FEDERAL COMMUNICATIONS COMMISSION WASHINGTON OFFICE OF THE CHAIRMAN December 6, 2018 The Honorable Debbie Dingell U.S. 1-louseof Representatives 116 Cannon I-louseOffice Building Washington. D.C. 20515 Dear Congresswoman Dingelt: You wrote to me recently regarding my response to you about the acquisition and use of consumer data by Cambridge Analytica. I agree with you that consumers care about the privacy and security of their personal data, which is why I am glad that the Federal Trade Commission whom Congress has entrusted with overseeing firms like Cambridge Analytica as well as the privacy practices of other tech companies is committed to protecting the privacy of consumers and has opened a dialogue with Congress on the best way to do just that. And given the Federal Trade Commission s expertise, the FCC has traditionally fbcused its investigative efforts on enforcement of our customer proprietary network information (CPNI) rules under section 222 of the Act rules governing common calTiersover whom the Federal Trade Commission has no authority. In your letter, you ask for specific data regarding any Commission actions involving sections 338(i) and 631 of the Communications Act. As you know, the Commission s policy is to not confirm or deny the existence of any ongoing investigations. As such, I confine my response to completed actions. The Enforcement Bureau has concluded one enforcement action against a cable operator in connection with a data breach. Specifically, the Bureau entered into a consent decree with Cox Communications in 2015 to resolve an investigation into whether Cox violated our CPNI rules as well as potential related violations of section 631 of the Act.1 Over the past decade, Commission staff also looked into six potential violations of section 631 of the Act and closed each case without enforcement action. Enforcement Bureau staff have informed me that the Commission has not issued any other consent decrees nor any Notices of Apparent Liability or Forfeiture Orders for violations of sections 338(i) and 631 in the past decade and is not aware of the Commission having ever taken enforcement action in a case not also involving a violation of the Commission s CPNI rules. The Commission nonetheless continues to review consumer complaints, including complaints involving subscriber personal information, and continues to investigate cases where there is credible evidence that our rules or the Act have been violated.  See Cox Communications, iflC., Order. 30 FCC Red 12302 (Nov. 5, 2015). Page 2 The Honorable Debbie Dingell Please let me know if I can be of any further assistance. Sincerely, Ait V. Pai (J