FCC ACTS TO PROTECT PRIVATE CONSUMER INFORMATION ON WIRELESS DEVICES
Washington, D.C. – The Commission today took action to protect the privacy of consumers of wireless services by clarifying its customer proprietary network information (CPNI) policies in response to changes in technology and market practices in recent years. Today's Declaratory Ruling rests on a simple and fundamentally fair principle: when a telecommunications carrier collects CPNI using its control of its customers' mobile devices, and the carrier or its designee has access to or control over the information, the carrier is responsible for safeguarding that information.
Specifically, the Declaratory Ruling makes clear that when mobile carriers use their control of customers' devices to collect information about customers' use of the network, including using preinstalled apps, and the carrier or its designee has access to or control over the information, carriers are required to protect that information in the same way they are required to protect CPNI on the network. This sensitive information can include phone numbers that a customer has called and received calls from, the durations of calls, and the phone's location at the beginning and end of each call.
Carriers are allowed to collect this information and to use it to improve their networks and for customer support. Carriers' collection of this information can benefit consumers by enabling a carrier to detect a weak signal, a dropped call, or trouble with particular phone models. But if carriers collect CPNI in this manner, today's ruling makes clear that they must protect it.
The Declaratory Ruling does not impose any requirements on non-carrier, third-party developers of applications that consumers may install on their own. The ruling also does not adopt or propose any new rules regarding how carriers may use CPNI or how they must protect it.
The Commission can take enforcement action in the event that a failure to take reasonable precautions causes a compromise of CPNI on a device. This clarification avoids what would otherwise be an important gap in privacy protections for consumers.
Today's action is the latest by the FCC to protect consumer privacy as part of the agency's mission to serve the public interest. By taking action in this area, the Commission reaffirms that it is looking out for consumers in the telecommunications market.
Action by the Commission June 27, 2013, by Declaratory Ruling (FCC 13-89). Acting Chairwoman Clyburn and Commissioner Rosenworcel with Commissioner Pai approving in part/concurring in part. Acting Chairwoman Clyburn, Commissioners Rosenworcel and Pai issuing statements.
Following the likes of Microsoft and Facebook, Apple has publicly responded to the explosion in interest in the NSA's PRISM program, and has been authorized to reveal some of the data on what it's shared with the US government in the past. It apparently first heard of the program when the media started to ask about it earlier this month and has reiterated that it provides no government agency with direct access to its servers. It does, however, get its fair share of requests for customer data from US law enforcement, receiving between 4,000 and 5,000 of them between December 1 2012 and May 31 2013. These requests covered over 9,000 accounts or devices, and come from federal, state and local authorities. Apple elaborated a little on these information requests too, saying that the majority of these requests have involved searching for missing children, preventing suicides and robberies. The company says it has "always placed a priority on protecting our customers' personal data," and its legal team evaluates each request. Apparently, Apple can't decrypt (and thus share) iMessage and FaceTime data, which is encrypted end-to-end. We've added its full statement after the break. Show full PR textApple's Commitment to Customer Privacy
By Lauren Indvik2013-05-13 18:02:01 UTC