Federal Communications Commission DA 11-1115 Before the Federal Communications Commission Washington, D.C. 20554 In the Matter of Southwest Communications, Inc. ) ) ) ) ) File No. EB-08-TC-5413 NAL/Acct. No. 200932170760 FRN: 0005079967 ORDER Adopted: July 12, 2011 Released: July 13, 2011 By the Chief, Telecommunications Consumers Division, Enforcement Bureau: 1. In this Order, we adopt the attached Consent Decree entered into between the Enforcement Bureau (“Bureau”) of the Federal Communications Commission (“FCC” or “Commission”) and Southwest Communications, Inc. (“Southwest Communications” or “Company”). The Consent Decree terminates an investigation and Notice of Apparent Liability for Forfeiture (“NAL”) by the Bureau against Southwest Communications for possible violation of section 222 of the Communications Act of 1934, as amended (“Communications Act” or “Act”), 47 U.S.C. § 222, section 64.2009(e) of the Commission’s rules, 47 C.F.R. § 64.2009(e), and the Commission’s EPIC CPNI Order,1 regarding Southwest Communications’ apparent failure to timely file a compliant annual customer proprietary network information (“CPNI”) certification pursuant to section 64.2009(e). 2. The Bureau and Southwest Communications have negotiated the terms of the Consent Decree that resolve this matter. A copy of the Consent Decree is attached hereto and incorporated by reference. 3. After reviewing the terms of the Consent Decree and evaluating the facts before us, we find that the public interest would be served by adopting the Consent Decree, terminating the investigation and cancelling the NAL. 4. In the absence of material new evidence relating to this matter, we conclude that our investigation raises no substantial or material questions of fact as to whether Southwest Communications possesses the basic qualifications, including those related to character, to hold or obtain any Commission license or authorization. 5. Accordingly, IT IS ORDERED that, pursuant to sections 4(i) and 503(b) of the Communications Act of 1934, as amended,2 and sections 0.111 and 0.311 of the Commission’s rules,3 the Consent Decree attached to this Order IS ADOPTED. 1 Implementation of the Telecommunications Act of 1996: Telecommunications Carriers’ Use of Customer Proprietary Network Information and Other Customer Information; IP-Enabled Services, CC Docket No. 96-115; WC Docket No. 04-36, Report and Order and Further Notice of Proposed Rulemaking, 22 FCC Rcd 6927, 6953 (2007) (“EPIC CPNI Order”); aff’d sub nom. Nat’l Cable & Telecom. Assoc. v. FCC, 555 F.3d 996 (D.C. Cir. 2009). 2 47 U.S.C. §§ 154(i), 503(b). 3 47 C.F.R. §§ 0.111, 0.311. Federal Communications Commission DA 11-1115 2 6. IT IS FURTHER ORDERED that the above-captioned investigation IS TERMINATED and the Notice of Apparent Liability for Forfeiture IS CANCELLED. FEDERAL COMMUNICATIONS COMMISSION Richard A. Hindman, Chief Telecommunications Consumers Division Enforcement Bureau Federal Communications Commission DA 11-1115 Before the Federal Communications Commission Washington, D.C. 20554 In the Matter of Southwest Communications, Inc. ) ) ) ) ) File No. EB-08-TC-5413 NAL/Acct. No. 200932170760 FRN: 0005079967 CONSENT DECREE 1. The Enforcement Bureau (“Bureau”) and Southwest Communications, Inc. (“Southwest Communications” or the “Company”), by their authorized representatives, hereby enter into this Consent Decree for the purpose of cancelling the Notice of Apparent Liability for Forfeiture (“NAL”) and terminating the Enforcement Bureau’s investigation into Southwest Communications’ possible noncompliance with the requirements of section 222 of the Communications Act of 1934, as amended (“Communications Act” or “Act”), 47 U.S.C. § 222, section 64.2009(e) of the Commission’s rules, 47 C.F.R. § 64.2009(e), and the Commission’s EPIC CPNI Order.1 I. DEFINITIONS 2. For the purposes of this Consent Decree, the following definitions shall apply: (a) “Communications Act” or “Act” means the Communications Act of 1934, as amended, 47 U.S.C. § 151 et seq. (b) “Adopting Order” means an Order of the Commission adopting the terms of this Consent Decree without change, addition, deletion, or modification. (c) “Bureau” means the Enforcement Bureau of the Federal Communications Commission. (d) “Commission” and “FCC” mean the Federal Communications Commission and all of its bureaus and offices. (e) “Compliance Plan” means the program described in this Consent Decree at paragraph 10. (f) “Effective Date” means the date on which the Commission releases the Adopting Order. (g) “Investigation” means the investigation commenced by the Bureau’s letter of inquiry2 regarding whether Southwest Communications violated the requirements of section 222 1 Implementation of the Telecommunications Act of 1996: Telecommunications Carriers’ Use of Customer Proprietary Network Information and Other Customer Information; IP-Enabled Services, CC Docket No. 96-115; WC Docket No. 04-36, Report and Order and Further Notice of Proposed Rulemaking, 22 FCC Rcd 6927, 6953 (2007) (“EPIC CPNI Order”); aff’d sub nom. Nat’l Cable & Telecom. Assoc. v. FCC, 555 F.3d 996 (D.C. Cir. 2009). 2 See Letter from Marcy Greene, Deputy Division Chief, Telecommunications Consumers Division, Enforcement Bureau, FCC, to Southwest Communications (Sept. 5, 2008). Federal Communications Commission DA 11-1115 2 of the Communications Act and section 64.2009(e) of the Commission’s rules by failing to file a compliant customer proprietary network information (“CPNI”) certification.3 (h) “Southwest Communications” means Southwest Communications, Inc. and its predecessors-in-interest and successors-in-interest. (i) “NAL” means Notice of Apparent Liability for Forfeiture. (j) “Parties” means Southwest Communications and the Bureau. II. BACKGROUND 3. Section 222 imposes the general duty on all telecommunications carriers to protect the confidentiality of their subscribers’ proprietary information.4 The Commission has issued rules implementing section 222 of the Act.5 The Commission required carriers to establish and maintain a system designed to ensure that carriers adequately protected their subscribers’ CPNI. Section 64.2009(e) is one such requirement. 4. In 2006, some companies, known as “data brokers,” advertised the availability of records of wireless subscribers’ incoming and outgoing telephone calls for a fee.6 Data brokers also advertised the availability of certain landline toll calls.7 On April 2, 2007, the Commission strengthened its privacy 3 47 C.F.R. 64.2009(e). 4 Section 222 of the Communications Act, 47 U.S.C § 222, provides that: “Every telecommunications carrier has a duty to protect the confidentiality of proprietary information of, and relating to, other telecommunications carriers, equipment manufacturers, and customers, including telecommunication carriers reselling telecommunications services provided by a telecommunications carrier.” Prior to the 1996 Act, the Commission had established CPNI requirements applicable to the enhanced services operations of AT&T, the Bell Operating Companies (“BOCs”), and GTE, and the customer premises equipment (“CPE”) operations of AT&T and the BOCs, in the Computer II, Computer III, GTE Open Network Architecture (“ONA”), and BOC CPE Relief proceedings. See Implementation of the Telecommunications Act of 1996: Telecommunications Carriers’ Use of Customer Proprietary Network Information and Other Customer Information and Implementation of Non-Accounting Safeguards of Sections 271 and 272 of the Communications Act of 1934, as amended, CC Docket Nos. 96-115 and 96-149, Second Report and Order and Further Notice of Proposed Rulemaking, 13 FCC Rcd 8061, 8068-70, para. 7 (1998) (“CPNI Order”) (describing the Commission’s privacy protections for confidential customer information in place prior to the 1996 Act.) 5 See CPNI Order. See also Implementation of the Telecommunications Act of 1996: Telecommunications Carriers' Use of Customer Proprietary Network Information and Other Customer Information and Implementation of the Non-Accounting Safeguards of Sections 271 and 272 of the Communications Act of 1934, as amended, CC Docket Nos. 96-115 and 96-149, Order on Reconsideration and Petitions for Forbearance, 14 FCC Rcd 14409 (1999); Implementation of the Telecommunications Act of 1996: Telecommunications Carriers’ Use of Customer Proprietary Network Information and Other Customer Information and Implementation of the Non-Accounting Safeguards of Sections 271 and 272 of the Communications Act of 1934, as amended, CC Docket Nos. 96-115 and 96-149; 2000 Biennial Regulatory Review -- Review of Policies and Rules Concerning Unauthorized Changes of Consumers’ Long Distance Carriers, CC Docket No. 00-257, Third Report and Order and Third Further Notice of Proposed Rulemaking, 17 FCC Rcd 14860 (2002); EPIC CPNI Order. 6 See, e.g., http://www.epic.org/privacy/iei/. 7 See id. Federal Communications Commission DA 11-1115 3 rules with the release of the EPIC CPNI Order,8 which adopted additional safeguards to protect CPNI against unauthorized access and disclosure. The EPIC CPNI Order was directly responsive to the actions of databrokers, or pretexters, to obtain unauthorized access to CPNI.9 The EPIC CPNI Order requires that all companies subject to the CPNI rules file annually, on or before March 1, a certification with the Commission pursuant to amended rule 47 C.F.R. § 64.2009(e).10 Additionally, companies must now provide, with their certification, “an explanation of any actions taken against data brokers and a summary of all customer complaints received in the past year concerning the unauthorized release of CPNI.”11 5. The Bureau sent a Letter of Inquiry (“LOI”) to Southwest Communications on September 5, 2008, asking it to provide copies and evidence of its timely filed CPNI compliance certificate for 2007, which was due by March 1, 2008, pursuant to section 64.2009(e) of the Commission’s rules or an explanation as to why no certification was filed.12 Southwest Communications submitted a response to the LOI on September 15, 2008.13 The Bureau concluded that Southwest Communications failed to submit satisfactory evidence of its timely filing of the annual CPNI compliance certification.14 Accordingly, on February 24, 2009, the Bureau released the Omnibus NAL against numerous companies, including Southwest Communications, proposing a monetary forfeiture of twenty thousand dollars ($20,000) for its apparent failure to comply with section 64.2009(e) of the Commission’s rules,15 and the Commission’s EPIC CPNI Order, and ordered the Company either to pay the proposed forfeiture or file a written response within thirty (30) days of the release date stating why the proposed forfeiture should be reduced or canceled. Southwest Communications submitted a response to the Omnibus NAL; subsequently, Southwest Communications and the Bureau entered into settlement discussions. III. TERMS OF AGREEMENT 6. Adopting Order. The Parties agree that the provisions of this Consent Decree shall be subject to final approval by the Bureau by incorporation of such provisions by reference in the Adopting Order without change, addition, modification, or deletion. 8 EPIC CPNI Order, 22 FCC Rcd 6927. Specifically, pursuant to section 64.2009(e): A telecommunications carrier must have an officer, as an agent of the carrier, sign and file with the Commission a compliance certificate on an annual basis. The officer must state in the certification that he or she has personal knowledge that the company has established operating procedures that are adequate to ensure compliance with the rules in this subpart. The carrier must provide a statement accompanying the certification explaining how its operating procedures ensure that it is or is not in compliance with the rules in this subpart. In addition, the carrier must include an explanation of any actions taken against data brokers and a summary of all customer complaints received in the past year concerning the unauthorized release of CPNI. This filing must be made annually with the Enforcement Bureau on or before March 1 in EB Docket No. 06-36, for data pertaining to the previous calendar year. 47 C.F.R. § 64.2009(e). 9 EPIC CPNI Order, 22 FCC Rcd at 6928. 10 Id. at 6953; 47 C.F.R. § 64.2009(e). 11 EPIC CPNI Order, 22 FCC Rcd at 6953. 12 See note 2, supra. 13 See email from Leon Nowalsky to Robert Somers (Sept. 15, 2008). 14 Annual CPNI Certification, Omnibus Notice of Apparent Liability for Forfeiture, 24 FCC Rcd 2299 (Enf. Bur. 2009) (“Omnibus NAL”). 15 Id. Federal Communications Commission DA 11-1115 4 7. Jurisdiction. Southwest Communications agrees that the Bureau has jurisdiction over it and the matters contained in this Consent Decree and has the authority to enter into and adopt this Consent Decree. 8. Effective Date; Violations. The Parties agree that this Consent Decree shall become effective on the date on which the FCC releases the Adopting Order. Upon release, the Adopting Order and this Consent Decree shall have the same force and effect as any other Order of the Bureau. Any violation of the Adopting Order or of the terms of this Consent Decree shall constitute a separate violation of a Bureau Order, entitling the Bureau to exercise any rights and remedies attendant to the enforcement of a Bureau Order. 9. Termination of Investigation. In express reliance on the covenants and representations in this Consent Decree and to avoid further expenditure of public resources, the Bureau agrees to terminate its investigation and to cancel the NAL. In consideration for the termination of said investigation and cancellation of the NAL, Southwest Communications agrees to the terms, conditions, and procedures contained herein. The Bureau further agrees that, in the absence of new material evidence, the Bureau will not use the facts developed in this investigation through the Effective Date of the Consent Decree, or the existence of this Consent Decree, to institute, on its own motion, any new proceeding, formal or informal, or take any action on its own motion against Southwest Communications concerning the matters that were the subject of the investigation. The Bureau also agrees that it will not use the facts developed in this investigation through the Effective Date of this Consent Decree, or the existence of this Consent Decree, to institute on its own motion any proceeding, formal or informal, or take any action on its own motion against Southwest Communications’ basic qualifications, including its character qualifications, to be a Commission licensee or authorized common carrier or hold Commission authorizations. 10. Compliance Plan. For purposes of settling the matters set forth herein and to help ensure compliance with the Commission’s CPNI rules, Southwest Communications agrees to take all measures necessary to achieve full compliance with section 64.2009(e) of the Commission’s rules. Southwest Communications agrees that within thirty (30) days its personnel will be trained as to when they are and are not authorized to use CPNI. Southwest Communications further agrees to have an express disciplinary process in place for the unauthorized use of CPNI within thirty (30) days. Additionally, Southwest Communications agrees to submit a copy of its annual section 64.2009(e) compliance certificate, which it is required to file annually in EB Docket 06-36, for each of two (2) years following the Effective Date of this Consent Decree to the Chief, Telecommunications Consumers Division, Enforcement Bureau, Federal Communications Commission, 445 12th Street, S.W. Room 4-C244, Washington, D.C. 20554, and must include the file number listed above. Southwest Communications will also send an electronic copy of its certification to other Telecommunications Consumers Division staff as directed by the Division Chief. This Consent Decree will expire two (2) years after the Effective Date or upon the termination of the certification requirement set forth in section 64.2009(e) of the Commission’s rules, 47 C.F.R. § 64.2009(e), whichever is earlier. 11. Section 208 Complaints; Subsequent Investigations. Nothing in this Consent Decree shall prevent the Commission or its delegated authority from adjudicating complaints filed pursuant to section 208 of the Act against Southwest Communications or its affiliates for alleged violations of the Act, or for any other type of alleged misconduct, regardless of when such misconduct took place. The Commission’s adjudication of any such complaint will be based solely on the record developed in that proceeding. Except as expressly provided in this Consent Decree, this Consent Decree shall not prevent the Commission from investigating new evidence of noncompliance by Southwest Communications of the Act, the rules, or the Adopting Order. Federal Communications Commission DA 11-1115 5 12. Voluntary Contribution. Southwest Communications agrees that it will make a voluntary contribution to the United States Treasury in the amount of $3,600.00. The contribution will be made within thirty (30) calendar days after the Effective Date of the Adopting Order. Payment must be made by check or similar instrument, payable to the order of the Federal Communications Commission. The payment must include the NAL/Account Number and FRN referenced in the caption to the Adopting Order. Payment by check or money order may be mailed to Federal Communications Commission, P.O. Box 979088, St. Louis, MO 63197-9000. Payment by overnight mail may be sent to U.S. Bank – Government Lockbox #979088, SL-MO-C2-GL, 1005 Convention Plaza, St. Louis, MO 63101. Payment by wire transfer may be made to ABA Number 021030004, receiving bank TREAS/NYC, and account number 27000001. For payment by credit card, an FCC Form 159 (Remittance Advice) must be submitted. When completing the FCC Form 159, enter the NAL/Account number in block number 23A (call sign/other ID), and enter the letters “FORF” in block number 24A (payment type code). Southwest Communications will also send electronic notification on the date said payment is made to johnny.drake@fcc.gov. 13. Waivers. Southwest Communications waives any and all rights it may have to seek administrative or judicial reconsideration, review, appeal or stay, or to otherwise challenge or contest the validity of this Consent Decree and the Adopting Order, provided the Commission issues an Adopting Order adopting the Consent Decree without change, addition, modification, or deletion. Southwest Communications shall retain the right to challenge Commission interpretation of the Consent Decree or any terms contained herein. If either Party (or the United States on behalf of the Commission) brings a judicial action to enforce the terms of the Adopting Order, neither Southwest Communications nor the Commission shall contest the validity of the Consent Decree or the Adopting Order, and Southwest Communications shall waive any statutory right to a trial de novo. Southwest Communications hereby agrees to waive any claims it may otherwise have under the Equal Access to Justice Act, 5 U.S.C. § 504 and 47 C.F.R. § 1.1501 et seq., relating to the matters addressed in this Consent Decree. 14. Severability. The Parties agree that if any of the provisions of the Adopting Order or the Consent Decree shall be invalid or unenforceable, such invalidity or unenforceability shall not invalidate or render unenforceable the entire Adopting Order or Consent Decree, but rather the entire Adopting Order or Consent Decree shall be construed as if not containing the particular invalid or unenforceable provision or provisions, and the rights and obligations of the Parties shall be construed and enforced accordingly. In the event that this Consent Decree in its entirety is rendered invalid by any court of competent jurisdiction, it shall become null and void and may not be used in any manner in any legal proceeding. 15. Subsequent Rule or Order. The Parties agree that if any provision of the Consent Decree conflicts with any subsequent rule or Order adopted by the Commission (except an Order specifically intended to revise the terms of this Consent Decree to which Southwest Communications does not expressly consent) that provision will be superseded by such Commission rule or Order. 16. Successors and Assigns. Southwest Communications agrees that the provisions of this Consent Decree shall be binding on its successors, assigns, and transferees. 17. Final Settlement. The Parties agree and acknowledge that this Consent Decree shall constitute a final settlement between the Parties. The Parties further agree that this Consent Decree does not constitute either an adjudication on the merits or a factual or legal finding or determination regarding any compliance or noncompliance with the requirements of the Act or the Commission’s rules and Orders. Federal Communications Commission DA 11-1115 6 18. Modifications. This Consent Decree cannot be modified without the advance written consent of both Parties. 19. Paragraph Headings. The headings of the Paragraphs in this Consent Decree are inserted for convenience only and are not intended to affect the meaning or interpretation of this Consent Decree. 20. Authorized Representative. Each party represents and warrants to the other that it has full power and authority to enter into this Consent Decree. 21. Counterparts. This Consent Decree may be signed in any number of counterparts (including by facsimile), each of which, when executed and delivered, shall be an original, and all of which counterparts together shall constitute one and the same fully executed instrument. ________________________________ Richard A. Hindman, Chief Telecommunications Consumers Division Enforcement Bureau ________________________________ Date ________________________________ Paul Kirby Operations Manager/Corporate Secretary Southwest Communications, Inc. ________________________________ Date