civil action in a Federal district court or other
court of competent jurisdiction. By a rollcall vote of 11 yeas
and 10 nays as follows (Senator Rockefeller was recorded as
necessarily absent), the amendment was adopted.
YEAS--11 NAYS--10
Ms. Snowe Mr. McCain \1\
Mr. Smith Mr. Burns \1\
Mr. Inouye Mr. Lott
Mr. Kerry \1\ Mrs. Hutchison \1\
Mr. Dorgan\1\ Mr. Ensign\1\
Mrs. Boxer Mr. Allen
Mr. Nelson of Florida \1\ Mr. Sununu
Ms. Cantwell Mr. DeMint \1\
Mr. Lautenberg Mr. Vitter\1\
Mr. Nelson of Nebraska\1\ Mr. Stevens
Mr. Pryor
\1\By proxy
ADDITIONAL VIEWS OF SENATOR PRYOR
PRIVATE RIGHT OF ACTION FOR CONSUMERS
As the Committee considered the difficult issue of protecting
consumers' private phone records, I felt that it was extremely
important that consumers be given the tools they need to
protect themselves from fraudulent and unscrupulous behavior.
In this legislation, we have provided a litany of enforcement
protections for consumers-including enforcement by the Federal
Trade Commission, Federal Communications Commission, and State
Attorneys General. I believe that these enforcement protections
are valuable and necessary to helping end the practice of
fraudulently obtaining and selling consumers' phone records
without authorization from the consumer. I support them
wholeheartedly. However, these enforcement protections do not
provide any recourse for the consumer-the person or persons
most likely to be harmed by unauthorized disclosures of phone
records. Furthermore, FTC, FCC, and State Attorney General
enforcement actions do not provide adequate protections for
those whose phone records are used for stalking and domestic
violence. For this reason, I offered an amendment to the
committee bill that would authorize consumers who have been
harmed by a person fraudulently obtaining or selling their
phone records to file suit against the person who caused the
harm through a violation of this act.
The Committee also did adopt, as a part of this legislation,
a providers' private right of action. Other recent consumer
protection legislation has not included a consumers' private
right of action. The inclusion of this amendment in this
legislation does not lead me to believe that the committee will
include a consumer private right of action in every
circumstance. In the SPAM legislation, the committee provided
Internet service providers a right of action. In S. 1408, the
Identity Theft Protection Act, there is no consumer or provider
private right of action. I believe that the exclusions of
private rights of action in these pieces of legislation are not
a good reason to exclude a consumer private right of action in
this case. In both cases of identity theft and SPAM, the nature
of the harm caused and the entity causing the harm are
fundamentally different than is the case with phone records.
Harm caused by SPAM is at worst an inconvenience, and
legitimate businesses could have a breach due to an honest
mistake in the case of identity theft. In those instances, we
have not allowed consumers to sue businesses performing
legitimate business practices. In the case of phone records,
the nature of the harm that can be caused is dramatically
different than in SPAM or identity theft because the harm can
be physical-it can literally endanger someone's life.
Individuals, rogue Internet operators, and fraudsters are
deliberately trying to cause harm, and as the committee heard
in testimony, this harm can sometimes lead to death. Because of
the special type of harm that can be caused by an unauthorized
disclosure of phone records, I believe a consumer private right
of action is a needed additional protection for consumers.
Several of my colleagues are concerned that the inclusion of
this amendment will create a precedent for future committee
consumer protection legislation. I believe that any future
consideration of a private right of action for consumers should
be done on a case by case basis. In this case of protecting
phone records, I felt that a consumer private right of action
was a common sense improvement to the bill, and a majority of
my colleagues agreed. I don't expect my colleagues to always
agree that this is an additional needed protection.
The purpose of this legislation is to protect consumers'
phone records. They are the ones most likely to be harmed
through an unauthorized release of their phone records, and
they have as much of a legally protectable interest as their
providers. The intention of my amendment is to provide recourse
for consumers who might not have any other place to go for
help, especially in the case of domestic violence. I feel they
should be allowed to pursue action, independent of the
government, against the criminals who intentionally steal their
information with the intent to cause harm. The unauthorized
disclosure, sale, or use of consumers' phone records are
practices we are trying to eliminate through this legislation.
I believe that more enforcement is always preferable to less
enforcement. My amendment is an attempt to make this bill
stronger for consumers.
Changes in Existing Law
SEC. 222. PRIVACY OF CUSTOMER INFORMATION.
[47 U.S.C. 222]
(a) In General.--Every telecommunications carrier or IP-
enabled voice service provider has a duty to protect the
confidentiality of proprietary information of, and relating to,
other [telecommunication carriers] telecommunications carriers
or IP-enabled voice service providers, equipment manufacturers,
and customers, including [telecommunication carriers]
telecommunications carriers or IP-enabled voice service
providers reselling telecommunications services provided by a
telecommunications carrier or IP-enabled voice service
provider.
(b) Confidentiality of Carrier and IP-enabled Voice Service
Provider Information.--A telecommunications carrier or IP-
enabled voice service provider that receives or obtains
proprietary information from another carrier for purposes of
providing any telecommunications service shall use such
information only for such purpose, and shall not use such
information for its own marketing efforts.
(c) Confidentiality of Customer Proprietary Network
Information.--
(1) Privacy requirements for telecommunications
carriers and ip-enabled voice service providers.--
Except as required by law or with the approval of the
customer, a telecommunications carrier or IP-enabled
voice service provider that receives or obtains
customer proprietary network information by virtue of
its provision of a telecommunications service shall
only use, disclose, or permit access to individually
identifiable customer proprietary network information
in its provision of (A) the telecommunications service
from which such information is derived, or (B) services
necessary to, or used in, the provision of such
telecommunications service, including the publishing of
directories.
(2) Disclosure on request by customers.--A
telecommunications carrier or IP-enabled voice service
provider shall disclose customer proprietary network
information, upon affirmative written request by the
customer, to any person designated by the customer.
(3) Aggregate customer information.--A
telecommunications carrier or IP-enabled voice service
provider that receives or obtains customer proprietary
network information by virtue of its provision of a
telecommunications service may use, disclose, or permit
access to aggregate customer information other than for
the purposes described in paragraph (1). A local
exchange carrier may use, disclose, or permit access to
aggregate customer information other than for purposes
described in paragraph (1) only if it provides such
aggregate information to other carriers or persons on
reasonable and nondiscriminatory terms and conditions
upon reasonable request therefor.
(d) Exceptions.--Nothing in this section prohibits a
telecommunications carrier or IP-enabled voice service provider
from using, disclosing, or permitting access to customer
proprietary network information obtained from its customers,
either directly or indirectly through its agents--
(1) to initiate, render, bill, and collect for
telecommunications services;
(2) to protect the rights or property of the carrier
or provider, or to protect users of those services and
other carriers or providers from fraudulent, abusive,
or unlawful use of, or subscription to, such services;
(3) to provide any inbound telemarketing, referral,
or administrative services to the customer for the
duration of the call, if such call was initiated by the
customer and the customer approves of the use of such
information to provide such service; and
(4) to provide call location information concerning
the user of a commercial mobile service (as such term
is defined in section 332(d))--
(A) to a public safety answering point,
emergency medical service provider or emergency
dispatch provider, public safety, fire service,
or law enforcement official, or hospital
emergency or trauma care facility, in order to
respond to the user's call for emergency
services;
(B) to inform the user's legal guardian or
members of the user's immediate family of the
user's location in an emergency situation that
involves the risk of death or serious physical
harm; or
(C) to providers of information or database
management services solely for purposes of
assisting in the delivery of emergency services
in response to an emergency.
(e) Subscriber List Information.--Notwithstanding subsections
(b), (c), and (d), a telecommunications carrier that provides
telephone exchange service shall provide subscriber list
information gathered in its capacity as a provider of such
service on a timely and unbundled basis, under
nondiscriminatory and reasonable rates, terms, and conditions,
to any person upon request for the purpose of publishing
directories in any format.
(f) Authority To Use Wireless Location Information.--For
purposes of subsection (c)(1), without the express prior
authorization of the customer, a customer shall not be
considered to have approved the use or disclosure of or access
to--
(1) call location information concerning the user of
a commercial mobile service (as such term is defined in
section 332(d)), other than in accordance with
subsection (d)(4); or
(2) automatic crash notification information to any
person other than for use in the operation of an
automatic crash notification system.
(g) Subscriber Listed and Unlisted Information for Emergency
Services.--Notwithstanding subsections (b), (c), and (d), a
telecommunications carrier that provides telephone exchange
service or IP-enabled voice service provider shall provide
information described in subsection (i)(3)(A) (including
information pertaining to subscribers whose information is
unlisted or unpublished) that is in its possession or control
(including information pertaining to subscribers of other
carriers) on a timely and unbundled basis, under
nondiscriminatory and reasonable rates, terms, and conditions
to providers of emergency services, and providers of emergency
support services, solely for purposes of delivering or
assisting in the delivery of emergency services.
(h) Notice of Violations.--
(1) In general.--The Commission shall by regulation
require each telecommunications carrier or IP-enabled
voice service provider to notify a customer within 14
calendar days after the carrier or provider is notified
of, or becomes aware of, an incident in which customer
proprietary network information relating to such
customer was disclosed to someone other than the
customer in violation of this section or section 2 of
the Protecting Consumer Phone Records Act.
(2) Law enforcement and homeland security related
delays.--Notwithstanding paragraph (1), a
telecommunications carrier or IP-enabled voice service
provider may delay the required notification for a
reasonable period of time if--
(A) a Federal or State law enforcement agency
determines that giving notice within the 14-day
period would materially impede a civil or
criminal investigation; or
(B) a Federal national security agency or the
Department of Homeland Security determines that
giving notice within the 14-day period would
threaten national or homeland security.
[(h)] (i) Definitions.--As used in this section:
(1) Customer proprietary network information.--The
term ``customer proprietary network information''
means--
(A) information that relates to the quantity,
technical configuration, type, destination,
location, and amount of use of a
telecommunications service or IP-enabled voice
service subscribed to by any customer of a
telecommunications carrier or IP-enabled voice
service provider, and that is made available to
the carrier or provider by the customer solely
by virtue of the carrier-customer or provider-
customer relationship; and
(B) information contained in the bills
pertaining to [telephone exchange service or
telephone toll service] telephone exchange
service, telephone toll service, or IP-enabled
voice service received by a customer of a
carrier or provider;
except that such term does not include subscriber list
[information.] information nor does it include
information that is related to non-voice service
features bundled with IP-enabled voice service.
(2) Aggregate information.--The term ``aggregate
customer information'' means collective data that
relates to a group or category of services or
customers, from which individual customer identities
and characteristics have been removed.
(3) Subscriber list information.--The term
``subscriber list information'' means any information--
(A) identifying the listed names of
subscribers of a carrier or provider and such
subscribers' telephone numbers, addresses, or
primary advertising classifications (as such
classifications are assigned at the time of the
establishment of such service), or any
combination of such listed names, numbers,
addresses, or classifications; and
(B) that the carrier or provider or an
affiliate has published, caused to be
published, or accepted for publication in any
directory format.
(4) Public safety answering point.--The term ``public
safety answering point'' means a facility that has been
designated to receive emergency calls and route them to
emergency service personnel.
(5) Emergency services.--The term ``emergency
services'' means 9-1-1 emergency services and emergency
notification services.
(6) Emergency notification services.--The term
``emergency notification services'' means services that
notify the public of an emergency.
(7) Emergency support services.--The term ``emergency
support services'' means information or data base
management services used in support of emergency
services.
(8) IP-enabled voice service.--The term ``IP-enabled
voice service'' means the provision of real-time 2-way
voice communications offered to the public, or such
classes of users as to be effectively available to the
public, transmitted through customer premises equipment
using TCP/IP protocol, or a successor protocol, for a
fee (whether part of a bundle of services or
separately) with interconnection capability such that
the service can originate traffic to, or terminate
traffic from, the public switched telephone network.
(j) Wireless Consumer Privacy Protection.--
(1) In general.--A provider of commercial mobile
services, or any direct or indirect affiliate or agent
of such a provider, may not include the wireless
telephone number information of any subscriber in any
wireless directory assistance service database unless
the mobile service provider--
(A) provides a conspicuous, separate notice
to the subscriber informing the subscriber of
the right not to be listed in any wireless
directory assistance service; and
(B) obtains express prior authorization for
listing from such subscriber, separate from any
authorization obtained to provide such
subscriber with commercial mobile service, or
any calling plan or service associated with
such commercial mobile service, and such
authorization has not been subsequently
withdrawn.
(2) Cost-free de-listing.--A provider of commercial
mobile services, or any direct or indirect affiliate or
agent of such a provider, shall remove the wireless
telephone number information of any subscriber from any
wireless directory assistance service database upon
request by that subscriber and without any cost to the
subscriber.
(3) Publication of directories prohibited.--A
provider of commercial mobile services, or any direct
or indirect affiliate or agent of such a provider, may
not publish, in printed, electronic, or other form, or
sell or otherwise disseminate, the contents of any
wireless directory assistance service database, or any
portion or segment thereof unless the mobile service
provider--
(A) provides a conspicuous, separate notice
to the subscriber informing the subscriber of
the right not to be listed; and
(B) obtains express prior authorization for
listing from such subscriber, separate from any
authorization obtained to provide such
subscriber with commercial mobile service, or
any calling plan or service associated with
such commercial mobile service, and such
authorization has not been subsequently
withdrawn.
(4) No consumer fee for retaining privacy.--A
provider of commercial mobile services may not charge
any subscriber for exercising any of the rights
described under this subsection.
(5) State and local laws pre-empted.--To the extent
that any State or local government imposes requirements
on providers of commercial mobile services, or any
direct or indirect affiliate or agent of such
providers, that are inconsistent with the requirements
of this subsection, this subsection preempts such State
or local requirements.
(6) Definitions.--In this subsection:
(A) Wireless telephone number information.--
The term ``wireless telephone number
information'' means the telephone number,
electronic address, and any other identifying
information by which a calling party may reach
a subscriber to commercial mobile services, and
which is assigned by a commercial mobile
service provider to such subscriber, and
includes the name and address of such
subscriber.
(B) Wireless directory assistance service.--
The term ``wireless directory assistance
service'' means any service for connecting
calling parties to a subscriber of commercial
mobile service when such calling parties
themselves do not possess the wireless
telephone number information of such
subscriber.
* * * * * * *
SEC. 503. FORFEITURES IN CASES OF REBATES AND OFFSETS.
[47 U.S.C. 503]
(a) Any person who shall deliver messages for interstate or
foreign transmission to any carrier, or for whom as sender or
receiver, any such carrier shall transmit any interstate or
foreign wire or radio communication, who shall knowingly by
employee, agent, officer, or otherwise, directly or indirectly,
by or through any means or device whatsoever, receive or accept
from such common carrier any sum of money or any other valuable
consideration as a rebate or offset against the regular charges
for transmission of such messages as fixed by the schedules of
charges provided for in this Act, shall in addition to any
other penalty provided by this Act forfeit to the United States
a sum of money three times the amount of money so received or
accepted and three times the value of any other consideration
so received or accepted, to be ascertained by the trial court;
and in the trial of said action all such rebates or other
considerations so received or accepted for a period of six
years prior to the commencement of the action, may be included
therein, and the amount recovered shall be three times the
total amount of money, or three times the total value of such
consideration, so received or accepted, or both, as the case
may be.
(b)(1) Any person who is determined by the Commission, in
accordance with paragraph (3) or (4) of this subsection, to
have--
(A) willfully or repeatedly failed to comply
substantially with the terms and conditions of any
license, permit, certificate, or other instrument or
authorization issued by the Commission;
(B) willfully or repeatedly failed to comply with any
of the provisions of this Act or of any rule,
regulation, or order issued by the Commission under
this Act or under any treaty, convention, or other
agreement to which the United States is a party and
which is binding upon the United States;
(C) violated any provision of section 317(c) or
508(a) of this Act; or
(D) violated any provision of section 1304, 1343, or
1464 of title 18, United States Code;
shall be liable to the United States for a forfeiture penalty.
A forfeiture penalty under this subsection shall be in addition
to any other penalty provided for by this Act; except that this
subsection shall not apply to any conduct which is subject to
forfeiture under title II, part II or III of title III, or
section 506 of this Act.
(2)(A) If the violator is (i) a broadcast station licensee or
permittee, (ii) a cable television operator, or (iii) an
applicant for any broadcast or cable television operator
license, permit, certificate, or other instrument or
authorization issued by the Commission, the amount of any
forfeiture penalty determined under this section shall not
exceed $25,000 for each violation or each day of a continuing
violation, except that the amount assessed for any continuing
violation shall not exceed a total of $250,000 for any single
act or failure to act described in paragraph (1) of this
subsection.
(B) If the violator is a common carrier subject to the
provisions of this Act or an applicant for any common carrier
license, permit, certificate, or other instrument of
authorization issued by the Commission, the amount of any
forfeiture penalty determined under this subsection shall not
exceed $100,000 for each violation or each day of a continuing
violation, except that the amount assessed for any continuing
violation shall not exceed a total of $1,000,000 for any single
act or failure to act described in paragraph (1) of this
subsection.
(C) In any case not covered in subparagraph (A) or (B), the
amount of any forfeiture penalty determined under this
subsection shall not exceed $10,000 for each violation or each
day of a continuing violation, except that the amount assessed
for any continuing violation shall not exceed a total of
$75,000 for any single act or failure to act described in
paragraph (1) of this subsection.
(D) The amount of such forfeiture penalty shall be assessed
by the Commission, or its designee, by written notice. In
determining the amount of such a forfeiture penalty, the
Commission or its designee shall take into account the nature,
circumstances, extent, and gravity of the violation and, with
respect to the violator, the degree of culpability, any history
of prior offenses, ability to pay, and such other matters as
justice may require.
(3)(A) At the discretion of the Commission, a forfeiture
penalty may be determined against a person under this
subsection after notice and an opportunity for a hearing before
the Commission or an administrative law judge thereof in
accordance with section 554 of title 5, United States Code. Any
person against whom a forfeiture penalty is determined under
this paragraph may obtain review thereof pursuant to section
402(a).
(B) If any person fails to pay an assessment of a forfeiture
penalty determined under subparagraph (A) of this paragraph,
after it has become a final and unappealable order or after the
appropriate court has entered final judgment in favor of the
Commission, the Commission shall refer the matter to the
Attorney General of the United States, who shall recover the
amount assessed in any appropriate district court of the United
States. In such action, the validity and appropriateness of the
final order imposing the forfeiture penalty shall not be
subject to review.
(4) Except as provided in paragraph (3) of this subsection,
no forfeiture penalty shall be imposed under this subsection
against any person unless and until--
(A) the Commission issues a notice of apparent
liability, in writing, with respect to such person;
(B) such notice has been received by such person, or
until the Commission has sent such notice to the last
known address of such person, by registered or
certified mail; and
(C) such person is granted an opportunity to show, in
writing, within such reasonable period of time as the
Commission prescribes by rule or regulation, why no
such forfeiture penalty should be imposed.
Such a notice shall (i) identify each specific provision, term,
and condition of any Act, rule, regulation, order, treaty,
convention, or other agreement, license, permit, certificate,
instrument, or authorization which such person apparently
violated or with which such person apparently failed to comply;
(ii) set forth the nature of the act or omission charged
against such person and the facts upon which such charge is
based; and (iii) state the date on which such conduct occurred.
Any forfeiture penalty determined under this paragraph shall be
recoverable pursuant to section 504(a) of this Act.
(5) No forfeiture liability shall be determined under this
subsection against any person, if such person does not hold a
license, permit, certificate, or other authorization issued by
the Commission, and if such person is not an applicant for a
license, permit, certificate, or other authorization issued by
the Commission, unless, prior to the notice required by
paragraph (3) of this subsection or the notice of apparent
liability required by paragraph (4) of this subsection, such
person (A) is sent a citation of the violation charged; (B) is
given a reasonable opportunity for a personal interview with an
official of the Commission, at the field office of the
Commission which is nearest to such person's place of
residence; and (C) subsequently engages in conduct of the type
described in such citation. The provisions of this paragraph
shall not apply, however, if the person involved is engaging in
activities for which a license, permit, certificate, or other
authorization is required, or is a cable television system
operator, if the person involved is transmitting on frequencies
assigned for use in a service in which individual station
operation is authorized by rule pursuant to section 307(e), or
in the case of violations of section 303(q), if the person
involved is a nonlicensee tower owner who has previously
received notice of the obligations imposed by section 303(q)
from the Commission or the permittee or licensee who uses that
tower. Whenever the requirements of this paragraph are
satisfied with respect to a paricular person, such person shall
not be entitled to receive any additional citation of the
violation charged, with respect to any conduct of the type
described in the citation sent under this paragraph.
(6) No forfeiture penalty shall be determined or imposed
against any person under this subsection if--
(A) such person holds a broadcast station license
issued under title III of this Act and if the violation
charged occurred--
(i) more than 1 year prior to the date of
issuance of the required notice or notice of
apparent liability; or
(ii) prior to the date of commencement of the
current term of such license,
whichever is earlier; or
[(B) such person does not hold a broadcast station
license issued under title III of this Act and if the
violation charged occurred more than 1 year prior to
the date of issuance of the required notice or notice
of apparent liability.]
(B) such person does not hold a broadcast
station license issued under title III of this
Act and--
(i) the person is charged with
violating section 222 and the violation
occurred more than 2 years prior to the
date of issuance of the required notice
or notice of apparent liability; or
(ii) the person is charged with
violating any other provision of this
Act and the violation occurred more
than 1 year prior to the date of
issuance of the required notice or
notice of apparent liability.
For purposes of this paragraph, ``date of commencement of the
current term of such license'' means the date of commencement
of the last term of license for which the licensee has been
granted a license by the Commission. A separate license term
shall not be deemed to have commenced as a result of continuing
a license in effect under section 307(c) pending decision on an
application for renewal of the license.
SEC. 509. PENALTIES FOR CONFIDENTIAL CUSTOMER PROPRIETARY NETWORK
INFORMATION VIOLATIONS.
(a) Civil Forfeiture.--
(1) In general.--Any person determined by the
Commission, in accordance with paragraphs (3) and (4)
of section 503(b), to have violated section 2 of the
Protecting Consumer Phone Records Act shall be liable
to the United States for a forfeiture penalty. A
forfeiture penalty under this subsection shall be in
addition to any other penalty provided for by this Act.
The amount of the forfeiture penalty determined under
this subsection shall not exceed $30,000 for each
violation, or 3 times that amount for each day of a
continuing violation, except that the amount assessed
for any continuing violation shall not exceed a total
of $3,000,000 for any single act or failure to act.
(2) Recovery.--Any forfeiture penalty determined
under paragraph (1) shall be recoverable pursuant to
section 504(a) of this Act.
(3) Procedure.--No forfeiture liability shall be
determined under paragraph (1) against any person
unless such person receives the notice required by
section 503(b)(3) or section 503(b)(4) of this Act.
(4) 2-year statute of limitations.--No forfeiture
penalty shall be determined or imposed against any
person under paragraph (1) if the violation charged
occurred more than 2 years prior to the date of
issuance of the required notice or notice or apparent
liability.
(b) Criminal Fine.--Any person who willfully and knowingly
violates section 2 of the Protecting Consumer Phone Records Act
shall upon conviction thereof be fined not more than $30,000
for each violation, or 3 times that amount for each day of a
continuing violation, in lieu of the fine provided by section
501 for such a violation. This subsection does not supersede
the provisions of section 501 relating to imprisonment or the
imposition of a penalty of both fine and imprisonment.
* * * * * * *
PART IV--MISCELLANEOUS PROVISIONS
SEC. 631. PROTECTION OF SUBSCRIBER PRIVACY.
[47 U.S.C. 551]
(a)(1) At the time of entering into an agreement to provide
any cable service or other service to a subscriber and at least
once a year thereafter, a cable operator shall provide notice
in the form of a separate, written statement to such subscriber
which clearly and conspicuously informs the subscriber of--
(A) the nature of personally identifiable information
collected or to be collected with respect to the
subscriber and the nature of the use of such
information;
(B) the nature, frequency, and purpose of any
disclosure which may be made of such information,
including an identification of the types of persons to
whom the disclosure may be made;
(C) the period during which such information will be
maintained by the cable operator;
(D) the times and place at which the subscriber may
have access to such information in accordance with
subsection (d); and
(E) the limitations provided by this section with
respect to the collection and disclosure of information
by a cable operator and the right of the subscriber
under subsections (f) and (h) to enforce such
limitations.
In the case of subscribers who have entered into such an
agreement before the effective date of this section, such
notice shall be provided within 180 days of such date and at
least once a year thereafter.
(2) For purposes of this section, other than subsection (h)--
(A) the term ``personally identifiable information''
does not include any record of aggregate data which
does not identify particular persons;
(B) the term ``other service'' includes any wire or
radio communications service provided using any of the
facilities of a cable operator that are used in the
provision of cable service; and
(C) the term ``cable operator'' includes, in addition
to persons within the definition of cable operator in
section 602, any person who (i) is owned or controlled
by, or under common ownership or control with, a cable
operator, and (ii) provides any wire or radio
communications service.
(b)(1) Except as provided in paragraph (2), a cable operator
shall not use the cable system to collect personally
identifiable information concerning any subscriber without the
prior written or electronic consent of the subscriber
concerned.
(2) A cable operator may use the cable system to collect such
information in order to--
(A) obtain information necessary to render a cable
service or other service provided by the cable operator
to the subscriber; or
(B) detect unauthorized reception of cable
communications.
(c)(1) Except as provided in paragraph (2), a cable operator
shall not disclose personally identifiable information
concerning any subscriber without the prior written or
electronic consent of the subscriber concerned and shall take
such actions as are necessary to prevent unauthorized access to
such information by a person other than the subscriber or cable
operator.
(2) A cable operator may disclose such information if the
disclosure is--
(A) necessary to render, or conduct a legitimate
business activity related to, a cable service or other
service provided by the cable operator to the
subscriber;
(B) subject to subsection (h), made pursuant to a
court order authorizing such disclosure, if the
subscriber is notified of such order by the person to
whom the order is directed;
(C) a disclosure of the names and addresses of
subscribers to any cable service or other service, if--
(i) the cable operator has provided the
subscriber the opportunity to prohibit or limit
such disclosure, and
(ii) the disclosure does not reveal, directly
or indirectly, the--
(I) extent of any viewing or other
use by the subscriber of a cable
service or other service provided by
the cable operator, or
(II) the nature of any transaction
made by the subscriber over the cable
system of the cable operator; or
(D) to a government entity as authorized under
chapters 119, 121, or 206 of title 18, United States
Code, except that such disclosure shall not include
records revealing cable subscriber selection of video
programming from a cable operator.
(d) A cable subscriber shall be provided access to all
personally identifiable information regarding that subscriber
which is collected and maintained by a cable operator. Such
information shall be made available to the subscriber at
reasonable times and at a convenient place designated by such
cable operator. A cable subscriber shall be provided reasonable
opportunity to correct any error in such information.
(e) A cable operator shall destroy personally identifiable
information if the information is no longer necessary for the
purpose for which it was collected and there are no pending
requests or orders for access to such information under
subsection (d) or pursuant to a court order.
(f)(1) Any person aggrieved by any act of a cable operator in
violation of this section may bring a civil action in a United
States district court.
(2) The court may award--
(A) actual damages but not less than liquidated
damages computed at the rate of $100 a day for each day
of violation or $1,000, whichever is higher;
(B) punitive damages; and
(C) reasonable attorneys' fees and other litigation
costs reasonably incurred.
(3) The remedy provided by this section shall be in addition
to any other lawful remedy available to a cable subscriber.
(g) Nothing in this title shall be construed to prohibit any
State or any franchising authority from enacting or enforcing
laws consistent with this section for the protection of
subscriber privacy.
(h) Except as provided in subsection (c)(2)(D), a
governmental entity may obtain personally identifiable
information concerning a cable subscriber pursuant to a court
order only if, in the court proceeding relevant to such court
order--
(1) such entity offers clear and convincing evidence
that the subject of the information is reasonably
suspected of engaging in criminal activity and that the
information sought would be material evidence in the
case; and
(2) the subject of the information is afforded the
opportunity to appear and contest such entity's claim.
(i) Customer Proprietary Network Information.--This section
does not apply to customer proprietary network information (as
defined in section 222(i)(1) of this Act) as it relates to the
provision of IP-enabled voice service (as defined in section
222(i)(8) of this Act) by a cable operator to the extent that
section 222 of this Act and section 2 of the Protecting
Consumer Phone Records Act applies to such information.