*Pages 1--112 from Microsoft Word - FCC 02-214.doc* Federal Communications Commission FCC 02- 214 Before the Federal Communications Commission Washington, D. C. 20554 In the Matter of Implementation of the Telecommunications Act of 1996: Telecommunications Carriers’ Use of Customer Proprietary Network Information and Other Customer Information; Implementation of the Non- Accounting Safeguards of Sections 271 and 272 of the Communications Act of 1934, As Amended 2000 Biennial Regulatory Review -- Review of Policies and Rules Concerning Unauthorized Changes of Consumers’ Long Distance Carriers ) ) ) ) ) ) ) ) ) ) ) ) ) ) ) ) ) CC Docket No. 96- 115 CC Docket No. 96- 149 CC Docket No. 00- 257 THIRD REPORT AND ORDER AND THIRD FURTHER NOTICE OF PROPOSED RULEMAKING Adopted: July 16, 2002 Released: July 25, 2002 Comment Date: 30 Days after Federal Register Publication of this NPRM Reply Comment Date: 60 Days after Federal Register Publication of this NPRM By the Commission: Chairman Powell issuing a statement; Commissioners Abernathy and Martin issuing separate statements and Commissioner Copps approving in part, dissenting in part and issuing a separate statement. TABLE OF CONTENTS Paragraph I. INTRODUCTION……………………………………………………………………………………………… 1 II. BACKGROUND………………………………………………………………………………………………. 5 A. SECTION 222 OF THE ACT……………………………………………………………………………………. 5 B. CPNI ORDER…………………………………………………………………………………..……………. 10 C. CPNI RECONSIDERATION ORDER…….…………………………………………………………………….. 15 1 Federal Communications Commission FCC 02- 214 2 D. TENTH CIRCUIT OPINION ............................................................................................................................... 20 E. AT& T AND WORLDCOM PETITIONS.............................................................................................................. 21 F. CLARIFICATION ORDER AND FURTHER NOTICE OF PROPOSED RULEMAKING ................................................ 23 III. THIRD REPORT AND ORDER............................................................................................................... 26 A. APPROVAL STANDARD................................................................................................................................... 26 1. Intra- Company and Joint Venture Use of CPNI by Telecommunications Carriers .................................. 31 2. Third Parties and Carriers’ Affiliates That Do Not Provide Communications- Related Services ............. 50 3. State Choice.............................................................................................................................................. 69 B. OTHER APPROVAL ISSUES.............................................................................................................................. 75 1. The Tenth Circuit’s Order Vacated Only Those CPNI Rules Related to Opt- In...................................... 79 2. Total Service Approach............................................................................................................................ 83 3. Grandfathering of Previously Obtained CPNI Approvals ........................................................................ 85 4. Customer Right to Restrict Carrier Use of CPNI for Marketing Purposes ............................................... 86 C. CUSTOMER NOTIFICATION REQUIREMENTS ................................................................................................... 89 1. Form of Notice ......................................................................................................................................... 90 2. Content of Notice ..................................................................................................................................... 97 3. Frequency of Notice ............................................................................................................................... 107 4. Waiting Period for Opt- Out Notification................................................................................................ 112 5. Methods by Which Customers Can Exercise CPNI Rights Under Opt- Out or Opt- In ........................... 118 D. COMPETITION ISSUES ................................................................................................................................... 120 1. Forbearance for Preferred Carrier Freeze Information ........................................................................... 120 2. Denial of CPNI to Another Carrier With Customer Authorization ........................................................ 129 3. Winback and Retention Marketing......................................................................................................... 131 4. Interplay Between Sections 222 and 272................................................................................................ 135 IV. THIRD FURTHER NOTICE OF PROPOSED RULEMAKING........................................................ 143 A. REGULATION OF FOREIGN STORAGE OF AND ACCESS TO DOMESTIC CPNI.................................................. 144 B. PROTECTIONS FOR CARRIER INFORMATION AND ENFORCEMENT MECHANISMS .......................................... 145 C. CPNI IMPLICATIONS WHEN A CARRIER GOES OUT OF BUSINESS ................................................................ 146 V. PROCEDURAL MATTERS......................................................................................................................... 148 A. THIRD REPORT AND ORDER ......................................................................................................................... 148 1. Final Regulatory Flexibility Analysis..................................................................................................... 148 2. Final Paperwork Reduction Act Analysis............................................................................................... 149 B. THIRD FURTHER NOTICE OF PROPOSED RULEMAKING................................................................................. 150 1. Ex Parte Presentations ............................................................................................................................ 150 2. Initial Regulatory Flexibility Act Analysis............................................................................................. 151 3. Initial Paperwork Reduction Act Analysis ............................................................................................. 152 4. Comment Filing Procedures ................................................................................................................... 153 VI. ORDERING CLAUSES............................................................................................................................ 155 Appendix A -- List of Commenters Appendix B -- Final Rules Appendix C -- Final Regulatory Flexibility Analysis (Third Report and Order) Appendix D -- Initial Regulatory Flexibility Analysis (Third Further NPRM) 2 Federal Communications Commission FCC 02- 214 3 I. INTRODUCTION 1. We resolve in this Order several issues in connection with carriers’ use of customer proprietary network information (“ CPNI”) pursuant to section 222 of the Telecommunications Act of 1996. 1 Through section 222, Congress recognized both that telecommunications carriers are in a unique position to collect sensitive personal information – including to whom, where and when their customers call – and that customers maintain an important privacy interest in protecting this information from disclosure and dissemination. The rules we adopt today focus on the nature of the customer approval needed before a carrier can use, disclose or permit access to CPNI. In formulating the required approval mechanism described below, we carefully balance carriers’ First Amendment rights and consumers’ privacy interests so as to permit carriers flexibility in their communications with their customers while providing the level of protection to consumers’ privacy interests that Congress envisioned under section 222. 2. More specifically, we adopt an approach that comports with the decision 2 of the United States Court of Appeals for the Tenth Circuit (“ Tenth Circuit”) vacating the Commission’s requirement that carriers obtain express customer consent for all sharing between a carrier and its affiliates, as well as unaffiliated entities. 3 We adopt today an approach that is derived from a careful balancing of harms, benefits, and governmental interests. First, use of CPNI by carriers or disclosure to their affiliated entities providing communications- related services 4 , as well as third- party agents and joint venture partners providing communications-related services, requires a customer’s knowing consent in the form of notice and “opt- out” approval. 5 Second, disclosure of CPNI to unrelated third parties or to carrier affiliates that do not provide communications- related services requires express customer consent, described as “opt-in” approval. 6 Finally, this Order affirms the finding that the Tenth Circuit vacated only those 1 Telecommunications Act of 1996, Pub. L. No. 104- 104, 110 Stat. 56 (1996 Act) (codified at 47 U. S. C. §§ 151 et seq.). Hereinafter, all citations to the 1996 Act will be to the 1996 Act as it is codified in the United States Code. The 1996 Act amended the Communications Act of 1934. We will refer to the Communications Act of 1934, as amended, as “the Communications Act” or “the Act.” 2 U. S. West, Inc. v. FCC, 182 F. 3d 1224 (10 th Cir. 1999), cert. denied, 530 U. S. 1213 (June 5, 2000) (No. 99-1427) (U S WEST v. FCC). 3 Implementation of the Telecommunications Act of 1996: Telecommunications Carriers’ Use of Customer Proprietary Network Information and Other Customer Information; and Implementation of the Non- Accounting Safeguards of Sections 271 and 272 of the Communications Act of 1934, as amended, Second Report and Order and Further Notice of Proposed Rulemaking, 13 FCC Rcd 8061 (1998) (CPNI Order). 4 In this Order and Further NPRM, we use the term "communications- related services" to mean telecommunications services, information services typically provided by telecommunications carriers, and services related to the provision or maintenance of customer premises equipment. We use this term only for convenience in this Order and Further NRPM and not for any other purposes. 5 See section III. A. 1, infra. 6 See section III. A. 2, infra. 3 Federal Communications Commission FCC 02- 214 4 CPNI rules related to opt- in and left intact the remainder of the Commission’s rules, 7 including the “total service approach,” which permits the carrier to use CPNI to market new product offerings within the carrier- customer service relationship, on the basis of the customer’s implied consent. 8 3. In this Order, we also further refine the rules governing the process by which carriers provide notification to customers of their CPNI rights. Specifically, we clarify the form, content and frequency of carrier notices. 9 In addition, although we decline to reconsider our conclusion that customers’ preferred carrier (PC) freeze information constitutes CPNI and thereby continue to accord it privacy protection pursuant to section 222, we choose to forbear from imposing the express consent requirements announced in this Order with respect to PC-freezes. Through our limited exercise of forbearance, we balance customers’ privacy concerns with carriers’ meaningful commercial interests, resulting in PC- freeze information being made more readily available among competing carriers, consistent with the public interest. 10 We also affirm our previous determination that the word “information” in section 272 does not include CPNI, which is governed instead by section 222 of the Act. 11 4. Finally, we accompany this Order with a Further Notice of Proposed Rulemaking (“ Further NPRM”) to refresh the record on two issues raised in the CPNI Order Further NPRM: foreign storage of and access to domestic CPNI, and CPNI safeguards and enforcement mechanisms. We additionally request comment on what, if any, appropriate regulations should govern the CPNI held by carriers that go out of business, sell all or part of their customer base, or seek bankruptcy protection. 12 II. BACKGROUND A. Section 222 of the Act 5. This proceeding was initiated in 1996 to implement section 222 of the Act, which governs carriers’ use and disclosure of CPNI. 13 Section 222, entitled “Privacy of Customer Information,” obligates carriers to protect the confidentiality of certain information. Section 7 See Implementation of the Telecommunications Act of 1996: Telecommunications Carriers’ Use of Customer Proprietary Network Information and Other Customer Information; and Implementation of the Non- Accounting Safeguards of Sections 271 and 272 of the Communications Act of 1934, as amended, Clarification Order and Second Further Notice of Proposed Rulemaking, 16 FCC Rcd 16506, 16510 (2001) (CPNI Clarification Order). 8 See section III. B. 2, infra. 9 See section III. C, infra. 10 See section III. D. 1, infra. 11 See section III. D. 4, infra. 12 See section IV. C, infra. 13 47 U. S. C. § 222. 4 Federal Communications Commission FCC 02- 214 5 222( a) imposes a general duty on telecommunications carriers to protect the confidentiality of proprietary information. 14 Carriers owe this duty to other carriers, equipment manufacturers, and customers. 15 Section 222( b) states that a carrier that receives or obtains proprietary information of other carriers in order to provide a telecommunications service can only use that information for that purpose and cannot use that information for its own marketing efforts. 16 Finally, section 222( c) protects the confidentiality of customer information and specifically delineates the exceptions to the general principle of confidentiality. 17 6. In section 222, Congress laid out a framework for carriers’ use of customer information based on the sensitivity of the information. In particular, the statute allows easier dissemination of information beyond the existing customer- carrier relationship where information is not sensitive, or where the customer so directs. Thus, section 222 establishes three categories of customer information to which different privacy protections and carrier obligations apply: (1) individually identifiable CPNI, (2) aggregate customer information, and (3) subscriber list information. The Wireless Communications and Public Safety Act of 1999 (911 Act) amended section 222 with respect to privacy of wireless location information. 18 7. CPNI is defined as “( A) information that relates to the quantity, technical configuration, type, destination, location, and amount of use of a telecommunications service subscribed to by any customer of a telecommunications carrier, and that is made available to the carrier by the customer solely by virtue of the carrier- customer relationship; and (B) information contained in the bills pertaining to telephone exchange service or telephone toll service received by a customer of a carrier.” 19 Practically speaking, CPNI includes personal information such as the phone numbers called by a consumer, the length of phone calls, and services purchased by the consumer, such as call waiting. Congress accorded CPNI – which includes personal, individually identifiable information – the greatest level of protection. A carrier can use customers’ CPNI only in limited circumstances, except as required by law or with the customer’s approval. As specified in section 222( c)( 1), a carrier can only “use, disclose or permit access to CPNI in its provision of (A) the telecommunications service from which such information is 14 47 U. S. C. § 222( a). 15 Id. 16 47 U. S. C. § 222( b). 17 47 U. S. C. § 222( c). 18 Wireless Communications and Public Safety Act of 1999, Pub. L. No. 106- 81, enacted Oct. 26, 1999, 113 Stat. 1286 (911 Act). 19 47 U. S. C. § 222( f)( 1) and 47 U. S. C. § 222( h)( 1)( A) (The 911 Act amended the definition of CPNI at section 222( h) to include “location” among a customer’s information that carriers are required to protect under the privacy provisions of section 222). 5 Federal Communications Commission FCC 02- 214 6 derived, or (B) services necessary to, or used in, the provision of such telecommunications service, including the publishing of directories.” 20 8. The narrow exceptions to this general rule allow carriers to use individually identifiable CPNI without customer approval for four additional reasons. 21 CPNI may be used by a telecommunications carrier, either directly or through its agents, to (1) initiate, render, bill and collect for telecommunications services; (2) protect the rights or property of the carrier, or to protect users and other carriers from fraudulent or illegal use of, or subscription to, such services; or (3) provide inbound marketing, referral or administrative services to the customer for the duration of the call, if the call was initiated by the customer and the customer approves of the carrier’s use to provide such service; or (4) provide call location information concerning the user of a commercial mobile service in certain specified emergency situations. 22 9. Aggregate customer information and subscriber list information, in contrast, do not involve personal, individually identifiable information, but nevertheless are valuable to competitors. 23 Aggregate customer information means “collective data that relates to a group or category of services or customers, from which individual customer identities and characteristics have been removed.” 24 Subscriber list information generally includes subscribers’ names, addresses and telephone numbers. 25 Accordingly, under sections 222( c)( 3) and 222( e), aggregate customer information and subscriber list information receive less protection from use and disclosure in order to promote competition. In particular, aggregate customer information – which by definition has been stripped of individually identifiable information – may be used beyond the purposes identified in section 222( c)( 1) for CPNI, but local exchange carriers (LECs) must make aggregate customer information available to competitors on reasonable and nondiscriminatory terms and conditions. 26 Subscriber list information – which is generally 20 47 U. S. C. § 222( c)( 1). We note that, subsequent to the adoption of section 222( c)( 1), Congress added section 222( f). Section 222( f) states that for purposes of section 222( c)( 1), without the “express prior authorization” of the customer, a customer shall not be considered to have approved the use or disclosure of or access to (1) call location information concerning the user of a commercial mobile service or (2) automatic crash notification information of any person other than for use in the operation of an automatic crash notification system. Thus, section 222 adopts a different standard for use of wireless location information than for use of other kinds of CPNI. The standard for use of wireless location information will be addressed in a separately docketed proceeding. Wireless Telecommunications Bureau Seeks Comment on Request to Commence Rulemaking to Establish Fair Location Information Practices, WT Docket No. 01- 72, Public Notice, DA 01- 696 (rel. March 16, 2001) . 21 47 U. S. C. § 222( d). 22 47 U. S. C. § 222( d). 23 CPNI Order, 13 FCC Rcd 8061, 8064, para. 2. 24 47 U. S. C. § 222( f)( 2). 25 47 U. S. C. § 222( f)( 3). “The term ‘subscriber list information’ means any information – (A) identifying the listed names of subscribers of a carrier and such subscribers’ telephone numbers, addresses or primary advertising classifications (as such classifications are assigned at the time of the establishment of such service), or any combination of such listed names, numbers, addresses, or classifications; and (B) that the carrier or an affiliate has published, caused to be published, or accepted for publication in any directory format.” Id. 6 Federal Communications Commission FCC 02- 214 7 publicly available – must be provided to third parties for the purpose of publishing directories on a timely and unbundled basis, under nondiscriminatory and reasonable rates, terms, and conditions. 27 In addition, subscriber listed and unlisted information must be disclosed to providers of emergency service and emergency support services under the circumstances set forth in section 222( g). 28 B. CPNI Order 10. On May 17, 1996, the Commission initiated a rulemaking in response to requests for guidance from the telecommunications industry regarding the obligations of telecommunications carriers under section 222 of the Act and related issues. 29 The Commission released the CPNI Order on February 26, 1998, in which it addressed the scope and meaning of section 222 and promulgated implementing regulations. 30 11. In the CPNI Order, the Commission found that in order to ensure the “informed consent” of consumers for use of their CPNI in a manner other than specifically allowed under section 222( c)( 1), carriers would be required to obtain express written, oral or electronic consent from their customers, i. e., an “opt in” requirement, before a carrier could use CPNI to market services outside the customer’s existing service relationship with that carrier. 31 The Commission reasoned that approval by “implied consent” (or opt- out) would not fulfill the statutory purpose of affording consumers with meaningful privacy protection. The Commission also concluded that a carrier must notify the customer of the customer’s rights under section 222 before soliciting approval to use the customer’s CPNI. 12. At the same time, the Commission adopted what is called the “total service approach” allowing carriers and their affiliates to use customers’ CPNI, without notice or approval, to market services within the package of services to which the customer already subscribes. 32 The total service approach recognized existing customer relationships for local, interexchange, and wireless services. Under the total service approach, a carrier that provides local service to a customer may use that customer’s local service CPNI to sell that customer other product offerings within the existing local service relationship (e. g., caller ID) without customer approval of the use of the CPNI. As service relationships expanded (e. g., the customer (Continued from previous page) 26 47 U. S. C. § 222( c)( 3). 27 47 U. S. C. § 222( e). 28 47 U. S. C. § 222( g). 29 In the Matter of Implementation of the Telecommunications Act of 1996: Telecommunications Carriers’ Use of Customer Proprietary Network Information and Other Customer Information, Notice of Proposed Rulemaking, 11 FCC Rcd 12513 (1996) (1996 NPRM). 30 CPNI Order, 13 FCC Rcd 8061. 31 CPNI Order, 13 FCC Rcd at 8128- 8150, paras. 87- 114. 32 CPNI Order, 13 FCC Rcd at 8080- 81, paras. 24- 25. 7 Federal Communications Commission FCC 02- 214 8 selected both local and wireless service), so too did the parameters of the permissible use of CPNI to market new product offerings. This approach recognizes that the customer may be fairly considered to have given implied consent to the carrier’s use of CPNI within the total service package to which the customer subscribes. 13. Such sharing was intended to allow carriers with a pre- existing relationship with the customer to develop “packages” of services best tailored to their customers’ needs. The Commission noted that customers would reasonably expect carriers with whom they dealt to review their CPNI to fashion service packages tailored to their needs, and thus would not object to inter- affiliate sharing if each affiliate already has a relationship with the customer. Because the order required express consent for any type of disclosures beyond those permitted by section 222( c)( 1), the order did not distinguish between disclosure to an affiliate or other carrier for telecommunications marketing purposes or disclosure to an unrelated third party for non-telecommunications purposes (e. g., divorce actions, insurance reviews, or random product marketing). 14. The CPNI Order also included a Further Notice of Proposed Rulemaking (CPNI Order Further NPRM) that sought comment regarding: (1) customers’ rights to restrict carrier use of CPNI for marketing purposes; (2) protections for carrier information and related enforcement mechanisms; and (3) foreign storage of and access to domestic CPNI. 33 C. CPNI Reconsideration Order 15. On August 16, 1999, the Commission adopted the CPNI Reconsideration Order in response to a number of petitions for reconsideration, forbearance, and clarification of the CPNI Order. 34 The CPNI Reconsideration Order was adopted “to preserve the consumer protections mandated by Congress while more narrowly tailoring [the CPNI] rules, where necessary, to enable telecommunications carriers to comply with the law in a more flexible and less costly manner.” 35 16. In the CPNI Reconsideration Order, the Commission denied petitions for reconsideration that sought to amend the CPNI rules to differentiate among types of telecommunications carriers. 36 The Commission declined to modify or forbear from the total service approach and clarified a number of aspects of the total service approach in response to 33 CPNI Order, 13 FCC Rcd 8200- 8204, paras. 203- 210. The first issue is dealt with in this Order while the second and third issues are addressed in the Further NPRM contained herein. 34 Implementation of the Telecommunications Act of 1996; Telecommunications Carriers’ Use of Customer Proprietary Network Information; and Implementation of the Non- Accounting Safeguards of Sections 271 and 272 of the Communications Act of 1934, as amended, Order on Reconsideration and Petitions for Forbearance, 14 FCC Rcd 14409 (1999) (CPNI Reconsideration Order). 35 CPNI Reconsideration Order, 14 FCC Rcd at 14412, para. 2. 36 CPNI Reconsideration Order, 14 FCC Rcd at 14418- 14420, paras. 11- 15. For example, some petitioners sought stricter requirements for incumbent local exchange carriers as opposed to competitive local exchange carriers or less stringent requirements for small and rural carriers. Id. 8 Federal Communications Commission FCC 02- 214 9 petitioners’ requests. 37 The Commission determined that PC- freeze information 38 “falls squarely within the definition of CPNI set out in both sections 222( f)( 1)( A) and (B),” 39 and thus denied MCI’s request to classify this information otherwise. 40 17. The Commission granted, in part, petitions for reconsideration requesting that all carriers be allowed to use CPNI to market customer premises equipment (“ CPE”) and information services under section 222( c)( 1) without customer approval. In particular, the Commission allowed all carriers to use CPNI, without customer approval, to market CPE. 41 The Commission also allowed CMRS carriers to use, without customer approval, CPNI to market all information services, while allowing wireline carriers to do so for most information services. 42 Further, the Commission eliminated “the restrictions on a carrier’s ability to use CPNI to regain customers who have switched to another carrier.” 43 However, the CPNI Reconsideration Order concluded that a carrier’s use of information regarding a customer’s decision to switch carriers derived from its wholesale operations to retain the customer would violate the prohibitions in section 222( b). 44 18. The Commission also addressed various aspects of the customer approval required to use CPNI in accordance with section 222. The Commission rejected requests to adopt preemptive national rules and affirmed its previous decision to exercise its preemption authority on a case- by- case basis for conflicting state rules, concluding that in connection with CPNI regulation, the Commission “may preempt state regulation of intrastate telecommunications matters where such regulation would negate the Commission’s exercise of its lawful authority because regulation of the interstate aspects of the matter cannot be severed 37 CPNI Reconsideration Order, 14 FCC Rcd at 14420- 14429, paras. 16- 38. 38 Under section 64.1190( a) of our rules, “[ a] preferred carrier freeze (or freeze) prevents a change in a subscriber’s preferred carrier selection unless the subscriber gives the carrier from whom the freeze was requested his or her express consent.” 47 C. F. R. § 64. 1190( a). 39 CPNI Reconsideration Order, 14 FCC Rcd at 14488, para. 148. See also BellSouth Opposition and Comments at 5. 40 CPNI Reconsideration Order, 14 FCC Rcd at 14488, para 148. 41 CPNI Reconsideration Order, 14 FCC Rcd at 14430- 14439, paras. 39- 56. 42 Id. The Commission found that CMRS providers historically have bundled CPE and information services with the underlying telecommunications service, and therefore, due primarily to customer expectations, those services fell within the meaning of “necessary to, or used in” the provision of service. Id. While wireline carriers traditionally have bundled CPE with wireline services, wireline carriers had not bundled Internet access services with wireline services. As a result, the Commission found that Internet access services are not “necessary to, or used in” the provision of service. Id. at 14434, para. 46. 43 CPNI Reconsideration Order, 14 FCC Rcd at 14442- 14448, paras. 64- 74. This activity is commonly referred to as “winback” marketing. 44 CPNI Reconsideration Order, 14 FCC Rcd at 14448- 14450, paras. 75- 79. This activity is commonly referred to as “retention” marketing. 9 Federal Communications Commission FCC 02- 214 10 from the intrastate aspects.” 45 Further, in order to lessen the burden on carriers, the Commission modified various CPNI safeguards, while allowing carriers more flexibility in determining how best to safeguard customers’ privacy. 46 19. The Commission also affirmed the conclusion reached in the CPNI Order regarding the interpretation of the interplay between sections 222 and 272 that “information,” as defined in section 272, does not include CPNI. 47 As a result, Bell operating companies (“ BOCs”) are not obligated by section 272 to make CPNI available to other carriers on a non-discriminatory basis when they share it with their long distance affiliates. Finally, the Commission determined that section 254 does “not confer any special status on carriers seeking to use CPNI to market enhanced services and CPE in rural exchanges to select customers.” 48 D. Tenth Circuit Opinion 20. On August 18, 1999, the Tenth Circuit issued an opinion vacating a portion of the CPNI Order in U S WEST. 49 U S WEST (now Qwest) contended that the opt- in approach adopted by the Commission violated the First and Fifth Amendments of the Constitution. 50 The Tenth Circuit struck down the Commission’s original customer approval rules, finding that the CPNI rules impermissibly regulated protected commercial speech and thus violated the First Amendment. 51 Specifically, the court found that the opt- in regime was not narrowly tailored because the Commission had failed to adequately consider an opt- out option. 52 45 CPNI Reconsideration Order, 14 FCC Rcd at 14465- 66, para 112- 13, quoting CPNI Order, 13 FCC Rcd at 8075- 78, paras. 16- 18. 46 CPNI Reconsideration Order, 14 FCC Rcd at 14468- 14479, paras. 117- 134. In the CPNI Order, the Commission had required carriers to develop and implement software systems that “flag” customer service records in connection with CPNI (“ flagging”) and to maintain an electronic audit mechanism (“ audit trail”) that tracks access to customer accounts. CPNI Order, 13 FCC Rcd at 8198- 8200, paras. 198- 199. In the CPNI Reconsideration Order, the Commission allowed carriers more flexibility by requiring carriers only to implement a system by which the status of a customer’s CPNI approval can be clearly established prior to access to CPNI. Carriers no longer had to implement an electronic system. CPNI Reconsideration Order, 14 FCC Rcd at 14474, para. 126. The Commission also eliminated the audit trail requirement and instead required carriers to maintain a record of their sales and marketing campaigns that use CPNI. CPNI Reconsideration Order, 14 FCC Rcd at 14474- 75, para. 127. 47 CPNI Reconsideration Order, 14 FCC Rcd at 14481- 88, paras. 137- 145. 48 CPNI Reconsideration Order, 14 FCC Rcd at 14490, para. 151. 49 U S WEST v. FCC, 182 F. 3d 1224. 50 U S WEST v. FCC, 182 F. 3d at 1231. 51 Id. at 1239. 52 Id. 10 Federal Communications Commission FCC 02- 214 11 E. AT& T and WorldCom Petitions 21. On October 8, 1999, AT& T filed a petition for review of the CPNI Order with the U. S. Circuit Court of Appeals for the District of Columbia, challenging the Commission’s CPNI decisions as they relate to the interplay between sections 222 and 272 of the Communications Act. 53 On July 25, 2000, the D. C. Circuit granted the Commission’s motion for voluntary remand of the AT& T appeal. 54 22. On November 1, 1999, MCI WorldCom filed a petition for further reconsideration arguing that the Commission should reexamine some of its notice requirements as applicable to competitive carriers’ access to CPNI during the sales and provisioning processes. 55 MCI WorldCom also argued that the Commission should reexamine its determination that preferred carrier freeze 56 information is CPNI, as well as its refusal to issue a definitive rule governing winbacks. 57 F. Clarification Order and Further Notice of Proposed Rulemaking 23. On August 28, 2001, the Commission adopted an order (CPNI Clarification Order) clarifying the status of its CPNI rules in light of the Tenth Circuit order and issuing a Further Notice of Proposed Rulemaking (Clarification Order Further NPRM). 58 The Commission affirmed its previous determination that the Tenth Circuit invalidated only the opt-in rule, not the entire CPNI Order. 59 The Commission sought comment on its interpretation of the scope of the Tenth Circuit order, and on what type of approval (opt- in or opt- out) would best serve the government’s goals while respecting constitutional limits. 60 In addition, the 53 AT& T Petition for Review, AT& T v. FCC, No. 99- 1413 (D. C. Cir., July 25, 2000) (petition for review filed Oct. 8, 1999). 54 AT& T v. FCC, No. 94- 1413 (D. C. Cir., July 25, 2000) (AT& T v. FCC). 55 MCI WorldCom Petition for Further Reconsideration (filed Nov. 1, 1999) (MCI WorldCom Petition). 56 Preferred carrier freezes and primary interexchange carrier freezes are sometimes referred to as PC- freezes and PIC- freezes, respectively. A PC- freeze is a more general term, applying to any freeze placed on a customer’s account to protect her preferred carrier selection from being changed without her explicit permission. PIC- freeze refers specifically to a freeze on a customer’s interexchange carrier selection. A PC- freeze/ PIC- freeze “prevents a change in a subscriber’s preferred carrier selection unless the subscriber gives the carrier from whom the freeze was requested his or her express written or oral consent.” Implementation of the Subscriber Carrier Selection Changes Provisions of the Telecommunications Act of 1996, Second Report and Order and Further Notice of Proposed Rulemaking, 14 FCC Rcd 1508, 1575, para. 112, n. 348 (1998) (Slamming Order). 57 MCI Petition at 17. Winback activities involve carriers’ attempts to regain the business of customers who have switched to another carrier. 58 Implementation of the Telecommunications Act of 1996; Telecommunications Carriers’ Use of Customer Proprietary Network Information and Other Customer Information; Implementation of the Non- Accounting Safeguards of Sections 271 and 272 of the Communications Act of 1934, as Amended; Clarification Order and Second Further Notice of Proposed Rulemaking, 16 FCC Rcd 16506 (2001) (CPNI Clarification Order). 59 CPNI Clarification Order, 16 FCC Rcd at 16510, para. 7. 60 CPNI Clarification Order, 16 FCC Rcd at 16512- 16517, paras. 14- 22. 11 Federal Communications Commission FCC 02- 214 12 Commission noted that “the consent mechanism that we eventually adopt in response to the Tenth Circuit’s Order could impact our previous findings regarding the interplay between [sections 222 and 272], and we therefore find it necessary to raise the relevant issues here.” 61 24. In the CPNI Clarification Order, the Commission sought to obtain a more complete record on ways in which consumers can consent to a carrier’s use of their CPNI. 62 Taking into account the Tenth Circuit’s opinion, the Commission sought comment on what methods of approval would serve the governmental interests at issue and afford informed consent, while also satisfying the First Amendment’s requirement that any restrictions on speech be narrowly tailored. 63 Specifically, the Commission sought comment on the interests and policies underlying section 222 that are relevant to formulating an approval requirement, including an analysis of the privacy interests that are at issue, and on the extent to which we should take competitive concerns into account. 64 To the extent that promoting competition is also a legitimate government interest under section 222, the Commission sought comment on the likely difference in competitive harms under opt- in and opt- out approvals. 25. In the CPNI Clarification Order, the Commission also sought comment on whether adoption of an opt- out mechanism is consistent with the rationale for the total service approach set forth in the CPNI Order. 65 Additionally, in the CPNI Reconsideration Order, the Commission determined that carriers may use CPNI derived from the provision of a telecommunications service to market CPE necessary to, or used in, the provision of that telecommunications service in accordance with section 222( c)( 1). 66 In a separate proceeding, the Commission modified and clarified its bundling rules promulgated under Computer II 67 to allow carriers to bundle CPE and enhanced services with telecommunications services. 68 The Commission sought comment on whether the issues raised in that proceeding should affect our interpretation of section 222( c)( 1) and the total service approach. 69 The Commission received 61 CPNI Clarification Order, 16 FCC Rcd at 16518, para. 24. 62 CPNI Clarification Order, 16 FCC Rcd at 16512, para. 12. 63 Id. 64 Id. 65 CPNI Clarification Order, 16 FCC Rcd at 16516, para. 21. 66 CPNI Reconsideration Order, 14 FCC Rcd at 14430, para. 39. 67 Amendment of Section 64. 702 of the Commission’s Rules and Regulations, CC Docket No. 20828, Final Decision, 77 FCC 2d 384 (1980). 68 Policy and Rules Concerning the Interstate, Interexchange Marketplace, Implementation of Section 254( g) of the Communications Act of 1934, as amended, CC Docket No. 96- 16, 1998 Biennial Regulatory Review – Review of Customer Premises Equipment and Enhanced Services Unbundling Rules in the Interexchange, Exchange Access and Local Exchange Market, CC Docket No. 98- 183, Report and Order, 16 FCC Rcd 7418 (2001). 69 CPNI Clarification Order, 16 FCC Rcd at 16516, para. 21. 12 Federal Communications Commission FCC 02- 214 13 extensive comments and replies from commenters representing a broad cross section of the industry and consumer interest groups in this proceeding. 70 III. THIRD REPORT AND ORDER A. Approval Standard 26. The primary issue to be decided here is how to implement section 222( c)( 1), which governs the use and disclosure of CPNI upon the “approval of the customer.” 71 In the CPNI Order, the Commission concluded that “approval” for all such uses and disclosure, whether sharing among affiliated entities or unaffiliated third parties, required express consent from the customer. 72 The Tenth Circuit invalidated the Commission’s original opt- in regime based on its concerns that the Commission’s CPNI rules impermissibly burdened carriers’ and consumers’ 73 commercial speech. 74 The court noted that nonmisleading commercial speech regarding a lawful activity is a form of protected speech under the First Amendment, although it is generally afforded less protection than noncommercial speech. 75 The court found that the CPNI rules implicated commercial speech concerns under the First Amendment “[ b] ecause [U S WEST’s] targeted speech to its customers is for the purpose of soliciting those customers to purchase more or different telecommunications services. . . .” 76 Notably, the court’s opinion presupposes that the speech at issue involves sharing with affiliates for telecommunications marketing, rather than unrestricted disclosure to unrelated third parties. 77 27. In deciding U S WEST v. FCC, the court analyzed the CPNI Order using the constitutional standards applicable to governmental regulations of commercial speech articulated in Central Hudson Gas & Elec. Corp. v. Public Service Commission. 78 In order to determine 70 A list of parties filing comments and reply comments on the Clarification Order Further NPRM is included at Appendix A. 71 47 U. S. C. § 222( c)( 1). 72 CPNI Order, 13 FCC Rcd at 8128- 50, paras. 87- 114. 73 The Tenth Circuit stated that the First Amendment protects both the right to engage in commercial speech and “necessarily protects the right to receive it.” U S WEST, 182 F. 3d at 1232 (quoting Martin v. City of Struthers, 319 U. S. 141, 143 (1943), which involved distribution of literature). 74 U S WEST, 182 F. 3d at 1239. 75 U S WEST, 182 F. 3d at 1233. 76 Id. at 1232- 33 (finding that [U S WEST’s] targeted speech “`does no more than propose a commercial transaction’ . . . [c] onsequently, the targeted speech in this case fits soundly within the definition of commercial speech.”) (quoting Virginia State Bd. Of Pharmacy v. Virginia Citizens Consumer Council, Inc., 425 U. S. 748, 760 (1976)). 77 U S WEST, 182 F. 3d at 1230, 1232- 33. 78 U S WEST v. FCC, 182 F. 3d at 1233. See also Central Hudson Gas & Elec. Corp. v. Public Service Comm’n of N. Y., 447 U. S. 557( 1980) (Central Hudson). 13 Federal Communications Commission FCC 02- 214 14 whether restrictions on commercial speech survive “intermediate scrutiny,” Central Hudson sets out a four- part test. 79 Central Hudson asks first whether the speech in question concerns illegal activity or is misleading, in which case the government may freely regulate the speech. If the speech is not misleading and does not involve illegal activity, the court applies the rest of the four- part test to the government’s regulation. 80 The second prong of Central Hudson examines whether the government has a substantial interest in regulating the speech. Third, the government must show that the restriction on commercial speech directly and materially advances that interest. Finally, the regulation must be narrowly drawn. 81 28. The court assumed that the Commission had demonstrated a substantial state interest in protecting privacy and acknowledged that Congress might have considered promoting competition in tandem with the privacy interest. Notwithstanding this assumption, the court later found that “[ t] he government presents no [empirical] evidence showing the harm to either privacy or competition is real.” 82 Accordingly, the court concluded that the government did not demonstrate that the opt- in regulations directly and materially advanced its interests. The court noted that the Commission also must show the dissemination of CPNI would “inflict specific and significant harm on individuals,” such as misappropriation of sensitive personal information for the purpose of assuming another’s identity. 83 The court concluded that the opt- in requirement was not “narrowly tailored” because the agency had not demonstrated a sufficiently good fit between the means chosen (opt- in or express approval) and the desired statutory objectives (protecting privacy and competition). In addition, the court recognized that while the government is obligated to consider less restrictive means, that requirement “does not amount to a least restrictive means test.” 84 However, the court found that the Commission had failed to adequately consider an “obvious and less restrictive alternative,” an opt- out strategy. 85 29. Importantly, the court did not find section 222 of the Act unconstitutional. 86 As noted, U S WEST did not even challenge the constitutionality of section 222. 87 Therefore, the 79 Central Hudson, 447 U. S. at 564- 65. 80 As the court noted and no commenter has disputed, the commercial speech impacted by the Commission’s CPNI rules is neither misleading nor does it involve illegal activity. U S WEST, 182 F. 3d at 1234. 81 Central Hudson, 447 U. S. at 564- 65. See also U S WEST, 182 F. 3d at 1233. 82 U S WEST, 182 F. 3d at 1237. 83 U S WEST, 182 F. 3d at 1235. 84 Id. at 1238, n. 11. 85 U S WEST, 182 F. 3d at 1238. 86 U S WEST, 182 F. 3d at 1243 (Briscoe, J., dissenting). 87 The dissent argued that U S WEST’s arguments were flawed because they were “more appropriately aimed at the restrictions and requirements outlined in section 222 rather than the approval method adopted in the CPNI Order.” She observed that the order, not the statute, was the subject of U S WEST’s petition for review. U S WEST, 182 F. 3d at 1243 (Briscoe, J., dissenting). 14 Federal Communications Commission FCC 02- 214 15 task before the Commission remains the same: to implement regulations that satisfy Congress’ goal of protecting consumer privacy by requiring carriers to obtain customer consent for certain uses of CPNI. As required by the Tenth Circuit, any new regulations adopted by the Commission in the instant proceeding must meet the standard articulated by the Supreme Court in Central Hudson. 30. In view of the court’s guidance, we take into account the burden on carriers’ commercial speech rights, provide an empirical justification for the government’s interest in protecting the privacy of consumers’ CPNI, and consider whether opt- out provides sufficient protection of consumer privacy. We discuss separately the appropriate means of obtaining customer approval for intra- company use of CPNI and for disclosure of CPNI to third parties because our application of Central Hudson in light of the record in this proceeding shows that the balance of the costs and benefits associated with the burden on speech are different between these categories, thus requiring different outcomes. Specifically, we find that opt- out is a narrowly tailored means that directly and materially advances Congress’ interest in protecting consumers from unapproved use of CPNI by carriers and their affiliates that provide communications- related services. 88 However, opt- in is a narrowly tailored means that directly and materially advances Congress’ interest in protecting consumers from unapproved disclosure of CPNI to third parties that have no business relationship with the customer and are not subject to enforcement under the Communications Act or the Commission’s rules such as those governing use and disclosure of CPNI. 1. Intra- Company and Joint Venture Use of CPNI by Telecommunications Carriers 31. Although in 1999 the Commission concluded that the more stringent opt- in rule was necessary, in light of U S WEST we now conclude that an opt- in rule for intra- company use cannot be justified based on the record we have before us. Thus, we adopt a less restrictive alternative – an opt- out rule – which is less burdensome on commercial speech. Applying the Central Hudson test to possible schemes for carriers to obtain customer approval for use and disclosure of CPNI under section 222( c)( 1), we conclude that: (1) the government has a substantial interest in ensuring that a customer be given an opportunity to approve (or disapprove) uses of her CPNI by a carrier and a carrier’s affiliates that provide communications-related services; 89 (2) opt- out directly and materially advances this interest by mandating that carriers provide prior notice to customers along with an opportunity to decline the carrier’s requested use or disclosure; and (3) opt- out is no more extensive than necessary to serve the government interest in protecting privacy because it is less burdensome on carriers than other alternatives such as opt- in, while still serving the government’s interest in ensuring that 88 However, we allow and encourage carriers to use an opt- in approval method if they prefer in order to provide consumers with heightened privacy protections. We note, for example, that some financial institutions market the fact that they provide privacy protections beyond those mandated by federal law. 89 We have defined “communications- related services” supra at n. 4. 15 Federal Communications Commission FCC 02- 214 16 consumers have an opportunity to exercise their approval rights regarding intra- company use and disclosure of CPNI. 90 32. We also conclude that opt- out is an appropriate approval mechanism for the sharing of CPNI with, and use by, a carrier’s joint venture partners and independent contractors in connection with communications- related services that are provided by the carrier (or its affiliates) individually, or together with the joint venture partner. 91 That is, in these two contexts, this form of consent directly and materially advances the government’s interest in ensuring that customers have an opportunity to approve such uses of CPNI, while also burdening no more carrier speech than necessary. a. Intra- Company Use 33. Government’s Substantial Interest. The customer approval requirement in section 222( c)( 1) is designed to protect the interest of telecommunications consumers in limiting unexpected and unwanted use and disclosure of their personal information by carriers who must collect such information in order to render bills and perform other services. Section 222( c)( 1) thus assumes a minimum level of customer concern regarding certain uses of CPNI by a carrier and its affiliates. This assumption has been borne out by evidence in the record, including surveys indicating consumers’ desires regarding dissemination of CPNI and other personal information. Notably, in one study, 55.5 percent of Cincinnati Bell Telephone (CBT) customers expressed some level of concern with use of CPNI by CBT for targeted marketing, including 17.2 percent that were “extremely concerned.” 92 Likewise, the Westin Study submitted by Pacific Telesis in the original CPNI proceeding indicated that 36 percent of customers found it “not acceptable” for their local telephone company to use CPNI for targeted marketing. 93 These concerns show a sensitivity to use of CPNI, consistent with the very private nature of the information collected by a telecommunications carrier, which includes, at a minimum, the telephone numbers a subscriber calls, and the times, dates, destinations and duration of those calls. 94 CPNI also includes services that a subscriber purchases, the equipment and facilities used, and it may also include personal/ household usage patterns, among other things. 95 Based on 90 However, we allow carriers to use an opt- in approval method if they prefer to do so. See section III. C. 1, infra. 91 See section III. A. 1.b infra. 92 Cincinnati Bell Telephone Comments (filed June 11, 1996), App. A at 2 (Cincinnati Bell Study). This carrier-specific evidence is consistent with the results of more recent survey data put on the record by Qwest which show that about 25 percent of all consumers are “privacy fundamentalists” who tend to oppose any sharing or dissemination of their private information. Qwest May 14, 2002 Ex Parte Letter, App. C at 11 n. 6. 93 Letter from Gina Harrison, Pacific Telesis Group, to William F. Caton, Acting Secretary, Federal Communications Commission, CC Docket No. 96- 115 (filed Dec. 12, 1996) (Pacific Telesis Dec. 12, 1996 Ex Parte Letter), Attach. A at 8 (Westin Survey). Sixty- four percent said that such uses would be acceptable to them. Id. 94 CPNI Order, 13 FCC Rcd at 8064, para. 2. 95 “[ T] his data can be processed and translated into subscriber profiles which may contain information about the identities and whereabouts of subscribers’ friends and relatives, which businesses subscribers patronize, when subscribers are likely to be home and awake, product and service preferences, and subscribers’ medical, business, (continued….) 16 Federal Communications Commission FCC 02- 214 17 the record before us, we conclude that the government’s interest in limiting unexpected disclosure and use of consumers’ CPNI is a substantial one. 34. Direct and Material Advancement. The next prong of Central Hudson examines whether a regulation impacting commercial speech directly and materially advances the government’s interest, i. e., the restriction is effective at promoting the government’s interest. 96 We conclude that, with respect to intra- company uses, opt- out directly and materially advances the government’s interest that a customer be given an opportunity to approve (or disapprove) uses of her CPNI by mandating that carriers provide prior notice to customers along with an opportunity to decline the carrier’s requested use or disclosure. 35. Although the record evidence demonstrates that a substantial portion of consumers have a high level of concern about protecting the privacy of their CPNI (a concern most acute for disclosure to parties other than their own carrier), 97 the record also makes evident that a majority of customers nevertheless want to be advised of the services that their telecommunications providers offer. 98 Furthermore, the record establishes that customers are in a position to reap significant benefits in the form of more personalized service offerings (and possible cost savings) from their carriers and carriers’ affiliates providing communications-related services based on the CPNI that the carriers collect. Enabling carriers to communicate with customers in this way is conducive to the free flow of information, 99 which can result in more efficient and better- tailored marketing 100 and has the potential to reduce junk mail and other forms of unwanted advertising. 101 Thus, consumers may profit from having more and better information provided to them, or by being introduced to products or services that interest them. 102 (Continued from previous page) client, sales, organizational, and political telephone contacts.” U. S. West, Inc. v. FCC, Julie Tuan, 15 Berkeley Tech. L. J. 353, 369 (2000). 96 U S WEST, 182 F. 3d at 1237 (stating that the government must “demonstrate that the harms it recites are real and that its restriction will in fact alleviate them to a material degree”) (quoting Edenfield v. Fane, 507 U. S. 761, 771 (1993)). 97 See infra section III. A. 2. 98 Cincinnati Bell Study at 2 (indicating that 81. 5 percent of respondents wanted to be advised of the services that Cincinnati Bell Telephone offers). 99 CTSI Reply Comments at 7 (“ Customers, as well as the market, benefit from the free flow of information.”). See also BellSouth Comments at 7. 100 Letter from Michael D. Alarcon, SBC, to William Caton, Acting Secretary, Federal Communications Commission, CC Docket Nos. 96- 115 and 96- 149 (filed Apr. 12, 2002) (SBC April 12, 2002 Ex Parte Letter) (stating that interim opt- out approval has resulted in “[ c] ustomized offerings of SBC’s products and services based on customers’ CPNI.”). See also Progress & Freedom Foundation Comments at 4. 101 AT& T Comments at 5, n. 3 (“ Indeed, limiting the use of CPNI may have the effect of increasing the number of solicitations by telecommunications carriers.”). See also Verizon Comments at 6; Progress & Freedom Foundation Reply Comments at 4. 102 Progress & Freedom Foundation Reply Comments at 4 (“ In other words, information allows communications to be targeted to make it more likely that consumers are made aware of goods and services they want to reach them, while reducing consumer exposure to unwanted or irrelevant advertising.”); Qwest Comments, Attach. A at 3 (continued….) 17 Federal Communications Commission FCC 02- 214 18 The empirical evidence indicating that a majority of customers want to be advised of service offerings from their carriers is consistent with the expectation that targeted carrier marketing will benefit them. 103 36. Based on this record evidence, we think it is reasonable to conclude that targeted marketing of communications- related services using CPNI by the carrier that collects it is within the range of reasonable customer expectations. We find that telecommunications consumers expect to receive targeted notices from their carriers about innovative telecommunications offerings that may bundle desired telecommunications services and/ or products, save the consumer money, and provide other consumer benefits. 104 Similar to a case recently before the D. C. Circuit, the record here indicates that “the identity of the audience and the use to which the information may be put” 105 bear strongly on consumers’ privacy interests. 106 In this respect, we conclude that consumers are concerned about use of CPNI, but that a large percentage of telecommunications customers also expect that carriers will use CPNI to market their own telecommunications services and products, as well as those of their affiliates. Thus, we conclude that an opt- out scheme giving customers an opportunity to disapprove intra- company uses of CPNI directly and materially advances customers’ interest in avoiding unexpected and unwanted use and disclosure of CPNI and is sufficient to meet the “approval” requirement under section 222. 37. Although many commenters have argued that opt- out necessarily is a less effective protection against unapproved dissemination of private information than opt- in, we are convinced, based on the record, that these concerns can be adequately addressed in the intra-company context. We find that an opt- out regime would adequately protect consumers’ privacy interests with respect to disclosure to carrier affiliates based on two important considerations that are dependent upon the underlying carrier- customer relationship. First, likelihood of any potential privacy harm from an inadvertent approval under opt- out is significantly reduced in the intra- company context by the carrier’s need for a continuing relationship with the customer. 107 (Continued from previous page) (“ CPNI allows telecommunications carriers to identify customers, on the basis of their past purchasing habits, who are most likely to be interested in particular new services, or to offer them information about packages of services through communications tailored to their individual needs.”). See also AT& T Comments at 9- 10. 103 Westin Survey at 8. 104 AT& T Comments at 9- 10; BellSouth Comments at 4; CenturyTel Comments at 5; Cincinnati Bell Telephone June 11, 1996 Comments at App. A; Nextel Comments at 5; USTA Comments at 13; AT& T Reply Comments at 2; Verizon Reply Comments at 8. 105 Trans Union Corp v. Federal Trade Commission, 245 F. 3d 809, rehearing denied, 267 F. 3d 1138, 1143 (D. C. Cir. 2001), petition for cert. pending. 106 CenturyTel Comments at 5 ([ C] arriers do not use or disseminate sensitive or personal information that would inflict specific or significant harm on their customers.”); Qwest Comments at 16 (“ Arguments may be made to the Commission that might support a finding that, in some circumstances, some carrier disclosures of CPNI to unaffiliated third parties might be privacy invasive.”). 107 USTA Reply Comments at 1 (“ In competitive telecommunications markets, the failure of carriers to meet customer privacy expectations will only serve to alienate those customers and cause them to obtain service from carriers that meet their expectations.”). 18 Federal Communications Commission FCC 02- 214 19 As AT& T argues, “[ i] f a carrier were to abuse CPNI, customers would likely switch carriers.” 108 Because of commercial constraints required to ensure customer accountability, therefore, the carrier with whom the customer has the existing business relationship has a strong incentive not to misuse its customers’ CPNI or it will risk losing its customers’ business. 109 38. Second, we find the potential harm to privacy to be much less significant in instances where the entity that uses and shares the CPNI is subject to section 222 and our implementing rules. If a consumer should decide to restrict disclosure after the original period to respond to an opt- out notice has elapsed, she may do so at any time and the carrier must comply with that request. Significantly, the holder of CPNI, the customer’s existing telecommunications provider (including its telecommunications affiliates), is subject to enforcement action by the Commission 110 for any failure to abide by the notice rules regarding planned use, disclosure, or permission to access a customer’s CPNI. 111 39. We are given further comfort that we can protect privacy interests under intra-company opt- out by fine- tuning our notification rules. These rules, as described below, are crafted to ensure that any opt- out mechanism provides effective notification to consumers. We are mindful of the deficiencies widely reported for the Gramm- Leach- Bliley 112 notifications in the financial services sector, 113 and have fashioned our CPNI notification requirements in this Order with an eye toward learning from that experience. As discussed further in section III. C infra, we bolster the CPNI opt- out regime by requiring a 30- day waiting period before consent is inferred and by refreshing consumers on a company’s opt- out policy every two years. Moreover, we note that under the opt- out rules we adopt today, the customer’s carrier would remain subject to enforcement action from the Commission for any deficiencies in its opt- out notice. 108 AT& T Comments at 7. 109 We recognize that this constraint is less effective where competitive choices are less readily available. See Arizona Attorney General Jan. 25, 2002 Ex Parte Letter, Ex. B. at 86). However, as competition continues to develop, this safeguard will only increase in its usefulness. 110 In addition, carriers may be subject to enforcement actions by state utility commissions. 111 By contrast, the threat of enforcement action in the third- party sharing context does not serve as a deterrent against the misuse of customer CPNI because non- carriers are not subject to section 222. Thus, such third parties have little or no reason to use customers’ CPNI in any way but that which generates the most profits, which may include selling or providing access to the personal information. 112 15 U. S. C. § 6802. The Financial Services Modernization Act is more commonly known as the “Gramm- Leach-Bliley Act” (Gramm- Leach- Bliley). 113 Russell Gold, Privacy Notice Offers Little Help, WALL STREET JOURNAL, May 30, 2002, at D1. Implementation of Gramm- Leach- Bliley has been particularly problematic, prompting complaints from privacy groups, consumers, and state and federal regulators. Commenters say that the opt- out notices to consumers have not been “clear and conspicuous” and that many notices have been unintelligible and couched in language far above the average American’s reading level. NAAG Dec. 21, 2001 Ex Parte Letter at 8; see Harris Interactive for the Privacy Leadership Initiative survey, available at http:// www. ftc. gov/ bcp/ workshops/ glb; NAAG Dec. 21, 2001 Ex Parte Letter at 9. Many consumers did not recall receiving the notices or reading them. See American Bankers Association survey, available at http:// www. aba. com/ Press+ Room/ bankfee060701. htm. 19 Federal Communications Commission FCC 02- 214 20 40. Narrow Tailoring. We now consider whether opt out is narrowly tailored, i. e., whether it burdens substantially more of a carrier’s speech than necessary. The Tenth Circuit points out that the narrow tailoring requirement under Central Hudson means that the government’s speech restriction must signify a “carefu[ l] calculat[ ion of] the costs and benefits associated with the burden on speech imposed by its prohibition.” 114 We have described the primary benefit associated with opt- out above. It directly and materially addresses customers’ interest in avoiding unexpected and unwanted use and disclosure of individually identifiable CPNI. Turning to the carriers’ burdens, i. e., the “costs” of the regulation, we find that, in this case, there is no flat prohibition on speech, but rather a requirement that a telecommunications carrier use a specified means of obtaining a customer’s consent before using that customer’s personal information in CPNI to market communications- related services or share the information with an affiliate that provides communications- related services. We also find that carriers have provided evidence that their commercial speech interest in using a customer’s CPNI for tailored telecommunications marketing is real and significant, and that an opt- out regime is a less burdensome means of obtaining a customer’s “approval” under section 222( c)( 1) than is an opt- in regime. 41. Carriers uniformly assert a significant competitive need to use CPNI for marketing purposes and/ or to share such information with their affiliates that provide communications- related services. 115 The carriers seek to offer competitive packages that are tailored to their customers’ usage patterns and demonstrated service needs. Carriers have demonstrated on the record that use of CPNI to develop such targeted offerings can lower the costs and improve the effectiveness of customer solicitations. 116 Moreover, carriers assert that opt- out imposes fewer burdens on their commercial speech interests than the other alternative for ascertaining approval – opt- in – and is thus the only approval mechanism that will satisfy First Amendment scrutiny under Central Hudson. 117 This assertion rests on a comparison of the relative costs of the mechanisms: under opt- out, carriers would be required to provide customers with advance notice that they intend to use a customer’s CPNI, and give the customer an opportunity to disapprove of the use; under opt- in, carriers are prohibited from using a customer’s CPNI unless the customer expressly approves the use that the carrier requests the customer to approve in its notice. 118 Given that approval is required under section 222( c)( 1), and opt- out or opt- in are the only means of obtaining an expression of the customer’s preference, 114 U S WEST v. FCC, 182 F. 3d at 1238 (quoting Cincinnati v. Discovery Network, Inc., 507 U. S. 410, 417 (1993)). 115 AT& T Comments at 9- 10; BellSouth Comments at 7; CenturyTel Comments at 7; Nextel Comments at 6; NTCA at 3. 116 AT& T Comments at 10; BellSouth Comments at 14; CenturyTel Comments at 11. 117 AT& T Comments at 7; BellSouth Comments at 5; CenturyTel Comments at 11; Nextel Comments at 6; Qwest Comments at 7; SBC Comments at 8; WorldCom Reply Comments at 3. 118 AT& T Comments at 9; Nextel Comments at 6. 20 Federal Communications Commission FCC 02- 214 21 carriers assert that opt- out is obviously less burdensome than opt- in and sufficient to ascertain approval for a carrier’s marketing of communications- related services. 119 42. We note that the particular form of opt- out that we adopt here is narrowly tailored to ensuring that a customer be given an opportunity to approve (or disapprove) uses of CPNI by a carrier and its affiliates that provide communications- related services. Specifically, as noted above, opt- out has been criticized in other contexts, e. g., the financial services sector, because of the possibility that customers may not actually see, read, or understand opt- out notices, and therefore the customers may not be able to respond to a carrier’s request for approval in a timely and appropriate manner. Furthermore, circumstances may change over time that would cause a customer to want to reexamine any privacy election he or she has made with respect to CPNI. We respond to these specific problems with requirements that are designed to increase the effectiveness of opt- out without burdening more carrier speech than necessary. 43. We require a 30- day waiting period following notice before customer consent can be inferred to ensure that customers have adequate time to respond to a notice. We also require carriers to provide refresher notices to customers of their opt- out rights every two years in case circumstances have changed so as to warrant a change in customers’ privacy elections. These requirements are narrowly tailored because they address the known shortcomings of opt- out in a targeted manner in lieu of adopting a more restrictive approach such as opt- in. Furthermore, there is no indication in the record that these requirements impose any undue burden on carriers. Carriers have been following the 30- day waiting period on an interim basis and are generally supportive of it in their comments. 120 Refresher notices, which are only required once every two years, give carriers an opportunity to reconfigure their CPNI policies. 44. We thus conclude, after weighing the relevant considerations, that a more stringent opt- in mechanism is not necessary to protect the substantial governmental interest evinced by section 222. Rather, an opt- out regime for intra- company use of CPNI to market communications- related services directly and materially advances Congress’ interest in ensuring that customers’ personal information is not used in unexpected ways without their permission, while at the same time avoiding unnecessary and improper burdens on commercial speech, thus meeting Central Hudson’s narrow tailoring requirement. b. Joint Venture/ Agent Use 45. We find that the same factors we consider above weigh in favor of allowing carriers to share CPNI based on opt- out approval with their agents, and with independent contractors (such as telemarketers) and joint venture partners to market and provide communications- related services. We allow carriers to disclose CPNI to agents, and for the purpose of marketing communications- related services, to independent contractors and joint 119 See U S WEST v. FCC, 182 F. 3d at 1230 (noting that under opt- out, a customer’s approval is inferred from the customer- carrier relationship unless the customer specifically requests that his or her CPNI be restricted). 120 See AT& T Wireless Comments at 3; Nextel Comments at 8; SBC Comments at 14; Verizon Comments at 13; Verizon Wireless Comments at 6, n. 9; Verizon Feb. 20, 2002 Ex Parte Letter at 4. 21 Federal Communications Commission FCC 02- 214 22 venture partners, because under those circumstances, consumers are protected by the same or equivalent safeguards as those that exist when carriers use CPNI themselves. We also realize that carrier burdens could be significant for these types of uses under an opt- in scenario because opt- in could immediately impact the way carriers conduct business. 121 Thus, the rule we adopt today permits a carrier to share CPNI with a joint venture partner to provide information services typically provided by telecommunications carriers, such as Internet access or voice mail services. 122 Further, those joint venture services that may be provided using CPNI exclude retail consumer services provided using Internet websites (such as travel reservation services or mortgage lending services), whether or not such services may otherwise be considered to be information services. 123 46. In defining the entities that may use or receive CPNI based on opt- out approval, we extend this treatment to all agency relationships, and, where certain additional safeguards are met, to joint ventures and independent contractors as well. As we discuss in detail below, the regulations we adopt distinguish between CPNI uses that are governed by section 222 and our rules, and those that are not. We allow carriers to share CPNI with their agents because the principles of agency law hold carriers responsible for the acts of their agents. Carriers thus remain responsible for improper use or disclosure of consumers’ CPNI while in the hands of their agents. Accordingly, carriers have an incentive to maintain appropriate control of CPNI disclosed to agents. As described below, we also allow carriers to share CPNI with independent contractors and in joint venture arrangements (collectively, “non- agency relationships”) for communications- related services based on opt- out approval as long as the following protections are employed. 47. Joint Venture/ Contractor Safeguards. We require that carriers that allow access to or disclose CPNI to independent contractors or joint venture partners under an opt- out regime assure that certain safeguards are in place to protect consumers’ CPNI from further dissemination or uses beyond those consented to by the consumer. In particular, we require carriers, at a minimum, to enter into confidentiality agreements with independent contractors or joint venture partners that: (1) allow the independent contractor or joint venture partner to use the CPNI only for the purpose of marketing the communications- related services for which that CPNI has been provided; (2) disallow the independent contractor or joint venture partner from using, allowing access to, or disclosing the CPNI to any other party, unless required to make such disclosure under force of law; (3) require that the independent contractor or joint venture 121 Many carriers employ independent contractors such as telemarketers rather than their own employees. We are taking this factor into account in order to avoid undue burdens to the carriers based on having to change current commercial practices. We note that we are also putting sufficient safeguards in place to avoid any abuses. 122 We reach this conclusion based on our analysis of customer surveys that indicate that customers have a reasonable expectation that their telecommunications providers will market to them other services that those carriers provide. Moreover, there is no indication in the record that carriers have an interest in entering into joint ventures to market types of services other than those they traditionally provide. To the extent, in the future, record evidence demonstrates that there are other types of services that carriers may desire to market and provide to customers through joint venture partnerships, we will address those situations as the record presents itself. 123 See Appendix B, 47 C. F. R. § 64. 2003( f) (defining "information services typically provided by telecommunications carriers"). 22 Federal Communications Commission FCC 02- 214 23 partner have appropriate protections in place to ensure the ongoing confidentiality of consumers’ CPNI. 124 We urge carriers to limit independent contractors’ and joint venture partners’ ability to maintain CPNI after it has been used for its specific purpose, but do not so mandate at this time. In addition, we note that carriers are required to maintain a record of all such disclosures as part of their responsibilities under section 64.2009( c) of our rules. Of course, to the degree that carriers intend to make such use of CPNI, they must provide notice of that fact in accordance with our rules. 125 48. Central Hudson Analysis. Applying Central Hudson, we conclude that opt- out with the additional safeguards described in this section would directly and materially advance consumers’ substantial privacy interests where a carrier enters into a joint venture with an unrelated third party for the offering and/ or provision of a communications- related service. 126 Central Hudson’s narrow tailoring requires that we balance the costs and benefits of the burden on speech imposed by our privacy rules. Considering the “benefits” of the regulation we adopt, consumers generally anticipate that they will receive marketing of telecommunications services and products from their own carriers, and the safeguards we require will ensure that the limited dissemination under the joint venture (or independent contractor) arrangement – under the auspices of the carrier – will avert the privacy harms from unrestricted third party dissemination that we discuss below. Specifically, without confidentiality agreements with carriers collecting CPNI, independent contractors or joint venture partners would not have any incentive to restrict their use of CPNI, to refrain from further disclosure to third parties, or to guard against their own employees’ use or disclosure of a customer’s CPNI. These requirements place independent contractors and joint venture partners on a similar footing as the carriers themselves in terms of incentives, thus obviating the need for more stringent approval requirements such as opt- in. 49. Considering the “costs” to carriers of adopting opt- out with these safeguards, we note that the burdens to carriers’ speech would be much more substantial if they were required to treat disclosures to their independent contractors as a "third- party disclosure." Many carriers use telemarketers to conduct portions of their marketing business, and so long as adequate safeguards are in place, we believe that a narrowly tailored requirement should not dictate that these carriers change their existing business practices. Moreover, carriers urge us to adopt opt- out for these uses because of the lessened carrier burdens associated with an opt- out method of obtaining customer approval under section 222. 127 We do not expect that carriers will have to enter into 124 Regarding enforcement associated with these confidentiality agreements, we note that under section 403 of the Communications Act, the Commission has “full authority and power at any time to institute an inquiry, on its own motion, in any case and as to any matter or thing concerning which complaint is authorized to be made, to or before the Commission by any provision of [the] Act, or concerning which any question may arise under any of the provisions of [the] Act, or relating to the enforcement of any of the provisions of [the] Act.” 47 U. S. C. § 403. 125 “The notification must specify . . . the specific entities that will receive the CPNI, describe the purposes for which CPNI will be used. . . .” 47 C. F. R. § 64. 2007( 2)( ii). 126 Qwest Comments at 14- 16; Qwest May 14, 2002 Ex Parte Letter at 4 , App. C at 10 & n. 5 (noting that Qwest uses agents to conduct marketing “when it makes sound business sense to contract the function out”). 127 Id. 23 Federal Communications Commission FCC 02- 214 24 any contracts that they otherwise would not have to enter because joint venture agreements and contractor relationships routinely provide for confidentiality of sensitive business information. Carriers would simply be required to include treatment of CPNI when negotiating such confidentiality provisions. In conclusion, balancing of the interests and the harms in this context weighs in favor of an opt- out regime with suitable consumer safeguards. 2. Third Parties and Carriers’ Affiliates That Do Not Provide Communications- Related Services 50. Applying the Central Hudson test to methods for carriers to obtain customer approval under section 222( c)( 1) to disclose or allow access to CPNI to third parties, we conclude that: (1) the government has a substantial interest in ensuring that a customer give her knowing approval to disclosures of CPNI to third parties because such disclosures can have significant privacy consequences and be irreversible; (2) opt- in directly and materially advances this interest by mandating that carriers provide prior notice to customers and refrain from disclosing or allowing access to CPNI unless a customer gives her express consent by written, oral, or electronic means; and (3) opt- in is narrowly tailored because carriers have not asserted any intention of sharing CPNI with unaffiliated third parties, and thus the burden of requiring opt- in in this context is negligible and certainly warranted in light of consumers’ substantial privacy interest in protecting their CPNI from unapproved disclosure to third parties. 51. As discussed in the following paragraphs, the record unequivocally demonstrates that, in contrast to intra- company use and disclosure of CPNI, there is a more substantial privacy interest with respect to third- party disclosures. The record indicates not only that consumers’ wishes are different regarding third- party disclosure, but that the privacy consequences are more significant in the case of unintended disclosure to third parties. Once the personal information in CPNI is disclosed to such companies or individuals, the use of that information is no longer subject to the constraints of section 222, and further, these third parties have no incentive to honor the privacy expectations of customers with whom they have no relationship. On the other hand, any carrier speech burden from having to seek express consent for third- party disclosures appears to be negligible. Carriers say that they need to share with third parties for telemarketing and joint ventures, for which we adopt opt- out with certain protections. Beyond that, carriers say they do not share with third parties, making any burden on speech nil, or speculative at best. Therefore, with respect to customer approval of third- party disclosures, carriers have not established on our record that there is, or would be, any significant burden on their First Amendment commercial speech interest from opt- in to weigh against consumers’ substantial privacy interest in avoiding unapproved disclosures to third parties. There is also no demonstrated consumer benefit to be derived from third- party sharing that would impact our balancing analysis. Thus, we find that opt- in is narrowly tailored under Central Hudson because it burdens no more carrier speech than necessary to directly and materially advance the government’s interest in ensuring informed consent before a customer’s personal information is disclosed to third parties by its telecommunications carrier. 24 Federal Communications Commission FCC 02- 214 25 52. We also conclude that opt- in is necessary with respect to disclosures of CPNI to a carrier’s affiliates that provide no communications- related services. 128 In this context, opt- in consent directly and materially advances the government’s interest in ensuring that customers give their knowing approval to such uses of CPNI, while burdening no more carrier speech than necessary. a. Disclosure to Third Parties 53. Government’s Substantial Interest. The record in this proceeding shows that the government’s interest in protecting consumers from unexpected and unwanted disclosure of their personal information in CPNI is a significant one, and the potential privacy harm to consumers from disclosure to third parties significantly exceeds that presented by the intra- company uses described above. First, carrier surveys and comments vividly demonstrate that consumers view use of CPNI by a consumer’s carrier differently than disclosure to or use by a third party. In the Cincinnati Bell study described above, nearly half of consumers questioned said they would be "extremely concerned" by the release of CPNI for marketing purposes to companies other than their own telephone company. 129 The most recent Harris 2002 Survey shows that this figure is now even higher, and today 73 percent would bar disclosure to other companies. 130 54. Second, the record shows that unexpected and unwanted disclosure of private information to third parties also exposes telecommunications consumers to potentially more harm from subsequent disclosures. Specifically, if a consumer’s CPNI is disclosed to entities unaffected by section 222 and our rules, that entity can resell or use the CPNI in any lawful way without limitation. 131 Once CPNI enters the stream of commerce, consumers are without meaningful recourse to limit further access to, or disclosure of, that personal information. 132 Thus, the threat to telecommunications consumers’ privacy interest from having their personal information in CPNI disclosed to parties who are not subject to section 222 and the Commission’s rules – without their knowing approval – is a substantial one. As one example of the disposition of sensitive personal information without adequate constraints, the state Attorneys 128 See infra section III. A. 2. b. 129 Cincinnati Bell Study at 2; Qwest Reply Comments at 18, n. 58. 130 Letter from Kathryn Marie Krause, Qwest, to Marlene H. Dortch, Secretary, Federal Communications Commission, CC Docket Nos. 96- 115 and 96- 149 (filed July 2, 2002) (Qwest July 2, 2002 Ex Parte Letter) (confidential submission), attaching “Privacy On & Off the Internet: What Consumers Want,” conducted by Harris Interactive, at 44 (Feb. 7, 2002) (“ Harris 2002 Survey”); Letter from Kathryn Marie Krause, Qwest, to Marlene H. Dortch, Secretary, Federal Communications Commission, CC Docket Nos. 96- 115 and 96- 149 (filed May 14, 2002) App. D at 14 n. 28 (Qwest May 14, 2002 Ex Parte Letter). 131 Letter from Ken Reif, NASUCA, to William F. Caton, Acting Secretary, Federal Communications Commission, CC Docket Nos. 96- 115 and 96- 149 (filed April 12, 2002) at 8 (“ NASUCA April 12, 2002 Ex Parte Letter”) (“ The use to which CPNI can be put and the resulting harm to the consumer is limited only by the imagination of those with an interest in selling it to the highest bidder.”). 132 NASUCA Apr. 12, 2002 Ex Parte Letter at 7 (“ Once disclosed, private information cannot be gathered up and returned to the customer.”). 25 Federal Communications Commission FCC 02- 214 26 General recount the questionable behavior of U. S. Bank under another privacy statute, which caused 40 states and the District of Columbia to enter into a settlement resolving allegations that the bank misrepresented its practice of selling highly personal and confidential financial information regarding its customers to telemarketers. 133 55. Harm to the consumer is exacerbated by the fact that third party entities receiving CPNI have no existing business relationship with the consumer and, hence, no accountability to the consumer. 134 Thus, companies that are not constrained by section 222, and with which the customer has no ongoing business relationship, are motivated to use customers’ CPNI in the way that generates the most profits – which may include selling or providing access to personal information to the highest bidder. 135 Indeed, as data mining and personalization capabilities mature, the value of personal information increases, as do the carrier’s incentive and opportunity to sell CPNI and third parties’ incentive and opportunity to purchase it. By contrast, a carrier with whom a customer has an existing business relationship has an incentive not to misuse its customer’s CPNI or it will risk losing that customer’s business. 136 For these reasons, we conclude that the government’s interest in ensuring knowing customer approval before carriers can disclose customers’ CPNI to third parties is a substantial one. 56. Direct and Material Advancement. We have noted the substantial government interest in protecting consumers’ privacy choices in the preceding paragraphs. Specifically, consumers say that their privacy interest is substantially greater when asked about releasing information to third parties or for uses beyond their expectations based on the existing relationship with their chosen carrier. 137 Furthermore, once such information leaves the hands of the customer’s carrier, the customer loses her ability to limit further dissemination, and section 222 and the Commission’s rules concerning use of CPNI are not applicable to those unknown third parties that receive the customer’s personal information. 138 For these reasons, there is a greater need to ensure express consent from an approval mechanism for third party disclosure. Opt- in directly and materially advances this interest by mandating that carriers provide prior 133 NAAG Dec. 21, 2001 Ex Parte Letter at 5. 134 Cf. CenturyTel Comments at 5 (“ CenturyTel notes that, in using, accessing and disseminating CPNI, carriers do not use or disseminate sensitive or personal information that would inflict specific or significant harm on their customers.”). 135 NAAG Dec. 21, 2001 Ex Parte Letter at 5 (“ The type of information that telemarketers and joint marketing partners would find useful, and therefore, be willing to pay for, is limitless.”). 136 AT& T Comments at 7. 137 Harris 2002 Survey at 44; Cincinnati Bell Study at 2. 138 Compare the CPNI statute to Gramm- Leach- Bliley, which specifically limits third parties’ ability to further use and disseminate consumers’ personal information: “Except as otherwise provided in this subtitle, a nonaffiliated third party that receives from a financial institution nonpublic personal information under this section shall not, directly or through an affiliate of such receiving third party, disclose such information to any other person that is a nonaffiliated third party of both the financial institution and such receiving third party, unless such disclosure would be lawful if made directly to such other person by the financial institution.” 15 U. S. C. § 6802( c). 26 Federal Communications Commission FCC 02- 214 27 notice to customers and refrain from disclosing CPNI unless a customer gives her express consent by written, oral, or electronic means. Thus, we require opt- in approval because it directly and materially advances the government’s interest in ensuring that customers give their knowing consent to use or sharing of CPNI that can have irreversible consequences for consumers’ privacy. 57. Narrow Tailoring. Under the narrow tailoring prong of Central Hudson, as noted above, we consider the “careful calculation” of costs and benefits associated with the burden on speech. 139 Considering the burden on carriers’ speech, i. e., the “costs” of an opt- in customer approval regime for disclosures of CPNI to third parties, we recognize that opt- in is more restrictive on carriers’ speech than opt- out because carriers wishing to engage in third- party disclosures other than to telemarketers and joint venture partners for communications- related services must secure express customer approval by written, electronic, or oral means. However, as described below, carriers themselves recognize the qualitative difference between third- party disclosure and disclosure to their own affiliates, and they do not assert any meaningful burden from having to seek opt- in approval for intended disclosures to third parties. In fact, carriers say they do not share CPNI with third parties. 58. In contrast to intra- company and joint venture uses, carriers generally have not asserted any commercial speech interest in (or consumer benefit from) sharing CPNI with third parties. We also know of no carrier that currently secures opt- out approval for third- party disclosure. Indeed, most carriers suggest that it would not be appropriate to disclose CPNI to unrelated third parties for independent use without express customer approval. 140 Therefore, most carriers that have spoken to this question affirmatively support an opt- in regime for third-party disclosures. 59. Even Qwest, which previously indicated it would challenge an opt- in requirement for third- party disclosure, 141 expressly acknowledges that there is a much greater customer 139 U S WEST v. FCC, 182 F. 3d at 1238 (quoting Cincinnati v. Discovery Network, Inc., 507 U. S. 410, 417 (1993)). 140 USTA Comments at 11 (“ Carriers have not disputed that a customer’s CPNI may not be shared with a third party without the customer’s consent.”); Letter from Richard T. Ellis, Verizon, to William F. Caton, Acting Secretary, Federal Communications Commission, CC Docket Nos. 96- 115 and 96- 149 (filed Feb. 20, 2002 (Verizon Feb. 20, 2002 Ex Parte Letter) (asserting that fears of carrier joint marketing with providers of medical products and telemarketing retailers “have no basis in fact and would be beyond scope of opt- out rule” and that “most recent publicity has centered around disclosure to non- affiliates, which requires prior written consent”); Letter from Michael B. Fingerhut, Sprint, to William F. Caton, Acting Secretary, Federal Communications Commission, CC Docket No. 96- 115 (filed Apr. 11, 2002) (Sprint Apr. 11, 2002 Ex Parte Letter) (third party disclosure requires express consent and opt- in). Some carriers speak about opt- out only in the context of disclosures within “the carrier’s corporate family” or to provide only telecommunications services. BellSouth Comments at 4; AT& T Wireless Comments at 2 (“ AWS supports the use of an ‘opt- out’ mechanism for obtaining customer approval before using CPNI to provide telecommunications services other than those from which the CPNI is derived.”). But see WorldCom Comments at 7- 8 (“ There is no statutory basis for the claim that the sharing of CPNI with a third party requires a higher form of consent . . . . [T] here is no evidence that such disclosure constitutes an invasion of privacy. . . .”). 141 Qwest Comments at 14- 16. 27 Federal Communications Commission FCC 02- 214 28 privacy interest in avoiding third- party disclosures than in limiting carrier uses of CPNI. Qwest now only asserts a right to use telemarketers or to engage in joint marketing with “appropriate [but undefined] protections for the confidentiality of the information.” 142 Qwest indicates that it has imposed voluntary internal constraints on CPNI disclosure “for years, operating in a fashion that protects the confidentiality of information about its customers and refusing to provide CPNI to unaffiliated parties for their own marketing uses.” 143 Thus, outside the carriers’ interest in disclosing CPNI to telemarketing agents and joint venture partners (for which we allow opt- out), carriers have not demonstrated that opt- in imposes any burden on speech that carriers need or even wish to undertake. 60. The significant benefits of opt- in approval for third party dissemination are discussed above, and we have already concluded that such approval directly and materially advances the government interest in protecting consumer privacy. We also note that opt- in, as we define the requirement, 144 is not the most restrictive approach the Commission could adopt. Requiring express prior written approval, such as a letter of authorization, would be the most restrictive means of obtaining customer approval. 61. We reject some commenters’ arguments that section 222( c)( 2) 145 requires express written authorization by a customer before a carrier may disclose CPNI to a third party. 146 We reiterate our prior conclusion that section 222( c)( 2) applies only to customer- initiated requests and does not circumscribe the form of “approval” that a carrier may secure from its customer under section 222( c)( 1) for use and disclosure of CPNI. 147 But we do find these commenters’ positions probative of (i) the absence of any burden on actual commercial speech from constraints on third party disclosure, and (ii) the greater consumer privacy interest in preventing unwanted third party disclosures. 142 See Qwest May 14, 2002 Ex Parte Letter, App. C (filing with Arizona Corporation Commission dated March 29, 2002). Notably, Qwest appears to have changed its position after consumer complaints about its CPNI disclosure policies (particularly its vague notices), resulting in investigations by various state Attorneys General and state commissions. Although initially indicating that it opposed opt- in even for third party disclosures, its recent ex parte submissions indicate its acceptance of some constraints on third- party disclosure. 143 Id. (page 10, answer (i)). 144 See Appendix B, § 64. 2003( h). 145 Section 222( c)( 2) states that “[ a] telecommunications carrier shall disclose customer proprietary network information, upon affirmative written request by the customer, to any person designated by the customer.” 47 U. S. C. § 222( c)( 2). 146 Verizon Reply Comments at 4; Nextel Comments at 12 ( . . . "section 222( c)( 2) [requires] that the customer submit an affirmative written request to the BOC or its affiliate before such information may be disclosed to their competitors.”); see also Verizon Feb. 20, 2002 Ex Parte Letter, attached presentation at 1 (stating that carrier joint marketing with providers of medical products and telemarketing retailers “have no basis in fact and would be beyond scope of opt- out rule” and “most recent publicity has centered around disclosure to non- affiliates, which requires prior written consent”). 147 CPNI Order, 13 FCC Rcd at 8125- 26, para. 84. 28 Federal Communications Commission FCC 02- 214 29 62. We have also examined opt- out as an alternative, and find that it would not be an effective means of protecting consumers from the far more substantial harms that are attendant upon unknowing and unwanted third- party disclosures. Some commenters recognize the possibility that customers may not see, read or understand notices informing them of third- party sharing. But, in contrast to intra- company sharing, there is no ongoing customer relationship or Commission enforcement authority over third- party recipients that would mitigate the harms from unwanted or inadvertent third- party disclosures that are possible with opt- out. This is a particular concern given empirical evidence that the method of approval significantly impacts the level of disclosure of personal information. Testimony submitted to the Federal Trade Commission (FTC) shows that opt- out results in disclosure rates of 95 percent, 148 but when the default is opt- in, 85 percent of consumers would choose not to provide their data. 149 In contrast, an opt- in approval offers greater protection for consumers’ privacy. In an opt- in regime, carriers have incentives to ensure that consumers are aware of CPNI notices, that such notices are comprehensible, that the methods for consumers to opt- in are not burdensome, and that consumers are given incentives to opt- in. 150 Opt- out regimes tend to reverse these incentives. 63. Accordingly, we conclude that opt- in for third party disclosures satisfies the narrow tailoring prong of Central Hudson because it does not impose any substantially greater burden on speech than is necessary to achieve the government’s interest. We note that our decision to establish an opt- in requirement is consistent with and draws support from the recent decision of the United States Court of Appeals for the District of Columbia Circuit in Trans Union v. FTC. 151 In this case, the court upheld the FTC’s application of an opt- in mechanism to obtain consumers’ approval for the use of private information in credit reports for target marketing. In so doing, the court held that an individual’s privacy interests in personal information “are defined not only by the content of the information, but also by the identity of the audience and the use to which the information may be put.” 152 Our analysis recognizes that the harms to customer privacy and the speech interests of the carriers are different in the context of third- party disclosure. Central Hudson requires that we recognize these differences, and we do so. While the means employed to protect the greater consumer privacy interest with respect to third- party disclosure of CPNI is more stringent, as discussed above, it reflects a narrowly 148 See Progress & Freedom Foundation Reply Comments at 5; Qwest May 14, 2002 Ex Parte Letter, App. C (filing with Arizona Corporation Commission dated March 29, 2002). 149 Progress & Freedom Foundation Reply Comments at 5. 150 EPIC et al. Reply Comments at 5 (“ Opt- out regimes create an economic incentive for businesses to make it difficult for consumers to exercise their preference not to disclose personal information to others.”). 151 Trans Union Corp. v. Federal Trade Comm’n., 267 F. 3d 1138, 1143 (D. C. Cir. 2000), petition for cert. pending (finding that requirement of customer opt- in approval before a credit reporting agency could use collected credit information for target marketing satisfied intermediate First Amendment scrutiny because selection of only “marginally” less restrictive alternative – opt- out – was not required under Central Hudson test). 152 Id. 29 Federal Communications Commission FCC 02- 214 30 tailored fit and "proper balancing of the benefits and harms of privacy,” 153 which Central Hudson requires of any privacy regulations that impact a carrier’s commercial speech interests. b. Disclosure to Affiliates that Provide no Communications-Related Services 64. We find that the same factors we consider above weigh in favor of requiring opt-in before a carrier may share CPNI with its affiliates that do not provide communications- related services. We find that CPNI dissemination to such affiliates is far more similar to third party dissemination than to the sharing of CPNI with affiliates that provide communications- related services, and thus warrants a similar level of protection as that required for third party disclosure. 65. Central Hudson Analysis. Applying Central Hudson, we find that opt- in in this context directly and materially advances the government’s interest, which is to ensure that customers give their knowing approval to disclosure of CPNI for purposes unrelated to obtaining communications- related services from their carrier (or its affiliates and partners). As noted, disclosure to affiliates that offer no communications- related services is strikingly similar to disclosures to unrelated parties, and the record has shown that the privacy interests in such types of disclosures – which are far more substantial than for disclosures to carriers for communications- related purposes 154 – will be protected to a greater extent by the express consent under opt- in approval, which best prevents against inadvertent disclosures. 155 66. Balancing the costs and benefits of opt- in for this type of disclosure under Central Hudson, we conclude that requiring opt- in approval before sharing CPNI with affiliates that do not provide communications- related services is narrowly tailored to protect consumers’ privacy interests. Considering consumers’ privacy interests, the empirical evidence cited above for customer expectations holds equally true for entities that, while technically affiliated with a telephone company, do not provide communications- related services. In various studies, consumers have stated that they do not want their CPNI released to anyone outside their telephone company. 156 There is no evidence in the record to suggest that customers expect or want marketing from an affiliate that does not offer communications- related services and may not even have a similar name as their telephone company. As we noted above, carriers have an incentive not to misuse CPNI, as otherwise they risk losing the customer. This incentive diminishes or disappears entirely, however, if the solicitation is not identifiable as coming from the carrier or within its corporate family. 67. Application of opt- in in this context significantly advances the consumer interest at the heart of section 222. If, despite the advocacy in this proceeding, a carrier were to share CPNI with an affiliate that did not provide communications- related services, such use would fall 153 U S WEST v. FCC, 182 F. 3d at 1235. 154 See paras. 53- 55. 155 See paras. 57- 63. 156 Harris 2002 Survey at 44; Cincinnati Bell Study at 2; Qwest Reply Comments at 18, n. 58. 30 Federal Communications Commission FCC 02- 214 31 outside the consumer’s reasonable expectation that CPNI would only be used by the telephone company for solicitation of communications- related services. 157 Moreover, misuse by such affiliates is less likely to result in the loss of the customer, so the affiliate would not have the same mitigating incentive to guard against misuse of CPNI as the carrier would when conducting its own solicitation. Thus, the analysis for affiliates that do not provide communications- related services parallels our reasoning regarding disclosure to third parties, who have no immediate carrier- customer relationship to maintain and consequently no incentive to use CPNI in accordance with a customer’s expectations. 68. Considering the burdens on carriers’ speech from having to obtain a customer’s express consent, we observe that while some commenters discuss intra- company sharing in general terms, others acknowledge that they are advocating opt- out approval only for affiliates that provide communications services. 158 Therefore, the record demonstrates that the actual burden on carriers’ speech is low, as the only burden demonstrated on the record would be a carrier’s inability to market communications- related services in conjunction with an affiliate. Thus, on this record, our balance of privacy interests and carrier speech burdens persuades us that opt- in is a proportionate and narrowly tailored means to protect the governmental interest. 3. State Choice 69. In this Order, we reconfirm our decision to exercise preemption authority on a case- by- case basis. 159 As the Commission found in the CPNI Order, the Commission may preempt state regulation of intrastate telecommunications matters “where such regulation would negate the Commission’s exercise of its lawful authority because regulation of the interstate aspects of the matter cannot be severed from regulation of the intrastate aspects.” 160 Because no specific state regulations are before us, we do not at this time exercise our preemption authority. We will examine any potentially conflicting state rules brought before us on a case- by- case basis. 161 70. We differ from our earlier approach in one respect. Should states adopt CPNI requirements that are more restrictive than those adopted by the Commission, we decline to apply any presumption that such requirements would be vulnerable to preemption. We recognize 157 Id. 158 See, e. g., AT& T Wireless Comments at 2 (“ AWS supports the use of an ‘opt- out’ mechanism for obtaining customer approval before using CPNI to provide telecommunications services other than those from which the CPNI is derived.”); Sprint Comments at 5 (“[ T] he fact that carriers have . . . flexibility [to devise methods to meet section 222 obligations] does not mean that they are violating Section 222 and using their customers’ CPNI to market the products and services offered by their affiliates or sharing their customers’ CPNI with such affiliates without first informing their customers of their CPNI rights and gaining their customers’ approval for such use.”) 159 CPNI Order at 8077- 78, para. 18; CPNI Reconsideration Order at 14466- 67, para. 113. 160 CPNI Order at 8075- 76, para. 16. 161 We disagree with those commenters who urge us to preempt state regulations. Qwest May 30, 2002 Ex Parte Letter; Verizon Feb. 20, 2002 Ex Parte Letter, Attach. at 4. 31 Federal Communications Commission FCC 02- 214 32 this approach differs from our approach in earlier CPNI orders, 162 but the change is necessary as a result of the change in approach we adopt in this Order. Prior to the Tenth Circuit’s opinion, our analysis did not incorporate First Amendment concerns, and, by requiring opt- in for all customer approval under section 222( c)( 1), established a relatively more burdensome means of ascertaining customer approval for the use of CPNI. As a practical matter, the only more restrictive approach that could be adopted, as noted above, would be express written approval. In this Order, as required by the Tenth Circuit, we have conducted a Central Hudson analysis of the burden of different approval mechanisms on protected speech, balancing carrier and customer rights to commercial speech with consumers’ rights to privacy in their CPNI. 71. We conclude that carriers can use opt- out for their own marketing of communications- related services, as described above, which is less burdensome than opt- in. We reach this conclusion based on the record before us, but must acknowledge that states may develop different records should they choose to examine the use of CPNI for intrastate services. 163 They may find further evidence of harm, or less evidence of burden on protected speech interests. Accordingly, applying the same standard, they may nevertheless find that more stringent approval requirements survive constitutional scrutiny, and thus adopt requirements that “go beyond those adopted by the Commission.” 164 While the Commission might still decide that such requirements could be preempted, it would not be appropriate for us to apply an automatic presumption that they will be preempted. We do not take lightly the potential impact that varying state regulations could have on carriers’ ability to operate on a multi- state or nationwide basis. Nevertheless, our state counterparts do bring particular expertise to the table regarding competitive conditions and consumer protection issues in their jurisdictions, and privacy regulation, as part of general consumer protection, is not a uniquely federal matter. 165 We 162 Previously, the Commission has noted that state rules “vulnerable to preemption are those that (1) permit greater carrier use of CPNI than section 222 and the Commission’s rules allow, or (2) seek to impose additional limitations on carriers’ use of CPNI.” CPNI Reconsideration Order at 14465- 66, para. 112. See also CPNI Order at 8077- 78, para. 18. 163 For example, we note that Arizona is currently examining whether to require carriers to provide verification to customers regarding customers’ CPNI elections. See Arizona Corporation Commission Docket No. RT- 00000J- 02-0066, Order, Decision No. 64375 (Jan. 28, 2002); Arizona Corporation Commission Staff Memorandum, Docket No. RT- 00000J- 02- 0066 (Feb. 15, 2002). We note that states may conduct their own examination of such alternatives and determine, based on the record developed in those proceedings, whether such additional safeguards are warranted. 164 NASUCA Apr. 12, 2002 Ex Parte Letter at 8. See also Arizona Corporation Commission Jan. 28, 2002 Ex Parte Letter at 2.; Letter from Jay Stovall, to William Caton, Acting Secretary, Federal Communications Commission, CC Docket Nos. 96- 115 and 96- 149 (filed Feb. 21, 2002) (Montana PSC Feb. 12, 2002 Ex Parte Letter) at 2; Texas Office of Public Utility Counsel April 16, 2002 Ex Parte Letter at 4. We also note in this respect that state commissions are charged with implementing differing state laws, regulations and constitutions. See, e. g., Arizona Corporation Commission Jan. 28, 2002 Ex Parte Letter discussing Arizona’s state constitutional right to privacy. See also California Public Utilities Commission Comments at 6 (noting that California amended its Constitution to make privacy an inalienable right). 165 In dealing with issues that have serious implications for consumers’ day- to- day use of their telecommunications services, such as the protection of their personal information, we look upon the states as partners whose experience and unique perspective informs our own. See, e. g., In the Matter of Truth- in- Billing and Billing Format, First Report and Order and Further Notice of Proposed Rulemaking 14 FCC Rcd 7492, 7507- 08, para. 26 (1999) (“ We (continued….) 32 Federal Communications Commission FCC 02- 214 33 decline, therefore, to apply any presumption that we will necessarily preempt more restrictive requirements. 72. Indeed, this approach is consistent with that taken in other Commission proceedings issued subsequent to the previous CPNI orders. In the UNE Remand Order, the Commission found that state commissions had the authority to impose additional unbundling obligations upon incumbent LECs, beyond those established by the Commission, as long as the state’s additional obligations meet the requirements of section 251 and the Commission’s analytical framework. 166 Section 251( d)( 3) specifically allows state commission to establish access and interconnection obligations that are “consistent with the requirements” of section 251. 167 The Commission found that additional obligations imposed by the states are not necessarily inconsistent with the statute and the Commission’s rules. Like our determination today that our CPNI rules establish the minimum requirements for carriers, the Commission in the UNE Remand Order also found that states could not remove unbundled network elements from the Commission’s list. 168 73. In addition, in the slamming context, the Commission acknowledged that while “it may be simpler for carriers to comply with one set of verification rules, [the Commission would not] interfere with the states' ability to adopt more stringent regulations.” 169 As the Commission stated in the Slamming Order, “the Commission must work hand- in- hand with the states towards the common goal of eliminating slamming. States have valuable insight into the slamming problems experienced by consumers in their respective locales and can share their expertise with this Commission.” 170 Furthermore, our rules implementing truth- in- billing requirements for all common carriers state that “the requirements [. . .] are not intended to preempt the adoption or enforcement of consistent truth- in- billing requirements by the states.” 171 (Continued from previous page) look upon this [. . .] as another phase of our partnership with the states to promote competition and to combat telecommunications- related fraud. Through information sharing and dialogue, we intend to work together with the states towards the common objective of truth- in- billing.”). 166 UNE Remand Order, 15 FCC Rcd 3696, 3767, para. 154 (1999), USTA v. FCC, 290 F. 3d 415 (D. C. Cir. 2002). 167 47 U. S. C. § 251( d)( 3). 168 UNE Remand Order, 15 FCC Rcd at 3767, para. 154. 169 Implementation of the Subscriber Carrier Selection Changes Provisions of the Telecommunications Act of 1996 and Policies and Rules Concerning Unauthorized Changes of Consumers’ Long Distance Carriers, CC Docket No. 94- 129, Third Report and Order and Second Order on Reconsideration, 15 FCC Rcd 15996, 16036, para. 87 (rel. Aug. 15, 2000) (Slamming Third Report and Order); Implementation of the Subscriber Carrier Selection Changes Provisions of the Telecommunications Act of 1996 and Policies and Rules Concerning Unauthorized Changes of Consumers’ Long Distance Carriers, CC Docket No. 94- 129, Erratum, DA 00- 2192 (rel. Oct. 4, 2000); Implementation of the Subscriber Carrier Selection Changes Provisions of the Telecommunications Act of 1996 and Policies and Rules Concerning Unauthorized Changes of Consumers’ Long Distance Carriers, CC Docket No. 94- 129, Errata, DA 00- 2163 (rel. Sept. 25, 2000). 170 Slamming Third Report and Order, 15 FCC Rcd at 16036, para. 87. 171 47 C. F. R. § 64. 2400( c). See also Truth- in Billing Order. 33 Federal Communications Commission FCC 02- 214 34 74. We note that we would be willing to preempt state requirements in the event that numerous different approval schemes make it impracticable for carriers to obtain customer approval for the use of CPNI. Carriers can always establish that burdens from state and federal CPNI regulation are unworkable. By reviewing requests for preemption on a case- by- case basis, we will be able to make preemption decisions based on the factual circumstances as they exist at the time and on a full and a complete record. B. Other Approval Issues 75. In the foregoing section of the Order we adopt today, we address the core of the Tenth Circuit’s order by establishing narrowly tailored means of advancing the privacy interests Congress sought to protect under section 222 and, in doing so, recognize that harms to both privacy and commercial speech interests may differ depending on how a carrier might choose to use CPNI. Commenters have also raised a variety of other issues by petition and in response to the CPNI Clarification Order, some related to and some independent from consideration of whatever mechanism we might adopt to determine whether customers have granted “approval” under section 222( c)( 1). Thus, while the above approval mechanism is directly responsive to the Tenth Circuit, we resolve these other issues as set forth below to provide the greatest degree of certainty in the industry regarding handling of CPNI. 76. As an initial matter, we confirm our previous determinations that the Tenth Circuit only vacated the portion of our original CPNI Order relating to the opt- in mechanism for determining customer approval under section 222( c)( 1). Unless otherwise specifically changed by this Order, the rules and mechanisms we have otherwise adopted to implement section 222 remain in place. Accordingly, we reaffirm our total service approach, 172 which was originally designed to define the limits of what a carrier could do with CPNI without first obtaining the customer’s “approval.” We also clarify the extent to which we elect to grandfather approvals already obtained under our interim rules. Additionally, we decline to establish rules that would allow customers to restrict carriers from using CPNI regardless of whether such use might otherwise be allowed under the statute, although we certainly encourage carriers to continue to honor customers’ requests in this respect. 77. While we also reaffirm many of our existing rules with regard to the form and content of opt- in or opt- out notices, we provide further clarification in Section III. C with regard to the form, content, and frequency of such notices. As part of this clarification, we explain that carriers using opt- out notices will be subject to specific requirements designed to ensure that such notice allows a customer to comprehend and effectively exercise his or her approval rights, while carriers using opt- in notices will be subject to relatively fewer specific requirements. In particular, we adopt as permanent the interim requirement that carriers using opt- out must allow a minimum period of thirty days from receipt of notice to assume a customer’s implicit approval to use CPNI. 172 See Section III. B. 2, infra. 34 Federal Communications Commission FCC 02- 214 35 78. After addressing issues related to how customers receive notice of their ability to elect approval, we address several final issues relating to the application of section 222 in Section III. D of this Order. First, we forbear from applying CPNI affirmative approval requirements to the use of preferred carrier freeze information, even though such information is appropriately considered CPNI, as we find such forbearance to be required under section 10 of the Act. Second, we decline to modify our CPNI rules to address several issues raised by MCI WorldCom that are related to the use of CPNI by competitive local exchange carriers. Third, we reaffirm our conclusion that the term “information” in section 272( c)( 1) does not include CPNI as defined under section 222, and we explicitly hold that this conclusion is not impacted by the opt- in/ opt- out mechanism we adopt today. 1. The Tenth Circuit’s Order Vacated Only Those CPNI Rules Related to Opt- In 79. We affirm our previous determinations that the “Tenth Circuit vacated only the specific portion of our CPNI rules relating to the opt- in mechanism.” 173 As the Commission noted in seeking comment in the Clarification Order Further NRPM, the Tenth Circuit’s order was subject to interpretation as to whether it vacated the entirety of the CPNI rules or just those related to the opt- in requirement. 174 However, as we have twice previously held, substantial portions of the Commission’s CPNI rules were not relevant to the issue before the court and were beyond the scope of the court’s constitutional analysis. 175 80. In AT& T v. New York Telephone, d/ b/ a Bell Atlantic – New York 176 and in the CPNI Clarification Order, the Commission determined that the court’s opinion in U S WEST v. 173 CPNI Clarification Order, 16 FCC Rcd at 16512, para. 13. 174 CPNI Clarification Order, 16 FCC Rcd at 16512, para. 13. See also USTA Comments at 16 (“[ t] he fact that the Tenth Circuit ‘vacated’ the CPNI Order raises a question as to which of the Commission’s rules, if any, survived the Tenth Circuit’s ruling”); ALLTEL Comments at 3 (“ ALLTEL believes that there remain serious questions as to the extent of the Court’s order and its effect ultimately on the vitality of the Commission’s CPNI rules in their entirety.”); NTCA Comments at 2 (“[ i] n reaching a conclusion, the Commission must consider the Tenth Circuit’s opinion that vacated at least a portion of the Commission’s CPNI rules”). 175 To the degree that such action is necessary, we grant USTA’s request that we “remove any uncertainty as to all matters previously addressed in [the] CPNI Order and Order on Reconsideration” (USTA Comments at 16) and formally readopt all previously adopted CPNI rules not related to opt- in or otherwise amended in this Order. See also Verizon Wireless Reply Comments at 7 (“ If the Commission determines that it must take further action to maintain these other aspects of its CPNI policy, it should re- adopt the rules and policies contained in the [CPNI Reconsideration Order] in the instant rulemaking proceeding.”). To allay any concerns regarding the status of our rules unrelated to opt- in after U S WEST v. FCC, we herein formally readopt the relevant reasoning and rules adopted in the CPNI Order and CPNI Reconsideration Order. To the degree that rules or reasoning related directly to the opt- in provisions of our previous orders, this Order will supplement any such reasoning. 176 AT& T Corp., v. New York Telephone Company, d/ b/ a Bell Atlantic – New York, 15 FCC Rcd 19997, 20004, para. 17 (2000) (AT& T v. Bell Atlantic Order) (concluding in the context of a formal complaint regarding certain CPNI issues, that “when read in context, the [Tenth Circuit’s] vacatur order related only to the discrete portions of the order and rules that were before the court in light of the parties’ petitions for review and were addressed by the court.”). 35 Federal Communications Commission FCC 02- 214 36 FCC analyzed only the constitutionality of the Commission’s establishment of the opt- in regime as its interpretation of the customer approval requirement of section 222( c)( 1). The Commission determined that the court’s vacatur order applied only to the discrete portions of the CPNI Order and rules requiring opt- in customer approval, which were the specific issues before the court. 177 The Commission concluded that the remainder of the CPNI rules remain in effect. 81. As we found in our previous orders, we find no compelling evidence to convince us that the court intended to “take the unusual step of vacating portions of the order and rules not before it” 178 without so stating explicitly, despite the fact that the court’s mandate is worded quite broadly. 179 A number of commenters in the instant proceeding support the Commission’s determination, agreeing that “the [Tenth] Circuit vacated the portion of the CPNI order and regulations relating to customer opt- in as a violation of the First Amendment.” 180 A few commenters argue that our previous determinations were erroneous and that U S WEST v. FCC did, in fact, vacate all of the Commission’s CPNI rules. 181 However, beyond pointing to the broad language of the court’s mandate, which exceeds the scope of the question presented to the court, these commenters present no new compelling argument that we have not already considered, and thus fail to convince us that the court intended to take the unusual step of vacating rules not before it. 82. We also reject arguments that simply by seeking comment on our notice rules, we have somehow undermined our holding. 182 We sought further comment in the CPNI Clarification Order without assuming any specific outcome, and effective administration requires us to periodically review regulatory requirements to ensure that they remain valid in 177 CPNI Clarification Order, 16 FCC Rcd at 16510, para. 7. 178 Id. 179 “Accordingly, we VACATE the FCC’s CPNI Order and the regulations adopted therein.” U S WEST, 182 F. 3d at 1240. 180 EPIC et al. Comments at 2. See also, NAAG Dec. 21, 2001 Ex Parte Letter at 3 (The Tenth Circuit “vacated the portion of the Commission’s CPNI order and regulations that required customer opt- in before carriers could use the information outside of one of the statutory exceptions.”); OPASTCO Comments at 3 (“ Specifically, the Court vacated the Commission’s ‘notice and opt- in’ requirement before a carrier may use CPNI to market services outside the customer’s existing service relationship with that carrier.”) (citation omitted); Direct Marketing Association Comments at 2, n. 1 (“ The court’s decision, however, makes plain that any of the subparts of the rule that entail opt-in are invalid.”). See also AT& T Wireless Comments at 3, n. 5; California Public Utilities Commission Comments at 3; National Association of Regulatory Utility Commissioners Comments at 1; Letter from Pam Whittington, Public Utility Commission of Texas, to William Caton, Acting Secretary, Federal Communications Commission, CC Docket Nos. 96- 115 and 96- 149 (filed March 1, 2002) (Texas PUC March 1, 2002 Ex Parte Letter) at 1. 181 See CTIA Comments at 2- 6 (“ However, the court did not simply vacate the specific opt- in method of customer approval, it vacated the entire section 64. 2007 rulemaking as constitutionally inadequate, failing all three prongs of Central Hudson.”); AT& T Reply Comments at 11 (“ The Tenth Circuit expressly vacated the entire order, including the discussion of section 272.”). See also ASCENT Comments at 8. 182 CTIA Comments at 4. 36 Federal Communications Commission FCC 02- 214 37 light of experience and changed circumstances over time. 183 In any event, the CPNI Clarification Order posed questions that were broader than the court’s vacatur, and thus interested parties were provided notice of our intention to consider aspects of our rules beyond those impacted by U S WEST. The rules we adopt in this Order are consistent with the scope of the issues presented in the CPNI Clarification Order. 2. Total Service Approach 83. We affirm the continued use of the total service approach to define what carriers may do under section 222( c)( 1) without notice to customers. 184 Based on the language of section 222( c)( 1), Congress intended that a carrier could use CPNI without customer approval, but could only do so depending on the service( s) to which the customer subscribes. 185 The total service approach defines the parameters of those services and thus defines what carriers may do without the approval of the customer. 84. In reaching our conclusion, we note that every commenter that addressed this issue save one 186 supports retaining the total service approach, 187 largely because the original justification for its adoption remains valid even if an opt- out system is applied to some uses of CPNI. Accordingly, today, as when we originally adopted it, the total service approach is a reasonable implementation of section 222( c)( 1) and remains reasonable regardless of the mechanism we adopt in this Order to provide for customer approval of other uses of CPNI. We also note that no better alternative has been proposed. The sole commenter to question the 183 See, e. g., Review of Section 251 Unbundling Obligations of Incumbent Local Exchange Carriers; Implementation of the Local Competition Provisions of the Telecommunications Act of 1996; Deployment of Wireline Services Offering Advanced Telecommunications Capability, Notice of Proposed Rulemaking, 16 FCC Rcd 22781, 22782 (2001) (Triennial Review) at para. 1 (“ We seek to ensure that our regulatory framework remains current and faithful to the pro- competitive, market- opening provisions of the 1996 Act in light of our experience over the last two years, advances in technology, and other developments in the markets for telecommunications services.”). 184 Section 222( c)( 1) provides that, except with the approval of the customer, a telecommunications carrier that receives or obtains CPNI by virtue of its “provision of a telecommunications service shall only use, disclose, or permit access to individually identifiable [CPNI] in the provision of (A) the telecommunications service from which such information is derived, or (B) services necessary to, or used in, the provision of such telecommunications service, including the publication of directories.” 185 CPNI Order, 13 FCC Rcd at 8080, 8083- 84, 8087- 88, paras. 23- 24, 30, 35. See also CPNI Reconsideration Order, 14 FCC Rcd at 14421, para. 17. 186 See CenturyTel Comments at 11- 12. 187 Nextel Comments at 7, n. 18 (“ Adoption of a notice and opt- out approach does not require any modification to the Commission’s total service approach, because the notice and opt- out framework in no way should affect the efficiency benefits to customers from the total service approach.”); Verizon Wireless Comments at 15 (“[ t] he Commission’s [total service approach] policy should be unaffected by adoption of a notice and opt- out mechanism … the [total service approach] was premised on the finding that customers fully expect a carrier to use CPNI to market services to them that are within the bounds of the existing carrier- customer relationship.”). See also AT& T Comments at 11; AT& T Wireless Comments at 9- 11; Cingular Wireless Comments at 7- 8; Verizon Comments at 12. 37 Federal Communications Commission FCC 02- 214 38 approach, CenturyTel, basically requests that we abandon the total service approach and instead adopt the “single category approach.” 188 The single category approach was considered and rejected in the CPNI Order and again rejected in the CPNI Reconsideration Order. 189 We again decline to adopt such an approach because that would vitiate the total service approach and attendant protection of customers’ personal information. As the Commission has stated, “[ t] he hallmark of the total service approach is that the customer, whose privacy is at issue, establishes the bounds of his or her relationship with the carrier.” 190 CenturyTel has provided no new evidence to convince us to reconsider the total service approach and the benefits and protections it affords to consumers and carriers alike. Finally, in the absence of comments indicating that the total service approach is undermined by our CPE bundling rules, we find no reason to modify our interpretation of section 222( c)( 1) or the total service approach at this time. 191 3. Grandfathering of Previously Obtained CPNI Approvals 85. We allow carriers to continue to use CPNI approvals previously received from customers based on our interim rules with the following limitations. Carriers cannot use or disclose CPNI in ways that require opt- in under the rules we adopt herein (e. g., third party disclosure) without first obtaining opt- in approval. 192 Accordingly, carriers that obtained opt- in approval prior to U S WEST, or carriers that voluntarily obtained opt- in approval during the period since U S WEST, where the other requirements of our rules were met, can continue to use those approvals. However, carriers that provided opt- out notices can only use customers’ opt- out approval for marketing of communications- related services by carriers, their affiliates that provide communications- related services, and carriers’ agents, joint venture partners and independent contractors. 4. Customer Right to Restrict Carrier Use of CPNI for Marketing Purposes 86. In the CPNI Order Further NPRM, the Commission sought comment on whether customers should be able to restrict a telecommunications carrier from using, disclosing or permitting access to CPNI, regardless of whether the use might otherwise be allowed under 188 The “single category approach would have permitted carriers to use CPNI obtained from the provision of any telecommunications service, including local or long distance or CMRS, to market any other service offered by the carrier, regardless of whether the customer subscribes to such service from that carrier.” CPNI Reconsideration Order, 14 FCC Rcd at 14421, para. 18. 189 CPNI Order, 13 FCC Rcd at 8083, 8085- 8091, paras. 29, 33, 39. CPNI Reconsideration Order, 14 FCC Rcd at 14421- 14422, paras. 19- 20. 190 CPNI Reconsideration Order, 14 FCC Rcd at 14422, para. 19. 191 In the CPNI Clarification Order the Commission sought comment as to whether the issues raised in the Computer II proceeding should affect the interpretation of section 222( c)( 1). 16 FCC Rcd at 16516, para. 21. 192 Carriers were on notice that such a determination was a real possibility. See CPNI Clarification Order, 16 FCC Rcd at 16510, para. 8 (“ Specifically, pending resolution of this docket, carriers may proceed to obtain consent consistent with the notification requirements in Section 64. 2007( f), using an opt- out mechanism or, should they choose to do so, an opt- in mechanism”) (emphasis added). 38 Federal Communications Commission FCC 02- 214 39 sections 222( c)( 1)( A) and (B). 193 We find that such a restriction is not warranted under section 222, consistent with the Tenth Circuit’s decision, or currently necessary to protect customer privacy. 87. Section 222 does not specifically address whether customers can restrict a telecommunications carrier from using, disclosing or permitting access to CPNI within the circumstances defined in sections 222( c)( 1)( A) and (B). 194 If section 222 allowed customers to do so, customers could prevent carriers from using CPNI for all marketing purposes, even if the marketing was within the carrier’s total service offering. However, as we have noted previously, section 222 “balances principles of privacy and competition in connection with the use and disclosure of CPNI and other customer information.” 195 Therefore, where the statute is silent, we weigh both of these interests. Most commenters urged the Commission not to adopt additional restrictions, arguing that such restrictions would be broader than that required by section 222 and would disallow carriers from engaging in the behavior necessary and appropriate in the provision of telecommunications services. 196 While we do not explicitly endorse this view, we must take notice of the fact that the Tenth Circuit’s recognition of a carrier’s right to use CPNI to engage in protected commercial speech strongly counsels against imposing additional restrictions. While section 222 imposes requirements to obtain approval for the use of CPNI under certain circumstances, and thus explicitly recognizes the interest of consumers in keeping this information private, the Tenth Circuit has also made clear that restrictions on the use of CPNI must be narrowly tailored. 197 A broad customer right to prevent any use of CPNI regardless of the uses allowed under section 222 would appear, on its face, to fail the Tenth Circuit’s requirement. 88. At any rate, as several commenters noted, adding a new rule allowing customers to restrict a carrier’s use of CPNI for all marketing purposes would do little to further the goal of protecting consumers’ privacy. 198 Commenters argue that mechanisms allowing customers to limit unwanted marketing solicitations already exist in the form of do- not- call or do- not- contact 193 CPNI Order, 13 FCC Rcd at 8200- 8201, paras. 204- 205. 194 Id. 195 CPNI Order, 13 FCC Rcd at 8073, para. 14. 196 Omnipoint March 30, 1998 Comments at 2 (“[ t] o add to this regime an opt- out requirement for CPNI within the total service offering would be contrary to the structure of the statute”). See also AT& T March 30, 1998 Comments at 1- 8; Bell Atlantic March 30, 1998 Comments at 1- 3; BellSouth March 30, 1998 Comments at 1- 4; GTE March 30, 1998 Comments at 2- 4; Intermedia March 30, 1998 Comments at 3- 7; MCI March 30, 1998 Comments at 2- 6; SBC March 30, 1998 Comments at 1- 8; Sprint March 30, 1998 Comments at 1- 5; USTA March 30, 1998 Comments at 2- 4; U S WEST March 30, 1998 Comments at 2- 5; Vanguard March 30, 1998 Comments at 3- 6. Although the comments we received applied to our previously adopted approval regime (opt- in), the arguments made by commenters continue to have force under the rules we adopt in this Order. 197 U S WEST, 183 F. 3d at 1238. 198 Bell Atlantic March 30, 1998, Comments at 2. 39 Federal Communications Commission FCC 02- 214 40 lists kept by the carrier. 199 The Telephone Consumer Protection Act and subsequent regulations require carriers to maintain and honor lists of consumers who have requested that they not receive telephone solicitations. 200 Coupled with section 222 and our CPNI rules, these mechanisms appear to provide safeguards that consumers who do not want to receive telemarketing or other unwanted marketing contacts can affirmatively remove themselves from carriers’ marketing lists. 201 We also recognize that additional regulations often require a financial and time commitment from carriers to implement new rules. Here, any such costs would not be justified by the incidental additional privacy protection further CPNI restrictions would afford consumers. 202 We decline to read section 222’s ambiguity in this respect to allow such a broad restriction. Nevertheless, we approve of voluntary mechanisms that keep consumers’ information confidential, and encourage carriers to continue to respect the privacy interests of their customers by using them. 203 C. Customer Notification Requirements 89. In this Order we largely affirm our previous notice rules, 204 which specify, inter alia, that a carrier’s notification “must be comprehensible and must not be misleading,” and that written notices “must be clearly legible, use sufficiently large type, and be placed in an area so as to be readily apparent to a customer.” 205 A telecommunications carrier’s solicitation for approval must also be proximate to the notification of a customer’s CPNI rights. 206 Failure to comply with these rules will subject carriers to appropriate enforcement action by the Commission. This Order also makes changes to the notice rules based on industry experience since their adoption, as well as some changes that are necessary to synchronize the notice requirements with the approval methods we adopt herein. Specifically, with respect to opt- in notices, we allow carriers 199 Among those carriers noting that they had such lists were GTE and Bell Atlantic. Bell Atlantic March 30, 1998 Comments at 3; GTE March 30, 1998 Comments at 3. 200 47 U. S. C. § 227( c)( 1)( A); 47 U. S. C. § 64. 1200( e)( 2). 201 The record does not indicate that these mechanisms are ineffective. 202 Intermedia March 30, 1998 Comments at 5- 6. 203 We note that some financial institutions have marketed the fact that they have voluntarily adopted privacy protections that exceed that which is required under Gramm- Leach- Bliley. We welcome such efforts to further educate consumers of their privacy choices regarding CPNI and encourage carriers to undertake such actions. 204 Many commenters support our continued use of the existing notice rules. Verizon Wireless Reply Comments at 4 (“ With the addition of a thirty- day opt- out period following notice, the Commission’s existing notice rules will sufficient [sic] to ensure knowing, informed approval.”); Worldcom Reply Comments at 3 (“ The Commission’s current rules already outline specific requirements on customer notification, including the provision of sufficient information that is comprehensible and not misleading.”). See also Verizon Comments at 13; Verizon Reply Comments at 8. A few, however, urge the Commission to adopt general principles or guidelines and allow carriers to determine how to implement those guidelines. See SBC Comments at 15. 205 See Appendix B, 47 C. F. R. §§ 64. 2008( c)( 4)-( c)( 5). 206 See Appendix B, 47 C. F. R. § 64. 2008( c)( 10). 40 Federal Communications Commission FCC 02- 214 41 more flexibility to determine what type of notices best suit their customers’ needs, and with respect to opt- out, we adopt more stringent notice requirements to ensure that customers are in a position to comprehend their choices and express their preferences regarding the use of their CPNI. In addition, we allow carriers to choose whether to use an opt- in or opt- out method for obtaining customer approval for carriers and their affiliates to use CPNI to market communications- related services. 207 We recognize, as SBC points out, that different types of customer relationships may be better suited to different types of notice and approval methods. 208 1. Form of Notice 90. We continue to allow carriers to use written, electronic, and oral notice to customers when soliciting opt- in approval. However, except as described below, we require carriers to provide some type of individual 209 tangible notice (written or electronic) to customers when soliciting opt- out approval. We continue to allow carriers to use oral notice to obtain limited, one- time use of CPNI, whether opt- in or opt- out. 210 91. In addition, we allow carriers the flexibility to provide combined opt- out and opt-in notices or to provide such notices separately, at individual carriers’ discretion. Accordingly, a carrier seeking approval to use CPNI internally and to share with third parties could combine notice for opt- out and opt- in CPNI uses on one notification, so long as it complies with our notice rules. Alternatively, we allow carriers that prefer to do so to provide separate notices to customers seeking different types (opt- in or opt- out) of CPNI approval. Of course, carriers may choose to use opt- in for all CPNI uses, in which case a carrier making such an election can provide a single notice to its customers. Finally, we allow carriers to provide notice based on the CPNI usage approvals they seek to obtain. Accordingly, a carrier that does not intend to disclose CPNI to third parties or affiliates that do not provide communications- related services does not need to provide to its customers notice regarding opt- in. Carriers that do not intend to use CPNI outside of the total service approach do not need to provide notice to their customers at all. 207 For this purpose, we also allow carriers to choose whether to use opt- in or opt- out on an individual customer basis. However, we caution carriers that the Act’s prohibition against “unjust or unreasonable discrimination in charges, practices, classifications, regulations, facilities or services” applies to CPNI practices. 47 U. S. C. § 202( a). We note that, as a general matter, a carrier can certainly elect to use opt- in to obtain customer approval of the use of CPNI by a carrier and its affiliates for marketing communications- related services, even though we have explicitly permitted carriers to use the relatively less burdensome alternative of opt- out. Thus, we leave to carriers the decision as to which approval method to use, and do not prohibit them from using opt- in even if they are not required to do so. 208 SBC Comments at 15. See also AT& T Comments at 3, n. 1; NTCA Comments at 2. 209 By individual, we mean that carriers must provide notice to each customer from which it seeks consent to use CPNI. Broadcast notice methods such as newspaper publication will not satisfy our requirements. 210 The method of one- time approval will depend on whether the use qualifies for the opt- out method under our rules – as in the case of an inbound customer inquiry to a carrier. Uses that would not qualify for the opt- out – for example, a cold call by a competitor seeking access to the customer’s CPNI – will require that the carrier obtain opt-in approval for the duration of the call. However, as we discuss in section III. C. 2. a, we allow carriers to provide abbreviated notice to obtain CPNI approval for limited duration, one- time CPNI approval. 41 Federal Communications Commission FCC 02- 214 42 a. Electronic Notice 92. We allow carriers to provide CPNI notices to customers through the use of e- mail or other electronic formats, 211 such as a website, as urged by some commenters. 212 However, we recognize that consumers are deluged with unrequested or unwanted commercial e- mail (“ spam”) and could easily overlook a notice provided via e- mail. Accordingly, we require carriers to follow certain precautions to ensure that such notices will not be mistaken as spam. Such requirements directly and materially advance our goal of ensuring that consumers have the information necessary to make informed decisions regarding the use of their personal information. 93. We require carriers that use e- mail to provide opt- out notices to obtain express, verifiable, prior approval from consumers to send notices via e- mail regarding their service in general, or CPNI in particular. 213 In addition, we require carriers to allow consumers to reply directly to e- mails containing CPNI notices in order to opt- out. We also encourage carriers who elect to use e- mail for opt- in notices to accept replies, but, because we do not think it is necessary to ensure consumers’ privacy choices are honored, we do not so mandate. Further, we require that opt- out e- mail notices which are returned to the carrier as undeliverable be sent to the customer in another form before carriers may consider the consumer to have opted- out. Finally, we require carriers that use e- mail to send CPNI notices to ensure that the subject line of the message clearly and accurately identifies the subject matter of the e- mail. 94. Carriers that elect to use other forms of electronic notice, such as notice provided on a website during the carrier selection process, are cautioned that, similar to our warning on the shrinkwrap/ break- the- seal approach in the next section, such notice must comply with our form requirements (e. g., placement so as to be readily apparent to the customer). In particular, we likely would not consider a CPNI notice that was combined with other legal terms and conditions, or other privacy information, to comply with our rules if the customer were deemed to have opted- in or opted- out simply by signing up for service. b. Shrinkwrap or Break- the- Seal “Notice” 95. Commenters raise the issue of shrinkwrap or break- the- seal agreements, 214 and 211 We note that carriers who use electronic notice methods must abide by our generally applicable notice rules and safeguards (i. e., record retention for at least one year, 47 C. F. R. § 64. 2008( a)( 2)), as well as the rules specifically applicable to electronic notice. 212 CTIA Comments at 11; Verizon Reply Comments at 8. 213 In addition, carriers must have procedures in place to allow consumers to: (1) discontinue receiving information via e- mail, and (2) update their e- mail addresses. 214 “The shrinkwrap license gets its name from the fact that . . . packages are covered in plastic or cellophane ‘shrinkwrap’ and some vendors . . . have written licenses that become effective as soon as the customer tears the wrapping from the package.” ProCD, Inc. v. Zeidenberg, 86 F. 3d 1447, 1449 (7 th Cir. 1996). 42 Federal Communications Commission FCC 02- 214 43 whether such agreements constitute effective solicitation of approval under section 222( c)( 1). 215 While we decline to adopt more stringent notice requirements at this time, we confirm that all of the existing notice requirements generally applicable under section 222 apply equally when a carrier solicits customer approval through shrinkwrap or break- the- seal methods. As a threshold matter, we note that the distinctions between notice of a customer’s rights, solicitation for approval to use CPNI, and the approval process sometimes become blurred. 216 In fact, shrinkwrap or break- the- seal approval “notice” implicates all three areas of our rules. Using a shrinkwrap or break- the- seal approach, a carrier 217 purports to provide “notice” of customers’ CPNI rights to the customer – usually in connection with other terms and conditions of service – and claims to “solicit” consumers’ approval for CPNI use and disclosure by asserting that by using the service or “breaking- the- seal” (as in the case of a cellular phone), the consumer has approved use and disclosure of his CPNI. Some shrinkwrap/ break- the- seal approaches offer the consumer an opportunity to take some action regarding his CPNI, 218 while some do not. 96. We are concerned that the shrinkwrap/ break- the- seal notices as they have been described to us are ineffective and may not comply with either the letter or spirit of our notice rules. However, in the absence of specific concerns on this record of abuse of these types of agreements, we do not find that additional restrictions beyond generally applicable notice requirements are warranted at this time. Nevertheless, we caution carriers that abuse of shrinkwrap or break- the- seal approaches will cause us to reexamine this question or initiate enforcement action. 2. Content of Notice 97. We largely affirm our previously adopted content rules with a few changes. 219 First, we allow carriers to obtain one- time limited use CPNI approval using a streamlined notice. Second, as discussed in more detail below, we require carriers to provide opt- out notices to their customers every two years. Accordingly, we require carriers to advise customers that if they have opted out previously, no action is needed to maintain the opt- out election. However, consumers who wish to reverse their previous decision to opt- out, or consumers who have not 215 The commenters who raise the issue generally assume or argue that shrinkwrap or break- the- seal approval is an acceptable “notice” method. See CTIA Comments at 14; Verizon Wireless Reply Comments at 4, n. 7. 216 “Prior to seeking customer approval . . . carriers must provide a one- time notification to the customer of her or his rights to restrict the use or disclosure of, and access to, her or his CPNI . . . . Once a customer is notified of her or his rights, the carrier may undertake a solicitation of the customer’s approval.” CPNI Reconsideration Order, 14 FCC Rcd at 14462, para. 103. 217 We note that this type of “notice” has generally been discussed in connection with wireless carriers. However, this section applies to all telecommunications carriers and to any type of “notice” that operates like shrinkwrap or break- the- seal “notice.” 218 We note that an agreement that amounted to a customer providing “opt- in” approval by his or her action of accepting or using service may be titled “opt- in” by the carrier, but would likely operate as negative approval or opt-out approval – and might not satisfy our other notice requirements. 219 See Appendix B. 43 Federal Communications Commission FCC 02- 214 46 while Verizon, BellSouth, GTE, and SBC filed comments in opposition to MCI WorldCom’s request. 228 101. The Commission previously has considered and rejected this same argument twice. 229 The Commission’s rules permit disclosure of a customer’s records only upon adequate notice to and approval from the customer. 230 These rules are designed to allow customers to make reasoned, informed decisions about their CPNI in which they have a privacy interest. 231 As several commenting parties note, the short notice statement proposed by MCI WorldCom is too vague to enable the customer to make an informed decision. 232 Although MCI WorldCom presents information about its experience competing for local exchange customers, MCI WorldCom and the other commenters supporting this request do not present compelling new facts or arguments that justify altering the existing rules, especially in light of the fact that, in the instant proceeding, we streamline the notice requirements. Specifically, MCI WorldCom does not establish how its need for this information 233 during an initial cold call to a potential customer overcomes that customer’s privacy interests – especially since there is no existing business relationship, making MCI WorldCom or another similarly situated carrier a third party to the consumer. 234 Accordingly, for the same reasons that we have differentiated the approval required (Continued from previous page) Dec. 2, 1999) (U S West Comments on Pet. for Further Recon.) at 3- 9 (supporting MCI WorldCom’s petition in part). See also WorldCom Reply on MCI WorldCom’s Petition for Further Recon., CC Docket Nos. 96- 115 and 96-149 (filed Dec. 15, 1999) (MCI WorldCom Reply on Pet. for Further Recon.) at 2- 5; WorldCom Comments at 7- 8. 228 Bell Atlantic Comments on MCI WorldCom’s Petition for Further Reconsideration, CC Docket Nos. 96- 115 and 96- 149 (filed Dec. 2, 1999) (Bell Atlantic Comments on Pet. for Further Recon.) at 1- 2, 4- 5; BellSouth Comments on MCI WorldCom’s Petition for Further Reconsideration, CC Docket Nos. 96- 115 and 96- 149 (filed Dec. 2, 1999) (BellSouth Comments on Pet. for Further Recon.) at 1- 5; GTE Reply Comments on MCI WorldCom’s Petition for Further Reconsideration, CC Docket Nos. 96- 115 and 96- 149 (filed Dec. 2, 1999) (GTE Reply to Pet. for Further Recon.) at 2- 3; SBC Communications Comments on MCI WorldCom’s Petition for Further Reconsideration, CC Docket Nos. 96- 115 and 96- 149 (filed Dec. 2, 1999) (SBC Comments on Pet. for Further Recon.) at 1- 3; BellSouth Reply at 5- 7; Letter from Richard T. Ellis, Verizon, to William Caton, Acting Secretary, Federal Communications Commission, CC Docket Nos. 96- 115 and 96- 149 (filed Mar. 6, 2002) (Verizon Mar. 6, 2002 Ex Parte Letter). 229 See CPNI Reconsideration Order, 14 FCC Rcd at 14453- 14454, paras. 86- 90 (determining that “the language of 222( c)( 1)( A) reflects Congress’ judgment that customer approval for carriers to use, disclose, and permit access to CPNI can be inferred in the context of an existing customer relationship.”) (emphasis in original); CPNI Order, 13 FCC Rcd at 8080, para. 23. 230 See Section III. C. 1. In addition, we note that this Order allows for streamlined notice for one- time, limited use of CPNI in Section III. C. 2. a. 231 The Commission’s rules requiring proper notice before a customer gives a carrier consent to access CPNI ensure that customers are given an opportunity to make a reasoned decision. See CPNI Order, 13 FCC Rcd at 8128, para. 87. 232 See BellSouth Comments on Pet. for Further Recon. at 1- 4; SBC Comments on Pet. for Further Recon. at 2. 233 As noted, this is information that Congress has determined to be private and worthy of special protection against disclosure without customer approval. 234 Moreover, MCI WorldCom and supporting commenters argue that making a customer’s feature information available will improve the process of converting customers from one carrier to another. MCI WorldCom Petition at (continued….) 46 Federal Communications Commission FCC 02- 214 47 depending on intended use as described above, we reject MCI WorldCom’s arguments here and again find no reason to disturb our earlier decisions. c. Notice Requirements Regarding Disclosure of Carriers’ Affiliates 102. We deny MCI WorldCom’s request that we allow carriers to use “broad, general terms” when providing notice, rather than informing “customers of the types of CPNI that may be viewed and the entities that may view it.” 235 MCI WorldCom provides no new facts and makes no arguments that we have not previously considered in our analysis and determination in the CPNI Reconsideration Order. 236 d. Ability to Warn Customer that Provisioning Delays are Possible Without Access to CPNI 103. We grant, with certain safeguards, MCI WorldCom’s request that we remove the prohibition against warning customers that failure to approve the disclosure of CPNI to a new carrier may disrupt the installation of service. 237 In the CPNI Second Report and Order, the Commission explained that customer notification “must provide sufficient information to enable the customer to make an informed decision as to whether to permit a carrier to disclose, or permit access to CPNI.” 238 In that same discussion, the Commission prohibited the inclusion of any implication “that approval is necessary to ensure the continuation of services to which the customer subscribes, or the proper servicing of the customer’s account.” 239 In the CPNI Reconsideration Order, based on a lack of evidence, the Commission denied an MCI petition to allow carriers to warn customers of problems that could result from failure to give permission to access the customer’s CPNI. 240 Because we want customers to be able to make informed decisions, 241 and because we do not want to place an undue burden on truthful speech, 242 we consider this topic below. (Continued from previous page) 5- 9. This argument, as well as AT& T’s argument that failure to allow access to such information could compromise a customer’s privacy and personal safety (AT& T Comments at 3), is misplaced in this discussion of access during the initial sales contact because it fails to consider that, before WorldCom or AT& T places an order for that customer, the customer can choose whether or not to permit access to his CPNI to facilitate the provisioning process. 235 MCI WorldCom Petition at 13- 14. 236 CPNI Reconsideration Order, 14 FCC Rcd at 14467- 68, paras. 115- 116. 237 MCI WorldCom Petition at 12- 13. 238 CPNI Order, 13 FCC Rcd at 8162, para. 138. 239 Id. 240 CPNI Reconsideration Order at para. 91 & n. 511. 241 See, e. g., RCN Comments on Pet. for Further Recon. at 6. 242 See, e. g., U S West Comments on Pet. for Further Recon. at 10. 47 Federal Communications Commission FCC 02- 214 48 104. Several parties commented on this issue. 243 For example, RCN and Qwest support MCI’s contention that without access to CPNI, delays or problems with proper provisioning are likely when a customer chooses to change carriers. 244 Verizon, however, disagrees with the argument that a competing carrier’s lack of access to a customer’s CPNI necessarily causes delays or provisioning problems, arguing instead that if such problems occur, they are the fault of MCI WorldCom. 245 Parties raise sufficient cause for us to believe that our current rules may restrict truthful speech that could beneficially inform consumers’ decisions on CPNI disclosure. 246 105. We recognize an important balance of interests in warning customers that failure to grant access to CPNI may impede the provisioning process. On one hand, we believe that customers should be given useful and truthful information that will better inform their decisions regarding CPNI. On the other hand, we are wary that carriers might use such a warning in such a way as to coerce customers into granting consent to access CPNI. Therefore, in order to maximize the ability of customers to make fully informed decisions about their CPNI, we permit carriers to provide an informative statement to customers about problems that often occur in provisioning service without access to CPNI. 106. Specifically, we decide that carriers soliciting consent to access a customer’s CPNI may, in addition to the statements required to obtain consent, provide a brief statement, in clear and neutral language, describing consequences directly resulting from the lack of access to CPNI. However, any consequences must affect customers and must be provable and material. 247 By requiring carriers to limit their representations in this way, we can best ensure that customers are protected from coercive or trivial assertions, while nevertheless ensuring that customers have information that is relevant to their decisions to allow use of their CPNI. We decline, at this time, to mandate specific language for such warnings because we believe that our rules will provide carriers with sufficient guidance to formulate scripts that inform customers in a neutral manner of significant consequences, without unduly restricting carrier flexibility in delivering the message. 243 Bell Atlantic Comments on Pet. For Further Recon. at 5- 6; RCN Comments on Pet. for Further Recon at 6; U S WEST Comments on Pet. for Further Recon. at 9- 10. 244 RCN Comments on Pet. for Further Recon. at 6; U S WEST Comments on Pet. for Further Recon. at 10. 245 Bell Atlantic Comments on Pet. for Further Recon. at 5- 6. 246 We expressly do not find that the specific claims of the various commenters are truthful, provable, significantly probable customer- impacting consequences of a lack of access to CPNI. 247 Consequences must be provable in the sense that they cannot be mere speculation as to possible harm. Rather, they must constitute an actual consequence of a failure to use CPNI in providing service to a customer, based on the carrier’s experience. Consequences must be material in the sense that they must constitute a problem that would prevent or significantly delay the initiation of service. Consequences must be customer- impacting, as otherwise there would be no reasonable purpose in communicating them, aside from attempting to coerce or confuse the customer. 48 Federal Communications Commission FCC 02- 214 49 3. Frequency of Notice 107. We hold that carriers using the opt- in customer approval mechanism must provide customers with a one- time notice before soliciting approval to use CPNI. Carriers electing the opt- out mechanism must provide notices to their customers every two years. We note that few commenters addressed the issue of frequency of notice and none suggested a specific time period. 248 108. We adopt a more stringent notice requirement for the opt- out regime for several reasons. First, under the opt- out mechanism, the possibility exists that customers have not made a conscious decision to allow the additional use of their CPNI. For example, the lack of response could be due to a customer’s failure to receive the notice, a failure to read the notice, or a failure to understand the notice. 249 As Qwest itself recognized in its comments, “[ t] he failure to act, then, provides little evidence of an individual’s true intentions, and no dispositive or compelling demonstration of a ‘decision. ’” 250 As already discussed, the opt- out mechanism requires more stringent safeguards because of the possibility that consumers are unaware of their rights and because opt- out provides incentives for carriers to not be as forthright as possible. 251 By contrast, in an opt- in environment, customers have taken affirmative action regarding the use of their CPNI that demonstrates they are informed of the scope and duration of a carrier’s use of CPNI. 252 109. Second, a number of relevant customer and carrier circumstances can change over time. A customer’s marital or parental status, job status, or health status can change. Carriers may change their affiliates, the methods available to opt- out, and the uses the carrier makes of the information. For example, a customer might be willing to share his CPNI with a local telephone company, but decide that he wants to restrict the use of his CPNI after that company merges with a larger entity. Periodic renotification is thus a reasonable way of ensuring that customers have an adequate opportunity to indicate approval. 110. Therefore, in accordance with the general policy we have adopted regarding the need for consumer safeguards in an opt- out regime, and because failing to provide for periodic confirmation would fail to account for material changes in circumstances over time, we hold that 248 Verizon Wireless urged the Commission not to adopt “costly or burdensome notice and consent requirements in conjunction with opt- out (in terms of frequency of notice, volume of notice materials, etc.).” Verizon Wireless Comments at 6. 249 NAAG Dec. 21, 2001 Ex Parte Letter at 7- 9. 250 Qwest Comments at 13. See also AT& T Wireless Comments at 4 regarding supposed limitations of opt- in, but equally applicable to opt- out (“ A carrier would not know whether the absence of such affirmative action reflects a conscious decision by the customer not to permit the carrier to use his or her CPNI, or simply a lack of interest”). 251 See supra description of problems reported with the Gramm- Leach- Bliley notifications, as well as survey information indicating that even those consumers with particularly strong privacy concerns are not responding as anticipated to opt- out notifications. 252 CPNI Order, 13 FCC Rcd at 8165, para. 142 (finding that a periodic notice requirement was no longer necessary under an opt- in customer approval mechanism). 49 Federal Communications Commission FCC 02- 214 50 carriers must provide opt- out notices at least once every two years. A two- year period is a reasonable period over which one might reasonably expect changed circumstances to warrant confirmation of an opt- out election. Biennial notice is also unlikely to impose an onerous burden on carriers, particularly when compared to their likely benefit in making use of the opt- out mechanism. 253 111. In addition, we require carriers to honor their customers' CPNI elections unless and until a customer affirmatively changes his election. Following a customer's election to withhold approval of CPNI usage, the carrier may subsequently attempt to secure the customer's approval to use, disclose, or permit access to his CPNI as frequently as the carrier deems appropriate, but carriers may not force customers to opt- out repeatedly in an attempt to wear the customer down or obtain an inadvertent "approval." Accordingly, although carriers must provide biennial opt- out notice to their customers, carriers must respect previously expressed opt- outs. Nor can carriers provide opt- in notices to their customers and immediately provide additional notices to those customers who choose not to opt- in, because such use of repeated notices is burdensome to customers and fails to respect their privacy choices regarding CPNI. 4. Waiting Period for Opt- Out Notification 112. We adopt a 30- day minimum period of time that carriers must wait after giving customers’ notice before assuming customer approval. In the CPNI Clarification Order, the Commission noted that the then- current rules did not provide for any time period after which a customer’s implicit approval of the use or sharing of CPNI could be reasonably assumed to have been given to the carrier. 254 As an interim measure, the Commission adopted a 30- day period from customer receipt of notice as a “safe harbor,” but permitted some shorter period if supported by an adequate explanation from the carrier. 255 Commenters addressing this topic uniformly supported a 30- day waiting period, 256 although one commenter found troubling that “[ a carrier’s] notice gave customers only thirty days to object.” 257 In light of the comments we received supporting the 30- day time frame and the lack of any other suggested time frames or 253 We note that the Commission’s earlier CPNI rules required carriers to send annual notices to some customers regarding their use of CPNI to market customer premises equipment and enhanced services. Computer III Phase II Order, 2 FCC Rcd 3072, 3093- 97, paras. 141- 174 (1987); GTE Safeguards Order, 9 FCC Rcd 4922, 4944- 45, para. 45 (1994). In addition, the Commission considered annual or semi- annual approval requirements in the CPNI Order, but found such a condition unwarranted in an opt- in environment. CPNI Order, 13 FCC Rcd 8061, 8151, para. 116. The requirement we adopt here is less burdensome than an annual or semi- annual requirement but still serves the purpose of ensuring consumers’ wishes with respect to the privacy of their CPNI are honored. 254 CPNI Clarification Order, 16 FCC Rcd 16506, 16511, para. 11. 255 Id. 256 AT& T Wireless Comments at 3 (“ AWS agrees that there should be a reasonable waiting period between the time notice is provided and consent is assumed, and supports the 30- day waiting period proposed by the Commission.”); Verizon Comments at 13 (“ a thirty- day period is sufficient for a response.”); see also Nextel Comments at 8; SBC Comments at 14; Verizon Wireless Comments at 6, n. 9; Verizon Feb. 20, 2002 Ex Parte Letter at 4. 257 Attorney General of Arizona Jan. 25, 2002 Ex Parte Letter at 5 (emphasis added). 50 Federal Communications Commission FCC 02- 214 51 evidence of harm to consumers or carriers, we adopt as permanent the interim 30- day time frame. We clarify that this 30- day period is merely the minimum time a carrier must wait to infer a customer’s approval of its requested use of CPNI; it is no way a deadline for customer action. Carriers are required to honor customer decisions to opt- out of requested uses whenever those decisions are communicated by customers, which may occur during or after the 30- day waiting period. 113. We also sought comment on how carriers should manage later requests for privacy from the customer. 258 For example, if a customer chooses to opt- out after the date on which approval has already been inferred, or, in the case of an opt- in mechanism, after the customer revokes an express consent previously granted, what would be a reasonable time period within which the carrier and its affiliates should be required to implement that opt- out request or revocation? We received limited comments on this topic, and note that we are unaware of any complaints regarding carriers’ failure to implement and honor later requests for privacy. Accordingly, we require carriers to implement customers’ privacy requests as expeditiously as possible within the regular course of business. However, we caution carriers that if we receive complaints that later privacy choices are not being effectuated in a timely manner, we will not hesitate to readdress this issue, and adopt prescriptive rules. In addition, we caution carriers that failure to implement customers’ privacy elections in a timely manner would likely be actionable violations of sections 222 and 201 of the Act. 114. We also require carriers to notify the Commission if their opt- out mechanisms break down. During the period preceding this Order, a number of carriers implemented opt- out policies. We are aware that many consumers experienced problems in effectuating their choice to opt- out. 259 For example, it was reported that Qwest’s call center was understaffed for the level of response and consumers were unable to get through or put on hold for unacceptably long periods; SBC generated similar complaints. 260 In light of recent problems customers have had opting- out, as well as the vital role that proper implementation of the opt- out mechanism plays in protecting consumers’ privacy, we require that carriers provide written notice within five business days to the Commission in any instances where opt- out mechanisms do not work properly, to such a degree that consumers’ inability to opt- out is more than an anomaly. 261 258 CPNI Clarification Order, 16 FCC Rcd at 16518, para. 23. 259 NASUCA April 12, 2002 Ex Parte Letter at 4; Texas Office of Public Utility Counsel April 16, 2002 Ex Parte Letter. 260 See Brett Glass Comments; Attorney General of Arizona Jan. 25, 2002 Ex Parte Letter at 5; Arizona Corporation Commission Jan. 28, 2002 Ex Parte Letter at 2; Texas Office of Public Utility Counsel Apr. 16, 2002 Ex Parte Letter at 2. See also Paul Wenske, Consumers Have Difficulty “Opting- Out,”, KANSAS CITY STAR (Feb. 17, 2002). 261 Such notices must be filed in WC Docket 96- 115 with the Secretary’s Office and sent to the Chief, Competition Policy Division, Wireline Competition Bureau and to the Chief, Policy Division, Consumer and Governmental Affairs Bureau. 51 Federal Communications Commission FCC 02- 214 52 115. In such instances, the Commission will consider whether to require carriers to extend the date by which opt- outs must be received, or if other corrective action is required. We encourage carriers to take such action voluntarily, and to advise the Commission of such action in the notice. The notice should take the form of a letter, and include the carrier’s name, a description of the opt- out mechanism( s) used, the problem( s) experienced, the remedy proposed and when it will be/ was implemented, whether the relevant state commission( s) has been notified and whether it has taken any action, a copy of the notice provided to customers, and contact information. Such notice must be submitted even if the carrier offers other methods by which consumers may opt- out. 116. In addition, we no longer allow carriers to use a time frame shorter than 30 days even if supported by an explanation. 262 To the degree that carriers previously provided notices that otherwise comply with our rules, but used a shorter time frame, we allow carriers to continue to use approval generated from those notices consistent with our holding regarding grandfathering of previously obtained approvals. 263 117. Moreover, we agree with Nextel’s request to “allow a carrier to provide the requisite notification at the time of an individual transaction and request that the consumer decide whether to opt- out as a requisite to completing that transaction.” 264 In particular, subject to our discussion of shrinkwrap consent, carriers may request that consumers affirmatively make a CPNI election when the consumer signs up for service. However, if the carrier provides an opt- out notice but does not require the customer to specifically demonstrate his decision whether or not to opt- out, then the carrier must abide by the thirty- day waiting period. Specifically, a carrier must obtain a demonstrable customer election to opt- in or opt- out that is separate and distinct from the customer’s decision to purchase the carrier’s service. For example, a carrier that uses an Internet sign- up page may provide the required notice and then require a customer to click on a button agreeing to opt- out or opt- in. 265 However, carriers may not require customers to assent to CPNI usage as a condition of service. 266 262 Should extraordinary circumstances occur, we will consider individual carriers’ waiver requests. 263 See section III. B. 3, infra. 264 Nextel Comments at 8. 265 See section III. C. 1. a, supra. 266 Accordingly, we disagree with CTIA’s assertion that “a carrier could notify a customer of its information practices at the time a customer subscribes. If the customer initiates service after such notice, there should be no dispute that consent has been given and is adequate to satisfy Section 222.” Because not all consumers have meaningful choice regarding all of their telecommunications providers, we do not allow carriers to require CPNI access as a term of service. CTIA’s proposed solution – “the customer may terminate the service if such practices are no longer acceptable” – is inappropriate where a customer depends on such service as a basic utility and has no other meaningful choice (e. g., local dial tone). 52 Federal Communications Commission FCC 02- 214 53 5. Methods by Which Customers Can Exercise CPNI Rights Under Opt-Out or Opt- In 118. We require that carriers make available to every customer (including, but not limited to, those without Internet access, and disabled customers) a method to opt- out that is of no additional cost 267 to the customer and available 24 hours a day, seven days a week. We allow carriers to satisfy this requirement through a combination of methods, 268 so long as all customers have the ability to opt- out at no cost and are able to effectuate that choice whenever they choose. 269 We note that in an opt- in paradigm, carriers have an incentive to make it as easy as possible for customers to opt- in because they need to receive the customer’s express approval to use CPNI. However, in the case of opt- out, it makes economic sense for carriers to make it difficult and expensive for customers to opt- out, because opting- out deprives the carrier of approval for its intended use of CPNI. 270 Many commenters suggest that the Commission allow carriers to determine what methods to offer customers to opt- in or out. 271 Based on comments as well as recent experiences with opt- in and opt- out in this and other industries, we allow carriers the freedom to choose the method( s) by which consumers may express their opt- out or opt- in choices, so long as all customers are able to access and use those mechanisms, 24 hours a day, seven days a week. We believe that these requirements will ensure that all consumers are afforded a reasonable opportunity to effectuate their privacy choices, while allowing carriers flexibility in determining how to meet their obligations. 272 119. We deny the request by a few commenters to require carriers to obtain written evidence of customers’ approval. 273 We have previously considered whether to require written evidence and were not convinced that such an approach was necessary, especially in light of the burden it would place on carriers. 274 We decline to do so here because we have not been presented any evidence that carriers are failing to obtain customers’ approval and then claiming 267 While we recognize that carriers may, and in fact probably will, pass the cost of providing a cost- free method of opting- out on to their customer base, we believe that this approach is more equitable than allowing carriers to impose costs only on consumers who elect not to share their CPNI. We are concerned that carriers could impose enough cost on consumers so as to disproportionately impact low- income consumers. 268 The avenues for opt- in and opt- out elections are written, oral, and electronic. 269 However, as discussed in section III. C. 1.b, supra, we have concerns regarding carriers’ use of “break the seal” or “shrinkwrap” methods for customers to opt- in or out. 270 See para. 62 supra, describing carriers’ incentives in an opt- in versus opt- out paradigm. 271 SBC Comments at 15; Sprint Comments at 6; Verizon Wireless Comments at 5. 272 Such mechanisms could include a wide variety of methods, including a postage- paid return postcard, a toll free number, a secure Internet page, and/ or an e- mail address to receive opt- outs. In addition, a form or other mechanism that could be returned with a customer’s bill payment would satisfy this requirement, as the customer would not incur any additional cost. 273 Cal. PUC Comments at 22; Texas PUC Mar. 1, 2002 Ex Parte Letter at 3. 274 CPNI Order, 13 FCC Rcd at 8146- 8149, paras. 110- 114. 53 Federal Communications Commission FCC 02- 214 54 to have such approval. To the degree that we receive complaints that abuses of this nature are occurring, we will revisit this issue and will not hesitate to initiate enforcement actions against offending carriers. In addition, we note that carriers bear the burden to provide proof that approval was obtained should a complaint arise. 275 D. Competition Issues 1. Forbearance for Preferred Carrier Freeze Information 120. While we confirm our previous determination that preferred carrier (“ PC”) freeze information “falls squarely within the definition of CPNI,” 276 in this Order we forbear from imposing section 222’s affirmative approval requirements on PC- freeze information so that it can be made more readily available to requesting carriers. 121. MCI WorldCom petitioned the Commission to reconsider its conclusion that PC-freeze status falls within the definition of CPNI. 277 In its petition, WorldCom states that “it is not apparent that customers have any privacy interest in restricting access to knowledge of the fact that their carrier selections have been frozen.” 278 WorldCom’s argument, however, only partially addresses the legal question. We have classified PC- freeze information as CPNI and have not differentiated among different types of CPNI for the purpose of applying the opt- in/ opt- out methodology or other requirements of section 222. 279 We remain convinced that this interpretation is a valid one, and deny MCI WorldCom’s request as it has not presented any arguments not already considered and rejected. 122. However, the Commission has nevertheless noted in the past that PC- freeze information is less sensitive than other CPNI. 280 Indeed, before clarifying that PC- freeze information is CPNI, the Commission had encouraged carriers to disclose such information to other carriers without customer consent, 281 although such sharing was not required by the 275 47 C. F. R. § 64. 2007( c). 276 CPNI Reconsideration Order, 14 FCC Rcd at 14488, para. 148 & n. 462. 277 MCI WorldCom Petition at 16. 278 MCI WorldCom Petition at 16. 279 For this reason, we decline to adopt Mpower’s proposal that the Commission adopt different approval requirements for CPNI based on the level of sensitivity. See Mpower Comments at 2- 6. While we appreciate Mpower’s initiative in proposing alternatives to the black and white approach to opt- in or opt- out, we find that Mpower’s proposal runs contrary to Congress’ unambiguous intent in defining all types of customer proprietary network information under one definition of CPNI in section 222. In addition, we are not convinced that carriers would be able to implement such a distinction in their existing customer service, operations support, and billing systems, where facilities information and call detail all may reside without distinction. 280 CPNI Reconsideration Order, 14 FCC Rcd at 14488, para. 148 & n. 462. 281 Slamming Order, 14 FCC Rcd 1508, 1587- 88, para. 133. See also U S West Opp. at 11- 13. As noted above, the statute does not clearly state whether or not PC- freeze information is CPNI. 54 Federal Communications Commission FCC 02- 214 55 Commission’s rules. Notwithstanding such encouragement, carriers in possession of PC- freeze status information may have feared that sharing this type of information without consent violated the Act. 282 In light of the past uncertainty regarding the sharing of PC- freeze information, and the fact that, absent forbearance, our rules would preclude the sharing of such CPNI without customer approval, we now undertake a forbearance analysis to ensure clear and consistent rules for carriers. We must conduct an analysis under Section 10 of the Act 283 in order to forbear from applying our affirmative approval requirements to PC- freeze information. 284 Section 10 of the Act requires forbearance where: (1) enforcement of such regulation or provision is not necessary to ensure that the charges, practices, classifications, or regulations by, for, or in connection with that telecommunications carrier or telecommunications service are just and reasonable and are not unjustly or unreasonably discriminatory; (2) enforcement of such regulation or provision is not necessary for the protection of consumers; and (3) forbearance from applying such provision or regulation is consistent with the public interest. 123. Section 10( b) of the Act provides that, in determining whether forbearance is consistent with the public interest, the Commission must consider whether forbearance will promote competitive market conditions, including the extent to which forbearance will enhance competition among providers of telecommunications services. a. Section 10( a)( 1) 124. The Commission must first ascertain that enforcement of the regulation is not necessary to ensure that services are provided in a just, reasonable and nondiscriminatory manner. Access to PC- freeze information does not implicate whether a given carrier’s charges, practices, classifications or regulations by, for, or in connection with PC- freeze information are just or reasonable, or unjustly or unreasonably discriminatory. Further, it is not unjust, unreasonable, or discriminatory for other carriers to have access to PC- freeze information, particularly if doing so prevents manifestly unjust and unreasonable carrier behavior, such as slamming. We thus find that forbearance from enforcing the CPNI notice and approval requirements as they related to PC- freeze information meets the first prong of section 10( a). 282 See 47 U. S. C. § 222( c)( 1). 283 47 U. S. C. § 160. 284 Although MCI WorldCom does not propose regulatory forbearance as an option, we note that U S WEST proposes forbearance as one interpretive option, among others. U S West Comments on Pet. for Further Recon. at 14. 55 Federal Communications Commission FCC 02- 214 56 b. Section 10( a)( 2) 125. Our review of whether the rule is necessary to ensure consumer protection focuses on two aspects of consumer protection – our slamming rules and consumers’ expectations of privacy. First, as we stated above, by this action the Commission does not remove the important consumer protection tools developed to prevent the practice of slamming, but rather, intends to make these rules more effective. As U S WEST notes, consumers will not be harmed because the PC- freeze “cannot be eliminated without the personal intervention of the subscriber, even if the [preferred carrier] freeze information is known to a soliciting carrier.” 285 Additionally, PC-freeze information, while CPNI, is not the type of information regarding which consumers would have a strong expectation of privacy. 286 Therefore, the necessity of enforcing the approval requirements in this instance is substantially reduced. Indeed, the only information conveyed by a PC- freeze status is that the customer prefers to verify affirmatively whether any changes are permissible in that customer’s choice of carrier. c. Sections 10( a)( 3) and 10( b) 126. Finally, we must consider whether forbearance is in the public interest and whether forbearance will promote competitive market conditions. Commenting parties assert that the unavailability of PC- freeze information can delay the conversion of customers to their services. 287 Such delays often result in unmet customer expectations, and customers may become confused or harmed when the new service or price options they have chosen are not implemented. Indeed, in the Slamming Order, the Commission found that PC- freezes could present an additional hurdle to switching carriers that could frustrate consumer choice. 288 The Commission also noted in the Slamming Order that broad availability of PC- freeze status information reduces the likelihood a customer will have a negative experience when switching service from one carrier to another. 289 With prior knowledge of a customer’s PC- freeze status, carriers can prevent such delays and customer confusion. 127. Forbearing from the CPNI approval requirements may increase carriers’ willingness and ability to share PC- freeze status information. Carriers may be able to more 285 U S West Comments on Pet. for Further Recon. at 13. 286 MCI WorldCom Petition at 16; AT& T Comments on Pet. for Further Recon. at 5; U S West Comments on Pet. for Further Recon. at 13. But see SBC Comments on Pet. for Further Recon. at 4; CPNI Recon Order at n. 462 (noting GTE’s argument to the contrary). 287 See Sprint Comments on Pet. for Further Recon. at 2- 3. 288 Slamming Order, 14 FCC Rcd at 1577- 78, para. 115. 289 The Commission stated, “we see benefit to the consumer – in terms of decreased confusion and inconvenience – where carriers would be able to determine whether a freeze is in place before or during an initial contact with the consumer.” Slamming Order, 14 FCC Rcd at 1587- 88, para. 133. 56 Federal Communications Commission FCC 02- 214 57 smoothly transfer customers who are unaware that a PC- freeze exists on their accounts, as the customers’ PC- freeze choices can be discovered earlier in the provisioning process. 290 128. We also believe all carriers operating in the competitive marketplace will benefit if our rules and regulations are consistent and clear. For example, if PC- freezes are CPNI that cannot be disclosed to a requesting carrier without express written consent, Sprint claims 291 another carrier could refuse to conduct a three- way conference call to lift a PC- freeze, which is allowed by the Commission’s rules. 292 Also, as discussed above, it is important to clarify carriers’ responsibilities in order to advance the Commission’s goal of protecting consumers from slamming. Therefore, we find that regulatory forbearance is in the public interest because it enhances the consumer’s choice and clarifies the rules that apply to carriers in the competitive market. 2. Denial of CPNI to Another Carrier With Customer Authorization 129. MCI WorldCom petitioned the Commission to strengthen the presumption that a violation of the Act has occurred when an incumbent LEC fails to provide access to CPNI to a competing carrier that has customer authorization to access that information. 293 We continue to hold that sections 201 and 222 of the Act apply to all carriers, and we find that a distinction between incumbent LECs and competitive LECs in this context would be imprudent. 294 The Commission has not previously required stricter CPNI rules for certain types of carriers, and MCI WorldCom has not provided us with new arguments that section 222 allows such a distinction. 130. The Commission has stated that “a carrier’s failure to disclose CPNI to a competing carrier that seeks to initiate service to that customer who wishes to subscribe to a competing carrier’s service, may well constitute an unreasonable practice in violation of section 290 While a carrier often can either rely on subscribers’ knowledge of whether they have a PC- freeze on their account, or use a three- way calling mechanism to determine such information, we see a benefit to consumers in making their PC- freeze choice available to other carriers. See Slamming Order, 14 FCC Rcd at 1587- 88, para. 133. However, we affirm our presumption that carriers do not need to rely on LEC- prepared lists identifying subscribers with freezes in place, given the other ways in which this information is available. See Slamming Third Report and Order, 15 FCC Rcd at 16031- 32, para. 76. 291 While Sprint makes no allegation that this problem actually exists, we believe that any uncertainty will be addressed by this regulatory forbearance. See Sprint Comments on Pet. for Further Recon. at 3. 292 Slamming Order, 14 FCC Rcd at 1585- 86, para. 129. 293 MCI WorldCom Petition at 10- 12. AT& T filed comments in support of this petition while Bell Atlantic and SBC filed comments in opposition. AT& T Comment on Pet. for Further Recon. at 1- 2; Bell Atlantic Comments on Pet. for Further Recon. at 3; SBC Comments on Pet. for Further Recon. at 3- 4; Letter from Michael D. Alarcon, SBC, to William Caton, Acting Secretary, Federal Communications Commission, CC Docket Nos. 96- 115 and 96- 149 (filed Mar. 22, 2002) (SBC Mar. 22, 2002 Ex Parte Letter) at 5. 294 CPNI Reconsideration Order, 14 FCC Rcd at 14418, para. 11. 57 Federal Communications Commission FCC 02- 214 58 201( b), depending on the circumstances.” 295 For conduct to be unlawful under section 201, the Commission must find that the conduct is “unjust or unreasonable.” 296 We believe that this standard requires a review of case- specific facts, 297 and therefore we decline to impose the additional presumption of illegality requested by MCI WorldCom. MCI WorldCom also asks the Commission to reconsider this request under the local competition provisions of section 251. 298 The Commission has addressed the ability of competitors to access customer service records pursuant to section 251 in other proceedings, including Local Competition dockets and applications under section 271 of the Act. 299 MCI WorldCom has not provided any reason for us to require further assurance of access in this proceeding, and thus we decline to expand the scope of section 251 access in this proceeding. 3. Winback and Retention Marketing 131. We reaffirm our existing rule that a carrier executing a change for another carrier “is prohibited from using such information to attempt to change the subscriber’s decision to switch to another carrier.” 300 However, because we recognize that a carrier’s retail operations may, without using information obtained in violation of section 222( b), 301 legitimately obtain notice that a customer plans to switch to another carrier or contact a defecting customer in the ordinary course of business, 302 we decline to impose a presumption that all retention efforts are illegal, as requested by MCI WorldCom. 295 CPNI Order, 13 FCC Rcd at 8125- 8126, paras. 84- 85; CPNI Reconsideration Order, 14 FCC Rcd at 14453- 14456, paras. 86- 92. 296 47 U. S. C § 201( b). 297 BellSouth Opposition and Comments at 5, n. 5 (“ Because individual circumstances will differ, the Commission cannot make the declaration MCI WorldCom asks of it.”). 298 MCI WorldCom Petition at 10- 12. 299 Local Competition First Report and Order, 11 FCC Rcd 15499, 15763- 64, 15766- 67 at paras. 518, 521- 23; Ameritech Michigan Order, para. 139 & n. 341. 300 Slamming Order, 14 FCC Rcd at 1572- 73, para. 106. The Commission’s rules are designed to prevent information obtained by a carrier’s wholesale operations with other carriers from being used to benefit its retail operations. See CPNI Reconsideration Order, 14 FCC Rcd. at 14450, paras. 78- 79 (stating, “where a carrier exploits advance notice of a customer change by virtue of its status as the underlying network- facilities or service provider to market to that customer, it does so in violation of section 222( b).”) 301 Section 222( b), entitled “Confidentiality of Carrier Information,” states that a “telecommunications carrier that receives or obtains proprietary information from another carrier for purposes of providing any telecommunications service shall use such information only for such purpose, and shall not use such information for its own marketing efforts.” 47 U. S. C. § 222( b). 302 However, we note that in our experience, such instances are the exception, not the rule. As explained in the CPNI Reconsideration Order, “competition is harmed if any carrier uses carrier- to- carrier information, such as switch or PIC orders, to trigger marketing campaigns, and consequently prohibit such actions accordingly . . . Thus, where a carrier exploits advance notice of a customer change by virtue of its status as the underlying network-( continued….) 58 Federal Communications Commission FCC 02- 214 59 132. Specifically, MCI WorldCom requests the Commission to establish a presumption that any winback 303 efforts be deemed unlawful if undertaken before the new carrier has started providing service. 304 Essentially, MCI WorldCom asks the Commission to change its rules in two ways: first, to re- draw the line between regulation of “retention” and “winback” activities; and second, to alter the legal presumption for “retention” efforts. 305 133. MCI WorldCom does not present any evidence or justification that we have not previously considered for changing this definitional boundary and legal presumption. 306 Further, we agree with BellSouth’s argument that deeming any “winback or retention effort[ s], including those based on information learned through the carrier’s retail operations, . . presumptively unlawful would deprive customers of . . . pro- consumer, pro- competitive benefits.” 307 We note that, to the degree that individual abuses are alleged, the enforcement process provides the proper avenue for resolving such complaints. 134. Finally, we are aware that a number of states are examining the issue of improper winback and retention activities and a number of states have adopted rules governing incumbent LECs’ winback activities. 308 We continue to believe that the states are uniquely qualified to assess the local competitive landscape and determine whether additional safeguards are necessary. Accordingly, we affirm that our rules properly balance concerns regarding the proper (Continued from previous page) facilities or service provider to market to that customer, it does so in violation of section 222( b).” 14 FCC Rcd at 14449- 14450, paras. 77- 78. 303 The Commission defines winback to cover the situation “where the customer has already switched” its service to another carrier. CPNI Reconsideration Order, 14 FCC Rcd at 14444, para. 65. 304 MCI WorldCom Petition at 17. 305 The Commission’s rules regarding “retention” deal with marketing efforts aimed at “soon- to- be- former” customers who have chosen to switch carriers, but have not yet been switched over. CPNI Reconsideration Order, 14 FCC Rcd at 14444, 14448- 49 at paras. 65, 75. Conversely, “winback” refers to marketing efforts to regain a customer that “has already switched to and is receiving service from another provider.” Id. at 14444, para. 65. The Commission’s rules permit carriers to use CPNI for winback marketing, which serves to provide customers more competitive choices. Id. at 14445, para. 67. 306 MCI WorldCom argues that retention regulations should apply until the later of the date on which the old carrier receives a “loss migration notice” or the date that service with the old carrier actually ends. MCI WorldCom Petition at 17. 307 BellSouth Opposition and Comments at 6. 308 See, e. g., Petition of the Southwest Competitive Telephone Association, IP Communications Corp., XO Texas, Inc., ASCENT, CompTel, Sage Telecom, Inc., Z- Tel Communications, and Birch Telecom of Texas, LLP to Amend PUC Substantive Rule 26. 226, Order Denying Petition for Rulemaking and Initiating Investigation, Project No. 24597, Public Utility Commission of Texas (Nov., 8, 2001); Investigation of Winback/ Retention Offers by Chapter 58 Electing Companies, Project No. 24948, Public Utility Commission of Texas; In the Matter of the Commission’s Discussion of Qwest Corporation’s WinBack Promotional Filing, Docket No. N2002.4.44 (May 8, 2002 vote to file a complaint in district court). A variety of other states are considering or have adopted rules governing winback/ retention activities including Florida, Illinois, Indiana, Missouri, North Carolina, and South Carolina. 59 Federal Communications Commission FCC 02- 214 60 use of CPNI with the goals of promoting competition in the marketplace and decline to adopt the presumption that MCI WorldCom suggests. 309 4. Interplay Between Sections 222 and 272 135. We find that our adoption today of an opt- out customer approval mechanism for the use of CPNI by carriers and their affiliates that provide communications- related services does not affect our prior statutory interpretation regarding the interplay between sections 222 and 272, nor does it alter our ultimate conclusion that the term “information” in section 272( c)( 1) 310 does not include CPNI. 311 136. In the CPNI Clarification Order, the Commission sought comment 312 on the interplay between sections 222 and 272 if the customer approval mechanism was revised in light of the Tenth Circuit’s opinion. 313 The Commission noted it might need to revisit its conclusion if it adopted an opt- out approach as a final rule in this proceeding. 314 However, we decline to revisit our interpretation of the interplay between sections 222 and 272 simply because we have amended our customer approval mechanisms. 315 While the Commission addressed the interplay of sections 222 and 272 in the context of an opt- in mechanism, the Commission did not rely on its adoption of the opt- in method in reaching its conclusion. 316 Instead, its decision was based 309 See CPNI Reconsideration Order, 14 FCC Rcd at 14447, para. 72. See also SBC Opposition at 4 (“ MCI’s suggestion should be denied because it does nothing to protect carrier- to- carrier information and does much to harm competition.”). 310 Section 272( c)( 1) states that a Bell operating company (BOC), in dealing with its section 272 affiliate, “may not discriminate between the company or affiliate and any other entity in the provision or procurement of goods, services, facilities, and information, or in the establishment of standards.” 47 U. S. C. § 272( c)( 1) (emphasis added). 311 In the CPNI Order, we found that the term “information” in section 272( c)( 1) does not include CPNI. CPNI Order, 13 FCC Rcd at 8172, para. 154. Our finding in that order overruled our earlier decision in the Non-Accounting Safeguards Order that the term “information” in section 272( c)( 1) includes CPNI. Non- Accounting Safeguards Order, 11 FCC Rcd at 22010, para. 222. We affirmed the CPNI Order finding in the CPNI Reconsideration Order. CPNI Reconsideration Order, 14 FCC Rcd at 14481, para. 137. 312 CPNI Clarification Order, 16 FCC Rcd at 16518- 19, paras. 24- 26. 313 CPNI Clarification Order, 16 FCC Rcd at 16518- 19, paras. 24- 26. We note that AT& T argues that the Tenth Circuit’s opinion vacated all of the Commission’s CPNI Order. According to AT& T, we need to reconsider the interplay between sections 222 and 272. AT& T Comments at 11. As we tentatively concluded in the Clarification Order and affirm in this order, we disagree with AT& T’s interpretation. See section III. B. 1, supra; CPNI Clarification Order, 16 FCC Rcd at 16510, para. 7. 314 CPNI Clarification Order, 16 FCC Rcd at 16519, para. 26. 315 Because we do not revise our earlier decisions for the reasons discussed herein, we do not address the other arguments raised by the BOCs, including their definitions of “provision” and “service” under section 272 and their argument that treating BOC affiliates as unaffiliated entities would violate the BOCs’ First Amendment rights to communicate with their affiliates and customers. SBC Comments at 17, 22- 24; SBC Reply Comments at 9. 316 CPNI Order, 13 FCC Rcd at 8174 -79, paras. 158- 169; CPNI Reconsideration Order, 14 FCC Rcd at 14481- 87, paras. 137- 145. 60 Federal Communications Commission FCC 02- 214 61 upon statutory analysis and application of the terms used in the Act. 317 However, even if we were to review the portion of analysis that discussed the opt- in mechanism, we would still reach the same conclusion, as discussed below. 137. We find that the legal basis for our decision does not change with our modification of the customer approval mechanism. In prior orders, the Commission found that in the context of the 1996 Act, it is not readily apparent that the meaning of “information” in section 272 necessarily includes CPNI. The Commission found that the most reasonable interpretation of the interplay between sections 222 and 272 is that section 272 “does not impose any additional CPNI requirements on BOCs’ sharing of CPNI with their section 272 affiliates when they share information with their section 272 affiliates according to the requirements of section 222.” 318 The Commission found this to be reasonable because, as we have affirmed above, 319 section 222( c)( 1) contemplates that, under the total service approach, carriers have implied approval to market services within the package of services to which the customer subscribes, and can also share CPNI with their affiliates to do so. However, section 272( c)( 1) prohibits BOCs from discriminating against other parties in the provision and procurement of “information.” Thus, if “information” includes CPNI, BOCs would be unable to share CPNI with their affiliates to the extent contemplated by section 222, unless they also met the nondiscrimination requirements of section 272. To meet these requirements, the BOC would be required, under section 222, to seek express approval from its customers to share CPNI with its affiliates and with any third parties. 320 Thus, the Commission found that these requirements, in the context of an opt- in approach, “pose a potentially insurmountable burden because a BOC soliciting approval to share CPNI with its affiliates would have to solicit approval for countless other carriers as well, known or unknown.” 321 138. This rationale is still applicable under the Commission’s new approval mechanism. First, because opt- in is required for third parties, a BOC would still need to obtain express approval for sharing with its 272 affiliates and third parties to meet the nondiscrimination requirements of 272. 322 Applying opt- out to intracompany sharing would not therefore alter the “potentially insurmountable burden” upon BOCs to obtain customer approval 317 CPNI Order, 13 FCC Rcd at 8174- 8176, paras. 160- 162; CPNI Reconsideration Order, 14 FCC Rcd at 14482- 87, paras. 139- 144; In the Matter of AT& T Corp. v. New York Telephone Co., d/ b/ a Bell Atlantic – New York, 15 FCC Rcd 19997, 20004- 05 (2000). The Commission “also listed other rationales, which were independent of Commission’s view that one of Congress’ purposes in enacting 222 was to promote competition.” 318 CPNI Order, 13 FCC Rcd at 8174- 75, 8179, paras. 160, 169; CPNI Reconsideration Order, 14 FCC Rcd at 14480- 81, para. 136. 319 See section III. B. 2, supra. 320 CPNI Order, 13 FCC Rcd at 8174, paras. 158- 59; CPNI Clarification Order, 16 FCC Rcd at 16518- 19, para. 25. 321 CPNI Reconsideration Order, 14 FCC Rcd at 14485, para. 142. 322 A few commenters argue that BOCs’ section 272 affiliates effectively should be treated as third parties instead of intra- company affiliates with respect to the disclosure and use of CPNI to neutralize the BOC affiliates’ “competitive disparity.” AT& T Comments at 15; Nextel Comments at 12- 13. 61 Federal Communications Commission FCC 02- 214 62 either. Even in a completely opt- out environment, a BOC seeking to share CPNI with its affiliates would have to solicit approval for countless other carriers as well, known or unknown. 323 We find that this result is neither required by the statute nor is it necessary to protect consumers’ privacy interests. If we adopted AT& T’s proposal to allow competing carriers to obtain CPNI on the same basis as the BOCs’ 272 affiliates – that is, using an opt- out approval method under the rules adopted today – we would defeat our purpose in requiring opt-in approval for third parties. As described above, we have found that disclosure to and use of CPNI by third parties requires greater assurance of a customer’s knowing consent to prevent unintentional disclosure of CPNI. Therefore, as in our previous orders, we still find that our interpretation best furthers the goals of Congress to protect customer privacy and to promote customer convenience and control. 324 139. At any rate, the Commission has previously concluded that section 222’s customer privacy protections effectively preclude the same anticompetitive behaviors as section 272, and this conclusion is not altered by the Order we adopt today. 325 In the CPNI Reconsideration Order, the Commission outlined three factors in section 222 that eliminate the necessity for the application of section 272’s nondiscrimination requirements to prevent anticompetitive harms. 326 First, competitors are still afforded access to customer CPNI through section 222( c)( 2), which requires disclosure of CPNI to “any person designated by the customer,” upon affirmative written request by the customer. 327 Changing the mechanism for obtaining customer approval under section 222( c)( 1) does not alter the ability of competitors to obtain CPNI through section 222( c)( 2). Second, section 222( c)( 3) continues to allow a LEC to use customer aggregate information only if it provides that information to other carriers upon reasonable request. 328 Again, changing section 222( c)( 1) ’s approval mechanism does not alter the ability of competitors to obtain aggregate information through section 222( c)( 3). 140. Third, the Commission stated that under the opt- in mechanism, BOCs could not share CPNI with their section 272 affiliates unless they either obtained express customer approval or the customer is an existing subscriber of a service of that affiliate. 329 Under the opt-in/ opt- out mechanisms established in this Order, BOCs are allowed to share customer CPNI with 323 CPNI Reconsideration Order, 14 FCC Rcd at 14485, para. 142. 324 CPNI Order, 13 FCC Rcd at 8174- 75, para. 160; CPNI Reconsideration Order, 14 FCC Rcd at 14485, para. 142. 325 CPNI Order, 13 FCC Rcd at 8177, para. 164. We disagree with AT& T’s assertion that the Commission’s decision to “implement an opt- in policy was inextricably intertwined with the interpretation of section 272.” AT& T Comments at 12. The Commission only tangentially discussed the opt- in policy in its prior analysis of the interplay of sections 222 and 272, and AT& T has provided us with no convincing argument to the contrary. 326 CPNI Order, 13 FCC Rcd at 8177- 78, paras. 164- 65. 327 47 U. S. C. § 222( c)( 2). 328 SBC Comments at 21. 329 CPNI Order, 13 FCC Rcd at 8177, para. 164. 62 Federal Communications Commission FCC 02- 214 63 their section 272 affiliates without obtaining express customer approval. Under the opt- out approval mechanism we adopt today, BOCs must still provide customer notice and the opportunity for customers to opt out for CPNI uses beyond the existing carrier- customer relationship prior to sharing CPNI with an affiliate. 330 However, as a practical matter, it is likely that the BOCs will be able to share more CPNI with their 272 affiliates under opt- out than they would have been able to share under opt- in. As shown above, consumers typically will accept whatever choice does not require any action on their part. 331 As a result, when the default is opt-out, carriers will be able to use more customer CPNI. 332 141. The possibility that BOCs will share more CPNI with their affiliates does not tip the scale to require application of section 272 to CPNI. 333 First, section 222 applies to all “telecommunications carriers” and does not single out any carriers for specific treatment, signaling Congress’ intent that all carriers should be treated alike in the CPNI context. For example, an interexchange carrier with a significant customer base can share CPNI, after receiving opt- out approval, with its local or wireless affiliates. Thus, under our rules, all carriers can share CPNI with their affiliates. Accordingly, we decline to place additional restrictions upon BOCs. Second, section 272( g) allows BOCs and their section 272 affiliates to market their services jointly. 334 A fair reading of that section indicates that Congress did not intend to preclude BOCs and their long distance affiliates from conducting joint marketing, which is the primary intent behind CPNI use. 335 As we found in earlier orders, we believe our conclusion is therefore consistent with the “regulatory symmetry Congress intended for carrier marketing activities.” 336 142. Finally, numerous commenters used the Further NPRM as an opportunity to reargue the statutory and policy issues that we have previously addressed and that are unrelated 330 Under the total service approach, carriers can use a customer’s CPNI to market services with the parameters of the existing customer- carrier relationship. See section III. B. 2, infra. So a carrier’s affiliate could use the CPNI without notice and approval if the affiliate were marketing the same services the customer already uses. 331 See section III. A, supra. 332 Id. 333 Sections 251 and 201( b) ensure that BOCs disclose customer information in connection with their interconnection obligations and by requiring the BOC to act in a reasonable manner. SBC Comments at 21. 334 47 U. S. C. § 272( g). 335 Several commenters agree with us that section 272( g) allows the BOCs to conduct joint marketing with their 272 affiliates, while arguing that if the BOCs’ 272 affiliates use BOC customer CPNI, the BOCs must provide that CPNI to competitive carriers. ASCENT Reply Comments at 7; AT& T Reply Comments at 19; Excel Reply Comments at 12; WorldCom Reply Comments at 9. The exact nature of BOC/ 272 affiliate joint marketing was not explicitly detailed in the statute, and therefore we must decide what is permissible. For all the reasons described above, we have drawn the line more broadly than the commenters would like. 336 CPNI Order, 13 FCC Rcd at 8178, para. 167. 63 Federal Communications Commission FCC 02- 214 64 to the issue before us. 337 AT& T and other commenters that request we reverse our holding in the CPNI Order do not get yet another “bite at the apple.” The Commission has previously considered these arguments in both the CPNI Order and the CPNI Reconsideration Order. 338 The Further NPRM did not request comment on these issues, and commenters have not presented changed circumstances, new evidence or additional arguments that would affect our prior decisions. Therefore, we decline to address them again here. IV. THIRD FURTHER NOTICE OF PROPOSED RULEMAKING 143. In this Further Notice of Proposed Rulemaking, we seek to refresh the record on two issues raised in the CPNI Order Further NPRM and we request comment on an issue of emerging importance, CPNI implications when a carrier goes out of business, sells all or part of its customer base, or seeks bankruptcy protection. A. Regulation of Foreign Storage of and Access to Domestic CPNI 144. In a July 8, 1997 Ex Parte letter, the FBI requested that the Commission regulate the foreign storage of and foreign- based access to CPNI of U. S. customers who use domestic telecommunications services. 339 The Commission requested comment on this proposal in its CPNI Order Further NPRM. 340 As an alternative, the FBI suggested that foreign storage or access to domestic CPNI be permitted only upon informed written customer approval. To the degree that CPNI is stored in a foreign country, the FBI asked that the Commission require carriers to keep a copy of customers’ CPNI records within the U. S. for public safety, law enforcement, and national security reasons. The FBI also requested that we require carriers to maintain copies of the CPNI of all U. S.- based customers because of the need for prompt and secure law enforcement purposes. The Commission now requests that commenters refresh the record on this topic. Specifically, we request that commenters consider the FBI proposal in light of heightened national security concerns. In addition, we request input as to whether any of the concerns raised by the FBI have been realized since comments were received on this topic. Finally, we ask commenters to provide estimates of the costs that would be incurred if we were to mandate carriers to maintain the domestic storage of, and access to, domestic CPNI. 337 Commenters argue that (1) the Commission’s statutory interpretation is incorrect and (2) BOCs must “operate independently” and therefore be treated as third parties. AT& T Comments at 12- 15; WorldCom Comments at 11; ASCENT Reply Comments at 3; Excel Reply Comments at 7- 10. WorldCom also argues that, with an opt- out mechanism, sections 222 and 272 are not in conflict. WorldCom Reply at 6. 338 CPNI Order, 13 FCC Rcd at 8174- 79, paras. 158- 169; CPNI Reconsideration Order, 14 FCC Rcd at 14481- 87, paras. 137- 145. 339 Letter from John F. Lewis, Jr., Federal Bureau of Investigation, to William F. Caton, Acting Secretary, Federal Communications Commission, CC Docket No. 96- 115 (filed July 8, 1997) (FBI July 8, 1998 Ex Parte Letter). 340 CPNI Order, 13 FCC Rcd at 8203- 8204, paras. 208- 210. 64 Federal Communications Commission FCC 02- 214 65 B. Protections for Carrier Information and Enforcement Mechanisms 145. In the CPNI Order Further NPRM, 341 the Commission sought comment on what safeguards in addition to those adopted in the CPNI Order, if any, are needed to protect the confidentiality of carrier proprietary information (CPI), including that of resellers and ISPs. The CPNI Order Further NPRM also sought comment on what, if any, further enforcement mechanisms the Commission should adopt to ensure carrier compliance with our CPNI policies and rules. 342 We seek to refresh the record on this topic. Specifically, we request that in light of the fact that carriers and other interested parties have actual experience with problems, commenters describe what, if any, problems have occurred since we originally issued the CPNI Order Further NPRM. C. CPNI Implications When a Carrier Goes Out of Business 146. In light of inquiries the Commission has received in the face of recent carrier bankruptcies, mergers, and asset sales, the Commission seeks comment on carrier use and disclosure of CPNI when it sells its assets or goes out of business. We seek comment on whether an exiting carrier should be able to use CPNI for transition of its customers to another carrier. If commenters believe that an exiting carrier should be able to disclose CPNI to the acquiring carrier, should we require the exiting carrier to state that fact in advance notice provided to customers acquired by the sale or transfer from another carrier in compliance with our authorization and verification (slamming) rules? 343 Further, to the degree that the exiting carrier has obtained CPNI approvals from its customer, should the new carrier be deemed to have received such approvals, or should it be required to provide notice and obtain approval for CPNI use and disclosure from the acquired customers? Also, what is the proper application of section 222 to DSL providers? Will this applicability change if the Commission adopts the tentative conclusions in the Wireline Broadband NPRM? 344 147. Further, should the Commission recognize a difference between service types? For example, the Commission might allow more liberal CPNI sharing to effectuate a LEC’s customer base transition than other types of service to ensure that customers continue to receive dial tone. We also seek comment on whether carriers can sell CPNI as an asset. If not, is such a limitation constitutional? Would such regulations go beyond the scope of section 222 or the Commission’s authority? 345 341 CPNI Order, 13 FCC Rcd at 8201- 8202, paras. 206- 207. 342 Id. 343 47 C. F. R. § 64. 1120( e) and orders in CC Docket No. 00- 257. 344 Appropriate Framework for Broadband Access to the Internet Over Wireline Facilities, Universal Service Obligations of Broadband Providers, CC Docket No. 02- 33, Notice of Proposed Rulemaking (rel. Feb. 15, 2002). 345 Qwest Comments at 15, n. 52. 65 Federal Communications Commission FCC 02- 214 66 V. PROCEDURAL MATTERS A. Third Report and Order 1. Final Regulatory Flexibility Analysis 148. As required by the Regulatory Flexibility Act, as amended, (RFA), 346 an Initial Regulatory Flexibility Analysis (IRFA) was incorporated in the CPNI Clarification Order Further NPRM. 347 The Commission sought written public comment on the proposals in the CPNI Clarification Order Further NPRM, including comment on the IRFA. Appendix C sets forth a Final Regulatory Flexibility Analysis for the present Report and Order. 2. Final Paperwork Reduction Act Analysis 149. This Order contains new and modified information collections subject to the Paperwork Reduction Act of 1995 (PRA), Public Law 104- 13. It will be submitted to the Office of Management and Budget (OMB) for review under Section 3507( d) of the PRA. OMB, the general public, and other Federal agencies are invited to comment on the new or modified information collection( s) contained in this proceeding. Implementation of these new or modified reporting and/ or recordkeeping requirements will be subject to approval by the OMB, as prescribed by the Act, and will go into effect upon announcement in the Federal Register of OMB approval. B. Third Further Notice of Proposed Rulemaking 1. Ex Parte Presentations 150. These matters shall be treated as a “permit- but- disclose” proceeding in accordance with the Commission’s ex parte rules. 348 Persons making oral ex parte presentations are reminded that memoranda summarizing the presentations must contain summaries of the substance of the presentations and not merely a listing of the subjects discussed. More than a one or two sentence description of the views and arguments presented is generally required. 349 Other rules pertaining to oral and written presentations are set forth in section 1.1206( b) as well. 2. Initial Regulatory Flexibility Act Analysis 151. Appendix D sets forth the Commission’s IRFA regarding policies and rules proposed in the Third Further NPRM. Written public comments are requested on this IRFA. 346 See 5 U. S. C. § 603. The RFA, 5 U. S. C. §§ 601- 612, has been amended by the Small Business Regulatory Enforcement Fairness Act of 1996 (SBREFA), Pub. L. No. 104- 121, Title II, 110 Stat. 857 (1996). 347 See CPNI Clarification Order, 16 FCC Rcd at 16527- 37. 348 47 C. F. R. §§ 1. 1200 et seq. 349 See 47 C. F. R. § 1.1206( b)( 2). 66 Federal Communications Commission FCC 02- 214 67 Comments must be identified as responses to the IRFA and must be filed by the deadlines for comments on the Third Further NPRM. The Commission will send a copy of the Third Further NPRM, including this IRFA, to the Chief Counsel for Advocacy of the Small Business Administration. 350 In addition, the Third Further NPRM and IRFA (or summaries thereof) will be published in the Federal Register. 351 3. Initial Paperwork Reduction Act Analysis 152. This Third Further NPRM may modify an information collection. As part of our continuing effort to reduce paperwork burdens, we invite the general public and the Office of Management and Budget (OMB) to take this opportunity to comment on the possible changes in information collections contained in this Third Further NPRM, as required by the Paperwork Reduction Act of 1995, Pub. L. No. 104- 13. Public and agency comments are due at the same time as other comments on this NPRM; OMB comments are due 60 days from date of publication of this Third Further NPRM in the Federal Register. Comments should address: (1) whether the possible changes in the collections of information are necessary for the proper performance of the functions of the Commission, including whether the information will have practical utility; (2) the accuracy of the Commission’s burden estimates; (3) ways to enhance the quality, utility, and clarity of any information collected; and (4) ways to minimize the burden of any collection of information on the respondents, including the use of automated collection techniques or other forms of information technology. 4. Comment Filing Procedures 153. Pursuant to Sections 1.415 and 1.419 of the Commission’s rules, 47 C. F. R. §§ 1.415, 1.419, interested parties may file comments on or before 30 days after Federal Register Publication of this NPRM, and reply comments on or before 60 days after Federal Register Publication of this NPRM. Comments may be filed using the Commission’s Electronic Comment Filing System (ECFS) or by filing paper copies. See Electronic Filing of Documents in Rulemaking Proceedings, 63 Fed. Reg. 24121 (1998). 154. Comments filed through the ECFS can be sent as an electronic file via the Internet to . Generally, only one copy of an electronic submission must be filed. If multiple dockets or rulemaking numbers appear in the caption of this proceeding, however, commenters must transmit one electronic copy of the comments to each docket or rulemaking number referenced in the caption. In completing the transmittal screen, commenters should include their full name, U. S. Postal Service mailing address, and the applicable docket or rulemaking number. Parties may also submit an electronic comment by Internet e- mail. To get filing instructions for e- mail comments, commenters should send an e-mail to ecfs@ fcc. gov, and should include the following words in the body of the message, “get form .” A sample form and directions will be sent in reply. Parties who choose to file by paper must file an original and four copies of each filing. In more than one 350 See 5 U. S. C. § 603( a). 351 Id. 67 Federal Communications Commission FCC 02- 214 68 docket or rulemaking number appear in the caption of this proceeding, commenters must submit two additional copies for each additional docket or rulemaking number. Filings can be sent by hand or messenger delivery, by commercial overnight courier, or by first- class or overnight U. S. Postal Service mail (although we continue to experience delays in receiving U. S. Postal Service mail). The Commission’s contractor, Vistronix, Inc., will receive hand- delivered or messenger-delivered paper filings for the Commission’s Secretary at 236 Massachusetts Ave., N. E., Suite 110, Washington, D. C., 20002. The filing hours at this location are 8: 00 a. m. to 7: 00 p. m. All hand deliveries must be held together with rubber bands or fasteners. Any envelopes must be disposed of before entering the building. Commercial overnight mail (other than U. S. Postal Service Express Mail or Priority Mail) must be sent to 9300 East Hampton Drive, Capitol Heights, MD 20743. U. S. Postal Service first- class mail, Express Mail, and Priority Mail should be addressed to 445 12 th Street, SW, Washington, D. C. 20554. All filings must be addressed to the Commission’s Secretary, Office of the Secretary, Federal Communications Commission. VI. ORDERING CLAUSES 155. Accordingly, IT IS ORDERED, pursuant to Sections 1, 4( i), 222 and 303( r) of the Communications Act of 1934, as amended, 47 U. S. C. §§ 151, 154( i), 222 and 303( r ), that the Third Report and Order and Third Further Notice of Proposed Rulemaking in CC Docket Nos. 96- 115, 96- 149, and 00- 257 ARE ADOPTED, and that Part 64 of the Commission’s rules, 47 C. F. R. Part 64, is amended as set forth in Appendix B. The requirements of this Order shall become effective 30 days after publication of a summary thereof in the Federal Register. Sections 64.2007, 64.2008, and 64.2009 contain new or modified information collections that have not been approved by OMB. The Commission will publish a document in the Federal Register announcing the effective date of these rules. 156. IT IS FURTHER ORDERED that the collection of information contained herein is contingent upon approval by the Office of Management and Budget. 157. IT IS FURTHER ORDERED that the California Public Utilities Commission’s Motion to Accept Late- Filed Comments is hereby GRANTED. 158. IT IS FURTHER ORDERED that, pursuant to sections 1, 4( i), 10 and 222 of the Communications Act of 1934, as amended, 47 U. S. C. §§ 151, 154( i), 160 and 222, MCI WorldCom’s Petition for Further Reconsideration IS GRANTED to the extent indicated herein and otherwise DENIED. 159. IT IS FURTHER ORDERED that the Commission’s Consumer and Governmental Affairs Bureau, Reference Information Center, SHALL SEND a copy of this Third Report and Order, including the Final Regulatory Flexibility Analysis, to the Chief Counsel for Advocacy of the Small Business Administration. FEDERAL COMMUNICATIONS COMMISSION Marlene H. Dortch Secretary 68 Federal Communications Commission FCC 02- 214 APPENDIX A Comments Filed ALLTEL Communications, Inc. AT& T Corp. AT& T Wireless Services, Inc. ATX Technologies, Inc. Association of Communications Enterprises (ASCENT) BellSouth Corporation California Public Utility Commission (Cal. PUC) Cellular Telecommunications & Internet Association (CTIA) CenturyTel, Inc. Cingular Wireless LLC Competition Policy Institute (CPI) Direct Marketing Association Electronic Privacy Information Center, American Civil Liberties Union, American Library Association, Center for Digital democracy, Center for Media Education, Computer Professionals for Social Responsibility, Consumer Action, Consumer federation of America, Junkbusters, Media Access, PrivacyActivism, Privacy Journal, Privacy Right Clearinghouse, Privacy Times, Public Citizens Litigation Group, and US PIRG (EPIC et al.) Intellione Inc. Mpower Communications Corp. National Association of Regulatory Utility Commissioners (NARUC) National Telephone Cooperative Association (NTCA) Nextel Communications, Inc. Organization for the Promotion and Advancement of Small Telecommunications Companies (OPASTCO) Qwest Services Corporation SBC Communications, Inc. Sprint Corporation United States Telecom Association (USTA) VarTec Telecom, Inc. Verizon Verizon Wireless WorldCom, Inc. 69 Federal Communications Commission FCC 02- 214 2 Reply Comments Filed Association of Communications Enterprises (ASCENT) AT& T Corp. ATX Technologies, Inc. CTSI, LLC Direct Marketing Association (DMA) EPIC et al. Excel Communications, Inc. Intelligent Transportation Society of America (ITSA) Mercedes- Benz USA, LLC National Association of Regulatory Utility Commissioners (NARUC) Progress & Freedom Foundation (PFF) Qwest Services Corporation SBC Communications, Inc. United States Telecom Association (USTA) VarTec Telecom, Inc. Verizon Verizon Wireless WorldCom, Inc. 70 Federal Communications Commission FCC 02- 214 APPENDIX B – Final Rules Part 64 of Title 47 of the Code of Federal Regulations is revised to read as follows: * * * * * Subpart U – Customer Proprietary Network Information § 64.2001 Basis and Purpose. (a) Basis. The rules in this subpart are issued pursuant to the Communications Act of 1934, as amended. (b) Purpose. The purpose of the rules in this subpart is to implement section 222 of the Communications Act of 1934, as amended, 47 U. S. C. § 222. § 64.2003 Definitions. Terms in this subpart have the following meanings: (a) Affiliate. The term “affiliate” has the same meaning given such term in section 3( 1) of the Communications Act of 1934, as amended, 47 U. S. C. § 153( 1). (b) Communications- related services. The term “communications- related services” means telecommunications services, information services typically provided by telecommunications carriers, and services related to the provision or maintenance of customer premises equipment. (c) Customer. A customer of a telecommunications carrier is a person or entity to which the telecommunications carrier is currently providing service. (d) Customer proprietary network information (CPNI). The term “customer proprietary network information (CPNI)” has the same meaning given to such term in section 222( h)( 1) of the Communications Act of 1934, as amended, 47 U. S. C. § 222( h)( 1). (e) Customer premises equipment (CPE). The term “customer premises equipment (CPE)” has the same meaning given to such term in section 3( 14) of the Communications Act of 1934, as amended, 47 U. S. C. §153( 14). (f) Information services typically provided by telecommunications carriers. The phrase "information services typically provided by telecommunications carriers" means only those information services (as defined in section 3( 20) of the Communications Act of 1934, as amended, 47 U. S. C. § 153( 2)) that are typically provided by telecommunications carriers, such 71 Federal Communications Commission FCC 02- 214 2 as Internet access or voice mail services. Such phrase “information services typically provided by telecommunications carriers," as used in this subpart, shall not include retail consumer services provided using Internet websites (such as travel reservation services or mortgage lending services), whether or not such services may otherwise be considered to be information services. (g) Local exchange carrier (LEC). The term “local exchange carrier (LEC)” has the same meaning given to such term in section 3( 26) of the Communications Act of 1934, as amended, 47 U. S. C. § 153( 26). (h) Opt- in approval. The term “opt- in approval” refers to a method for obtaining customer consent to use, disclose, or permit access to the customer’s CPNI. This approval method requires that the carrier obtain from the customer affirmative, express consent allowing the requested CPNI usage, disclosure, or access after the customer is provided appropriate notification of the carrier’s request consistent with the requirements set forth in this subpart. (i) Opt- out approval. The term “opt- out approval” refers to a method for obtaining customer consent to use, disclose, or permit access to the customer’s CPNI. Under this approval method, a customer is deemed to have consented to the use, disclosure, or access to the customer’s CPNI if the customer has failed to object thereto within the waiting period described in section 64.2009( d)( 1) of this subpart, after the customer is provided appropriate notification of the carrier’s request for consent consistent with the rules in this subpart. (j) Subscriber list information (SLI). The term “subscriber list information (SLI)” has the same meaning given to such term in section 222( h)( 3) of the Communications Act of 1934, as amended, 47 U. S. C. § 222( h)( 3). (k) Telecommunications carrier or carrier. The terms “telecommunications carrier” or “carrier” shall have the same meaning as set forth in section 3( 44) of the Communications Act of 1934, as amended, 47 U. S. C. §153( 44). (l) Telecommunications service. The term “telecommunications service” has the same meaning given to such term in section 3( 46) of the Communications Act of 1934, as amended, 47 U. S. C. §153( 46). § 64.2005 Use of Customer Proprietary Network Information Without Customer Approval. (a) Any telecommunications carrier may use, disclose, or permit access to CPNI for the purpose of providing or marketing service offerings among the categories of service (i. e., local, interexchange, and CMRS) to which the customer already subscribes from the same carrier, without customer approval. (1) If a telecommunications carrier provides different categories of service, and a customer subscribes to more than one category of service offered by the carrier, the carrier is 72 Federal Communications Commission FCC 02- 214 3 permitted to share CPNI among the carrier's affiliated entities that provide a service offering to the customer. (2) If a telecommunications carrier provides different categories of service, but a customer does not subscribe to more than one offering by the carrier, the carrier is not permitted to share CPNI with its affiliates, except as provided in section 64.2007( b). (b) A telecommunications carrier may not use, disclose, or permit access to CPNI to market to a customer service offerings that are within a category of service to which the subscriber does not already subscribe from that carrier, unless that carrier has customer approval to do so, except as described in paragraph (c) of this section. (1) A wireless provider may use, disclose, or permit access to CPNI derived from its provision of CMRS, without customer approval, for the provision of CPE and information service( s). A wireline carrier may use, disclose or permit access to CPNI derived from its provision of local exchange service or interexchange service, without customer approval, for the provision of CPE and call answering, voice mail or messaging, voice storage and retrieval services, fax store and forward, and protocol conversion. (2) A telecommunications carrier may not use, disclose or permit access to CPNI to identify or track customers that call competing service providers. For example, a local exchange carrier may not use local service CPNI to track all customers that call local service competitors. (c) A telecommunications carrier may use, disclose, or permit access to CPNI, without customer approval, as described in this subparagraph (c). (1) A telecommunications carrier may use, disclose, or permit access to CPNI, without customer approval, in its provision of inside wiring installation, maintenance, and repair services. (2) CMRS providers may use, disclose, or permit access to CPNI for the purpose of conducting research on the health effects of CMRS. (3) LECs and CMRS providers may use CPNI, without customer approval, to market services formerly known as adjunct- to- basic services, such as, but not limited to, speed dialing, computer- provided directory assistance, call monitoring, call tracing, call blocking, call return, repeat dialing, call tracking, call waiting, caller I. D., call forwarding, and certain centrex features. (d) A telecommunications carrier may use, disclose or permit access to CPNI to protect the rights or property of the carrier, or to protect users of those services and other carriers from fraudulent, abusive, or unlawful use of, or subscription to, such services. § 64.2007 Approval Required for Use of Customer Proprietary Network Information. (a) A telecommunications carrier may obtain approval through written, oral or electronic 73 Federal Communications Commission FCC 02- 214 4 methods. (1) A telecommunications carrier relying on oral approval shall bear the burden of demonstrating that such approval has been given in compliance with the Commission's rules in this part. (2) Approval or disapproval to use, disclose, or permit access to a customer’s CPNI obtained by a telecommunications carrier must remain in effect until the customer revokes or limits such approval or disapproval. (3) A telecommunications carrier must maintain records of approval, whether oral, written or electronic, for at least one year. (b) Use of Opt- Out and Opt- In Approval Processes. (1) A telecommunications carrier may, subject to opt- out approval or opt- in approval, use its customer’s individually identifiable CPNI for the purpose of marketing communications-related services to that customer. A telecommunications carrier may, subject to opt- out approval or opt- in approval, disclose its customer’s individually identifiable CPNI, for the purpose of marketing communications- related services to that customer, to (i) its agents, (ii) its affiliates that provide communications- related services, and (iii) its joint venture partners and independent contractors. A telecommunications carrier may also permit such persons or entities to obtain access to such CPNI for such purposes. Any such disclosure to or access provided to joint venture partners and independent contractors shall be subject to the safeguards set forth below in paragraph (2) of this subsection (b). (2) Joint Venture/ Contractor Safeguards. A telecommunications carrier that discloses or provides access to CPNI to its joint venture partners or independent contractors shall enter into confidentiality agreements with independent contractors or joint venture partners that comply with the following requirements. The confidentiality agreement shall: (A) require that the independent contractor or joint venture partner use the CPNI only for the purpose of marketing or providing the communications- related services for which that CPNI has been provided; (B) disallow the independent contractor or joint venture partner from using, allowing access to, or disclosing the CPNI to any other party, unless required to make such disclosure under force of law; (C) require that the independent contractor or joint venture partner have appropriate protections in place to ensure the ongoing confidentiality of consumers’ CPNI. (3) Except for use and disclosure of CPNI that is permitted without customer approval under section 64.2005, or that is described in paragraph (1) of this section, or as otherwise provided in section 222 of the Communications Act of 1934, as amended, a telecommunications carrier may only use, disclose, or permit access to its customer’s individually identifiable CPNI subject to opt- in approval. 74 Federal Communications Commission FCC 02- 214 5 § 64.2008 Notice Required for Use of Customer Proprietary Network Information (a) Notification, Generally. (1) Prior to any solicitation for customer approval, a telecommunications carrier must provide notification to the customer of the customer's right to restrict use of, disclosure of, and access to that customer's CPNI. (2) A telecommunications carrier must maintain records of notification, whether oral, written or electronic, for at least one year. (b) Individual notice to customers must be provided when soliciting approval to use, disclose, or permit access to customers’ CPNI. (c) Content of Notice. Customer notification must provide sufficient information to enable the customer to make an informed decision as to whether to permit a carrier to use, disclose, or permit access to, the customer's CPNI. (1) The notification must state that the customer has a right, and the carrier has a duty, under federal law, to protect the confidentiality of CPNI. (2) The notification must specify the types of information that constitute CPNI and the specific entities that will receive the CPNI, describe the purposes for which CPNI will be used, and inform the customer of his or her right to disapprove those uses, and deny or withdraw access to CPNI at any time. (3) The notification must advise the customer of the precise steps the customer must take in order to grant or deny access to CPNI, and must clearly state that a denial of approval will not affect the provision of any services to which the customer subscribes. However, carriers may provide a brief statement, in clear and neutral language, describing consequences directly resulting from the lack of access to CPNI. (4) The notification must be comprehensible and must not be misleading. (5) If written notification is provided, the notice must be clearly legible, use sufficiently large type, and be placed in an area so as to be readily apparent to a customer. (6) If any portion of a notification is translated into another language, then all portions of the notification must be translated into that language. (7) A carrier may state in the notification that the customer's approval to use CPNI may enhance the carrier's ability to offer products and services tailored to the customer's needs. A carrier also may state in the notification that it may be compelled to disclose CPNI to any person upon affirmative written request by the customer. (8) A carrier may not include in the notification any statement attempting to encourage a customer to freeze third- party access to CPNI. 75 Federal Communications Commission FCC 02- 214 6 (9) The notification must state that any approval, or denial of approval for the use of CPNI outside of the service to which the customer already subscribes from that carrier is valid until the customer affirmatively revokes or limits such approval or denial. (10) A telecommunications carrier's solicitation for approval must be proximate to the notification of a customer's CPNI rights. (d) Notice Requirements Specific to Opt- Out. A telecommunications carrier must provide notification to obtain opt- out approval through electronic or written methods, but not by oral communication (except as provided in paragraph (f) of this section). The contents of any such notification must comply with the requirements of subsection (c) of this section. (1) Carriers must wait a 30- day minimum period of time after giving customers notice and an opportunity to opt- out before assuming customer approval to use, disclose, or permit access to CPNI. A carrier may, in its discretion, provide for a longer period. Carriers must notify customers as to the applicable waiting period for a response before approval is assumed. (A) In the case of an electronic form of notification, the waiting period shall begin to run from the date on which the notification was sent. (B) In the case of notification by mail, the waiting period shall begin to run on the third day following the date that the notification was mailed. (2) Carriers using the opt- out mechanism must provide notices to their customers every two years. (3) Telecommunications carriers that use e- mail to provide opt- out notices must comply with the following requirements in addition to the requirements generally applicable to notification: (A) carriers must obtain express, verifiable, prior approval from consumers to send notices via e- mail regarding their service in general, or CPNI in particular; (B) carriers must allow customers to reply directly to e- mails containing CPNI notices in order to opt- out; (C) opt- out e- mail notices that are returned to the carrier as undeliverable must be sent to the customer in another form before carriers may consider the customer to have received notice; and (D) carriers that use e- mail to send CPNI notices must ensure that the subject line of the message clearly and accurately identifies the subject matter of the e- mail. (E) Telecommunications carriers must make available to every customer a method to opt- out that is of no additional cost to the customer and that is available 24 hours a day, seven days a week. Carriers may satisfy this requirement through a combination of methods, so long as 76 Federal Communications Commission FCC 02- 214 7 all customers have the ability to opt- out at no cost and are able to effectuate that choice whenever they choose. (e) Notice Requirements Specific to Opt- In. (1) A telecommunications carrier may provide notification to obtain opt- in approval through oral, written, or electronic methods. The contents of any such notification must comply with the requirements of subsection (c) of this section. (f) Notice Requirements Specific to One- Time Use of CPNI. Carriers may use oral notice to obtain limited, one- time use of CPNI for inbound and outbound customer telephone contacts for the duration of the call, regardless of whether carriers use opt- out or opt- in approval based on the nature of the contact. (1) The contents of any such notification must comply with the requirements of subsection (c) of this section, except that telecommunications carriers may omit any of the following notice provisions if not relevant to the limited use for which the carrier seeks CPNI: (A) carriers need not advise customers that if they have opted- out previously, no action is needed to maintain the opt- out election. (B) carriers need not advise customers that they may share CPNI with their affiliates or third parties and need not name those entities, if the limited CPNI usage will not result in use by, or disclosure to, an affiliate or third party. (C) carriers need not disclose the means by which a customer can deny or withdraw future access to CPNI, so long as carriers explain to customers that the scope of the approval the carrier seeks is limited to one- time use. (D) carriers may omit disclosure of the precise steps a customer must take in order to grant or deny access to CPNI, as long as the carrier clearly communicates that the customer can deny access to his CPNI for the call. § 64.2009 Safeguards Required for Use of Customer Proprietary Network Information (a) Telecommunications carriers must implement a system by which the status of a customer’s CPNI approval can be clearly established prior to the use of CPNI. (b) Telecommunications carriers must train their personnel as to when they are, and are not, authorized to use CPNI, and carriers must have an express disciplinary process in place. (c) All carriers shall maintain a record, electronically or in some other manner, of their own and their affiliates’ sales and marketing campaigns that use their customers’ CPNI. All carriers shall maintain a record of all instances where CPNI was disclosed or provided to third parties, or where third parties were allowed access to CPNI. The record must include a description of each campaign, the specific CPNI that was used in the campaign, and what 77 Federal Communications Commission FCC 02- 214 8 products and services were offered as a part of the campaign. Carriers shall retain the record for a minimum of one year. (d) Telecommunications carriers must establish a supervisory review process regarding carrier compliance with the rules in this subpart for outbound marketing situations and maintain records of carrier compliance for a minimum period of one year. Specifically, sales personnel must obtain supervisory approval of any proposed outbound marketing request for customer approval. (e) A telecommunications carrier must have a corporate officer, as an agent of the carrier, sign a compliance certificate on an annual basis stating that the officer has personal knowledge that the company has established operating procedures that are adequate to ensure compliance with the rules in this subpart. The carrier must provide a statement accompanying the certificate explaining how its operating procedures ensure that it is, or is not, in compliance with the rules in this subpart. (f) Carriers must provide written notice within five business days to the Commission of any instance where the opt- out mechanisms do not work properly, to such a degree that consumers’ inability to opt- out is more than an anomaly. (1) The notice shall be in the form of a letter, and shall include the carrier’s name, a description of the opt- out mechanism( s) used, the problem( s) experienced, the remedy proposed and when it will be/ was implemented, whether the relevant state commission( s) has been notified and whether it has taken any action, a copy of the notice provided to customers, and contact information. (2) Such notice must be submitted even if the carrier offers other methods by which consumers may opt- out. 78 Federal Communications Commission FCC 02- 214 APPENDIX C – FINAL REGULATORY FLEXIBILITY ANALYSIS 1. As required by the Regulatory Flexibility Act, as amended, (RFA), 1 an Initial Regulatory Flexibility Analysis (IRFA) was incorporated in the Clarification Order and Second Further Notice of Proposed Rulemaking issued in CC Docket No. 96- 115 and CC Docket No. 96- 149. 2 The Commission sought written public comment on the proposals in the Notice, including comment on the IRFA. This present Final Regulatory Flexibility Analysis (FRFA) conforms to the RFA. 3 A. Need for, and Objectives of, the Third Report and Order 2. The initial need for the proceeding of which this Report and Order is a part is that on May 17, 1996, the Commission initiated a rulemaking in response to requests for guidance from the telecommunications industry regarding the obligations of telecommunications carriers under section 222 of the Act and related issues. 4 The Commission released the CPNI Order on February 26, 1998, in which it addressed the scope and meaning of section 222 and promulgated implementing regulations. 5 On August 18, 1999, the Tenth Circuit issued an opinion vacating a portion of the CPNI Order in U S WEST v. FCC. 6 That left the Commission with a need to clarify the CPNI rules and their future operation. We do so herein. 3. On August 28, 2001, the Commission adopted an order (CPNI Clarification Order) clarifying the status of its CPNI rules in light of the Tenth Circuit order and issuing a Further Notice of Proposed Rulemaking (Clarification Order Further NPRM). 7 Specifically, the 1 See 5 U. S. C. § 603. The RFA, 5 U. S. C. §§ 601- 612, has been amended by the Small Business Regulatory Enforcement Fairness Act of 1996 (SBREFA), Pub. L. No. 104- 121, Title II, 110 Stat. 857 (1996). 2 Implementation of the Telecommunications Act of 1996; Telecommunications Carriers’ Use of Customer Proprietary Network Information and Other Customer Information; Implementation of the Non- Accounting Safeguards of Sections 271 and 272 of the Communications Act of 1934, as Amended, Clarification Order and Second Further Notice of Proposed Rulemaking, 16 FCC Rcd at 16527- 16537 (2001) (CPNI Clarification Order). 3 See 5 U. S. C. § 604. 4 In the Matter of Implementation of the Telecommunications Act of 1996; Telecommunications Carriers’ Use of Customer Proprietary Network Information and Other Customer Information, Notice of Proposed Rulemaking, 11 FCC Rcd 12513 (1996) (1996 NPRM). See also section II. A, supra 5 Implementation of the Telecommunications Act of 1996: Telecommunications Carriers’ Use of Customer Proprietary Network Information and Other Customer Information; and Implementation of the Non- Accounting Safeguards of Sections 271 and 272 of the Communications Act of 1934, as amended; Second Report and Order and Further Notice of Proposed Rulemaking, 13 FCC Rcd 8061 (1998) (CPNI Order). See also section II. B, supra. 6 U. S. WEST, Inc. v. FCC, 182 F. 3d 1224 (10 th Cir. 1999), cert. denied, 530 U. S. 1213 (June 5, 2000) (No. 99-1427) (U S WEST v. FCC). 7 Implementation of the Telecommunications Act of 1996; Telecommunications Carriers’ Use of Customer Proprietary Network Information and Other Customer Information; Implementation of the Non- Accounting Safeguards of Sections 271 and 272 of the Communications Act of 1934, as Amended; Clarification Order and Second Further Notice of Proposed Rulemaking, 16 FCC Rcd 16506 (2001) (CPNI Clarification Order). 79 Federal Communications Commission FCC 02- 214 2 Commission sought comment on (1) its interpretation of the scope of the Tenth Circuit order; (2) what type of approval (opt- in or opt- out) would best serve the government’s goals while respecting constitutional limits; 8 (3) ways in which consumers can consent to a carrier’s use of their CPNI; 9 (4) what methods of approval would serve the governmental interests at issue and afford informed consent, while also satisfying the First Amendment’s requirement that any restrictions on speech be narrowly tailored; 10 (5) the interests and policies underlying section 222 that are relevant to formulating an approval requirement, including an analysis of the privacy interests that are at issue, and on the extent to which it should take competitive concerns into account; 11 (6) the likely difference in competitive harms under opt- in and opt- out approvals; and (7) whether adoption of an opt- out mechanism is consistent with the rationale for the total service approach set forth in the CPNI Order. 12 In addition, the Commission sought comment on whether its consent mechanism would affect its previous findings on the interplay between sections 222 and 272. 13 4. In this Order, the Commission reaches the objective of resolving several issues in connection with carriers’ use of customer proprietary network information pursuant to section 222 of the Telecommunications Act of 1996. 14 In formulating the required approval mechanism described below, we carefully balance carriers’ First Amendment rights and consumers’ privacy interests so as to permit carriers flexibility in their communications with their customers while providing the level of protection to consumers’ privacy interests that Congress envisioned under section 222. 5. More specifically, we adopt an approach that comports with the decision 15 of the United States Court of Appeals for the Tenth Circuit vacating the Commission’s requirement that carriers obtain express customer consent for all sharing between a carrier and its affiliates, as well as unaffiliated entities. 16 We adopt today an approach that is derived from a careful 8 CPNI Clarification Order, 16 FCC Rcd at 16512- 16517, paras. 14- 22. 9 CPNI Clarification Order, 16 FCC Rcd at 16512, para. 12. 10 Id See section III. A, supra, for a discussion of the constitutional standard governing regulation of commercial speech. 11 Id. 12 CPNI Clarification Order, 16 FCC Rcd at 16516, para. 21. 13 CPNI Clarification Order, 16 FCC Rcd at 16518, para. 24. 14 Telecommunications Act of 1996, Pub. L. No. 104- 104, 110 Stat. 56 (1996 Act) (codified at 47 U. S. C. §§ 151 et seq.). Hereinafter, all citations to the 1996 Act will be to the 1996 Act as it is codified in the United States Code. The 1996 Act amended the Communications Act of 1934. We will refer to the Communications Act of 1934, as amended, as “the Communications Act” or “the Act.” 15 U. S. West, Inc. v. FCC, 182 F. 3d 1224 (10 th Cir. 1999), cert. denied, 530 U. S. 1213 (June 5, 2000) (No. 99-1427) (U S WEST v. FCC). 16 Implementation of the Telecommunications Act of 1996: Telecommunications Carriers’ Use of Customer Proprietary Network Information and Other Customer Information; and Implementation of the Non- Accounting (continued….) 80 Federal Communications Commission FCC 02- 214 3 balancing of harms, benefits, and governmental interests. First, use of CPNI by carriers or disclosure to their affiliated entities providing communications- related services, 17 as well as third- party agents and joint venture partners providing communications- related services, requires a customer’s knowing consent in the form of notice and “opt- out” approval. 18 Second, disclosure of CPNI to unrelated third parties or to carrier affiliates that do not provide communications-related services requires express customer consent, described as “opt- in” approval. 19 Finally, we reaffirm our “total services approach,” which permits the carrier to use CPNI to market new product offerings within the carrier- customer service relationship, on the basis of the customer’s implied consent. 20 6. In this Order, we also further refine the rules governing the process by which carriers provide notification to customers of their CPNI rights. Specifically, we clarify the form, content and frequency of carrier notices. 21 In addition, although we decline to reconsider our conclusion that customers’ preferred carrier (PC) freeze information constitutes CPNI and thereby continue to accord it privacy protection pursuant to section 222, we choose to forbear from imposing the express consent requirements announced in this Order with respect to PC-freezes. Through our limited exercise of forbearance, we balance customers’ privacy concerns with carriers’ meaningful commercial interests, resulting in PC- freeze information being made more readily available among competing carriers, consistent with the public interest. 22 We also affirm our previous determination that the word “information” in section 272 does not include CPNI, which is governed instead by section 222 of the Act. 23 7. Finally, we accompany this Order with a Further Notice of Proposed Rulemaking (“ Further NPRM”) to refresh the record on two issues raised in the CPNI Order Further NPRM: foreign storage of and access to domestic CPNI, and CPNI safeguards and enforcement mechanisms. We additionally request comment on what, if any, appropriate regulations should govern the CPNI held by carriers that go out of business, sell all or part of their customer base, or (Continued from previous page) Safeguards of Sections 271 and 272 of the Communications Act of 1934, as amended, Second Report and Order and Further Notice of Proposed Rulemaking, 13 FCC Rcd 8061 (1998) (CPNI Order). 17 In this Order and Further NPRM, we use the term "communications- related services" to mean telecommunications services, information services typically provided by telecommunications carriers, and services related to the provision or maintenance of customer premises equipment. We use this term only for convenience in this Order and FNRPM and not for any other purposes. 18 See section III. A. 1, supra. 19 See section III. A. 2, supra. 20 See section III. B. 2, supra. 21 See section III. C, supra. 22 See section III. D. 1, supra. 23 See section III. D. 4, supra. 81 Federal Communications Commission FCC 02- 214 4 seek bankruptcy protection. 24 B. Summary of Significant Issues Raised by Public Comments in Response to the IRFA 8. One party, the Organization for the Promotion and Advancement of Small Telecommunications Companies (“ OPASTCO”), commented specifically in response to the IRFA. 25 OPASTCO argues that the IRFA was “deficient” for two reasons. First, OPASTCO notes that the IRFA “reverts to language which incorrectly suggests that small ILECs are not ‘small entities’ under the Regulatory Flexibility Act.” 26 Further, OPASTCO takes issue with the IRFA’s determination that whatever consent rules are ultimately adopted will be applicable to all carriers. OPTASCO argues that “the Commission has not considered any alternatives, contrary to the requirements of 5 U. S. C.§ 603( c).” 27 9. We confirm OPASTCO’s assumption that the Clarification Order’s IRFA did contain a clerical error 28 regarding the classification of small ILECs. Accordingly, we affirm that Commission practice is to discuss small ILECs as “small entities” within our IRFAs, under the RFA. However, we note that no party was prejudiced or harmed by this error because the IRFA put potentially affected entities on notice by affirmatively stating that the Commission was “consider[ ing] small ILECs within this analysis and us[ ing] the term ‘small LECs’ to refer to any ILECs that arguably might be defined by SBA as ‘small business concerns. ’" 29 Hence, the clerical error was cured in the very document in which it was alleged to be present. 10. OPASTCO’s concern, therefore, that “if the rulemaking body itself has no preconceived idea of what the final rules might be, there is no way it can make the prejudgment that its final rules will be appropriate for all entities,” 30 takes a statement from the IRFA out of context. Furthermore, OPASTCO’s contention inaccurately describes the Commission’s decision- making process and outcome in this proceeding. 11. First, although the Clarification Order did not propose specific consent requirements, the Clarification Order did “seek comment on ways in which carriers can obtain their customers’ consent and the extent to which an opt- in or opt- out approach would satisfy both Sections 222 and the Tenth Circuit’s concerns that any restrictions on speech be no more than 24 See section IV. C, supra. 25 OPASTCO Comments at 8- 11. 26 OPASTCO Comments at 8. 27 OPASTCO Comments at 8 -9. 28 OPASTCO Comments at 9. 29 CPNI Clarification Order, 16 FCC Rcd at 16529, para. 9 (internal citations omitted). 30 OPASTCO Comments at 10. 82 Federal Communications Commission FCC 02- 214 5 necessary to serve the asserted state interests.” 31 Accordingly, although specific consent rules were not proposed, the only two potential types of consent (opt- in and opt- out) were explicitly mentioned and offered to interested parties for consideration and comment. In an instance such as this, where the Commission has previously considered what type of consent to require, and where the Order in question mentions the only two potential options for obtaining consent, it is unreasonable to claim that the Commission or any interested party had and has no idea what the final rules might be. Clearly, the Commission knew and adequately advised interested parties that the final rules would involve opt- in approval, opt- out approval, or some combination of the two. In fact, every commenter, including OPASTCO, 32 focused extensively on whether the Commission should adopt opt- in or opt- out consent requirements. We also note that the IRFA went on to state that “[ w] e have, however, taken the limited resources of small entities into account in promulgating certain existing CPNI rules, and intend to do so again in addressing the customer consent requirements.” 33 The omission of ILECs, whether or not evidence of Commission oversight, is rendered moot by our inclusion of this statement. 12. Furthermore, the previously adopted opt- in approval rules were subject to, and complied with, the requirements of the RFA. Accordingly, the Commission has previously undertaken an analysis of opt- in and potential alternatives with respect to small carriers. Although such analysis does not supplant the analysis that the Commission must perform in this Order and in this FRFA, it provides meaningful guidance. In previous CPNI Orders, the Commission has received comment from several parties on the impact of proposed rules on small carriers. After extensive analysis, the Commission found that “[ a] fter consideration of possible alternatives, we have concluded that our rules should apply equally to all carriers.” 34 Thus any argument that the Commission ever neglected the interests of small carriers is thereby rendered invalid. The Commission’s reasoning remains valid today. We stated: “we are unpersuaded that customers of small businesses have less meaningful privacy interests in their CPNI." 35 Additionally, the weight added by Congressional intent is critical in this context and deserves comment. In drafting section 222, Congress determined that CPNI protections should apply to consumers of “[ e] very telecommunications carrier.” 36 Finally, we note that the rules we adopt today are less burdensome on all carriers, including small carriers, than the Commission’s original opt- in rules. C. Description and Estimate of the Number of Small Entities to Which Rules Will Apply 31 CPNI Clarification Order, 16 FCC Rcd at 16536, para. 26. 32 OPASTCO Comments at 3- 8. 33 CPNI Clarification Order, 16 FCC Rcd at 16536, para. 27. 34 CPNI Order, 13 FCC Rcd at 8213, para. 235. 35 CPNI Order, 13 FCC Rcd at 8214, para. 236. 36 47 U. S. C. § 222( a). 83 Federal Communications Commission FCC 02- 214 6 13. The RFA directs agencies to provide a description of and, where feasible, an estimate of the number of small entities that will be affected by the proposed rules, if adopted. 37 The RFA generally defines the term "small entity" as having the same meaning as the terms "small business," "small organization," and "small governmental jurisdiction." 38 In addition, the term "small business" has the same meaning as the term “small business concern” under the Small Business Act. 39 A “small business concern" is one that: (1) is independently owned and operated; (2) is not dominant in its field of operation; and (3) satisfies any additional criteria established by the Small Business Administration (SBA). 40 14. The most reliable source of information regarding the total numbers of certain common carrier and related providers nationwide appears to be data the Commission publishes annually in its Telecommunications Provider Locator report, derived from filings made in connection with the Telecommunications Relay Service (TRS). 41 According to data in the most recent report, there are 5,679 interstate service providers. 42 These providers include, inter alia, local exchange carriers, wireline carriers and service providers, interexchange carriers, competitive access providers, operator service providers, pay telephone operators, providers of telephone service, providers of telephone exchange service, and resellers. 15. We have included small incumbent local exchange carriers (ILECs) 43 in this present RFA analysis. As noted above, a "small business" under the RFA is one that, inter alia, meets the pertinent small business size standard (e. g., a telephone communications business having 1,500 or fewer employees), and "is not dominant in its field of operation." 44 The SBA's Office of Advocacy contends that, for RFA purposes, small incumbent LECs are not dominant in their field of operation because any such dominance is not "national" in scope. 45 We have 37 5 U. S. C. §§ 603( b)( 3). 38 5 U. S. C. § 601( 6). 39 5 U. S. C. § 601( 3) (incorporating by reference the definition of “small business concern” in the Small Business Act, 15 U. S. C. § 632). Pursuant to 5 U. S. C. § 601( 3), the statutory definition of a small business applies “unless an agency, after consultation with the Office of Advocacy of the Small Business Administration and after opportunity for public comment, establishes one or more definitions of such term which are appropriate to the activities of the agency and publishes such definition( s) in the Federal Register.” 40 15 U. S. C. § 632. 41 FCC, Common Carrier Bureau, Industry Analysis Division, Telecommunications Provider Locator, Tables 1- 2 (November 2001) (Provider Locator). See also 47 C. F. R. § 64. 601 et seq. 42 Provider Locator at Table 1. 43 See 47 U. S. C § 251( h) (defining “incumbent local exchange carrier”). 44 15 U. S. C. § 632. 45 Letter from Jere W. Glover, Chief Counsel for Advocacy, SBA, to William E. Kennard, Chairman, FCC (May 27, 1999). The Small Business Act contains a definition of "small business concern," which the RFA incorporates into its own definition of "small business." See 15 U. S. C. § 632( a) (Small Business Act); 5 U. S. C. § 601( 3) (RFA). SBA regulations interpret "small business concern" to include the concept of dominance on a national basis. 13 C. F. R. § 121.102( b). 84 Federal Communications Commission FCC 02- 214 7 therefore included small incumbent LECs 46 in this RFA analysis, although we emphasize that this RFA action has no effect on FCC analyses and determinations in other, non- RFA contexts. 16. Total Number of Telephone Companies Affected. The U. S. Bureau of Census (Census Bureau) reports that, at the end of 1992, there were 3,497 firms engaged in providing telephone services, as defined therein, for at least one year. 47 This number contains a variety of different categories of carriers, including LECs, interexchange carriers, competitive access providers, operator service providers, pay telephone operators, and resellers. It seems certain that some of these 3,497 telephone service firms may not qualify as small entities or small incumbent LECs because they are not "independently owned and operated." 48 It seems reasonable to conclude that fewer than 3,497 telephone service firms are small entity telephone service firms that may be affected by these rules. 17. Wireline Carriers and Service Providers. The SBA has developed a definition of small entities for telephone communications companies other than radiotelephone (wireless) companies. The Census Bureau reports that there were 2,321 such telephone companies in operation for at least one year at the end of 1992. 49 According to the SBA's definition, a small business telephone company other than a radiotelephone (wireless) company is one employing no more than 1,500 persons. 50 All but 26 of the 2,321 non- radiotelephone (wireless) companies listed by the Census Bureau were reported to have fewer than 1,000 employees. Even if all 26 of the remaining companies had more than 1,500 employees, there would still be 2,295 non- radiotelephone (wireless) companies that might qualify as small entities or small incumbent LECs. Although it seems certain that some of these carriers are not independently owned and operated, we are unable at this time to estimate with greater precision the number of wireline carriers and service providers that would qualify as small business concerns under SBA’s definition. Therefore, we estimate that fewer than 2,295 small telephone communications companies other than radiotelephone (wireless) companies are small entities that may be affected by these rules. 18. Local Exchange Carriers. Neither the Commission nor the SBA has developed a definition of small providers of local exchange services. The closest applicable definition under the SBA's rules is for telephone communications companies other than radiotelephone (wireless) companies. 51 According to the SBA's definition, a small business telephone company other than 46 13 C. F. R § 121.201, NAICS code513310. 47 U. S. Department of Commerce, Bureau of the Census, 1992 Census of Transportation, Communications, and Utilities: Establishment and Firm Size, at Firm Size 1- 123 (1995) (1992 Census). 48 See generally 15 U. S. C. § 632( a)( 1). 49 1992 Census at Firm Size 1- 123. 50 13 C. F. R. § 121.201, North American Industry Classification System (NAICS) codes 513310, 513330, and 513340. 51 13 C. F. R. § 121.201, NAICS code 513310. 85 Federal Communications Commission FCC 02- 214 8 a radiotelephone (wireless) company is one employing no more than 1,500 persons. 52 The most reliable source of information regarding the number of LECs nationwide of which we are aware appears to be the data that we collect annually in connection with the Telecommunications Relay Service (TRS). 53 According to our most recent data, there are 1,329 local exchange carriers, including incumbent LECs. 54 Although it seems certain that some of these carriers are not independently owned and operated, or have more than 1,500 employees, we are unable at this time to estimate with greater precision the number of LECs that would qualify as small business concerns under the SBA's definition. Consequently, we estimate that they are fewer than 1, 329 small entity LECs that may be affected by the proposals in the Second Further Notice. 19. Interexchange Carriers. Neither the Commission nor the SBA has developed a definition of small entities specifically applicable to providers of interexchange services (IXCs). The closest applicable definition under the SBA's rules is for telephone communications companies other than radiotelephone (wireless) companies. 55 The most reliable source of information regarding the number of IXCs nationwide of which we are aware appears to be the data that we collect annually in connection with TRS. 56 According to our most recent data, 229 companies reported that they were engaged in the provision of interexchange services. 57 Although it seems certain that some of these carriers are not independently owned and operated, or have more than 1,500 employees, we are unable at this time to estimate with greater precision the number of IXCs that would qualify as small business concerns under the SBA's definition. Consequently, we estimate that there are fewer than 229 small entity IXCs that may be affected by this order. 20. Competitive Access Providers. Neither the Commission nor the SBA has developed a definition of small entities specifically applicable to providers of competitive access services (CAPs). The closest applicable definition under the SBA's rules is for telephone communications companies other than radiotelephone (wireless) companies. 58 According to the SBA's definition, a small business telephone company other than a radiotelephone (wireless) company is one employing no more than 1,500 persons. 59 The most reliable source of information regarding the number of CAPs nationwide of which we are aware appears to be the 52 13 C. F. R. § 121.201, North American Industry Classification System (NAICS) codes 513310, 513330, and 513340. 53 See 47 C. F. R. § 64. 601 et seq.; Provider Locator at Table 1. 54 Provider Locator at Table 1. 55 13 C. F. R. § 121.201, NAICS code 513310. 56 See 47 C. F. R. § 64. 601 et seq.; Provider Locator at Table 1. 57 Provider Locator at Table 1. 58 13 C. F. R. § 121.201, NAICS code 513310. 59 13 C. F. R. § 121.201, North American Industry Classification System (NAICS) codes 513310, 513330, and 513340. 86 Federal Communications Commission FCC 02- 214 9 data that we collect annually in connection with the TRS. 60 According to our most recent data, 532 companies reported that they were engaged in the provision of either competitive access services or competitive local exchange service. 61 Although it seems certain that some of these carriers are not independently owned and operated, or have more than 1,500 employees, we are unable at this time to estimate with greater precision the number of CAPs that would qualify as small business concerns under the SBA's definition. Consequently, we estimate that there are fewer than 532 small entity CAPs that may be affected by this order. 21. Operator Service Providers. Neither the Commission nor the SBA has developed a definition of small entities specifically applicable to providers of operator services. The closest applicable definition under the SBA's rules is for telephone communications companies other than radiotelephone (wireless) companies. 62 The most reliable source of information regarding the number of operator service providers nationwide of which we are aware appears to be the data that we collect annually in connection with the TRS. 63 According to our most recent data, 22 companies reported that they were engaged in the provision of operator services. 64 Although it seems certain that some of these companies are not independently owned and operated, or have more than 1,500 employees, we are unable at this time to estimate with greater precision the number of operator service providers that would qualify as small business concerns under the SBA's definition. Consequently, we estimate that there are fewer than 22 small entity operator service providers that may be affected by this order. 22. Pay Telephone Providers. Neither the Commission nor the SBA has developed a definition of small entities specifically applicable to pay telephone providers. The closest applicable definition under the SBA's rules is for telephone communications companies other than radiotelephone (wireless) companies. 65 The most reliable source of information regarding the number of pay telephone operators nationwide of which we are aware appears to be the data that we collect annually in connection with the TRS. 66 According to our most recent data, 936 companies reported that they were engaged in the provision of pay telephone services. 67 Although it seems certain that some of these carriers are not independently owned and operated, or have more than 1,500 employees, we are unable at this time to estimate with greater precision the number of pay telephone operators that would qualify as small business concerns under the 60 See 47 C. F. R. § 64. 601 et seq.; Provider Locator at Table 1. 61 Provider Locator at Table 1. 62 13 C. F. R. § 121.201, NAICS code 513310. 63 See 47 C. F. R. § 64. 601 et seq.; Provider Locator at Table 1. 64 Provider Locator at Table 1. 65 13 C. F. R. § 121.201, NAICS code 513310. 66 13 C. F. R. § 121.201, NAICS code 513310. 67 Provider Locator at Table 1. 87 Federal Communications Commission FCC 02- 214 10 SBA's definition. Consequently, we estimate that there are fewer than 936 small entity pay telephone operators that may be affected by this order. 23. Wireless Carriers. Wireless telephony includes cellular, personal communications services (PCS) or specialized mobile radio (SMR) service providers. The SBA has developed a definition of small entities for radiotelephone (wireless) companies; 68 however, neither the Commission nor the SBA has developed a definition of small entities applicable to cellular licensees, or to providers of paging and messaging services. Through categorized under the same size standard as other wireless services discussed in this paragraph, paging is now considered a separate industry. 69 The closest applicable definition under the SBA's rules is for telephone communications companies other than radiotelephone (wireless) companies. 70 According to the SBA's definition, a small business radiotelephone company is one employing no more than 1,500 persons. 71 We consider paging and messaging services to fall within this category. According to the most recent Provider Locator data, 858 carriers reported that they were engaged in the provision of wireless telephony and 576 companies reported that they were engaged in the provision of paging and messaging services. 72 Although it seems certain that some of these carriers are not independently owned and operated, we are unable at this time to estimate with greater precision the number of radiotelephone carriers and service providers that would qualify as small business concerns under the SBA's definition. Consequently, we estimate that there are fewer than 858 small carriers providing wireless telephony services and fewer than 576 small companies providing paging and messaging services that may be affected by these rules. 24. Resellers. Neither the Commission nor the SBA has developed a definition of small entities specifically applicable to resellers. The closest applicable definition under the SBA's rules is for all telephone communications companies. 73 The most reliable source of information regarding the number of toll resellers nationwide of which we are aware appears to be the data that we collect annually in connection with the TRS. 74 According to our most recent data, 710 companies reported that they were engaged in the resale of telephone services. 75 Although it seems certain that some of these carriers are not independently owned and operated, or have more than 1,500 employees, we are unable at this time to estimate with greater precision the number of resellers that would qualify as small business concerns under the SBA's definition. 68 13 C. F. R. § 121.201, NAICS codes 513321 and 513322. 69 13 C. F. R. § 121.201, NAICS code 513321. 70 Id. 71 13 C. F. R. § 121.201 (SIC 4812/ NAICS 513322). 72 Provider Locator at Table 1. 73 13 C. F. R. § 121.201, NAICS code 513310. 74 13 C. F. R. § 121.201, NAICS code 513310. 75 Provider Locator at Table 1. The total for resellers includes both toll resellers and local resellers. 88 Federal Communications Commission FCC 02- 214 11 Consequently, we estimate that there are fewer than 710 small entity resellers that may be affected by this order. D. Description of Projected Reporting, Recordkeeping, and Other Compliance Requirements for Small Entities 25. In this Order, we take a number of steps that may affect small entities that use customers’ CPNI outside of the total service approval or statutory exceptions in section 222. 76 Some of the approval and notice requirements discussed herein will require additional reporting, recordkeeping or compliance requirements for service providers; however, certain approval and notice requirements discussed herein will also decrease certain reporting, recordkeeping or compliance requirements for service providers. We believe that, overall, these new requirements will lessen the regulatory burden on small carriers by allowing carriers to obtain customers’ consent through an opt- out approval mechanism to use customers’ CPNI for marketing communications- related services. 26. This Order imposes the following additional reporting, recordkeeping or compliance requirements on all carriers. None of these requirements should affect small carriers disproportionately or require special professional skills. First, carriers must obtain opt- in CPNI approval for certain CPNI uses, and have the choice of obtaining opt- out or opt- in approval for other CPNI uses. As discussed in section III. C. 1, supra, a carrier may determine whether to use one notice or multiple notices, and may request and provide notice relevant only to the CPNI uses the carriers proposes to make. Accordingly, if, as OPASTCO claims, its members only intend to use CPNI internally for marketing communications- related services, 77 its member small carriers will only have to obtain opt- out approval from their customers. 27. Carriers who use opt- out approval must provide notice to their customers every two years. This requirement, while an added burden on all carriers, is counterbalanced by the fact that carriers who choose to use the opt- out method will be able to use and disclose more CPNI for marketing than under the opt- in method. Accordingly, a carrier that finds the burden of biennial notices to outweigh the benefit of expanded CPNI access can choose to obtain opt- in approval from its customers and avoid the biennial notice requirement. Additionally, notice requirements are common in the telecommunications industry and the requirements adopted here allow carriers flexibility in determining how to provide such notices. Accordingly, all carriers, including small carriers, should already have resources in place to provide notices required by such regulations to their customers. 28. We require carriers who use e- mail notices to advise their customers of their opt-out CPNI choices to abide by certain requirements. See section III. C. 1. a, supra. These requirements are not burdensome. To the degree that any carrier could seriously argue that these requirements are burdensome, carriers are not required to use e- mail to notify their customers of CPNI policies. Accordingly, a carrier can choose the least burdensome notification method 76 47 U. S. C. § 222( d). 77 OPASTCO Comments at 4. 89 Federal Communications Commission FCC 02- 214 12 allowed under our rules, based on the carrier’s individual circumstances. 29. In addition, we add minor content requirements to our notice rules to synchronize the rules with the newly adopted consent requirements. 78 These requirements should require minimal effort on the part of carriers, large and small, to implement. Furthermore, we also streamline the notice requirements for carriers to obtain limited, one- time use of consumers’ CPNI for the duration of an inbound or outbound call with the customer, 79 which will benefit small carriers. 30. We adopt a 30- day minimum period of time that carriers must wait after giving customers’ opt- out notice before assuming customer approval. Every carrier commenter supported the 30- day time period. Such a time period imposes minimal burden on carriers. This is especially true because the 30- day waiting period has been the interim rule since we adopted the CPNI Clarification Order and has been the subject of no carrier complaints or concerns. 31. We adopt a requirement that carriers make available to every customer a method to opt- out that is of no additional cost and available 24 hours a day, seven days a week. This requirement can be satisfied through a combination of methods, so long as all customers have the ability to opt- out at no cost and are able to effectuate that choice whenever they choose. To the degree that carriers find that the burden of meeting this requirement outweigh the value of using an opt- out approval method, carriers are free to use opt- in. Carriers are otherwise free to determine what methods to use to allow customer to effectuate their CPNI elections. Although this requirement will impose a burden on small and large carriers alike, the Commission strongly believes that two factors mitigate against allowing small carriers to utilize less burdensome alternatives. First, as the Commission has previously held, 80 there is nothing in this record that convinces us that customers of small carriers are entitled to lesser protection of the privacy of their calling records than those customers of larger carriers. Accordingly, it would be inappropriate to allow small carriers to provide less effective methods for customers to effectuate their CPNI choices. Second, to the degree that these requirements impose burdens on carriers, those burdens are outweighed by the value of using an opt- out approval mechanism to obtain customer approval to use CPNI for marketing communications- related services. Should carriers find that not to be the case in their individual situations, they can avoid the 24/ 7 requirement by adopting an opt- in approval mechanism. 32. We forbear from applying our CPNI approval regulations to preferred carrier (“ PC”) freezes, allowing small and large carriers alike easier access to PC- freeze information. 81 78 See section III. C, supra. 79 See section III. C. 2. a, supra. 80 CPNI Order, 13 FCC Rcd at 8214, para. 236. 81 See section III. D. 1, supra. A “preferred carrier freeze (or freeze) prevents a change in a subscriber’s preferred carrier selection unless the subscriber gives the carrier from whom the freeze was requested his or he express consent.” 47 C. F. R. § 64. 1190( a). 90 Federal Communications Commission FCC 02- 214 13 E. Steps Taken to Minimize Significant Economic Impact on Small Entities, and Significant Alternatives Considered 33. The RFA requires an agency to describe any significant alternatives that it has considered in reaching its proposed approach, which may include the following four alternatives (among others): “( 1) the establishment of differing compliance or reporting requirements or timetables that take into account the resources available to small entities; (2) the clarification, consolidation, or simplification of compliance or reporting requirements under the rule for small entities; (3) the use of performance, rather than design, standards; and (4) an exemption from coverage of the rule, or any part thereof, for small entities.” 82 34. While the approval and related notice measures adopted in this Order apply similarly to both small and large entities, we expect that small entities are likely to benefit to the extent such firms have fewer or reduced resources available, as compared to large firms. The Commission’s previously adopted rules required all carriers to obtain opt- in approval from their customers to use CPNI outside of the total service approach. Although the Commission allowed carriers to use opt- out as an interim measure in light of the Tenth Circuit’s opinion, that approach was never codified or adopted as a permanent rule. As discussed above, this Order adopts an approach that is derived from a careful balancing of harms, benefits, and governmental interests. 83 First, use of CPNI by carriers or disclosure to their affiliated entities providing communications- related services, 84 as well as third- party agents and joint venture partners providing communications- related services, requires a customer’s knowing consent in the form of notice and “opt- out” approval. 85 Second, disclosure of CPNI to unrelated third parties or to carrier affiliates that do not provide communications- related services requires express customer consent, described as “opt- in” approval. 86 Finally, we reaffirm our “total services approach,” which permits the carrier to use CPNI to market new product offerings within the carrier-customer service relationship, on the basis of the customer’s implied consent. 87 35. Accordingly, we conclude that the measures adopted and described in this Order would reduce regulatory burdens for small carriers including resellers, by allowing carriers access to CPNI for marketing communications- related services to their customers via an opt- out mechanism. Further, the Order specifically allows carriers to use opt- in approval for all CPNI uses should a carrier determine that opt- in is more appropriate for its individual circumstances, 82 5 U. S. C. § 603( c)( 1)-( c)( 4). 83 See sections I and III. A, supra. 84 In this Order and Further NPRM, we use the term "communications- related services" to mean telecommunications services, information services typically provided by telecommunications carriers, and services related to the provision or maintenance of customer premises equipment. We use this term only for convenience in this Order and FNRPM and not for any other purposes. 85 See section III. A. 1, supra. 86 See section III. A. 2, supra. 87 See section III. B. 2, supra. 91 Federal Communications Commission FCC 02- 214 14 allowing carriers to make decisions regarding their customers and resources. 36. Furthermore, as noted above, the previously adopted opt- in rules were subject to and complied with the requirements of the RFA. Accordingly, the Commission has previously undertaken an analysis of opt- in and potential alternatives with respect to small carriers. Although such analysis does not replace the analysis that the Commission must perform in this Order, it provides meaningful guidance. In previous CPNI Orders, the Commission received comment from several parties on the impact of proposed rules on small carriers. After extensive analysis, the Commission found that “[ a] fter consideration of possible alternatives, we have concluded that our rules should apply equally to all carriers.” 88 The Commission’s reasoning remains valid today. Of special importance in this context, our consistent determination, made throughout this proceeding, that “we are unpersuaded that customers of small businesses have less meaningful privacy interests in their CPNI." 89 This is especially true because, in drafting section 222, Congress determined that CPNI protections should apply to consumers of “[ e] very telecommunications carrier.” 90 37. In this Order, we also describe commenters’ positions regarding other appropriate approval methods and related notice issues and state why those alternatives that we do not adopt would not serve the public interest. 91 For example, many carriers, including small carriers, proposed that we allow carriers to use opt- out approval for all CPNI uses. However, as we point out in this Order, the Commission must fulfill its statutorily imposed duty to protect consumers’ CPNI, while balancing those interests with carriers’ First Amendment interests. Therefore, as discussed in detail in the Order, we conclude that the CPNI rules we adopt today – which balance in an equitable fashion all consumers’ privacy rights with carriers’ First Amendment rights – strike the right balance for small and large carriers alike. Moreover, we gain assurance from 88 CPNI Order, 13 FCC Rcd at 8213, para. 235. 89 CPNI Order, 13 FCC Rcd at 8214, para. 236. 90 47 U. S. C. § 222( a). 91 See Sections V. A and V. B. 92 Federal Communications Commission FCC 02- 214 15 knowing that the rules we adopt benefit small carriers and serve the public interest by allowing carriers with expanded access to consumers’ CPNI from our original opt- in rules. 38. Report to Congress. The Commission will send a copy of this Order, including this FRFA, in a report to be sent to Congress pursuant to the Congressional Review Act. 92 In addition, the Commission will send a copy of this Order, including this FRFA, to the Chief Counsel for Advocacy of the SBA. A copy of this Order and FRFA (or summaries thereof) will also be published in the Federal Register. 93 92 See 5 U. S. C. § 801( a)( 1)( A). 93 See 5 U. S. C. § 604( b). 93 Federal Communications Commission FCC 02- 214 APPENDIX D – INITIAL REGULATORY FLEXIBILITY ANALYSIS 1. As required by the Regulatory Flexibility Act (RFA), 1 the Commission has prepared this Initial Regulatory Flexibility Analysis (IRFA) of the possible significant economic impact on small entities by the policies and rules proposed in this Third Further Notice of Proposed Rulemaking (“ Third Further NPRM”). Written public comments are requested on this IRFA. Comments must be identified as responses to the IRFA and must be filed by the deadlines for comments on the Third Further NPRM provided above in paragraph 153. The Commission will send a copy of the Third Further NPRM, including this IRFA, to the Chief Counsel for Advocacy of the Small Business Administration. 2 In addition, the Third Further NPRM and IRFA (or summaries thereof) will be published in the Federal Register. 3 A. Need for, and Objectives of, the Proposed Rules 2. The Commission is issuing the Third Further NPRM to refresh the record on two issues raised in the CPNI Order Further NPRM, 4 and to seek comment on the CPNI implications when a carrier goes out of business, sells all or part of its customer base, or seeks bankruptcy protection. Specifically, the Third Further NPRM seeks comment on: (1) foreign storage of and access to domestic CPNI; (2) CPNI safeguards and enforcements mechanisms; and (3) appropriate regulations governing the CPNI held by carriers that go out of business, sell all or part of their customer base, or seek bankruptcy protection. 3. In a July 8, 1997 Ex Parte letter, the FBI requested that the Commission regulate the foreign storage of and foreign- based access to CPNI of U. S. customers who use domestic telecommunications services. 5 The Commission requested comment on this proposal in its CPNI Order Further NPRM. 6 As an alternative, the FBI suggested that foreign storage or access to domestic CPNI be permitted only upon informed written customer approval. To the degree that CPNI is stored in a foreign country, the FBI asked that the Commission require carriers to keep a copy of customers’ CPNI records within the U. S. for public safety, law enforcement, and national security reasons. The FBI also requested that we require carriers to maintain copies of the CPNI of all U. S.- based customers because of the need for prompt and secure law 1 See 5 U. S. C. § 603. The RFA, 5 U. S. C. § 601 et. seq., has been amended by the Small Business Regulatory Enforcement Fairness Act of 1996 (SBREFA), Pub. L. No. 104- 121, 110 Stat. 847 (1996). 2 5 U. S. C. § 603( a). 3 5 U. S. C. § 603( a). 4 Implementation of the Telecommunications Act of 1996: Telecommunications Carriers’ Use of Customer Proprietary Network Information and Other Customer Information; and Implementation of the Non- Accounting Safeguards of Sections 271 and 272 of the Communications Act of 1934, as amended, Second Report and Order and Further Notice of Proposed Rulemaking, 13 FCC Rcd 8061, 8200 (1998) (CPNI Order Further NPRM). 5 Letter from John F. Lewis, Jr., Federal Bureau of Investigation, to William F. Caton, Acting Secretary, Federal Communications Commission, CC Docket No. 96- 115 (filed July 8, 1997) (FBI July 8, 1998 Ex Parte Letter). 6 CPNI Order Further NPRM, 13 FCC Rcd at 8203- 8204, paras. 208- 210. 94 Federal Communications Commission FCC 02- 214 2 enforcement purposes. The Commission now requests that commenters refresh the record on this topic. Specifically, we request that commenters consider the FBI proposal in light of heightened national security concerns. In addition, we request input as to whether any of the concerns raised by the FBI have been illustrated by actual incidents during the period since comments were received on this topic. Finally, we ask commenters to provide estimates of the costs that would be incurred if we were to mandate carriers to maintain the domestic storage of, and access to, domestic CPNI. 7 4. In the CPNI Order Further NPRM, 8 the Commission sought comment on what safeguards in addition to those adopted in the CPNI Order, 9 if any, are needed to protect the confidentiality of carrier proprietary information (CPI), including that of resellers and ISPs. The CPNI Order Further NPRM also sought comment on what, if any, further enforcement mechanisms the Commission should adopt to ensure carrier compliance with our CPNI policies and rules. 10 We seek to refresh the record on this topic. Specifically, we request that carriers and other interested parties describe any actual experience with problems since we originally issued the CPNI Order Further NPRM. 11 5. Finally, in light of inquiries the Commission has received in the face of recent carrier bankruptcies, mergers, and asset sales, the Commission seeks comment on carrier use and disclosure of CPNI when it sells its assets or goes out of business. We seek comment on whether an exiting carrier should be able to use CPNI for transition of its customers to another carrier. If commenters believe that an exiting carrier should be able to disclose CPNI to the acquiring carrier, we seek comment on whether we should require the exiting carrier to state that fact in advance notice provided to customers acquired by the sale or transfer from another carrier in compliance with our authorization and verification (slamming) rules. 12 Further, we ask, to the degree that the exiting carrier has obtained CPNI approvals from its customer, whether the new carrier should be deemed to have received such approvals, or whether it should be required to provide notice and obtain approval for CPNI use and disclosure from the acquired customers. 13 Further, we seek comment on whether the Commission should recognize a difference between service types. We also seek comment on whether carriers can sell CPNI as an asset. We seek comment on whether such regulations would go beyond the scope of section 222 or the Commission’s authority. 14 7 See supra para. 144. 8 CPNI Order, 13 FCC Rcd at 8201- 8202, paras. 206- 207. 9 CPNI Order, 13 FCC Rcd at 8193- 8200, paras. 190- 202. 10 Id. 11 See supra para. 145. 12 47 C. F. R 64. 1120( e). 13 See supra para. 146. 14 See supra para. 147. 95 Federal Communications Commission FCC 02- 214 3 B. Legal Basis 6. The Third Further NPRM is adopted pursuant to Sections 1, 4( i), 222, and 303( r) of the Communications Act of 1934, as amended, 47 U. S. C. §§ 151, 154( i), 222, and 303( r). C. Description and Estimate of the Number of Small Entities to Which the Proposed Rules will Apply 7. The RFA directs agencies to provide a description of and, where feasible, an estimate of the number of small entities that will be affected by the proposed rules, if adopted. 15 The RFA generally defines the term "small entity" as having the same meaning as the terms "small business," "small organization," and "small governmental jurisdiction." 16 In addition, the term "small business" has the same meaning as the term “small business concern” under the Small Business Act. 17 A “small business concern" is one that: (1) is independently owned and operated; (2) is not dominant in its field of operation; and (3) satisfies any additional criteria established by the Small Business Administration (SBA). 18 8. The most reliable source of information regarding the total numbers of certain common carrier and related providers nationwide appears to be data the Commission publishes annually in its Telecommunications Provider Locator report, derived from filings made in connection with the Telecommunications Relay Service (TRS). 19 According to data in the most recent report, there are 5,679 interstate service providers. 20 These providers include, inter alia, local exchange carriers, wireline carriers and service providers, interexchange carriers, competitive access providers, operator service providers, pay telephone operators, providers of telephone service, providers of telephone exchange service, and resellers. 9. We have included small incumbent local exchange carriers (LECs) 21 in this present RFA analysis. As noted above, a "small business" under the RFA is one that, inter alia, meets the pertinent small business size standard (e. g., a telephone communications business 15 5 U. S. C. §§ 603( b)( 3). 16 5 U. S. C. § 601( 6). 17 5 U. S. C. § 601( 3) (incorporating by reference the definition of “small business concern” in the Small Business Act, 15 U. S. C. § 632). Pursuant to 5 U. S. C. § 601( 3), the statutory definition of a small business applies “unless an agency, after consultation with the Office of Advocacy of the Small Business Administration and after opportunity for public comment, establishes one or more definitions of such term which are appropriate to the activities of the agency and publishes such definition( s) in the Federal Register.” 18 15 U. S. C. § 632. 19 FCC, Common Carrier Bureau, Industry Analysis Division, Telecommunications Provider Locator, Tables 1- 2 (November 2001) (Provider Locator). See also 47 C. F. R. § 64. 601 et seq. 20 Provider Locator at Table 1. 21 See 47 U. S. C § 251( h) (defining “incumbent local exchange carrier”). 96 Federal Communications Commission FCC 02- 214 4 having 1,500 or fewer employees), and "is not dominant in its field of operation." 22 The SBA's Office of Advocacy contends that, for RFA purposes, small incumbent LECs are not dominant in their field of operation because any such dominance is not "national" in scope. 23 We have therefore included small incumbent LECs in this RFA analysis, although we emphasize that this RFA action has no effect on FCC analyses and determinations in other, non- RFA contexts. 10. Total Number of Telephone Companies Affected. The U. S. Bureau of Census (Census Bureau) reports that, at the end of 1992, there were 3,497 firms engaged in providing telephone services, as defined therein, for at least one year. 24 This number contains a variety of different categories of carriers, including LECs, interexchange carriers, competitive access providers, operator service providers, pay telephone operators, and resellers. It seems certain that some of these 3,497 telephone service firms may not qualify as small entities or small incumbent LECs because they are not "independently owned and operated." 25 It seems reasonable to conclude that fewer than 3,497 telephone service firms are small entity telephone service firms that may be affected by these rules. 11. Wireline Carriers and Service Providers. The SBA has developed a definition of small entities for telephone communications companies other than radiotelephone (wireless) companies. The Census Bureau reports that there were 2,321 such telephone companies in operation for at least one year at the end of 1992. 26 According to the SBA's definition, a small business telephone company other than a radiotelephone (wireless) company is one employing no more than 1,500 persons. 27 All but 26 of the 2,321 non- radiotelephone (wireless) companies listed by the Census Bureau were reported to have fewer than 1,000 employees. Even if all 26 of the remaining companies had more than 1,500 employees, there would still be 2,295 non- radiotelephone (wireless) companies that might qualify as small entities or small incumbent LECs. Although it seems certain that some of these carriers are not independently owned and operated, we are unable at this time to estimate with greater precision the number of wireline carriers and service providers that would qualify as small business concerns under SBA’s definition. Therefore, we estimate that fewer than 2,295 small telephone communications 22 15 U. S. C. § 632. 23 Letter from Jere W. Glover, Chief Counsel for Advocacy, SBA, to William E. Kennard, Chairman, FCC (May 27, 1999). The Small Business Act contains a definition of "small business concern," which the RFA incorporates into its own definition of "small business." See 15 U. S. C. § 632( a) (Small Business Act); 5 U. S. C. § 601( 3) (RFA). SBA regulations interpret "small business concern" to include the concept of dominance on a national basis. 13 C. F. R. § 121.102( b). 24 U. S. Department of Commerce, Bureau of the Census, 1992 Census of Transportation, Communications, and Utilities: Establishment and Firm Size, at Firm Size 1- 123 (1995) (1992 Census). 25 See generally 15 U. S. C. § 632( a)( 1). 26 1992 Census at Firm Size 1- 123. 27 13 C. F. R. § 121.201, North American Industry Classification System (NAICS) codes 513310, 513330, and 513340. 97 Federal Communications Commission FCC 02- 214 5 companies other than radiotelephone (wireless) companies are small entities that may be affected by these rules. 12. Local Exchange Carriers. Neither the Commission nor the SBA has developed a definition of small providers of local exchange services. The closest applicable definition under the SBA's rules is for telephone communications companies other than radiotelephone (wireless) companies. 28 The most reliable source of information regarding the number of LECs nationwide of which we are aware appears to be the data that we collect annually in connection with the Telecommunications Relay Service (TRS). 29 According to our most recent data, there are 1,329 local exchange carriers, including incumbent LECs. 30 Although it seems certain that some of these carriers are not independently owned and operated, or have more than 1,500 employees, we are unable at this time to estimate with greater precision the number of LECs that would qualify as small business concerns under the SBA's definition. Consequently, we estimate that they are fewer than 1, 329 small entity LECs that may be affected by the proposals in the Second Further Notice. 13. Interexchange Carriers. Neither the Commission nor the SBA has developed a definition of small entities specifically applicable to providers of interexchange services (IXCs). The closest applicable definition under the SBA's rules is for telephone communications companies other than radiotelephone (wireless) companies. 31 The most reliable source of information regarding the number of IXCs nationwide of which we are aware appears to be the data that we collect annually in connection with TRS. 32 According to our most recent data, 229 companies reported that they were engaged in the provision of interexchange services. 33 Although it seems certain that some of these carriers are not independently owned and operated, or have more than 1,500 employees, we are unable at this time to estimate with greater precision the number of IXCs that would qualify as small business concerns under the SBA's definition. Consequently, we estimate that there are fewer than 229 small entity IXCs that may be affected by this order. 14. Competitive Access Providers. Neither the Commission nor the SBA has developed a definition of small entities specifically applicable to providers of competitive access services (CAPs). The closest applicable definition under the SBA's rules is for telephone communications companies other than radiotelephone (wireless) companies. 34 The most reliable source of information regarding the number of CAPs nationwide of which we are aware appears 28 13 C. F. R. § 121.201, NAICS code 513310. 29 See 47 C. F. R. § 64. 601 et seq.; Provider Locator at Table 1. 30 Provider Locator at Table 1. 31 13 C. F. R. § 121.201, NAICS code 513310. 32 See 47 C. F. R. § 64. 601 et seq.; Provider Locator at Table 1. 33 Provider Locator at Table 1. 34 13 C. F. R. § 121.201, NAICS code 513310. 98 Federal Communications Commission FCC 02- 214 6 to be the data that we collect annually in connection with the TRS. 35 According to our most recent data, 532 companies reported that they were engaged in the provision of either competitive access services or competitive local exchange service. 36 Although it seems certain that some of these carriers are not independently owned and operated, or have more than 1,500 employees, we are unable at this time to estimate with greater precision the number of CAPs that would qualify as small business concerns under the SBA's definition. Consequently, we estimate that there are fewer than 532 small entity CAPs that may be affected by this order. 15. Operator Service Providers. Neither the Commission nor the SBA has developed a definition of small entities specifically applicable to providers of operator services. The closest applicable definition under the SBA's rules is for telephone communications companies other than radiotelephone (wireless) companies. 37 The most reliable source of information regarding the number of operator service providers nationwide of which we are aware appears to be the data that we collect annually in connection with the TRS. 38 According to our most recent data, 22 companies reported that they were engaged in the provision of operator services. 39 Although it seems certain that some of these companies are not independently owned and operated, or have more than 1,500 employees, we are unable at this time to estimate with greater precision the number of operator service providers that would qualify as small business concerns under the SBA's definition. Consequently, we estimate that there are fewer than 22 small entity operator service providers that may be affected by this order. 16. Pay Telephone Providers. Neither the Commission nor the SBA has developed a definition of small entities specifically applicable to pay telephone providers. The closest applicable definition under the SBA's rules is for telephone communications companies other than radiotelephone (wireless) companies. 40 The most reliable source of information regarding the number of pay telephone operators nationwide of which we are aware appears to be the data that we collect annually in connection with the TRS. 41 According to our most recent data, 936 companies reported that they were engaged in the provision of pay telephone services. 42 Although it seems certain that some of these carriers are not independently owned and operated, or have more than 1,500 employees, we are unable at this time to estimate with greater precision the number of pay telephone operators that would qualify as small business concerns under the 35 See 47 C. F. R. § 64. 601 et seq.; Provider Locator at Table 1. 36 Provider Locator at Table 1. 37 13 C. F. R. § 121.201, NAICS code 513310. 38 See 47 C. F. R. § 64. 601 et seq.; Provider Locator at Table 1. 39 Provider Locator at Table 1. 40 13 C. F. R. § 121.201, NAICS code 513310. 41 13 C. F. R. § 121.201, NAICS code 513310. 42 Provider Locator at Table 1. 99 Federal Communications Commission FCC 02- 214 7 SBA's definition. Consequently, we estimate that there are fewer than 936 small entity pay telephone operators that may be affected by this order. 17. Wireless Carriers. Wireless telephony includes cellular, personal communications services (PCS) or specialized mobile radio (SMR) service providers. The SBA has developed a definition of small entities for radiotelephone (wireless) companies; 43 however, neither the Commission nor the SBA has developed a definition of small entities applicable to cellular licensees, or to providers of paging and messaging services. Though categorized under the same size standard as the other wireless services discussed in this paragraph, paging is now considered a separate industry. 44 The closest applicable definition under the SBA's rules is for telephone communications companies other than radiotelephone (wireless) companies. 45 According to the SBA's definition, a small business radiotelephone company is one employing no more than 1,500 persons. 46 According to the most recent Provider Locator data, 858 carriers reported that they were engaged in the provision of wireless telephony and 576 companies reported that they were engaged in the provision of paging and messaging services. 47 Although it seems certain that some of these carriers are not independently owned and operated, we are unable at this time to estimate with greater precision the number of radiotelephone carriers and service providers that would qualify as small business concerns under the SBA's definition. Consequently, we estimate that there are fewer than 858 small carriers providing wireless telephony services and fewer than 576 small companies providing paging and messaging services that may be affected by these rules. 18. Resellers. Neither the Commission nor the SBA has developed a definition of small entities specifically applicable to resellers. The closest applicable definition under the SBA's rules is for all telephone communications companies. 48 The most reliable source of information regarding the number of toll resellers nationwide of which we are aware appears to be the data that we collect annually in connection with the TRS. 49 According to our most recent data, 710 companies reported that they were engaged in the resale of telephone services. 50 Although it seems certain that some of these carriers are not independently owned and operated, or have more than 1,500 employees, we are unable at this time to estimate with greater precision the number of resellers that would qualify as small business concerns under the SBA's definition. 43 13 C. F. R. § 121.201, NAICS codes 513321 and 513322. 44 13 C. F. R. § 121.201, NAICS code 513321. 45 Id. 46 13 C. F. R. § 121.201 (SIC 4812/ NAICS 513322). 47 Provider Locator at Table 1. 48 13 C. F. R. § 121.201, NAICS code 513310. 49 13 C. F. R. § 121.201, NAICS code 513310. 50 Provider Locator at Table 1. The total for resellers includes both toll resellers and local resellers. 100 Federal Communications Commission FCC 02- 214 8 Consequently, we estimate that there are fewer than 710 small entity resellers that may be affected by this order. D. Description of Projected Reporting, Recordkeeping and Other Compliance Requirements 19. We have discussed generally in the Third Further NPRM, supra paras. 143- 147, the possibility that our tentative policies and rules, if adopted, might entail additional obligations for carriers. We ask for comment on any reporting, record keeping, or compliance requirements that might arise that could impact any entities, large and small, affected by such requirements. E. Steps Taken to Minimize Significant Economic Impact on Small Entities, and Significant Alternatives Considered 20. The RFA requires an agency to describe any significant alternatives that it has considered in reaching its proposed approach, which may include the following four alternatives (among others): (1) the establishment of differing compliance or reporting requirements or timetables that take into account the resources available to small entities; (2) the clarification, consolidation, or simplification of compliance or reporting requirements under the rule for small entities; (3) the use of performance, rather than design, standards; and (4) an exemption from coverage of the rule, or any part thereof, for small entities. 51 21. Section 222 applies to all telecommunications carriers, and therefore, any rules that we adopt will be applicable to all carriers. 52 Accordingly, we cannot exempt small entities from complying with any rules that we adopt. We have, however, taken the limited resources of small entities into account in promulgating certain existing CPNI rules, 53 and intend to do so again in addressing the issues that are addressed in the Third Further NPRM. In response to the IRFA issued in connection with the Clarification Order and Second Further Notice of Proposed Rulemaking, we note that some commenters asserted that, because the statute requires a universal standard, the Commission had not adequately taken notice of the issues of small entities in this area. 54 That is untrue; 55 it is of particular concern to the Commission that the interests of small entities be addressed. 51 5 U. S. C. § 603( c). 52 CPNI Order, 13 FCC Rcd at 8098- 8100, paras. 49- 50. 53 See Implementation of the Telecommunications Act of 1996; Telecommunications Carriers’ Use of Customer Proprietary Network Information; and Implementation of the Non- Accounting Safeguards of Sections 271 and 272 of the Communications Act of 1934, as amended, Order on Reconsideration and Petitions for Forbearance, 14 FCC Rcd 14409, 14472- 75, paras. 125- 27 (1999) (CPNI Reconsideration Order) (adjusting certain CPNI safeguards to ease the costs of compliance for small carriers). 54 See App. C, supra. 55 See App. C, supra. 101 Federal Communications Commission FCC 02- 214 9 22. In this Third Further NPRM, we seek comment on whether we should regulate the foreign storage or foreign- based access to the CPNI of U. S. customers who use domestic telecommunications services. Specifically, we seek comment on whether foreign storage or foreign access to domestic CPNI should be permitted only upon informed customer approval. We also request comment upon whether we should require that copies of domestic CPNI should be maintained within the United States. If we adopt rules governing foreign storage of and access to CPNI, all telecommunications carriers, including small entities, must comply with such rules. While additional rules could place a burden upon small entities in terms of developing, tracking and maintaining customer consent or in terms of creating copies of customer CPNI, such actions would only be required to the extent carriers choose to store domestic CPNI outside of the United States. Carriers could decide whether the burdens of any such regulations outweighs the benefit to the carrier of foreign storage of or access to domestic CPNI. 23. We also seek to refresh the record on what, if any, additional safeguards may be needed to protect the confidentiality of carrier proprietary information, as well as what further enforcement mechanisms, if any, may be necessary. In addition, we seek comment on the use and disclosure of CPNI in the event a carrier goes out of business or sells its assets. Because we have not proposed any rules at this time, we are unable to forecast the economic impact on small entities. Overall, we ask for comment in response to this IRFA on what competitive or economic impact any proposed rules in these areas would have on small entities and on whether there is any alternative form or proposals that we should consider to minimize the economic impact on them. Further, while we do not anticipate that any adopted rules will have a different impact upon small entities, we seek comment in particular from small entities that have concerns about the affect the proposed policies or rules, if adopted, might have on them if they later go out of business or sell their assets. F. Federal Rules that May Duplicate, Overlap, or Conflict with the Proposed Rules 24. None. 102 Federal Communications Commission FCC 02- 214 SEPARATE STATEMENT OF CHAIRMAN MICHAEL K. POWELL Re: Implementation of the Telecommunications Act of 1996; Telecommunications Carriers’ Use of Customer Proprietary Network Information and Other Customer Information; Implementation of the Non- Accounting Safeguards of Sections 271 and 272 of the Communications Act of 1934, as Amended, Third Report and Order and Third Further Notice of Proposed Rulemaking, CC Docket Nos. 96- 115 et al. In this Order, the Commission implements the Tenth Circuit’s directive that we must, as a constitutional matter, carefully weigh the costs and benefits associated with satisfying consumers’ statutory entitlement to give knowing consent to the use and disclosure of their customer proprietary network information (CPNI). We do this, as the court insisted, while still respecting companies’ valid speech interests pursuant to the First Amendment. This item is in response to the Tenth Circuit’s decision remanding our prior order implementing section 222 by embracing a “mixed approach” to customer approval. Companies must obtain affirmative consent from consumers for third party and non- communications uses (i. e., allow consumers to “opt- in” to such use). But we conclude, albeit somewhat reluctantly, that under the court’s constitutional analysis, companies may satisfy the somewhat less stringent requirement of giving consumers the chance to “opt- out” of intracompany communications-related use of CPNI. 1 Indeed, the court concluded that the First Amendment concerns implicated here are so grave that the Commission is not entitled to the usual Chevron deference. 2 This mixed approach we adopt here tracks evidence on the record that consumers have a reduced expectation of privacy regarding CPNI where this information is used by their existing carriers to market services customarily offered by telephone companies, such as voicemail and Internet access. This approach also comports with decisions by other appeals courts, at least one of which has required opt- in consent for some purposes and opt- out consent for others. 3 Regrettably, the reach of the Tenth Circuit’s opinion does not allow us to adopt an across-the- board opt- in regime at this time. Specifically, the Commission is severely constrained by the court’s overt skepticism that the record supporting our prior order lacked the empirical support necessary to justify in this instance the intrusion on carriers’ commercial speech interests. The court demanded, if requiring opt- in consent were to withstand a second appeal, that the record provide more persuasive empirical evidence that the privacy interest for intracarrier CPNI disclosure is substantial given companies’ intended uses of this information. Yet, despite the 1 The court instructed the Commission to consider an opt- out strategy, which the court concluded was "an obvious and substantially less restrictive alternative" to opt- in. U. S. West v. FCC, 182 F. 3d 1224, 1238 (10 th Cir. 1999), cert. denied 530 U. S. 1213 (2000). 2 See generally Chevron U. S. A., Inc. v. Natural Resources Defense Council, Inc., 467 U. S. 837 (1984). 3 See Trans Union Corp. v. FTC, 267 F. 3d 1138 (D. C. Cir. 2001) (declining to rehear decision approving opt- out consent regime with respect to disclosure of personal information in return for offers of credit, while requiring opt- in consent regime for target marketing generally), cert. denied, Trans Union LLC v. FTC, 122 S. Ct. 2386 (June 10, 2002). 103 Federal Communications Commission FCC 02- 214 2 laudable efforts of the parties to generate such an empirical record, not to mention our own efforts, no more persuasive evidence emerged that would satisfy the high constitutional bar set by the court. Indeed, the most persuasive empirical evidence of this sort regards third party dissemination of CPNI, where this Order confidently requires opt- in consent. In closing, I would underscore that I remain committed to continued vigilance in this area and urge parties to ask us to revisit these requirements in the event they uncover new support that meets the courts’ demanding standard. I hasten to add, moreover, that states continue to be uniquely positioned to assess the proper scope of CPNI use and may adopt more stringent notification requirements where those can be squared with the First Amendment based on state-specific facts on which we lack the opportunity to rely here. I take comfort that these avenues will enable the Commission or our state colleagues to protect consumers from unwarranted invasions of privacy where the evidence supports more stringent consent requirements in the manner the Constitution requires. 104 Federal Communications Commission FCC 02- 214 STATEMENT OF COMMISSIONER MICHAEL J. COPPS, APPROVING IN PART, DISSENTING IN PART Re: Implementation of the Telecommunications Act of 1996; Telecommunications Carriers Use of Customer Proprietary Network Information and Other Customer Information; Implementation of the Non- Accounting Safeguards of Sections 271 and 272 of the Communications Act of 1934, As Amended Few rights are so fundamental as the right to privacy in our daily lives, yet few are under such frontal assault. Today information technologies can monitor what we do, who we talk with, what we buy, what organizations we belong to, what political activities we undertake, what gods we worship. We may have avoided Orwell’s 1984, but the threat of technology intrusion into our private lives is not only real – it is growing. Today we have an opportunity to do something about it. We take a baby step; I think we could have taken a giant stride. Certainly I support that part of the Order that will prohibit the sale or disclosure of personal data to unaffiliated third parties unless consumers give specific approval, the so- called “opt- in” approach, and I am pleased that the decision does not preempt states from adopting more stringent privacy protections than we do today. But our business is communications, and when we are given the chance to decide how communications companies handle personal information within themselves and their affiliates, we retreat to an entirely different “opt- out” policy whereby the company gets an always- on green light to sell personal information about its customer unless the customer specifically takes the initiative to tell the company it may not do so. Today’s decision is cast as pro- consumer and “opt- in” except for what is implied to be the limited and less problematic sale of personal information to “communications- related affiliates,” “third party agents,” and “joint venture partners,” where “opt- out” will be required. But everyone should understand that this decision is neither narrow nor pro- privacy. It does not preclude companies in all instances from selling to the highest bidder personal and detailed information about who Americans call, when they call, and how long they talk, as long as these companies use it for some “communications related” purpose and have some undefined and murky affiliation, agency relationship, or partnership with the phone company. Anyone who has looked at some of the incredibly complex organizational charts submitted in our merger proceedings knows just how confusing and murky these affiliations can be. In that confusion and murkiness I find potentially serious trouble for consumer privacy. Importance of Privacy Safeguards Telephone carriers obtain a vast amount of information about each of us. Carriers know not only the phone services we purchase, but also personal information such as who we call, how often, and for how long. And in a converging communications industry, these same companies now, or may soon, also be able to track what Internet sites we visit, who we e- mail, what cable or satellite television programs we watch, what wireless phone calls we place, and even our location as we use our cell phone. Companies can combine this data with other information that they buy 106 Federal Communications Commission FCC 02- 214 2 from other sources, such as financial data, credit histories, travel habits, and any of the myriad invasive databases that exist in our digital world, to create a profile on each of us. Companies can use this information, known as CPNI, for a variety of purposes. They rely heavily on this information for marketing. Sometimes these marketing practices are merely annoying, such as telemarketing calls and junk mail. But when this marketing is based on in-depth personal information, it can become dangerous. CPNI could potentially be used to allow a company to market healthcare services to people who call certain doctors or specialists; insurance companies to know who calls AIDS hotlines; fundraisers to identify an individual’s political affiliation based on who calls the offices of candidates or political parties; or landlords to monitor the behavior of their tenants. When the stakes for misuse of our personal information are so high the Commission should be extraordinarily vigilant. Section 222 and the FCC Opt- in Decision Congress recognized this and instructed the Commission to protect the privacy of telephone consumers in section 222 of the Telecommunications Act. Congress recognized that information about individual communications use requires special privacy safeguards. In particular, section 222 limits the use and disclosure of personal customer information unless a carrier first obtains the “approval of the customer.” 1 In 1998, the Commission adopted rules to implement Congress’ privacy directive. The Commission correctly understood Congress’s insistence on a company acquiring the “approval of the customer” to require express approval, also known as “opt- in,” for use and disclosure of this sensitive personal information. “Approval” is clearly an active rather than a passive requirement. “Opt- out,” which would require a customer to take affirmative action to protect his or her personal information, is a failure to object, and not “approval.” These concepts are founded on fundamentally different premises. “Opt- out” strikes me as based on the notion that the company owns the information and can use that information as it chooses unless there is objection from the consumer. “Opt- in” is premised on the consumer being in control of this information and grants to each of us the ability to authorize a company to share it with somebody else should we so choose. On policy grounds, the Commission explained why Congress’s insistence on approval had been correct, by determining that “even assuming that an opt- out approach can be appropriate for less sensitive customer information, such an approach would not be appropriate for the disclosure of personal CPNI.” 2 The Commission concluded that an express approval requirement was necessary for both privacy and competitive concerns. It reasoned that “an express approval requirement provides superior protection for privacy interests because, unlike 1 47 U. S. C. § 222. 2 Implementation of the Telecommunications Act of 1996; Telecommunications Carriers Use of Customer Proprietary Network Information and Other Customer Information; Implementation of the Non- Accounting Safeguards of Sections 271 and 272 of the Communications Act of 1934, As Amended, Second Report and Order and Further Notice of Proposed Rulemaking, 13 FCC Rcd 8061, 8133 (1998) (CPNI Order). 107 Federal Communications Commission FCC 02- 214 3 under an opt- out approach, when customers must affirmatively act before their CPNI is used or disclosed, the confidentiality of CPNI is preserved until the customer is actually informed of its statutory protections. This ensures that customers’ privacy rights are protected against unknowing and unintended CPNI disclosure.” 3 In addition, the Commission recognized that the limitations were designed to eliminate restraints on competition, by “limiting the ability of incumbent carriers to leverage their control over monopoly- derived CPNI into emerging telecommunications markets.” 4 On appeal, the Tenth Circuit struck down the express approval requirement because the Commission had not built an adequate record to demonstrate that the regulations would materially and directly alleviate privacy harms and that the regulations were narrowly tailored so as to avoid a First Amendment violation. In particular, the court determined that the Commission had failed adequately to consider the less restrictive “opt- out” alternative. Importantly, the court did not hold that the express approval requirement could not be justified or that opt- out was the only way to read section 222. It held only that the Commission had failed to adequately justify its decision. So I think we are being overly cautious here. The Legal and Policy Inadequacy of Today’s Order In response to the Tenth Circuit’s decision, the Commission today requires approval only for disclosure to third parties and non- communications- related affiliates. Contrary to law, and without policy justification, the Commission allows mere notice and “opt- out,” an absence of complaint rather than the statutorily required approval, for a company to use, disclose, and permit access to sensitive personal information within a company, to “communications- related affiliates,” to “third party agents,” and to “joint venture partners.” These activities represent the most common of all uses of CPNI. The majority does not adequately narrow the definition of “communications related,” “affiliates,” “third party agents,” or “joint venture partners.” Without careful definitions the restrictions leave dangerous loopholes. I appreciate the majority’s willingness to respond to some of my concerns by stating that a carrier cannot sell such information to a pure content provider such as the operator of a Web site, a telemarketer, or a junk e- mailer. The definitions, however, remain unreasonably imprecise. According to my understanding, a carrier could still market personal consumer information to, for example, an ISP who also happens to provide content over its Internet system. Thus a telephone company could, without the permission of its customers, sell CPNI to any company that owns an ISP. I say this is my understanding because, even as late as this morning, the definitions and explanations are in flux. Trying to administer a regime whose exact parameters we, its designers, cannot pin- point creates problems. That’s not good for privacy. The majority seems to believe that they can go no further than “opt- out” for fear of 3 Id. 4 Id. at 8145. 108 Federal Communications Commission FCC 02- 214 4 litigation. We can be certain there will be challenges to this order no matter what decision is made. The fear of litigation should not unduly constrain us – we will be in court on this matter. I prefer to go there with our best foot forward, with a Commission decision that is more securely grounded in statute and one that accomplishes the will of Congress. Let us be clear: the court did not require “opt- out” nor did it invalidate “opt- in.” It demanded better justification for what the previous Commission did. I do not wish to minimize the showing we would have to make to the court, but neither do I want it to become an obstacle for moving proactively ahead. My understanding is that to satisfy court review, the Commission would need to provide more empirical explanation and justification for the government’s asserted interest; to demonstrate that “opt- in” materially advances that interest; and that “opt- in” is narrowly tailored and balanced as to its costs and benefits. I believe the Commission can effectively and convincingly meet these tests. There is an abundance of contemporary empirical data, including consumer surveys demonstrating consumer preferences, a state referendum in North Dakota with easy- to- understand results, and at least one company’s unhappy experiences with an “opt- out” program. There is new case- law altogether relevant to and supportive of “opt-in.” And, as explained below, “opt- in” is both narrowly tailored and balanced. We must always be at pains to ensure that our decisions do not violate the First Amendment. Part of our responsibility in this instance involves adequately explaining how our rule is necessary to protect privacy, as well as investigating whether less restrictive alternatives exist. Some, including the dissenting judge in U S WEST, take issue with whether the Commission’s previous order implicated constitutionally protected “speech”; whether it violated the First Amendment; and whether the Commission’s statutory construction was reasonable and thereby entitled to deference. But, even under the test applied by the Tenth Circuit, I believe that express approval is justified, necessary, and most clearly comports with the statute. Section 222 limits the use of sensitive individual information without “approval of the customer.” I agree with the Commission’s previous order that express approval “is guided by the natural, common sense understanding of the term ‘approval, ’ which we believe generally connotes an informed and deliberate response.” 5 As the Commission pointed out, it is “difficult to construe a customer’s failure to respond to a notice as constituting an informed approval of its contents.” 6 Since the Tenth Circuit’s decision, other courts have addressed express approval provisions and, using the same analysis, found them not to infringe upon First Amendment rights. In Trans Union Corp. v. FTC, the DC Circuit held that “[ a] lthough the opt- in scheme may limit more Trans Union speech than would the opt- out scheme the company prefers, intermediate scrutiny does not obligate courts to invalidate a ‘remedial scheme because some 5 Id. at 8130; see also U. S. WEST, Inc. v. FCC, 182 F. 3d 1224, 1241 (10 th Cir. 1999) (Briscoe, J., dissenting) (“ Although Congress did not specifically define the term ‘approval’ in the statute, its ordinary and natural meaning clearly ‘implies knowledge and exercise of discretion after knowledge. ’”) 6 CPNI Order at 8131. 109 Federal Communications Commission FCC 02- 214 5 alternative solution is marginally less intrusive on a speaker’s First Amendment interests. ’” 7 We are left with the issue whether “opt- in” is narrowly tailored and balanced. To decide this question, we must examine the prongs of the test applied by the Tenth Circuit. If the speech concerns lawful activity, we must determine whether there is a substantial state interest in regulating the speech, whether the regulation materially and directly advances that interest, and whether the regulation is no more extensive than necessary to alleviate the harm. The majority agrees that the first two prongs are met for both “opt- out” and “opt- in.” Thus, the relevant question at issue is whether “opt- in” is narrowly drawn or whether some lesser alternative such as “opt- out” would serve the government’s interest. We have seen in several contexts that “opt- out” does not adequately protect consumers’ privacy interests. As today’s order details, significant concerns have been raised about the effectiveness of “opt- out” requirements in the banking and financial sectors. Similarly, in the telecommunications sector, we have seen one example after another of instances where notice and “opt- out” have been ineffective in ensuring “that customers maintain control over carrier use of sensitive CPNI, and that those that wish to limit the use and dissemination of their information will know how, and be able to do so.” 8 Attorneys General from 39 states strongly advocate an express approval requirement because “opt- out” has proven so ineffective. A number of these Attorneys General have expressed concern about “opt- out” notices from telecommunications companies that are unclear and confusing and may therefore have been ignored or misunderstood by consumers. Even were I to approve the use of “opt- out,” I would dissent from the Commission’s rules here because these rules do not adequately address the problem at hand. Indeed, to develop an effective “opt- out” mechanism would require more detailed rules to ensure that consumers have a user- friendly, understandable and effective mechanism. Because companies view personal data as so valuable, they do not have an incentive to offer opt- out mechanisms that make it easy for consumers to choose to protect their privacy. Many companies simply do not want customers to take advantage of “opting- out.” So companies may reduce the likelihood of customers “opting- out” by providing notices that are lengthy, vague, obscured by other information or confusing. Consumers may not understand the extent of the use of the information, for example, if the company buries the information about sharing with affiliates and joint venture partners in the middle of a long disclosure form. “Opt- in,” on the other hand, provides an incentive to companies to ensure that customers read, understand, and respond to a notice. I fear that today’s decision – adopting “opt- out” and failure to provide adequate rules -- will lead inevitably to consumer abuses in the marketplace. Today’s decision puts the burden on the competitive marketplace to constrain use of personal information, arguing that carriers will not want to lose their customers due to misuse of information. But it is this same competitive marketplace that will put added pressure on carriers 7 Trans Union Corp. v. FTC, 267 F. 3d 1138, 1143 (D. C. Cir. 2001) 8 CPNI Order at 8138. 110 Federal Communications Commission FCC 02- 214 6 to create customer profiles to enhance their marketing efforts. We’ve all seen in recent weeks what havoc the pressures of the marketplace can cause. Threats to privacy will become even greater as data processing technology grows increasingly sophisticated and carriers become even more integrated through increasing consolidation. Moreover, “[ e] ven if market forces provide carriers with incentives not to abuse their customer’s privacy rights . . . these forces would not protect competitors’ concerns that CPNI could be used successfully to leverage former monopoly power into other markets.” 9 In light of the grave privacy and competition harms that this order could cause, I respectfully dissent from those parts of this decision that allow carriers to use sensitive personal information without first obtaining the express approval of the customer. 9 Id. at 8134. 111 Federal Communications Commission FCC 02- 214 STATEMENT OF COMMISSIONER KEVIN J. MARTIN Re: Implementation of the Telecommunications Act of 1996; CC Docket No. 96- 115 Telecommunications Carriers’ Use of Customer Proprietary Network Information and Other Customer Information; Implementation of Non- Accounting Safeguards of Sections 271 and 272 of the Communications Act of 1934, as Amended; CC Docket No. 96- 149 2000 Biennial Regulatory Review -- Review of Policies and Rules Concerning Unauthorized Changes of Consumers’ Long Distance Carriers; CC Docket No. 00- 257 I commend the Chairman and Bureau staff for their hard work and effort to craft rules that attempt to implement the customer proprietary network information (“ CPNI”) provisions of the Act and continue to protect the privacy of consumers in the face of court decisions that have limited our previous privacy safeguards. I believe that the Commission must remain vigilant with respect to protecting sensitive personal information of customers of telecommunications carriers. Indeed, our Congressional directive is to empower consumers with the ability to protect the confidentiality of their sensitive personal information. Previously, the Commission sought to protect customer privacy rights by requiring carriers to obtain express customer consent (i. e., an “opt- in” requirement) prior to obtaining access to CPNI. The U. S. Court of Appeals for the Tenth Circuit, however, struck down the Commission’s original “opt- in” rules, finding that the rules impermissibly regulated protected commercial speech and thus violated the First Amendment. In particular, the court determined that the “opt- in” rules failed constitutional scrutiny because they were not narrowly tailored as a result of the Commission’s failure to adequately consider an “opt- out” regime. Today’s recommendation seeks to find the appropriate balance between the continued privacy interests of consumers and the First Amendment rights of carriers to communicate with their customers. While I generally support the majority’s dual opt- in/ opt- out approach set forth in the decision, I remain cognizant of the imperfect science we implement today to effectuate the Court’s mandate. While I believe that the notification requirements outlined in today’s recommendation to protect customer’s privacy interests are adequate, we may need to do more to empower consumers to protect their personal information and I will not hesitate to revisit this decision if evidence in the marketplace indicates that these rules are insufficient to protect the consumers’ right to safeguard their personal information. 112