Federal Communications Commission FCC 07-22
STATEMENT OF
COMMISSIONER JONATHAN S. ADELSTEIN
APPROVING IN PART, DISSENTING IN PART
Re:  Implementation of the Telecommunications Act of 1996:  Telecommunications Carriers’ Use of 
Customer Proprietary Network Information and Other Customer Information; IP-Enabled Services, 
Report and Order and Further Notice of Proposed Rulemaking, CC Docket No. 96-115 and WC Docket 
No. 04-36
Through this proceeding, we address an issue of immediate personal importance to American 
consumers, the protection of sensitive information that telephone companies collect about their customers.  
This information can include some of the most private personal information about an individual, and 
failure to safeguard it can result in highly invasive intrusions into both the personal and professional lives 
of consumers.  When someone gets hold of who you are calling, and for how long, it is like letting 
strangers pick your brain about your friends, plans or business dealings.  So, I am pleased to support 
much of this Order, which takes meaningful steps to shut off the information drain that has left so many 
customers exasperated.
Congress recognized the sensitivity of this information in the Telecommunications Act of 1996 
when it prohibited phone companies from using or disclosing customer proprietary network information 
without the customer’s approval.  It charged the Commission with enforcing this privacy protection and 
the Commission previously adopted a set of rules designed to ensure that telephone companies have 
effective safeguards in place.  
Today’s action comes in response to the chorus of evidence detailing the need for greater privacy 
measures.  Indeed, this proceeding flows from a petition filed by a watchful public interest group, the 
Electronic Privacy Information Center (EPIC), which alerted the FCC during the summer of 2005 to the 
troubling trend of telephone call records being made available on the Internet without customers’ 
knowledge or consent.  As EPIC then made clear to the Commission and as the record to this proceeding 
has borne out, disclosure of these records is far more than a mere annoyance; indeed, it can lead to tragic 
consequences.
So, our efforts here to strengthen our rules are critical and time sensitive.  This Order takes 
several important steps tighten our rules and provide greater security for sensitive consumer records.  
Requiring more rigorous customer authentication, giving customers notice of account changes, and 
applying a more consumer-friendly approach to sharing of customer data should all serve to improve 
customers control over their private data.  As documented by EPIC, the sheer volume of customer 
information illegally available for public consumption made clear just how porous the existing firewalls 
and safeguards have been.  At the same time, the Commission strikes a balanced approach in this Order, 
giving consumers greater ability to control their own information while also giving companies a degree of 
flexibility in how they implement safeguards.  In this regard, I would like to thank Chairman Martin and 
the Wireline Competition Bureau for their attention to this item.  Their extra work to fine tune the rules 
we adopt here will surely improve their functioning for consumers and providers alike.
Although much of this Order does exactly what Congress contemplated – putting the customer in 
control – there is one critical aspect where this Order falls short.  Despite the Order’s conclusion that 
customers should have notice of unauthorized disclosure of customer information, this Order set up a 
process which can result in the unnecessary and even indefinite delay of consumer notification without 
any accountability.  Under these rules, the Commission gives the Federal Bureau of Investigation a 
potentially open-ended ability to delay customer notification of security breaches.  While I expect that the 
FBI will work as quickly as possible to identify any investigative issues, I find no statutory basis in the 
Act for granting the FBI a blank check to delay notice to customers.  I can understand the need for delay 
in extraordinary circumstances identified by law enforcement, but automatic delays coupled with 
unlimited and unchecked extensions are not appropriate.  Particularly given that timely notice to 
  Federal Communications Commission                      FCC 07-22
2
consumers may be essential for those customers to take protective action, I must dissent from this portion 
of the Order.
Finally, even as we work here to improve our rules and as Congress considers additional 
safeguards, we must also re-double our efforts to address abuses of this private information.  Swift 
enforcement action against companies that are violating our rules will be essential if we are to live up to 
our duty under the Act to protect customers’ sensitive and private information.