Federal Communications Commission	FCC 20-26


STATEMENT OF
COMMISSIONER JESSICA ROSENWORCEL
DISSENTING

Re: 	Verizon Communications, File No.:  EB-TCD-18-00027698.

This investigation is a day late and a dollar short.  Our real-time location information is some of the most sensitive data there is about us, and it deserves the highest level of privacy protection.  It did not get that here—not from our nationwide wireless carriers and not from the Federal Communications Commission.  For this reason, I dissent.

	Everywhere we go our smartphones follow.  They power the connections that we count on for so much of modern life.  But because they are always in our palms and pockets, they are collecting gobs of data about everything we are doing—and where we are doing it.

	That means our phones know our location at any given moment.  This geolocation data is especially sensitive.  It’s a record of where we’ve been and by extension, who we are.  If it winds up in the wrong hands, it could provide criminals and stalkers with the ability to locate any one of us with pinpoint accuracy.  It could be sold to domestic abusers or anyone else who wishes to do us harm.  Its collection and distribution or sale without our permission or without reasonable safeguards in place is a violation of our most basic privacy norms.  It’s also a violation of the law.  

	But what we’ve learned is that it happened anyway.  In May 2018, The New York Times reported that our wireless carriers were selling our real-time location information to data aggregators.  Then in January 2019 Motherboard revealed that bounty hunters and other shady businesses had access to this highly sensitive data.  Further reporting by Vice pieced together just how this sensitive data wound up in the hands of hundreds of bounty hunters who were willing to sell it to anyone for just a few hundred dollars.  It turns out wireless carriers sold access to individual real-time location information to data aggregators, who then sold it to a skip-tracing firm, who then sold it to a bail-bond company, who then sold it to individual bounty hunters.

	If that sounds like a tortured chain of data possession, it is.  And if you don’t remember giving this kind of permission or signing up for the sale of your geolocation data on a black market, you’re not alone.  Comb through your wireless contract, it’s a good bet there is nothing in there that discloses your carrier could monetize your real-time location in this way.

	It should have been simple for the FCC to take action to stop this practice under Section 222 of the Communications Act.  But that didn’t happen.  Instead, for months this agency said nothing except that it was investigating.  It did not provide the public with any details, despite the ongoing risk to the security of every one of us with a smartphone.  As a result, the sale of our most sensitive location information continued for far too long under the watch of this agency.

	All told, taking nearly two years to address these troubling revelations is a stain on this agency’s public safety record.  It’s a testament to how little it makes privacy a priority.

	That’s why starting last year I took on this issue on my own.  I took to television and spoke on cable and broadcast news about how a black market was developing where anyone could buy information about where we are and what we are doing based on location data from our wireless devices.  I wrote every nationwide wireless carrier and asked them to state whether they had ended their arrangements to sell location data and what steps they were taking to secure any data that had already been shared.  I made these letters public.  I also made public the responses.  In the course of doing so, I am pleased to report that I was able to secure the first public statements from inside this agency about what carriers were doing with our location information.  
	I am also pleased that at my request the FCC is taking the necessary steps to remove redactions in the text of this long-awaited enforcement action that would have covered up exactly what happened with our location data.  We should care more about protecting the privacy of consumers than the privacy of companies’ business practices—especially when they violate the law.   

	However, in the end I find this enforcement action inadequate.  There are more than 270 million smartphones in service in the United States and this practice put everyone using them at a safety risk.  The FCC heavily discounts the fines the carriers could owe under the law and disregards the scope of the problem.  

	Here’s why.  At the outset, the FCC states that this impermissible practice should be the subject of a fine for every day that it was ongoing.  But right at the outset the agency gives each carrier a thirty-day pass from this calculation.  This thirty day “get-out-of-jail-free” card is plucked from thin air.  You’ll find it in no FCC enforcement precedent.  And if you compare it to every data security law in the country, this stands as an outlier.  In fact, state privacy laws generally require companies to act on discovered breaches on a much faster timetable—in some cases, less than a week.  Real-time location data is some of the most sensitive information available about all of us and it deserves the highest level of privacy protection.  Permitting companies to turn a blind eye for thirty days after discovering this data is at risk falls short of any reasonable standard.

	Next, the FCC engages in some seriously bureaucratic math to discount the violations of our privacy laws.  The agency proposes a $40,000 fine for the violation of our rules—but only on the first day.  For every day after that, it imposes only a $2,500 fine for the same violation.    But it offers no acceptable justification for reducing the fine in this way.  Plus, given the facts here—the sheer volume of those who could have had their privacy violated—I don’t think this discount is warranted.

In sum, it took too long to get here and we impose fines that are too small relative to the law and the population put at risk.  But this effort is far from over.  Because when the FCC releases a Notice of Apparent Liability, it is just early days.  The fines are not final until after the carriers that are the subject of this action get a chance to respond.  That means there is still work to do—and this agency cannot afford to wait another year to do it.  If past practice is any guide, we all have reason to be concerned.


2