FCC Declares Information On Mobile Devices May Qualify As CPNI

On June 27, 2013, the Federal Communications Commission issued a Declaratory Ruling clarifying that telecommunications carriers have a duty to protect customer proprietary network information (CPNI) that carriers cause to be stored on their customers' mobile devices when carriers or their designees have access to or control over that information. The Commission did not adopt nor propose any new rules related to CPNI, but clarified the applicability of existing rules to information stored on mobile devices. Section 222 of the Communications Act of 1934, as amended, requires communications providers to protect consumers' sensitive personal information to which they have access as a result of their unique position as network operators. The most specific obligations concern CPNI, which includes information about a customer's use of the service that is made available to the carrier by virtue of the carrier-customer relationship. The Commission has previously explained that CPNI includes information such as the phone numbers called by a consumer, the frequency, duration, and timing of such calls, and any related services purchased or used by the consumer, such as call waiting. The location of a customer's use of a telecommunications service also qualifies as CPNI. The Declaratory Ruling clarifies that section 222 applies to information that fits the statutory definition of CPNI when such information is collected by the subscriber's mobile device, provided that the collection is undertaken at the carrier's direction and that the carrier or its designee has access to or control over that information. The Declaratory Ruling does not prohibit the collection of...