1018 Highland Colony Parkway, Suite 700 EMILIE F. WHITEHEAD Ridgeland, Mississippi 39157 Deputy General Counsel Telephone: 601.355.1522 Direct Line: 601.487.5232 Email: ewhitehead@telapexinc.com August 3, 2022 VIA EMAIL Hon. Jessica Rosenworcel Chairwoman, Federal Communications Commission 45 L Street, NE Washington, DC 20554 Jessica.Rosenworcel@fcc.gov Re: Letter of Inquiry Dear Chairwoman Rosenworcel: I am writing on behalf of C Spire in response to your July 19, 2022 email and Letter of Inquiry to Telepak Networks, Inc. d/b/a C Spire. Please be advised that Telepak Networks, Inc. does not include C Spire’s wireless division. Therefore, given the Commission’s line of inquiry, we are providing responses on behalf of Cellular South, Inc., C Spire’s wireless line of business. The responses below reflect the information C Spire has identified to date. C Spire will supplement its responses if it learns of additional responsive information. 1) Data retention a. Please describe in detail the geolocation data that C-Spire collects and/or retains regarding current and/or former subscribers. How is that data collected? C Spire does not collect precise geolocation data related to current or former subscribers. C Spire only collects general location data through “pinging” a phone to determine the tower, sector, and roundtrip delay between the device and the tower in order to make a generalized determination regarding a mobile phone’s location. C Spire collects “ping” related data when C Spire’s Network Operations Center sends a signal to the handset and records the return from the tower. C Spire also collects cell site location 06501583.5 information (“CSLI”) from a computerized switch and retains it in billing records in its data warehouse. C Spire’s vendor, Intrado, collects 911 location data. Intrado provides an emergency routing service that delivers a caller’s 911 location information to the appropriate Public Safety Answering Point (“PSAP”). C Spire does not directly collect or retain any precise 911 geolocation data. b. Please explain the reasons geolocation data is retained for both current and former subscribers. Please see C Spire’s response to item 1(a) above. CSLI data is retained in C Spire’s data warehouse for billing purposes and to comply with various forms of legal process described in more detail below. c. How long is geolocation data retained for both current and former subscribers? Generally, C Spire retains CSLI data in its data warehouse for approximately eighteen (18) months, after which it is purged on a rolling basis. Upon receipt of a preservation request, C Spire’s Subpoena Compliance Department (“Subpoena Compliance”), will pull and preserve the CSLI records associated with the request. Individual CSLI records preserved pursuant to a preservation request received by Subpoena Compliance are retained indefinitely or until Subpoena Compliance is advised that the preservation request has been lifted. d. Please provide a description of what safeguards C-Spire uses to protect current and former subscriber geolocation data. C Spire takes commercially reasonable physical and technical security measures to protect personal information, including CSLI data, against unauthorized disclosure, theft, and misuse. C Spire would be happy to confidentially discuss with the Commission the specifics of the company’s security measures. e. In what country (or countries) is geolocation data stored? C Spire stores the location data described in response to item 1(a) in the United States. f. Please share whether and how you disclose your data retention policies to subscribers. At the point of service activation, C Spire provides each subscriber with the company’s privacy policy and subscribers cannot activate service with C Spire without acknowledging that they have reviewed and agreed to the privacy policy. C Spire’s privacy policy provides that C Spire only stores information for as long as needed to fulfill its contractual or legal obligations or any other permissible purpose for which C Spire collects it, including to prevent fraud and security incidents. C Spire also makes its privacy policy available on the company’s website and mobile applications. 06501583.5 2 g. What is your data deletion policy for current or former subscribers, and how do you dispose of subscriber geolocation data? Please see C Spire’s prior response to item 1(c) above. C Spire would be happy to confidentially discuss with the Commission the specifics of the company’s data disposal protocols. h. Do your subscribers have any opportunity to opt-out of your data retention policies and if not, why not? C Spire’s privacy policy provides subscribers with information on how they may request deletion of certain information prior to the expiration of C Spire’s standard retention period by logging into their “Your Preference Profile” or by sending an email to askus@cspire.com. 2) Data sharing a. Please provide C-Spire’s process and policies for sharing subscriber geolocation data with law enforcement? C Spire will produce CSLI data to a law enforcement agency when the agency provides a search warrant issued by a court of general criminal jurisdiction, consistent with the U.S. Supreme Court’s decision in Carpenter v. United States, 585 U.S. ___; 138 S. Ct. 2206; 201 L. Ed. 2d 50 (2018) and 18 U.S.C. §§ 2701, et seq. b. Describe the arrangements, agreements, and circumstances in which C-Spire shares subscriber geolocation data with third parties that are not law enforcement. As described in item 1(a) above, Intrado processes C Spire’s location data for the purpose of PSAP routing. C Spire also shares general location data when subpoenaed in civil matters. In such instances, C Spire provides the subject subscriber with notice in advance of disclosing their CSLI data so they may have the opportunity to file an objection or motion to quash in the court in which the matter is pending as described in more detail in item 2(c), below. C Spire does not share or sell subscriber geolocation data with third parties for commercial purposes. c. Describe in detail the process by which a subscriber may opt out of the sharing of their geolocation data. Under this opt-out process is that subscriber’s data still shared with third parties? In particular, does the opt-out process allow a subscriber to opt out of the sharing of their geolocation data with all third parties that are not law enforcement? 06501583.5 3 C Spire does not collect precise geolocation data related to current or former subscribers. With regard to subpoenas in civil matters, C Spire mails the following notice to the associated subscriber prior to producing their CSLI data: “Please be advised that the subpoena seeks historical cell site location information (“CSLI”) which will provide a comprehensive record of the cell phone user’s general location on the dates at issue.” The subscriber is given ten (10) days in which to file an objection or motion to quash in the court in which the matter is pending. d. Are subscribers notified of the sharing of their geolocation information with third parties that are not law enforcement? And if so, how are they notified? Please see C Spire’s responses to items 1(f), 2(b), and 2(c), above. I hope the foregoing responses are helpful in the Commission’s inquiry. Should you have any additional questions, please do not hesitate to reach out to me. Sincerely, Emilie F. Whitehead Deputy General Counsel Telapex, Inc./C Spire cc: Charles L. McBride, Jr. David LaFuria 06501583.5 4