[{"innerBlocks":[],"name":"core\/freeform","postId":897,"blockType":{"name":"core\/freeform","keywords":[],"attributes":{"content":{"type":"string","source":"html"},"lock":{"type":"object"}},"providesContext":[],"usesContext":[],"supports":{"className":false,"customClassName":false,"reusable":false},"styles":[],"variations":[],"apiVersion":2,"title":"Classic","description":"Use the classic WordPress editor.","category":"text"},"originalContent":" $\"Binary$ \n\nOn March 31, 2016, the Federal Communications Commission (FCC) issued a Notice of Proposed Rulemaking (NPRM) of privacy and security regulations for Internet service providers (ISPs). The NPRM, In The Matter of Protecting the Privacy of Customer of Broadband and Other Telecommunications Service<\/em>, available here<\/a>, is intended to apply privacy requirements of the federal Communications Act (Act) to broadband Internet access services (BIAS). The FCC issued the NPRM through authority stemming from the 2015 Open Internet Order<\/u><\/em>, which applies Section 222 of the Act to BIAS providers, making some material changes in how the FCC addresses privacy and data security for more traditional telecoms, such as landline phone service providers, but applying much of the same approach. The proposal redefines customer proprietary information for protection by BIAS providers, institutes opt-in\/opt-out provisions for data use, defines and limits the use and sharing of aggregate data, suggests data security standards for BIAS providers, and sets forth a new data breach definition and new notification requirements. Throughout the NPRM, the FCC struggles with requiring third parties of BIAS providers to follow the same regulations as BIAS providers, such as whether to require third parties to follow the BIAS providers\u2019 breach notification requirements and whether to hold BIAS providers vicariously liable for privacy failures of third parties. Defining the relationship between BIAS providers and affiliates proves to be similarly difficult when the FCC discusses data security regulations and limiting use, sharing, or disclosure of customer proprietary information.\n\nAlthough the FCC repeatedly references comments and data from the Federal Trade Commission (FTC), its approach to regulating ISPs is an entirely different setup and contains more similarities to the Health Insurance Portability and Accountability Act (HIPAA) than to the FTC\u2019s approach to regulating online services. Where the FTC primarily allows online services to follow self-regulatory standards, the FCC expressly states its concern that BIAS providers engage in a much greater flow of customer PI than other online services such as websites and even edge networks (e.g., Facebook) and that information is not necessarily provided knowingly or willingly. For these reasons, the FCC is approaching data security and privacy in a more hands-on and detailed manner.\n\nIt is worth noting that the Commission was far from unanimous, with Commissioners Pai and O\u2019Rielly dissenting. Commissioner O\u2019Rielly blasted the NPRM, writing in his dissent that regulating only one part of the Internet economy (i.e., ISPs but not edge networks) would \u201chamstring competition with the largest users of consumer data.\u201d In addition, the Commission laid out in the NPRM at least 500 questions on which it seeks input from the industry and the public during the comment period.\n\nThe following summary of the potential changes reveals how a sectorial approach to ISPs may saddle them with significantly more burdensome data protection requirements than faced by other online service providers, including Facebook, Google, Uber, and other edge networks. Ultimately, the distinction and its advisability present a public policy question. However, the potential impact on ISPs, particularly regarding their ability to leverage big data for commercial advantage, is immense.\n\nExpanding the Definitions of Customer Proprietary Network Information and Customer Proprietary Information<\/strong>\n\nCustomer Proprietary Network Information<\/em>\n\nThe FCC proposes expanding the definition of customer proprietary network information (CPNI), excluding the telephone exchange service or telephone toll service portion of the existing definition and interpreting CPNI to include any information that the BIAS provider collects or accesses in connection with the provision of BIAS. This includes information that a BIAS provider causes to be collected and stored on customer premises equipment (CPE) or other devices, including mobile devices, in order to allow the carrier to collect or access the information. The definition will also include any information a BIAS provider attaches to a customer\u2019s Internet traffic if it falls within one of the categories in Section 222(h)(1)(A). In order to provide clarity, the FCC proposes to delineate non-exhaustive examples of types of information that would be considered CPNI in the broadband context. Examples of types of information that would constitute CPNI include (1) service plan information, including type of service (e.g., cable, fiber, or mobile); service tier (e.g., speed); pricing; and capacity (e.g., information pertaining to data caps); (2) geolocation; (3) media access control (MAC) addresses and other device identifiers; (4) source and destination Internet protocol (IP) addresses and domain name information; and (5) traffic statistics.\n\nCustomer Proprietary Information <\/em>\n\nThe FCC also proposes to define the type of proprietary customer information that telecommunications carriers have to protect pursuant to Section 222(a). Customer proprietary information would include private information that customers have an interest in protecting from public disclosure, and such information would fall into either the CPNI category or the personally identifiable information (PII) category. Together, these categories are \u201ccustomer PI\u201d and include information the BIAS provider acquires in connection with its provision of BIAS. In defining PII, the FCC draws heavily from other federal regulations and guidance, resulting in a nonexclusive list of PII data elements, which among common elements also include mother\u2019s maiden name; MAC address or other unique device identifiers; IP addresses; persistent online identifiers; eponymous and non-eponymous online identities; Internet browsing history; traffic statistics; application usage data; current or historical geolocation; and shopping records. PII would also include a BIAS customer\u2019s name, postal address, and telephone number as PII, a deviation from the standard treatment of \u201ctelephone directory information,\u201d as the FCC does not view the current collection standards for that type of information to be similar to the directories of customer information that telephone services maintain and publish.\n\nWhat Is a Communications-Related Service?<\/strong>\n\nThe FCC seeks comment regarding the definition of \u201ccommunications-related services\u201d for allowing BIAS providers to use customer PI to market communications-related services to subscribers and to disclose customer PI to their communications-related affiliates for the purpose of marketing communications-related services subject to opt-out approval.\n\nNotice of Privacy Policy<\/strong>\n\nUnder the proposed regulations, BIAS providers must notify customers of their privacy practices in a clear and conspicuous manner at the point of sale and on an ongoing basis through a link on the provider\u2019s home page, mobile application, and any functional equivalent. BIAS providers will be required to:\n
\n\t
Provide a notice of their privacy practices that will specify and describe types of customer PI collected by virtue of its provision of broadband service; of how the BIAS provider uses, and under what circumstances it discloses, each type of customer PI it collects; and the categories of entities that will receive customer PI from the BIAS provider and the purposes for which the customer PI will be used by each category of entities;<\/li>\n\t
Advise customers of their opt-in and opt-out rights with respect to their own PI, and provide access to a simple, easy-to-access method for customers to provide or withdraw consent to use, disclose, or provide access to customer PI for purposes other than the provision of broadband services through a method that is persistently available and at no additional cost to the customer;<\/li>\n\t
Explain that a denial of approval to use, disclose, or permit access to customer PI for purposes other than providing BIAS will not affect the provision of any services to which the customer subscribes, except for a brief description in clear and neutral language describing any consequences directly resulting from the lack of access to the customer PI; and<\/li>\n\t
Explain that any approval, denial, or withdrawal of approval for the use of customer PI for any purposes other than providing BIAS is valid until the customer affirmatively revokes such approval or denial, and inform the customer of his or her right to deny or withdraw access to such PI at any time. The notification must also explain that the provider may be compelled to disclose a customer\u2019s PI when other laws provide for such disclosure.<\/li>\n<\/ul>\nThe notification must be comprehensible and not misleading, clearly legible in sufficiently large type, displayed in an area so as to be readily apparent to the customer, and completely translated into another language if any portion of the notice is translated into that language. In addition to these requirements, the FCC seeks comment on whether to adopt a provision similar to California\u2019s Shine the Light law, which requires businesses, upon request, to provide to their customers, free of charge and within 30 days, (1) a list of categories of personal information disclosed by the business to third parties for the third parties\u2019 marketing purposes; (2) the names and addresses of all the third parties that received personal information from the business in the preceding calendar year; and (3) if the nature of the third parties\u2019 businesses cannot be reasonably determined by the third parties\u2019 name, examples of the products or services marketed by the third party. See Cal. Civ. Code. \u00a71798.83.\n\nIn order to ease the burden on both customers and BIAS providers, the FCC contemplates creating a standardized notice of privacy practices, which could provide a safe harbor for BIAS providers for the proposed law\u2019s notice provision, and removing the current requirement to provide customers with periodic updates. However, under the FCC\u2019s proposed rules, a BIAS provider would be required to provide notice of material changes to the privacy policies to customers prior to the material changes and also include specific terms within the material change update.\n\nLevels of Customer Choice for Data Use and Disclosures<\/strong>\n\nThe FCC proposal sets forth three categories of data for use and disclosure. The first category does not require customer approval or permission. The second category requires BIAS providers to provide customers with notice and opportunity to opt out before using a customer\u2019s PI or sharing a customer\u2019s PI with an affiliate that provides communications-related services in order to market communications-related services to the customer. The third category requires BIAS providers to seek and receive opt-in approval from customers before using or sharing customer PI for all other uses.\n\nCategory 1: Customer Approval Implied\/Not Required<\/em>\n\nBIAS providers will not be required to secure customer approval for customer PI when the customer PI is required for provision of the telecommunications service from which the information is derived or for services necessary to or used in the provision of the telecommunications service. This language mirrors Section 222(c)(1) for CPNI. However, it is unclear how the \u201cprovision of\u201d BIAS and \u201cservices necessary to or used in\u201d BIAS are going to be defined. The regulations also expand the amount of information a BIAS provider may use in the provision of BIAS or services necessary to or used in BIAS. BIAS providers will be able to use all customer PI and can also use customer PI to market to the customer additional BIAS offerings that are in the \u201csame category of service\u201d when the customer already subscribes to that category of service from the provider. The FCC proposes to adopt Section 222(d) as tailored for broadband services, which contains statutory exceptions for use of CPNI without customer notice or approval. Examples of these exceptions include IP-enabled voice service in specific emergency situations and billing for the broadband services.\n\nCategory 2: Use and Disclosure of Customer PI for Marketing Communications-Related Services <\/em>\n\nUnder the proposed regulations, customers would have the responsibility to opt out from use, disclosure, and permitted access to customer PI for marketing of other communications-related services after receiving a BIAS provider\u2019s notice of privacy policy. The proposed rules also:\n
\n\t
Expand the opt-out definition approval in the current CPNI rules (47 C.F.R. \u00a764.2003(l)) to include customer PI; and<\/li>\n\t
Eliminate the 30-day waiting period currently required to make a voice customer\u2019s opt-out approval effective so that a customer can opt out at any time and \u201cwith minimal effort.\u201d<\/li>\n<\/ul>\nOpt-out information must be clearly disclosed, easily used, and continuously available. Questions remain about how affiliates and BIAS providers will be treated, especially with the provision of bundled services. The FCC seeks clarification of how customers view sharing of customer PI between BIAS providers and affiliates. As proposed, communications-related services would not include edge services offered by the broadband provider.\n\nCategory 3: Use and Disclosure of Customer PI for All Other Purposes<\/em>\n\nThe FCC proposes to require BIAS providers to seek and receive opt-in approval from customers before using or sharing customer PI for all uses and sharing other than those that fall within categories 1 and 2, supra. <\/em>BIAS providers will have to acquire opt-in approval before:\n
\n\t
Using customer PI for purposes other than marketing communications-related services,<\/li>\n\t
Sharing customer PI with affiliates providing communications-related services for purposes other than marketing communications-related services, and<\/li>\n\t
Sharing customer PI with all other affiliates and third parties. Third parties include joint venture partners and independent contractors.<\/li>\n<\/ul>\nThe FCC seeks clarification of the purposes for which BIAS providers use customer PI and specifically whether the FCC should require opt-in consent for sharing geolocation data with affiliates. The primary concern in this category appears to be sharing customer PI in mobile contexts and allowing customers more control over the flow of their data to third parties.\n\nMaintaining Customer Opt-In\/Opt-Out Records<\/em>\n\nBIAS providers must:\n
\n\t
maintain records on customer PI disclosure to third parties for at least one year,<\/li>\n\t
maintain records of customer notices and approval for at least one year,<\/li>\n\t
adequately train and supervise their personnel on customer PI access,<\/li>\n\t
establish supervisory review processes, and<\/li>\n\t
provide prompt notice to the Commission of unauthorized uses or disclosures.<\/li>\n<\/ul>\nData Security Standards<\/strong>\n\nThe FCC seeks to codify BIAS providers\u2019 obligation found in Section 222(a) to \u201cprotect the security, confidentiality and integrity\u201d of customer PI. The FCC seeks comment on defining these terms, while noting that HIPAA (healthcare sector) has defined the terms (42 C.F.R. \u00a7164.304) but the Gramm Leach Bliley Act (GLBA) (financial services sector) has not (15 U.S.C. 6801(b)). In order to protect data, every BIAS provider will be required to:\n
\n\t
Establish and perform regular risk management assessments and promptly address any weaknesses in the provider\u2019s data security system identified by such assessments;<\/li>\n\t
Train employees, contractors, and affiliates that handle customer PI about the BIAS provider\u2019s data security procedures;<\/li>\n\t
Ensure due diligence and oversight of these security requirements by designating a senior management official with responsibility for implementing and maintaining the BIAS provider\u2019s data security procedures;<\/li>\n\t
Establish and use robust customer authentication procedures to grant customers or their designees access to customer PI; and<\/li>\n\t
Take responsibility for the use of customer PI by third parties with whom they share such information.<\/li>\n<\/ul>\nBIAS Provider Liability for Third-Party Downstream Privacy Violations<\/em>\n\nThe FCC appears to be pursuing a theory of vicarious liability for BIAS providers that share customer data with third parties. However, the FCC is also exploring and requests input on using contractual commitments to fulfill protecting shared data in lieu of vicarious liability. Additional concerns of the FCC include whether mobile BIAS providers should use contractual relationships with mobile device or mobile operating systems (OS) manufacturers that manufacture devices and hardware that operate on a BIAS provider\u2019s network to safeguard shared data.\n\nFlexible Data Security Considerations<\/em>\n\nAlthough the FCC is considering very specific requirements for protecting data security, there are a few factors that BIAS providers may work with while implementing the data security requirements, such as the nature and scope of the BIAS provider activities and the sensitivity of the customer PI that is involved. For example, reasonable safeguards for small BIAS providers will differ significantly from those for large-scale BIAS providers, and BIAS providers regularly handling Social Security numbers and medical information will need to institute stronger protections than BIAS providers handling names and email addresses.\n\nLimiting Data Collection, Retention, and Required Disposal<\/em>\n\nThe FCC further seeks to institute data minimization procedures for customer PI, differentiating between sensitive customer PI and other customer PI. In addition to requesting information on whether certain data should be exempt from any collection and storage, the FCC is also contemplating harmonizing data retention requirements for BIAS providers with those of cable and satellite providers. For example, cable and satellite providers are required to destroy personal data if the information is no longer necessary for the purpose for which it was collected. 47 U.S.C. \u00a7\u00a7551(e); 338(i)(6).\n\nData Breach Notification Requirements<\/strong>\n\nThe FCC removed the \u201cintent\u201d requirement of the Section 222 breach definition and instead defines a breach as any instance in which \u201ca person, without authorization or exceeding authorization, has gained access to, used or disclosed customer proprietary information.\u201d The proposed notification requirements are stringent. BIAS providers must:\n
\n\t
Notify affected customers of breaches of customer PI no later than 10 days after the discovery of the breach, subject to law enforcement needs, under circumstances enumerated by the Commission;<\/li>\n\t
Notify the Commission of any breach of customer PI no later than seven days after discovery of the breach; and<\/li>\n\t
Notify the Federal Bureau of Investigation (FBI) and the U.S. Secret Service (USS) of breaches of customer PI reasonably believed to relate to more than 5,000 customers no later than seven days after discovery of the breach and at least three days before notification to the customers.<\/li>\n<\/ul>\nThe FCC seeks to limit notification fatigue for customers and is considering both limitations based on risk of harm analyses, similar to those currently existing in some state breach notification laws, and a time limit that is more expansive, such as \u201cwithout undue delay\u201d instead of the currently proposed 10-day limit to notify customers. As indicated in BakerHostetler\u2019s Data Security Incident Response Report<\/a>, for the majority of breaches in 2015, it was approximately 40 days from the date of discovery to the date of notification.\n\nData Breach Notification Content Requirements<\/em>\n\nIn a change from the less-specific existing breach notification rules in Section 222, the FCC provides that particular content must be included in breach notifications to customers:\n
\n\t
The date, estimated date, or estimated date range of the breach.<\/li>\n\t
A description of the customer PI that was used, disclosed, or accessed or was reasonably believed to have been used, disclosed, or accessed by a person without authorization or exceeding authorization as a part of the breach of security.<\/li>\n\t
Information the customer can use to contact the telecommunications provider to inquire about the breach of security and the customer PI that the carrier maintains about the customer.<\/li>\n\t
Information about how to contact the FCC and any state regulatory agencies relevant to the customer and the service.<\/li>\n\t
Information about national credit-reporting agencies and the steps customers can take to guard against identity theft, including any credit monitoring or reporting the telecommunications provider is offering customers affected by the breach of security.<\/li>\n<\/ul>\nProhibited Practices<\/strong>\n\nLast, the FCC sets forth practices with privacy implications that \u201cmay be prohibited\u201d by the final rule. These practices include offering higher-priced broadband services for heightened privacy protections and the use of deep packet inspection for purposes other than network management. In other words, the FCC may be poised to outright prohibit offering consumers less-expensive broadband if they consent to have their usage data used to tailor interest-based ads for them. Commissioner O\u2019Rielly points out that this \u201cis a popular program offered by a major provider\u201d and challenges the Commission\u2019s concern that consumers \u201cmay not understand what they are trading.\u201d In addition, the FCC also seeks comment on whether persistent identifiers should be subject to heightened privacy protections beyond even opt-in usage proposals already made. Finally, the FCC asks whether it should prohibit mandatory arbitration of consumer disputes, which enable companies to avoid class action litigation.\n\nIn Conclusion<\/strong>\n\nThe FCC\u2019s proposals would result in BIAS providers having constraints on their data practices, such as those related to interest-based advertising, that do not apply to other digital service providers like Google and Facebook, at least to the extent they remain edge networks and not providers of BIAS. To the extent BIAS providers want to compete on an equal footing with edge networks, should the rulemaking take effect as proposed, they would need to segregate their BIAS and non-BIAS service offerings and related data. Further, the FCC\u2019s approach to privacy reflects a Californiaesque or European-style approach to what is treated as protected data and the level of consent required to collect, use, and share such data. The FCC is seeking public comment on this NPRM through May 27, 2016 and reply comments thereafter are due by June 27, 2016.\n\n \n\n ","saveContent":" $\"Binary$ \n\nOn March 31, 2016, the Federal Communications Commission (FCC) issued a Notice of Proposed Rulemaking (NPRM) of privacy and security regulations for Internet service providers (ISPs). The NPRM, In The Matter of Protecting the Privacy of Customer of Broadband and Other Telecommunications Service<\/em>, available here<\/a>, is intended to apply privacy requirements of the federal Communications Act (Act) to broadband Internet access services (BIAS). The FCC issued the NPRM through authority stemming from the 2015 Open Internet Order<\/u><\/em>, which applies Section 222 of the Act to BIAS providers, making some material changes in how the FCC addresses privacy and data security for more traditional telecoms, such as landline phone service providers, but applying much of the same approach. The proposal redefines customer proprietary information for protection by BIAS providers, institutes opt-in\/opt-out provisions for data use, defines and limits the use and sharing of aggregate data, suggests data security standards for BIAS providers, and sets forth a new data breach definition and new notification requirements. Throughout the NPRM, the FCC struggles with requiring third parties of BIAS providers to follow the same regulations as BIAS providers, such as whether to require third parties to follow the BIAS providers\u2019 breach notification requirements and whether to hold BIAS providers vicariously liable for privacy failures of third parties. Defining the relationship between BIAS providers and affiliates proves to be similarly difficult when the FCC discusses data security regulations and limiting use, sharing, or disclosure of customer proprietary information.\n\nAlthough the FCC repeatedly references comments and data from the Federal Trade Commission (FTC), its approach to regulating ISPs is an entirely different setup and contains more similarities to the Health Insurance Portability and Accountability Act (HIPAA) than to the FTC\u2019s approach to regulating online services. Where the FTC primarily allows online services to follow self-regulatory standards, the FCC expressly states its concern that BIAS providers engage in a much greater flow of customer PI than other online services such as websites and even edge networks (e.g., Facebook) and that information is not necessarily provided knowingly or willingly. For these reasons, the FCC is approaching data security and privacy in a more hands-on and detailed manner.\n\nIt is worth noting that the Commission was far from unanimous, with Commissioners Pai and O\u2019Rielly dissenting. Commissioner O\u2019Rielly blasted the NPRM, writing in his dissent that regulating only one part of the Internet economy (i.e., ISPs but not edge networks) would \u201chamstring competition with the largest users of consumer data.\u201d In addition, the Commission laid out in the NPRM at least 500 questions on which it seeks input from the industry and the public during the comment period.\n\nThe following summary of the potential changes reveals how a sectorial approach to ISPs may saddle them with significantly more burdensome data protection requirements than faced by other online service providers, including Facebook, Google, Uber, and other edge networks. Ultimately, the distinction and its advisability present a public policy question. However, the potential impact on ISPs, particularly regarding their ability to leverage big data for commercial advantage, is immense.\n\nExpanding the Definitions of Customer Proprietary Network Information and Customer Proprietary Information<\/strong>\n\nCustomer Proprietary Network Information<\/em>\n\nThe FCC proposes expanding the definition of customer proprietary network information (CPNI), excluding the telephone exchange service or telephone toll service portion of the existing definition and interpreting CPNI to include any information that the BIAS provider collects or accesses in connection with the provision of BIAS. This includes information that a BIAS provider causes to be collected and stored on customer premises equipment (CPE) or other devices, including mobile devices, in order to allow the carrier to collect or access the information. The definition will also include any information a BIAS provider attaches to a customer\u2019s Internet traffic if it falls within one of the categories in Section 222(h)(1)(A). In order to provide clarity, the FCC proposes to delineate non-exhaustive examples of types of information that would be considered CPNI in the broadband context. Examples of types of information that would constitute CPNI include (1) service plan information, including type of service (e.g., cable, fiber, or mobile); service tier (e.g., speed); pricing; and capacity (e.g., information pertaining to data caps); (2) geolocation; (3) media access control (MAC) addresses and other device identifiers; (4) source and destination Internet protocol (IP) addresses and domain name information; and (5) traffic statistics.\n\nCustomer Proprietary Information <\/em>\n\nThe FCC also proposes to define the type of proprietary customer information that telecommunications carriers have to protect pursuant to Section 222(a). Customer proprietary information would include private information that customers have an interest in protecting from public disclosure, and such information would fall into either the CPNI category or the personally identifiable information (PII) category. Together, these categories are \u201ccustomer PI\u201d and include information the BIAS provider acquires in connection with its provision of BIAS. In defining PII, the FCC draws heavily from other federal regulations and guidance, resulting in a nonexclusive list of PII data elements, which among common elements also include mother\u2019s maiden name; MAC address or other unique device identifiers; IP addresses; persistent online identifiers; eponymous and non-eponymous online identities; Internet browsing history; traffic statistics; application usage data; current or historical geolocation; and shopping records. PII would also include a BIAS customer\u2019s name, postal address, and telephone number as PII, a deviation from the standard treatment of \u201ctelephone directory information,\u201d as the FCC does not view the current collection standards for that type of information to be similar to the directories of customer information that telephone services maintain and publish.\n\nWhat Is a Communications-Related Service?<\/strong>\n\nThe FCC seeks comment regarding the definition of \u201ccommunications-related services\u201d for allowing BIAS providers to use customer PI to market communications-related services to subscribers and to disclose customer PI to their communications-related affiliates for the purpose of marketing communications-related services subject to opt-out approval.\n\nNotice of Privacy Policy<\/strong>\n\nUnder the proposed regulations, BIAS providers must notify customers of their privacy practices in a clear and conspicuous manner at the point of sale and on an ongoing basis through a link on the provider\u2019s home page, mobile application, and any functional equivalent. BIAS providers will be required to:\n
\n\t
Provide a notice of their privacy practices that will specify and describe types of customer PI collected by virtue of its provision of broadband service; of how the BIAS provider uses, and under what circumstances it discloses, each type of customer PI it collects; and the categories of entities that will receive customer PI from the BIAS provider and the purposes for which the customer PI will be used by each category of entities;<\/li>\n\t
Advise customers of their opt-in and opt-out rights with respect to their own PI, and provide access to a simple, easy-to-access method for customers to provide or withdraw consent to use, disclose, or provide access to customer PI for purposes other than the provision of broadband services through a method that is persistently available and at no additional cost to the customer;<\/li>\n\t
Explain that a denial of approval to use, disclose, or permit access to customer PI for purposes other than providing BIAS will not affect the provision of any services to which the customer subscribes, except for a brief description in clear and neutral language describing any consequences directly resulting from the lack of access to the customer PI; and<\/li>\n\t
Explain that any approval, denial, or withdrawal of approval for the use of customer PI for any purposes other than providing BIAS is valid until the customer affirmatively revokes such approval or denial, and inform the customer of his or her right to deny or withdraw access to such PI at any time. The notification must also explain that the provider may be compelled to disclose a customer\u2019s PI when other laws provide for such disclosure.<\/li>\n<\/ul>\nThe notification must be comprehensible and not misleading, clearly legible in sufficiently large type, displayed in an area so as to be readily apparent to the customer, and completely translated into another language if any portion of the notice is translated into that language. In addition to these requirements, the FCC seeks comment on whether to adopt a provision similar to California\u2019s Shine the Light law, which requires businesses, upon request, to provide to their customers, free of charge and within 30 days, (1) a list of categories of personal information disclosed by the business to third parties for the third parties\u2019 marketing purposes; (2) the names and addresses of all the third parties that received personal information from the business in the preceding calendar year; and (3) if the nature of the third parties\u2019 businesses cannot be reasonably determined by the third parties\u2019 name, examples of the products or services marketed by the third party. See Cal. Civ. Code. \u00a71798.83.\n\nIn order to ease the burden on both customers and BIAS providers, the FCC contemplates creating a standardized notice of privacy practices, which could provide a safe harbor for BIAS providers for the proposed law\u2019s notice provision, and removing the current requirement to provide customers with periodic updates. However, under the FCC\u2019s proposed rules, a BIAS provider would be required to provide notice of material changes to the privacy policies to customers prior to the material changes and also include specific terms within the material change update.\n\nLevels of Customer Choice for Data Use and Disclosures<\/strong>\n\nThe FCC proposal sets forth three categories of data for use and disclosure. The first category does not require customer approval or permission. The second category requires BIAS providers to provide customers with notice and opportunity to opt out before using a customer\u2019s PI or sharing a customer\u2019s PI with an affiliate that provides communications-related services in order to market communications-related services to the customer. The third category requires BIAS providers to seek and receive opt-in approval from customers before using or sharing customer PI for all other uses.\n\nCategory 1: Customer Approval Implied\/Not Required<\/em>\n\nBIAS providers will not be required to secure customer approval for customer PI when the customer PI is required for provision of the telecommunications service from which the information is derived or for services necessary to or used in the provision of the telecommunications service. This language mirrors Section 222(c)(1) for CPNI. However, it is unclear how the \u201cprovision of\u201d BIAS and \u201cservices necessary to or used in\u201d BIAS are going to be defined. The regulations also expand the amount of information a BIAS provider may use in the provision of BIAS or services necessary to or used in BIAS. BIAS providers will be able to use all customer PI and can also use customer PI to market to the customer additional BIAS offerings that are in the \u201csame category of service\u201d when the customer already subscribes to that category of service from the provider. The FCC proposes to adopt Section 222(d) as tailored for broadband services, which contains statutory exceptions for use of CPNI without customer notice or approval. Examples of these exceptions include IP-enabled voice service in specific emergency situations and billing for the broadband services.\n\nCategory 2: Use and Disclosure of Customer PI for Marketing Communications-Related Services <\/em>\n\nUnder the proposed regulations, customers would have the responsibility to opt out from use, disclosure, and permitted access to customer PI for marketing of other communications-related services after receiving a BIAS provider\u2019s notice of privacy policy. The proposed rules also:\n
\n\t
Expand the opt-out definition approval in the current CPNI rules (47 C.F.R. \u00a764.2003(l)) to include customer PI; and<\/li>\n\t
Eliminate the 30-day waiting period currently required to make a voice customer\u2019s opt-out approval effective so that a customer can opt out at any time and \u201cwith minimal effort.\u201d<\/li>\n<\/ul>\nOpt-out information must be clearly disclosed, easily used, and continuously available. Questions remain about how affiliates and BIAS providers will be treated, especially with the provision of bundled services. The FCC seeks clarification of how customers view sharing of customer PI between BIAS providers and affiliates. As proposed, communications-related services would not include edge services offered by the broadband provider.\n\nCategory 3: Use and Disclosure of Customer PI for All Other Purposes<\/em>\n\nThe FCC proposes to require BIAS providers to seek and receive opt-in approval from customers before using or sharing customer PI for all uses and sharing other than those that fall within categories 1 and 2, supra. <\/em>BIAS providers will have to acquire opt-in approval before:\n
\n\t
Using customer PI for purposes other than marketing communications-related services,<\/li>\n\t
Sharing customer PI with affiliates providing communications-related services for purposes other than marketing communications-related services, and<\/li>\n\t
Sharing customer PI with all other affiliates and third parties. Third parties include joint venture partners and independent contractors.<\/li>\n<\/ul>\nThe FCC seeks clarification of the purposes for which BIAS providers use customer PI and specifically whether the FCC should require opt-in consent for sharing geolocation data with affiliates. The primary concern in this category appears to be sharing customer PI in mobile contexts and allowing customers more control over the flow of their data to third parties.\n\nMaintaining Customer Opt-In\/Opt-Out Records<\/em>\n\nBIAS providers must:\n
\n\t
maintain records on customer PI disclosure to third parties for at least one year,<\/li>\n\t
maintain records of customer notices and approval for at least one year,<\/li>\n\t
adequately train and supervise their personnel on customer PI access,<\/li>\n\t
establish supervisory review processes, and<\/li>\n\t
provide prompt notice to the Commission of unauthorized uses or disclosures.<\/li>\n<\/ul>\nData Security Standards<\/strong>\n\nThe FCC seeks to codify BIAS providers\u2019 obligation found in Section 222(a) to \u201cprotect the security, confidentiality and integrity\u201d of customer PI. The FCC seeks comment on defining these terms, while noting that HIPAA (healthcare sector) has defined the terms (42 C.F.R. \u00a7164.304) but the Gramm Leach Bliley Act (GLBA) (financial services sector) has not (15 U.S.C. 6801(b)). In order to protect data, every BIAS provider will be required to:\n
\n\t
Establish and perform regular risk management assessments and promptly address any weaknesses in the provider\u2019s data security system identified by such assessments;<\/li>\n\t
Train employees, contractors, and affiliates that handle customer PI about the BIAS provider\u2019s data security procedures;<\/li>\n\t
Ensure due diligence and oversight of these security requirements by designating a senior management official with responsibility for implementing and maintaining the BIAS provider\u2019s data security procedures;<\/li>\n\t
Establish and use robust customer authentication procedures to grant customers or their designees access to customer PI; and<\/li>\n\t
Take responsibility for the use of customer PI by third parties with whom they share such information.<\/li>\n<\/ul>\nBIAS Provider Liability for Third-Party Downstream Privacy Violations<\/em>\n\nThe FCC appears to be pursuing a theory of vicarious liability for BIAS providers that share customer data with third parties. However, the FCC is also exploring and requests input on using contractual commitments to fulfill protecting shared data in lieu of vicarious liability. Additional concerns of the FCC include whether mobile BIAS providers should use contractual relationships with mobile device or mobile operating systems (OS) manufacturers that manufacture devices and hardware that operate on a BIAS provider\u2019s network to safeguard shared data.\n\nFlexible Data Security Considerations<\/em>\n\nAlthough the FCC is considering very specific requirements for protecting data security, there are a few factors that BIAS providers may work with while implementing the data security requirements, such as the nature and scope of the BIAS provider activities and the sensitivity of the customer PI that is involved. For example, reasonable safeguards for small BIAS providers will differ significantly from those for large-scale BIAS providers, and BIAS providers regularly handling Social Security numbers and medical information will need to institute stronger protections than BIAS providers handling names and email addresses.\n\nLimiting Data Collection, Retention, and Required Disposal<\/em>\n\nThe FCC further seeks to institute data minimization procedures for customer PI, differentiating between sensitive customer PI and other customer PI. In addition to requesting information on whether certain data should be exempt from any collection and storage, the FCC is also contemplating harmonizing data retention requirements for BIAS providers with those of cable and satellite providers. For example, cable and satellite providers are required to destroy personal data if the information is no longer necessary for the purpose for which it was collected. 47 U.S.C. \u00a7\u00a7551(e); 338(i)(6).\n\nData Breach Notification Requirements<\/strong>\n\nThe FCC removed the \u201cintent\u201d requirement of the Section 222 breach definition and instead defines a breach as any instance in which \u201ca person, without authorization or exceeding authorization, has gained access to, used or disclosed customer proprietary information.\u201d The proposed notification requirements are stringent. BIAS providers must:\n
\n\t
Notify affected customers of breaches of customer PI no later than 10 days after the discovery of the breach, subject to law enforcement needs, under circumstances enumerated by the Commission;<\/li>\n\t
Notify the Commission of any breach of customer PI no later than seven days after discovery of the breach; and<\/li>\n\t
Notify the Federal Bureau of Investigation (FBI) and the U.S. Secret Service (USS) of breaches of customer PI reasonably believed to relate to more than 5,000 customers no later than seven days after discovery of the breach and at least three days before notification to the customers.<\/li>\n<\/ul>\nThe FCC seeks to limit notification fatigue for customers and is considering both limitations based on risk of harm analyses, similar to those currently existing in some state breach notification laws, and a time limit that is more expansive, such as \u201cwithout undue delay\u201d instead of the currently proposed 10-day limit to notify customers. As indicated in BakerHostetler\u2019s Data Security Incident Response Report<\/a>, for the majority of breaches in 2015, it was approximately 40 days from the date of discovery to the date of notification.\n\nData Breach Notification Content Requirements<\/em>\n\nIn a change from the less-specific existing breach notification rules in Section 222, the FCC provides that particular content must be included in breach notifications to customers:\n
\n\t
The date, estimated date, or estimated date range of the breach.<\/li>\n\t
A description of the customer PI that was used, disclosed, or accessed or was reasonably believed to have been used, disclosed, or accessed by a person without authorization or exceeding authorization as a part of the breach of security.<\/li>\n\t
Information the customer can use to contact the telecommunications provider to inquire about the breach of security and the customer PI that the carrier maintains about the customer.<\/li>\n\t
Information about how to contact the FCC and any state regulatory agencies relevant to the customer and the service.<\/li>\n\t
Information about national credit-reporting agencies and the steps customers can take to guard against identity theft, including any credit monitoring or reporting the telecommunications provider is offering customers affected by the breach of security.<\/li>\n<\/ul>\nProhibited Practices<\/strong>\n\nLast, the FCC sets forth practices with privacy implications that \u201cmay be prohibited\u201d by the final rule. These practices include offering higher-priced broadband services for heightened privacy protections and the use of deep packet inspection for purposes other than network management. In other words, the FCC may be poised to outright prohibit offering consumers less-expensive broadband if they consent to have their usage data used to tailor interest-based ads for them. Commissioner O\u2019Rielly points out that this \u201cis a popular program offered by a major provider\u201d and challenges the Commission\u2019s concern that consumers \u201cmay not understand what they are trading.\u201d In addition, the FCC also seeks comment on whether persistent identifiers should be subject to heightened privacy protections beyond even opt-in usage proposals already made. Finally, the FCC asks whether it should prohibit mandatory arbitration of consumer disputes, which enable companies to avoid class action litigation.\n\nIn Conclusion<\/strong>\n\nThe FCC\u2019s proposals would result in BIAS providers having constraints on their data practices, such as those related to interest-based advertising, that do not apply to other digital service providers like Google and Facebook, at least to the extent they remain edge networks and not providers of BIAS. To the extent BIAS providers want to compete on an equal footing with edge networks, should the rulemaking take effect as proposed, they would need to segregate their BIAS and non-BIAS service offerings and related data. Further, the FCC\u2019s approach to privacy reflects a Californiaesque or European-style approach to what is treated as protected data and the level of consent required to collect, use, and share such data. The FCC is seeking public comment on this NPRM through May 27, 2016 and reply comments thereafter are due by June 27, 2016.\n\n \n\n ","order":0,"get_parent":{},"attributes":{"content":" $\"Binary$ \n\nOn March 31, 2016, the Federal Communications Commission (FCC) issued a Notice of Proposed Rulemaking (NPRM) of privacy and security regulations for Internet service providers (ISPs). The NPRM, In The Matter of Protecting the Privacy of Customer of Broadband and Other Telecommunications Service<\/em>, available here<\/a>, is intended to apply privacy requirements of the federal Communications Act (Act) to broadband Internet access services (BIAS). The FCC issued the NPRM through authority stemming from the 2015 Open Internet Order<\/u><\/em>, which applies Section 222 of the Act to BIAS providers, making some material changes in how the FCC addresses privacy and data security for more traditional telecoms, such as landline phone service providers, but applying much of the same approach. The proposal redefines customer proprietary information for protection by BIAS providers, institutes opt-in\/opt-out provisions for data use, defines and limits the use and sharing of aggregate data, suggests data security standards for BIAS providers, and sets forth a new data breach definition and new notification requirements. Throughout the NPRM, the FCC struggles with requiring third parties of BIAS providers to follow the same regulations as BIAS providers, such as whether to require third parties to follow the BIAS providers\u2019 breach notification requirements and whether to hold BIAS providers vicariously liable for privacy failures of third parties. Defining the relationship between BIAS providers and affiliates proves to be similarly difficult when the FCC discusses data security regulations and limiting use, sharing, or disclosure of customer proprietary information.\n\nAlthough the FCC repeatedly references comments and data from the Federal Trade Commission (FTC), its approach to regulating ISPs is an entirely different setup and contains more similarities to the Health Insurance Portability and Accountability Act (HIPAA) than to the FTC\u2019s approach to regulating online services. Where the FTC primarily allows online services to follow self-regulatory standards, the FCC expressly states its concern that BIAS providers engage in a much greater flow of customer PI than other online services such as websites and even edge networks (e.g., Facebook) and that information is not necessarily provided knowingly or willingly. For these reasons, the FCC is approaching data security and privacy in a more hands-on and detailed manner.\n\nIt is worth noting that the Commission was far from unanimous, with Commissioners Pai and O\u2019Rielly dissenting. Commissioner O\u2019Rielly blasted the NPRM, writing in his dissent that regulating only one part of the Internet economy (i.e., ISPs but not edge networks) would \u201chamstring competition with the largest users of consumer data.\u201d In addition, the Commission laid out in the NPRM at least 500 questions on which it seeks input from the industry and the public during the comment period.\n\nThe following summary of the potential changes reveals how a sectorial approach to ISPs may saddle them with significantly more burdensome data protection requirements than faced by other online service providers, including Facebook, Google, Uber, and other edge networks. Ultimately, the distinction and its advisability present a public policy question. However, the potential impact on ISPs, particularly regarding their ability to leverage big data for commercial advantage, is immense.\n\nExpanding the Definitions of Customer Proprietary Network Information and Customer Proprietary Information<\/strong>\n\nCustomer Proprietary Network Information<\/em>\n\nThe FCC proposes expanding the definition of customer proprietary network information (CPNI), excluding the telephone exchange service or telephone toll service portion of the existing definition and interpreting CPNI to include any information that the BIAS provider collects or accesses in connection with the provision of BIAS. This includes information that a BIAS provider causes to be collected and stored on customer premises equipment (CPE) or other devices, including mobile devices, in order to allow the carrier to collect or access the information. The definition will also include any information a BIAS provider attaches to a customer\u2019s Internet traffic if it falls within one of the categories in Section 222(h)(1)(A). In order to provide clarity, the FCC proposes to delineate non-exhaustive examples of types of information that would be considered CPNI in the broadband context. Examples of types of information that would constitute CPNI include (1) service plan information, including type of service (e.g., cable, fiber, or mobile); service tier (e.g., speed); pricing; and capacity (e.g., information pertaining to data caps); (2) geolocation; (3) media access control (MAC) addresses and other device identifiers; (4) source and destination Internet protocol (IP) addresses and domain name information; and (5) traffic statistics.\n\nCustomer Proprietary Information <\/em>\n\nThe FCC also proposes to define the type of proprietary customer information that telecommunications carriers have to protect pursuant to Section 222(a). Customer proprietary information would include private information that customers have an interest in protecting from public disclosure, and such information would fall into either the CPNI category or the personally identifiable information (PII) category. Together, these categories are \u201ccustomer PI\u201d and include information the BIAS provider acquires in connection with its provision of BIAS. In defining PII, the FCC draws heavily from other federal regulations and guidance, resulting in a nonexclusive list of PII data elements, which among common elements also include mother\u2019s maiden name; MAC address or other unique device identifiers; IP addresses; persistent online identifiers; eponymous and non-eponymous online identities; Internet browsing history; traffic statistics; application usage data; current or historical geolocation; and shopping records. PII would also include a BIAS customer\u2019s name, postal address, and telephone number as PII, a deviation from the standard treatment of \u201ctelephone directory information,\u201d as the FCC does not view the current collection standards for that type of information to be similar to the directories of customer information that telephone services maintain and publish.\n\nWhat Is a Communications-Related Service?<\/strong>\n\nThe FCC seeks comment regarding the definition of \u201ccommunications-related services\u201d for allowing BIAS providers to use customer PI to market communications-related services to subscribers and to disclose customer PI to their communications-related affiliates for the purpose of marketing communications-related services subject to opt-out approval.\n\nNotice of Privacy Policy<\/strong>\n\nUnder the proposed regulations, BIAS providers must notify customers of their privacy practices in a clear and conspicuous manner at the point of sale and on an ongoing basis through a link on the provider\u2019s home page, mobile application, and any functional equivalent. BIAS providers will be required to:\n
\n\t
Provide a notice of their privacy practices that will specify and describe types of customer PI collected by virtue of its provision of broadband service; of how the BIAS provider uses, and under what circumstances it discloses, each type of customer PI it collects; and the categories of entities that will receive customer PI from the BIAS provider and the purposes for which the customer PI will be used by each category of entities;<\/li>\n\t
Advise customers of their opt-in and opt-out rights with respect to their own PI, and provide access to a simple, easy-to-access method for customers to provide or withdraw consent to use, disclose, or provide access to customer PI for purposes other than the provision of broadband services through a method that is persistently available and at no additional cost to the customer;<\/li>\n\t
Explain that a denial of approval to use, disclose, or permit access to customer PI for purposes other than providing BIAS will not affect the provision of any services to which the customer subscribes, except for a brief description in clear and neutral language describing any consequences directly resulting from the lack of access to the customer PI; and<\/li>\n\t
Explain that any approval, denial, or withdrawal of approval for the use of customer PI for any purposes other than providing BIAS is valid until the customer affirmatively revokes such approval or denial, and inform the customer of his or her right to deny or withdraw access to such PI at any time. The notification must also explain that the provider may be compelled to disclose a customer\u2019s PI when other laws provide for such disclosure.<\/li>\n<\/ul>\nThe notification must be comprehensible and not misleading, clearly legible in sufficiently large type, displayed in an area so as to be readily apparent to the customer, and completely translated into another language if any portion of the notice is translated into that language. In addition to these requirements, the FCC seeks comment on whether to adopt a provision similar to California\u2019s Shine the Light law, which requires businesses, upon request, to provide to their customers, free of charge and within 30 days, (1) a list of categories of personal information disclosed by the business to third parties for the third parties\u2019 marketing purposes; (2) the names and addresses of all the third parties that received personal information from the business in the preceding calendar year; and (3) if the nature of the third parties\u2019 businesses cannot be reasonably determined by the third parties\u2019 name, examples of the products or services marketed by the third party. See Cal. Civ. Code. \u00a71798.83.\n\nIn order to ease the burden on both customers and BIAS providers, the FCC contemplates creating a standardized notice of privacy practices, which could provide a safe harbor for BIAS providers for the proposed law\u2019s notice provision, and removing the current requirement to provide customers with periodic updates. However, under the FCC\u2019s proposed rules, a BIAS provider would be required to provide notice of material changes to the privacy policies to customers prior to the material changes and also include specific terms within the material change update.\n\nLevels of Customer Choice for Data Use and Disclosures<\/strong>\n\nThe FCC proposal sets forth three categories of data for use and disclosure. The first category does not require customer approval or permission. The second category requires BIAS providers to provide customers with notice and opportunity to opt out before using a customer\u2019s PI or sharing a customer\u2019s PI with an affiliate that provides communications-related services in order to market communications-related services to the customer. The third category requires BIAS providers to seek and receive opt-in approval from customers before using or sharing customer PI for all other uses.\n\nCategory 1: Customer Approval Implied\/Not Required<\/em>\n\nBIAS providers will not be required to secure customer approval for customer PI when the customer PI is required for provision of the telecommunications service from which the information is derived or for services necessary to or used in the provision of the telecommunications service. This language mirrors Section 222(c)(1) for CPNI. However, it is unclear how the \u201cprovision of\u201d BIAS and \u201cservices necessary to or used in\u201d BIAS are going to be defined. The regulations also expand the amount of information a BIAS provider may use in the provision of BIAS or services necessary to or used in BIAS. BIAS providers will be able to use all customer PI and can also use customer PI to market to the customer additional BIAS offerings that are in the \u201csame category of service\u201d when the customer already subscribes to that category of service from the provider. The FCC proposes to adopt Section 222(d) as tailored for broadband services, which contains statutory exceptions for use of CPNI without customer notice or approval. Examples of these exceptions include IP-enabled voice service in specific emergency situations and billing for the broadband services.\n\nCategory 2: Use and Disclosure of Customer PI for Marketing Communications-Related Services <\/em>\n\nUnder the proposed regulations, customers would have the responsibility to opt out from use, disclosure, and permitted access to customer PI for marketing of other communications-related services after receiving a BIAS provider\u2019s notice of privacy policy. The proposed rules also:\n
\n\t
Expand the opt-out definition approval in the current CPNI rules (47 C.F.R. \u00a764.2003(l)) to include customer PI; and<\/li>\n\t
Eliminate the 30-day waiting period currently required to make a voice customer\u2019s opt-out approval effective so that a customer can opt out at any time and \u201cwith minimal effort.\u201d<\/li>\n<\/ul>\nOpt-out information must be clearly disclosed, easily used, and continuously available. Questions remain about how affiliates and BIAS providers will be treated, especially with the provision of bundled services. The FCC seeks clarification of how customers view sharing of customer PI between BIAS providers and affiliates. As proposed, communications-related services would not include edge services offered by the broadband provider.\n\nCategory 3: Use and Disclosure of Customer PI for All Other Purposes<\/em>\n\nThe FCC proposes to require BIAS providers to seek and receive opt-in approval from customers before using or sharing customer PI for all uses and sharing other than those that fall within categories 1 and 2, supra. <\/em>BIAS providers will have to acquire opt-in approval before:\n
\n\t
Using customer PI for purposes other than marketing communications-related services,<\/li>\n\t
Sharing customer PI with affiliates providing communications-related services for purposes other than marketing communications-related services, and<\/li>\n\t
Sharing customer PI with all other affiliates and third parties. Third parties include joint venture partners and independent contractors.<\/li>\n<\/ul>\nThe FCC seeks clarification of the purposes for which BIAS providers use customer PI and specifically whether the FCC should require opt-in consent for sharing geolocation data with affiliates. The primary concern in this category appears to be sharing customer PI in mobile contexts and allowing customers more control over the flow of their data to third parties.\n\nMaintaining Customer Opt-In\/Opt-Out Records<\/em>\n\nBIAS providers must:\n
\n\t
maintain records on customer PI disclosure to third parties for at least one year,<\/li>\n\t
maintain records of customer notices and approval for at least one year,<\/li>\n\t
adequately train and supervise their personnel on customer PI access,<\/li>\n\t
establish supervisory review processes, and<\/li>\n\t
provide prompt notice to the Commission of unauthorized uses or disclosures.<\/li>\n<\/ul>\nData Security Standards<\/strong>\n\nThe FCC seeks to codify BIAS providers\u2019 obligation found in Section 222(a) to \u201cprotect the security, confidentiality and integrity\u201d of customer PI. The FCC seeks comment on defining these terms, while noting that HIPAA (healthcare sector) has defined the terms (42 C.F.R. \u00a7164.304) but the Gramm Leach Bliley Act (GLBA) (financial services sector) has not (15 U.S.C. 6801(b)). In order to protect data, every BIAS provider will be required to:\n
\n\t
Establish and perform regular risk management assessments and promptly address any weaknesses in the provider\u2019s data security system identified by such assessments;<\/li>\n\t
Train employees, contractors, and affiliates that handle customer PI about the BIAS provider\u2019s data security procedures;<\/li>\n\t
Ensure due diligence and oversight of these security requirements by designating a senior management official with responsibility for implementing and maintaining the BIAS provider\u2019s data security procedures;<\/li>\n\t
Establish and use robust customer authentication procedures to grant customers or their designees access to customer PI; and<\/li>\n\t
Take responsibility for the use of customer PI by third parties with whom they share such information.<\/li>\n<\/ul>\nBIAS Provider Liability for Third-Party Downstream Privacy Violations<\/em>\n\nThe FCC appears to be pursuing a theory of vicarious liability for BIAS providers that share customer data with third parties. However, the FCC is also exploring and requests input on using contractual commitments to fulfill protecting shared data in lieu of vicarious liability. Additional concerns of the FCC include whether mobile BIAS providers should use contractual relationships with mobile device or mobile operating systems (OS) manufacturers that manufacture devices and hardware that operate on a BIAS provider\u2019s network to safeguard shared data.\n\nFlexible Data Security Considerations<\/em>\n\nAlthough the FCC is considering very specific requirements for protecting data security, there are a few factors that BIAS providers may work with while implementing the data security requirements, such as the nature and scope of the BIAS provider activities and the sensitivity of the customer PI that is involved. For example, reasonable safeguards for small BIAS providers will differ significantly from those for large-scale BIAS providers, and BIAS providers regularly handling Social Security numbers and medical information will need to institute stronger protections than BIAS providers handling names and email addresses.\n\nLimiting Data Collection, Retention, and Required Disposal<\/em>\n\nThe FCC further seeks to institute data minimization procedures for customer PI, differentiating between sensitive customer PI and other customer PI. In addition to requesting information on whether certain data should be exempt from any collection and storage, the FCC is also contemplating harmonizing data retention requirements for BIAS providers with those of cable and satellite providers. For example, cable and satellite providers are required to destroy personal data if the information is no longer necessary for the purpose for which it was collected. 47 U.S.C. \u00a7\u00a7551(e); 338(i)(6).\n\nData Breach Notification Requirements<\/strong>\n\nThe FCC removed the \u201cintent\u201d requirement of the Section 222 breach definition and instead defines a breach as any instance in which \u201ca person, without authorization or exceeding authorization, has gained access to, used or disclosed customer proprietary information.\u201d The proposed notification requirements are stringent. BIAS providers must:\n
\n\t
Notify affected customers of breaches of customer PI no later than 10 days after the discovery of the breach, subject to law enforcement needs, under circumstances enumerated by the Commission;<\/li>\n\t
Notify the Commission of any breach of customer PI no later than seven days after discovery of the breach; and<\/li>\n\t
Notify the Federal Bureau of Investigation (FBI) and the U.S. Secret Service (USS) of breaches of customer PI reasonably believed to relate to more than 5,000 customers no later than seven days after discovery of the breach and at least three days before notification to the customers.<\/li>\n<\/ul>\nThe FCC seeks to limit notification fatigue for customers and is considering both limitations based on risk of harm analyses, similar to those currently existing in some state breach notification laws, and a time limit that is more expansive, such as \u201cwithout undue delay\u201d instead of the currently proposed 10-day limit to notify customers. As indicated in BakerHostetler\u2019s Data Security Incident Response Report<\/a>, for the majority of breaches in 2015, it was approximately 40 days from the date of discovery to the date of notification.\n\nData Breach Notification Content Requirements<\/em>\n\nIn a change from the less-specific existing breach notification rules in Section 222, the FCC provides that particular content must be included in breach notifications to customers:\n
\n\t
The date, estimated date, or estimated date range of the breach.<\/li>\n\t
A description of the customer PI that was used, disclosed, or accessed or was reasonably believed to have been used, disclosed, or accessed by a person without authorization or exceeding authorization as a part of the breach of security.<\/li>\n\t
Information the customer can use to contact the telecommunications provider to inquire about the breach of security and the customer PI that the carrier maintains about the customer.<\/li>\n\t
Information about how to contact the FCC and any state regulatory agencies relevant to the customer and the service.<\/li>\n\t
Information about national credit-reporting agencies and the steps customers can take to guard against identity theft, including any credit monitoring or reporting the telecommunications provider is offering customers affected by the breach of security.<\/li>\n<\/ul>\nProhibited Practices<\/strong>\n\nLast, the FCC sets forth practices with privacy implications that \u201cmay be prohibited\u201d by the final rule. These practices include offering higher-priced broadband services for heightened privacy protections and the use of deep packet inspection for purposes other than network management. In other words, the FCC may be poised to outright prohibit offering consumers less-expensive broadband if they consent to have their usage data used to tailor interest-based ads for them. Commissioner O\u2019Rielly points out that this \u201cis a popular program offered by a major provider\u201d and challenges the Commission\u2019s concern that consumers \u201cmay not understand what they are trading.\u201d In addition, the FCC also seeks comment on whether persistent identifiers should be subject to heightened privacy protections beyond even opt-in usage proposals already made. Finally, the FCC asks whether it should prohibit mandatory arbitration of consumer disputes, which enable companies to avoid class action litigation.\n\nIn Conclusion<\/strong>\n\nThe FCC\u2019s proposals would result in BIAS providers having constraints on their data practices, such as those related to interest-based advertising, that do not apply to other digital service providers like Google and Facebook, at least to the extent they remain edge networks and not providers of BIAS. To the extent BIAS providers want to compete on an equal footing with edge networks, should the rulemaking take effect as proposed, they would need to segregate their BIAS and non-BIAS service offerings and related data. Further, the FCC\u2019s approach to privacy reflects a Californiaesque or European-style approach to what is treated as protected data and the level of consent required to collect, use, and share such data. The FCC is seeking public comment on this NPRM through May 27, 2016 and reply comments thereafter are due by June 27, 2016.\n\n \n\n "},"attributesType":{"content":{"type":"string","source":"html"},"lock":{"type":"object"}},"dynamicContent":null}]

Internet Service Providers Face New Regulatory Environment in the FCC’s Privacy and Security Proposal