[Federal Register: September 20, 2002 (Volume 67, Number 183)]
[Rules and Regulations]               
[Page 59205-59213]
From the Federal Register Online via GPO Access [wais.access.gpo.gov]
[DOCID:fr20se02-15]                         

=======================================================================
-----------------------------------------------------------------------

FEDERAL COMMUNICATIONS COMMISSION

47 CFR Part 64

[CC Docket Nos. 96-115, 96-149; FCC 02-214]

 
Implementation of the Telecommunications Act of 1996: 
Telecommunications Carriers' Use of Customer Proprietary Network 
Information and Other Customer Information; Implementation of the Non-
Accounting Safeguards of Sections 271 and 272 of the Connumications Act 
of 1934, as Amended

AGENCY: Federal Communications Commission.

ACTION: Final rule.

-----------------------------------------------------------------------

SUMMARY: This document adopts rules to implement section 222 of the 
Communications Act of 1934 (as amended by the Telecommunications Act of 
1996), which governs carriers' use and disclosure of customer 
proprietary network information (CPNI). This document affirms the 
continued use of the total service approach to define what carriers may 
do under section 222(c)(1) without notice to customers, and allows a 
carrier to choose whether to use an opt-out or opt-in approval method 
for obtaining customer approval for a carrier to use its customer's 
individually identifiable CPNI for the purpose of marketing 
communications-related services to that customer. Specifically, this 
document allows the use of CPNI by carriers or disclosure to their 
affiliated entities providing communications-related services, as well 
as third-party agents and joint venture partners providing 
communications-related services, only after a carrier receives a 
customer's knowing consent in the form of notice and ``opt-out'' 
approval. This document also permits disclosure of CPNI to unrelated 
third parties or to carrier affiliates that do not provide 
communications-related services requires express customer consent, 
described as ``opt-in'' approval. This document also further refines 
the rules governing the process by which carriers provide notification 
to customers of their CPNI rights. Specifically, it clarifies the form, 
content and frequency of carrier notices. Additionally, this document 
affirms the Federal Communications Commission's conclusion that 
customers' preferred carrier (PC) freeze information constitutes CPNI 
and thereby warrants privacy protection pursuant to section 222, and 
announces the Commission's decision to forbear from imposing the 
express consent requirements announced in this document with respect to 
PC-freezes. This document also reaffirms existing Commission rules 
addressing winback and retention marketing, and declines to adopt 
further rules regarding a carrier's denial of CPNI to another carrier 
with customer authorization.

DATES: Effective October 21, 2002, except Sec. Sec.  64.2007, 64.2008, 
and 64.2009, which contain information collection requirements that are 
not effective until approved by the Office of Management and Budget. 
The Federal Communications Commission will publish a document in the 
Federal Register announcing the effective date of these rules.

FOR FURTHER INFORMATION CONTACT: Marcy Greene, Attorney-Advisor, 
Competition Policy Division, Wireline Competition Bureau, at (202) 418-
2410, or via the Internet at mgreene@fcc.gov.

SUPPLEMENTARY INFORMATION: This is a summary of the Commission's Third 
Report and Order in CC Docket Nos. 96-115 and 96-149, adopted July 16, 
2002, and released July 25, 2002. The complete text of this Report and 
Order is available for inspection and copying during normal business 
hours in the FCC Reference Information Center, Portals II, 445 12th 
Street, SW., Room CY-A257, Washington, DC, 20554. This document may 
also be purchased from the Commission's duplicating contractor, Qualex 
International, Portals II, 445 12th Street, SW., Room CY-A257, 
Washington, DC 20554, telephone 202-863-2893, facsimile 202-863-2898, 
or via e-mail at qualexint@aol.com. It is also available on the 
Commission's Web site at http://www.fcc.gov.

Synopsis of the Report and Order

    1. The Commission resolves in this Order several issues in 
connection with carriers' use of customer proprietary network 
information (``CPNI'') pursuant to section 222 of the 
Telecommunications Act of 1996. Through section 222, Congress 
recognized both that telecommunications carriers are in a unique 
position to collect sensitive personal information and that customers 
maintain an important privacy interest in protecting this information 
from disclosure and dissemination. The rules adopted by the Commission 
focus on the nature of the customer approval needed before a carrier 
can use, disclose or permit access to CPNI.
    2. Background. This proceeding was initiated in 1996 to implement 
section 222 of the Communications Act of 1934 (as amended), which 
governs carriers' use and disclosure of CPNI. On February 26, 1998, the 
Commission adopted regulations implementing section 222 in its CPNI 
Order. [63 FR 20236, April 24, 1998]. In particular, it concluded that 
section 222(c)(1) of the Act allows a carrier to use a customer's CPNI, 
derived from the complete service subscribed to from that carrier, for 
marketing purposes within the existing service relationship. This is 
known as the ``total service approach.'' The Commission also concluded 
that carriers must notify the customer of the customer's rights under 
section 222 and then obtain express written, oral or electronic 
customer approval--a ``notice and opt-in'' approach--before a carrier 
may use CPNI to market services outside the customer's existing service 
relationship with that carrier. On September 3, 1999, the Commission 
released an Order on Reconsideration [64 FR 53242, Oct. 1, 1999] that 
affirmed the opt-in approach, but streamlined the CPNI rules so that 
carriers could use CPNI to market customer premises equipment and 
information services without customer approval, and lessened carriers' 
CPNI record-keeping responsibilities. It also eliminated restrictions 
on a carrier's ability to use CPNI to regain customers that switched to 
another carrier, known as ``winbacks.''
    3. After the Commission adopted the Order on Reconsideration, but 
prior to its release, the Court of Appeals for the Tenth Circuit 
vacated portions of the 1998 CPNI Order. The court found that the 
Commission did not show that the opt-in form of consent protected 
privacy and promoted competition in a manner consistent with the First 
Amendment of the U.S. Constitution.
    4. In an October 6, 2000 Order, AT&T; v. Bell Atlantic (denying a 
complaint by AT&T; regarding the manner in which Bell Atlantic markets 
the services of its long distance affiliate to its local exchange 
customers), the Commission interpreted the Tenth Circuit's vacatur as 
applying only to the discrete issue that was before the court. On 
September 7, 2001, the Commission released a Clarification Order and 
Second Further Notice of Proposed Rulemaking [66 FR 50140, Oct. 2, 
2001] that determined that all CPNI rules except those relating to opt-
in remained in effect, and that carriers may choose to obtain customer 
approval by means of an opt-out approach until the Commission adopted

[[Page 59206]]

final rules. This Order sought comment on adopting either an opt-in or 
opt-out approach.
    5. On July 16, 2002, the Commission adopted a Third Report and 
Order that allows a carrier to choose whether to use an opt-out or opt-
in approval method for obtaining customer approval for a carrier to use 
its customer's individually identifiable CPNI for the purpose of 
marketing communications-related services to that customer. The Order 
allows a carrier--subject to opt-out or opt-in approval--to disclose 
its customer's individually identifiable CPNI, for the purpose of 
marketing communications-related services to that customer, to (i) Its 
agents, (ii) its affiliates that provide communications-related 
services, and (iii) its joint venture partners and independent 
contractors. Carriers must obtain opt-in customer approval for all 
other uses and disclosures of CPNI to which other exceptions do not 
apply.
    6. Discussion. This document allows carriers to choose the 
method(s) by which consumers may express their opt-out or opt-in 
choices. However, carriers are required to make available to all 
customers a method to opt-out that is of no cost to the customer and 
that is available 24 hours a day, seven days a week. This document 
confirms the previous determination that preferred carrier freezes (PC 
freezes) fit within the statutory definition of CPNI, and forbears from 
imposing the affirmative approval requirements in the CPNI rules so 
that preferred carrier freeze information can be disclosed among 
carriers.

Final Paperwork Reduction Act Analysis

    7. This Order contains new and modified information collections 
subject to the Paperwork Reduction Act of 1995 (PRA), Public Law 104-
13. It will be submitted to the Office of Management and Budget (OMB) 
for review under Section 3507(d) of the PRA. OMB, the general public, 
and other Federal agencies are invited to comment on the new or 
modified information collection(s) contained in this proceeding. 
Implementation of these new or modified reporting and/or recordkeeping 
requirements will be subject to approval by the OMB, as prescribed by 
the Act, and will go into effect upon announcement in the Federal 
Register of OMB approval.

Final Regulatory Flexibility Analysis

    8. As required by the Regulatory Flexibility Act, as amended, 
(RFA), an Initial Regulatory Flexibility Analysis (IRFA) was 
incorporated in the Clarification Order and Second Further Notice of 
Proposed Rulemaking issued in CC Docket No. 96-115 and CC Docket No. 
96-149. The Commission sought written public comment on the proposals 
in the Second FNPRM, including comment on the IRFA. This present Final 
Regulatory Flexibility Analysis (FRFA) conforms to the RFA.

Need for, and Objectives of, the Third Report and Order

    9. The initial need for the proceeding of which this Report and 
Order is a part is that on May 17, 1996, the Commission initiated a 
rulemaking in response to requests for guidance from the 
telecommunications industry regarding the obligations of 
telecommunications carriers under section 222 of the Act and related 
issues. The Commission released the CPNI Order on February 26, 1998, in 
which it addressed the scope and meaning of section 222 and promulgated 
implementing regulations. On August 18, 1999, the Tenth Circuit issued 
an opinion vacating a portion of the CPNI Order in U S WEST v. FCC. 
That left the Commission with a need to clarify the CPNI rules and 
their future operation. The Commission does so herein.
    10. On August 28, 2001, the Commission adopted an order (CPNI 
Clarification Order) clarifying the status of its CPNI rules in light 
of the Tenth Circuit order and issuing a Further Notice of Proposed 
Rulemaking (Clarification Order Further NPRM). Specifically, the 
Commission sought comment on (1) Its interpretation of the scope of the 
Tenth Circuit order; (2) what type of approval (opt-in or opt-out) 
would best serve the government's goals while respecting constitutional 
limits; (3) ways in which consumers can consent to a carrier's use of 
their CPNI; (4) what methods of approval would serve the governmental 
interests at issue and afford informed consent, while also satisfying 
the First Amendment's requirement that any restrictions on speech be 
narrowly tailored; (5) the interests and policies underlying section 
222 that are relevant to formulating an approval requirement, including 
an analysis of the privacy interests that are at issue, and on the 
extent to which it should take competitive concerns into account; (6) 
the likely difference in competitive harms under opt-in and opt-out 
approvals; and (7) whether adoption of an opt-out mechanism is 
consistent with the rationale for the total service approach set forth 
in the CPNI Order. In addition, the Commission sought comment on 
whether its consent mechanism would affect its previous findings on the 
interplay between sections 222 and 272.
    11. In this Order, the Commission reaches the objective of 
resolving several issues in connection with carriers' use of customer 
proprietary network information pursuant to section 222 of the 
Telecommunications Act of 1996. In formulating the required approval 
mechanism described below, we carefully balance carriers' First 
Amendment rights and consumers' privacy interests so as to permit 
carriers flexibility in their communications with their customers while 
providing the level of protection to consumers' privacy interests that 
Congress envisioned under section 222.
    12. More specifically, The Commission adopts an approach that 
comports with the decision of the United States Court of Appeals for 
the Tenth Circuit vacating the Commission's requirement that carriers 
obtain express customer consent for all sharing between a carrier and 
its affiliates, as well as unaffiliated entities. The Commission adopts 
today an approach that is derived from a careful balancing of harms, 
benefits, and governmental interests. First, use of CPNI by carriers or 
disclosure to their affiliated entities providing communications-
related services, as well as third-party agents and joint venture 
partners providing communications-related services, requires a 
customer's knowing consent in the form of notice and ``opt-out'' 
approval. Second, disclosure of CPNI to unrelated third parties or to 
carrier affiliates that do not provide communications-related services 
requires express customer consent, described as ``opt-in'' approval. 
Finally, the Commission reaffirms its ``total services approach,'' 
which permits the carrier to use CPNI to market new product offerings 
within the carrier-customer service relationship, on the basis of the 
customer's implied consent.
    13. In this Order, the Commission also further refines the rules 
governing the process by which carriers provide notification to 
customers of their CPNI rights. Specifically, clarifying the form, 
content and frequency of carrier notices. In addition, although the 
Commission decline to reconsider its conclusion that customers' 
preferred carrier (PC) freeze information constitutes CPNI and thereby 
continue to accord it privacy protection pursuant to section 222, the 
Commission chooses to forbear from imposing the express consent 
requirements announced in this Order with respect to PC-freezes. 
Through its limited exercise of forbearance, the Commission balances 
customers'

[[Page 59207]]

privacy concerns with carriers' meaningful commercial interests, 
resulting in PC-freeze information being made more readily available 
among competing carriers, consistent with the public interest. The 
Commission also affirms its previous determination that the word 
``information'' in section 272 does not include CPNI, which is governed 
instead by section 222 of the Act.
    14. Finally, the Commission accompanies this Order with a Further 
Notice of Proposed Rulemaking (``Further NPRM'') to refresh the record 
on two issues raised in the CPNI Order Further NPRM: foreign storage of 
and access to domestic CPNI, and CPNI safeguards and enforcement 
mechanisms. The Commission additionally requests comment on what, if 
any, appropriate regulations should govern the CPNI held by carriers 
that go out of business, sell all or part of their customer base, or 
seek bankruptcy protection.

Summary of Significant Issues Raised by Public Comments in Response to 
the IRFA

    15. One party, the Organization for the Promotion and Advancement 
of Small Telecommunications Companies (``OPASTCO''), commented 
specifically in response to the IRFA. OPASTCO argues that the IRFA was 
``deficient'' for two reasons. First, OPASTCO notes that the IRFA 
``reverts to language which incorrectly suggests that small ILECs are 
not ``small entities'' under the Regulatory Flexibility Act.'' Further, 
OPASTCO takes issue with the IRFA's determination that whatever consent 
rules are ultimately adopted will be applicable to all carriers. 
OPTASCO argues that ``the Commission has not considered any 
alternatives, contrary to the requirements of 5 U.S.C. 603(c).''
    16. The Commission confirms OPASTCO's assumption that the 
Clarification Order's IRFA did contain a clerical error regarding the 
classification of small ILECs. Accordingly, we affirm that Commission 
practice is to discuss small ILECs as ``small entities'' within our 
IRFAs, under the RFA. However, we note that no party was prejudiced or 
harmed by this error because the IRFA put potentially affected entities 
on notice by affirmatively stating that the Commission was 
``consider[ing] small ILECs within this analysis and us[ing] the term 
``small LECs'' to refer to any ILECs that arguably might be defined by 
SBA as ``small business concerns. '' Hence, the clerical error was 
cured in the very document in which it was alleged to be present.
    17. OPASTCO's concern, therefore, that ``if the rulemaking body 
itself has no preconceived idea of what the final rules might be, there 
is no way it can make the prejudgment that its final rules will be 
appropriate for all entities,'' takes a statement from the IRFA out of 
context. Furthermore, OPASTCO's contention inaccurately describes the 
Commission's decision-making process and outcome in this proceeding.
    18. First, although the Clarification Order did not propose 
specific consent requirements, the Clarification Order did ``seek 
comment on ways in which carriers can obtain their customers' consent 
and the extent to which an opt-in or opt-out approach would satisfy 
both sections 222 and the Tenth Circuit's concerns that any 
restrictions on speech be no more than necessary to serve the asserted 
state interests.'' Accordingly, although specific consent rules were 
not proposed, the only two potential types of consent (opt-in and opt-
out) were explicitly mentioned and offered to interested parties for 
consideration and comment. In an instance such as this, where the 
Commission has previously considered what type of consent to require, 
and where the Order in question mentions the only two potential options 
for obtaining consent, it is unreasonable to claim that the Commission 
or any interested party had and has no idea what the final rules might 
be. Clearly, the Commission knew and adequately advised interested 
parties that the final rules would involve opt-in approval, opt-out 
approval, or some combination of the two. In fact, every commenter, 
including OPASTCO, focused extensively on whether the Commission should 
adopt opt-in or opt-out consent requirements. The Commission also notes 
that the IRFA went on to state that ``[w]e have, however, taken the 
limited resources of small entities into account in promulgating 
certain existing CPNI rules, and intend to do so again in addressing 
the customer consent requirements.'' The omission of ILECs, whether or 
not evidence of Commission oversight, is rendered moot by its inclusion 
of this statement.
    19. Furthermore, the previously adopted opt-in approval rules were 
subject to, and complied with, the requirements of the RFA. 
Accordingly, the Commission has previously undertaken an analysis of 
opt-in and potential alternatives with respect to small carriers. 
Although such analysis does not supplant the analysis that the 
Commission must perform in this Order and in this FRFA, it provides 
meaningful guidance. In previous CPNI Orders, the Commission has 
received comment from several parties on the impact of proposed rules 
on small carriers. After extensive analysis, the Commission found that 
``[a]fter consideration of possible alternatives, we have concluded 
that our rules should apply equally to all carriers.'' Thus any 
argument that the Commission ever neglected the interests of small 
carriers is thereby rendered invalid. The Commission's reasoning 
remains valid today. The Commission stated: ``we are unpersuaded that 
customers of small businesses have less meaningful privacy interests in 
their CPNI.'' Additionally, the weight added by Congressional intent is 
critical in this context and deserves comment. In drafting section 222, 
Congress determined that CPNI protections should apply to consumers of 
``[e]very telecommunications carrier.'' Finally, the Commission notes 
that the rules it adopts today are less burdensome on all carriers, 
including small carriers, than the Commission's original opt-in rules.

Description and Estimate of the Number of Small Entities to Which Rules 
Will Apply

    20. The RFA directs agencies to provide a description of and, where 
feasible, an estimate of the number of small entities that will be 
affected by the proposed rules, if adopted. The RFA generally defines 
the term ``small entity'' as having the same meaning as the terms 
``small business,'' ``small organization,'' and ``small governmental 
jurisdiction.'' In addition, the term ``small business'' has the same 
meaning as the term ``small business concern'' under the Small Business 
Act. A ``small business concern'' is one that: (1) Is independently 
owned and operated; (2) is not dominant in its field of operation; and 
(3) satisfies any additional criteria established by the Small Business 
Administration (SBA).
    21. The most reliable source of information regarding the total 
numbers of certain common carrier and related providers nationwide 
appears to be data the Commission publishes annually in its 
Telecommunications Provider Locator report, derived from filings made 
in connection with the Telecommunications Relay Service (TRS). 
According to data in the most recent report, there are 5,679 interstate 
service providers. These providers include, inter alia, local exchange 
carriers, wireline carriers and service providers, interexchange 
carriers, competitive access providers, operator service providers, pay 
telephone operators, providers of telephone service, providers of 
telephone exchange service, and resellers.

[[Page 59208]]

    22. The Commission has included small incumbent local exchange 
carriers (ILECs) in this present RFA analysis. As noted above, a 
``small business'' under the RFA is one that inter alia, meets the 
pertinent small business size standard (e.g., a telephone 
communications business having 1,500 or fewer employees), and ``is not 
dominant in its field of operation.'' The SBA's Office of Advocacy 
contends that, for RFA purposes, small incumbent LECs are not dominant 
in their field of operation because any such dominance is not 
``national'' in scope. The Commission therefore included small 
incumbent LECs in this RFA analysis, although it emphasizes that this 
RFA action has no effect on FCC analyses and determinations in other, 
non-RFA contexts.
    23. Total Number of Telephone Companies Affected. The U.S. Bureau 
of Census (Census Bureau) reports that, at the end of 1992, there were 
3,497 firms engaged in providing telephone services, as defined 
therein, for at least one year. This number contains a variety of 
different categories of carriers, including LECs, interexchange 
carriers, competitive access providers, operator service providers, pay 
telephone operators, and resellers. It seems certain that some of these 
3,497 telephone service firms may not qualify as small entities or 
small incumbent LECs because they are not ``independently owned and 
operated.'' It seems reasonable to conclude that fewer than 3,497 
telephone service firms are small entity telephone service firms that 
may be affected by these rules.
    24. Wireline Carriers and Service Providers. The SBA has developed 
a definition of small entities for telephone communications companies 
other than radiotelephone (wireless) companies. The Census Bureau 
reports that there were 2,321 such telephone companies in operation for 
at least one year at the end of 1992. According to the SBA's 
definition, a small business telephone company other than a 
radiotelephone (wireless) company is one employing no more than 1,500 
persons. All but 26 of the 2,321 non-radiotelephone (wireless) 
companies listed by the Census Bureau were reported to have fewer than 
1,000 employees. Even if all 26 of the remaining companies had more 
than 1,500 employees, there would still be 2,295 non-radiotelephone 
(wireless) companies that might qualify as small entities or small 
incumbent LECs. Although it seems certain that some of these carriers 
are not independently owned and operated, the Commission is unable at 
this time to estimate with greater precision the number of wireline 
carriers and service providers that would qualify as small business 
concerns under SBA's definition. Therefore, the Commission estimates 
that fewer than 2,295 small telephone communications companies other 
than radiotelephone (wireless) companies are small entities that may be 
affected by these rules.
    25. Local Exchange Carriers. Neither the Commission nor the SBA has 
developed a definition of small providers of local exchange services. 
The closest applicable definition under the SBA's rules is for 
telephone communications companies other than radiotelephone (wireless) 
companies. According to the SBA's definition, a small business 
telephone company other than a radiotelephone (wireless) company is one 
employing no more than 1,500 persons. The most reliable source of 
information regarding the number of LECs nationwide of which the 
Commission is aware appears to be the data collected annually in 
connection with the Telecommunications Relay Service (TRS). According 
to the Commission's most recent data, there are 1,329 local exchange 
carriers, including incumbent LECs. Although it seems certain that some 
of these carriers are not independently owned and operated, or have 
more than 1,500 employees, the Commission is unable at this time to 
estimate with greater precision the number of LECs that would qualify 
as small business concerns under the SBA's definition. Consequently, 
the Commission estimates that they are fewer than 1, 329 small entity 
LECs that may be affected by the proposals in the Second Further 
Notice.
    26. Interexchange Carriers. Neither the Commission nor the SBA has 
developed a definition of small entities specifically applicable to 
providers of interexchange services (IXCs). The closest applicable 
definition under the SBA's rules is for telephone communications 
companies other than radiotelephone (wireless) companies. The most 
reliable source of information regarding the number of IXCs nationwide 
of which we are aware appears to be the data that the Commission 
collects annually in connection with TRS. According to its most recent 
data, 229 companies reported that they were engaged in the provision of 
interexchange services. Although it seems certain that some of these 
carriers are not independently owned and operated, or have more than 
1,500 employees, the Commission are unable at this time to estimate 
with greater precision the number of IXCs that would qualify as small 
business concerns under the SBA's definition. Consequently, the 
Commission estimates that there are fewer than 229 small entity IXCs 
that may be affected by this order.
    27. Competitive Access Providers. Neither the Commission nor the 
SBA has developed a definition of small entities specifically 
applicable to providers of competitive access services (CAPs). The 
closest applicable definition under the SBA's rules is for telephone 
communications companies other than radiotelephone (wireless) 
companies. According to the SBA's definition, a small business 
telephone company other than a radiotelephone (wireless) company is one 
employing no more than 1,500 persons. The most reliable source of 
information regarding the number of CAPs nationwide of which the 
Commission is are aware appears to be the data that it collect annually 
in connection with the TRS. According to the Commission's most recent 
data, 532 companies reported that they were engaged in the provision of 
either competitive access services or competitive local exchange 
service. Although it seems certain that some of these carriers are not 
independently owned and operated, or have more than 1,500 employees, 
the Commission is unable at this time to estimate with greater 
precision the number of CAPs that would qualify as small business 
concerns under the SBA's definition. Consequently, the Commission 
estimates that there are fewer than 532 small entity CAPs that may be 
affected by this order.
    28. Operator Service Providers. Neither the Commission nor the SBA 
has developed a definition of small entities specifically applicable to 
providers of operator services. The closest applicable definition under 
the SBA's rules is for telephone communications companies other than 
radiotelephone (wireless) companies. The most reliable source of 
information regarding the number of operator service providers 
nationwide of which the Commission is aware appears to be the data that 
it collects annually in connection with the TRS. According to the 
Commission's most recent data, 22 companies reported that they were 
engaged in the provision of operator services. Although it seems 
certain that some of these companies are not independently owned and 
operated, or have more than 1,500 employees, the Commission is unable 
at this time to estimate with greater precision the number of operator 
service providers that would qualify as small business concerns under 
the SBA's definition. Consequently, the Commission

[[Page 59209]]

estimates that there are fewer than 22 small entity operator service 
providers that may be affected by this order.
    29. Pay Telephone Providers. Neither the Commission nor the SBA has 
developed a definition of small entities specifically applicable to pay 
telephone providers. The closest applicable definition under the SBA's 
rules is for telephone communications companies other than 
radiotelephone (wireless) companies. The most reliable source of 
information regarding the number of pay telephone operators nationwide 
of which the Commission is aware appears to be the data that it 
collects annually in connection with the TRS. According to the 
Commission's most recent data, 936 companies reported that they were 
engaged in the provision of pay telephone services. Although it seems 
certain that some of these carriers are not independently owned and 
operated, or have more than 1,500 employees, the Commission is unable 
at this time to estimate with greater precision the number of pay 
telephone operators that would qualify as small business concerns under 
the SBA's definition. Consequently, the Commission estimates that there 
are fewer than 936 small entity pay telephone operators that may be 
affected by this order.
    30. Wireless Carriers. Wireless telephony includes cellular, 
personal communications services (PCS) or specialized mobile radio 
(SMR) service providers. The SBA has developed a definition of small 
entities for radiotelephone (wireless) companies; however, neither the 
Commission nor the SBA has developed a definition of small entities 
applicable to cellular licensees, or to providers of paging and 
messaging services. Though categorized under the same size standard as 
other wireless services discussed in this paragraph, paging is now 
considered a separate industry. The closest applicable definition under 
the SBA's rules is for telephone communications companies other than 
radiotelephone (wireless) companies. According to the SBA's definition, 
a small business radiotelephone company is one employing no more than 
1,500 persons. The Commission considers paging and messaging services 
to fall within this category. According to the most recent Provider 
Locator data, 858 carriers reported that they were engaged in the 
provision of wireless telephony and 576 companies reported that they 
were engaged in the provision of paging and messaging services. 
Although it seems certain that some of these carriers are not 
independently owned and operated, the Commission is unable at this time 
to estimate with greater precision the number of radiotelephone 
carriers and service providers that would qualify as small business 
concerns under the SBA's definition. Consequently, the Commission 
estimates that there are fewer than 858 small carriers providing 
wireless telephony services and fewer than 576 small companies 
providing paging and messaging services that may be affected by these 
rules.
    31. Resellers. Neither the Commission nor the SBA has developed a 
definition of small entities specifically applicable to resellers. The 
closest applicable definition under the SBA's rules is for all 
telephone communications companies. The most reliable source of 
information regarding the number of toll resellers nationwide of which 
the Commission is aware appears to be the data that it collects 
annually in connection with the TRS. According to the Commission's most 
recent data, 710 companies reported that they were engaged in the 
resale of telephone services. Although it seems certain that some of 
these carriers are not independently owned and operated, or have more 
than 1,500 employees, the Commission is unable at this time to estimate 
with greater precision the number of resellers that would qualify as 
small business concerns under the SBA's definition. Consequently, the 
Commission estimates that there are fewer than 710 small entity 
resellers that may be affected by this order.

Description of Projected Reporting, Recordkeeping, and Other Compliance 
Requirements for Small Entities

    32. In this Order, the Commission takes a number of steps that may 
affect small entities that use customers' CPNI outside of the total 
service approval or statutory exceptions in section 222. Some of the 
approval and notice requirements discussed herein will require 
additional reporting, recordkeeping or compliance requirements for 
service providers; however, certain approval and notice requirements 
discussed herein will also decrease certain reporting, recordkeeping or 
compliance requirements for service providers. The Commission believes 
that, overall, these new requirements will lessen the regulatory burden 
on small carriers by allowing carriers to obtain customers' consent 
through an opt-out approval mechanism to use customers' CPNI for 
marketing communications-related services.
    33. This Order imposes the following additional reporting, 
recordkeeping or compliance requirements on all carriers. None of these 
requirements should affect small carriers disproportionately or require 
special professional skills. First, carriers must obtain opt-in CPNI 
approval for certain CPNI uses, and have the choice of obtaining opt-
out or opt-in approval for other CPNI uses. As discussed in section 
III.C.1, supra, a carrier may determine whether to use one notice or 
multiple notices, and may request and provide notice relevant only to 
the CPNI uses the carriers proposes to make. Accordingly, if, as 
OPASTCO claims, its members only intend to use CPNI internally for 
marketing communications-related services, its member small carriers 
will only have to obtain opt-out approval from their customers.
    34. Carriers who use opt-out approval must provide notice to their 
customers every two years. This requirement, while an added burden on 
all carriers, is counterbalanced by the fact that carriers who choose 
to use the opt-out method will be able to use and disclose more CPNI 
for marketing than under the opt-in method. Accordingly, a carrier that 
finds the burden of biennial notices to outweigh the benefit of 
expanded CPNI access can choose to obtain opt-in approval from its 
customers and avoid the biennial notice requirement. Additionally, 
notice requirements are common in the telecommunications industry and 
the requirements adopted here allow carriers flexibility in determining 
how to provide such notices. Accordingly, all carriers, including small 
carriers, should already have resources in place to provide notices 
required by such regulations to their customers.
    35. The Commission requires carriers who use e-mail notices to 
advise their customers of their opt-out CPNI choices to abide by 
certain requirements. These requirements are not burdensome. To the 
degree that any carrier could seriously argue that these requirements 
are burdensome, carriers are not required to use e-mail to notify their 
customers of CPNI policies. Accordingly, a carrier can choose the least 
burdensome notification method allowed under our rules, based on the 
carrier's individual circumstances.
    36. In addition, the Commission adds minor content requirements to 
our notice rules to synchronize the rules with the newly adopted 
consent requirements. These requirements should require minimal effort 
on the part of carriers, large and small, to implement. Furthermore, 
the Commission also streamlines the notice requirements for carriers to 
obtain limited, one-time use of consumers' CPNI for the duration of an 
inbound or outbound call with the customer, which will benefit small 
carriers.

[[Page 59210]]

    37. The Commission adopts a 30-day minimum period of time that 
carriers must wait after giving customers' opt-out notice before 
assuming customer approval. Every carrier commenter supported the 30-
day time period. Such a time period imposes minimal burden on carriers. 
This is especially true because the 30-day waiting period has been the 
interim rule since we adopted the CPNI Clarification Order and has been 
the subject of no carrier complaints or concerns.
    38. The Commission adopts a requirement that carriers make 
available to every customer a method to opt-out that is of no 
additional cost and available 24 hours a day, seven days a week. This 
requirement can be satisfied through a combination of methods, so long 
as all customers have the ability to opt-out at no cost and are able to 
effectuate that choice whenever they choose. To the degree that 
carriers find that the burden of meeting this requirement outweigh the 
value of using an opt-out approval method, carriers are free to use 
opt-in. Carriers are otherwise free to determine what methods to use to 
allow customer to effectuate their CPNI elections. Although this 
requirement will impose a burden on small and large carriers alike, the 
Commission strongly believes that two factors mitigate against allowing 
small carriers to utilize less burdensome alternatives. First, as the 
Commission has previously held, there is nothing in this record that 
convinces it that customers of small carriers are entitled to lesser 
protection of the privacy of their calling records than those customers 
of larger carriers. Accordingly, it would be inappropriate to allow 
small carriers to provide less effective methods for customers to 
effectuate their CPNI choices. Second, to the degree that these 
requirements impose burdens on carriers, those burdens are outweighed 
by the value of using an opt-out approval mechanism to obtain customer 
approval to use CPNI for marketing communications-related services. 
Should carriers find that not to be the case in their individual 
situations, they can avoid the 24/7 requirement by adopting an opt-in 
approval mechanism.
    39. The Commission forbears from applying our CPNI approval 
regulations to preferred carrier (``PC'') freezes, allowing small and 
large carriers alike easier access to PC-freeze information.

Steps Taken to Minimize Significant Economic Impact on Small Entities, 
and Significant Alternatives Considered

    40. The RFA requires an agency to describe any significant 
alternatives that it has considered in reaching its proposed approach, 
which may include the following four alternatives (among others): ``(1) 
The establishment of differing compliance or reporting requirements or 
timetables that take into account the resources available to small 
entities; (2) the clarification, consolidation, or simplification of 
compliance or reporting requirements under the rule for small entities; 
(3) the use of performance, rather than design, standards; and (4) an 
exemption from coverage of the rule, or any part thereof, for small 
entities.''
    41. While the approval and related notice measures adopted in this 
Order apply similarly to both small and large entities, the Commission 
expects that small entities are likely to benefit to the extent such 
firms have fewer or reduced resources available, as compared to large 
firms. The Commission's previously adopted rules required all carriers 
to obtain opt-in approval from their customers to use CPNI outside of 
the total service approach. Although the Commission allowed carriers to 
use opt-out as an interim measure in light of the Tenth Circuit's 
opinion, that approach was never codified or adopted as a permanent 
rule. As discussed above, this Order adopts an approach that is derived 
from a careful balancing of harms, benefits, and governmental 
interests. First, use of CPNI by carriers or disclosure to their 
affiliated entities providing communications-related services, as well 
as third-party agents and joint venture partners providing 
communications-related services, requires a customer's knowing consent 
in the form of notice and ``opt-out'' approval. Second, disclosure of 
CPNI to unrelated third parties or to carrier affiliates that do not 
provide communications-related services requires express customer 
consent, described as ``opt-in'' approval. Finally, the Commission 
reaffirms its ``total services approach,'' which permits the carrier to 
use CPNI to market new product offerings within the carrier-customer 
service relationship, on the basis of the customer's implied consent.
    42. Accordingly, the Commission concludes that the measures adopted 
and described in this Order would reduce regulatory burdens for small 
carriers including resellers, by allowing carriers access to CPNI for 
marketing communications-related services to their customers via an 
opt-out mechanism. Further, the Order specifically allows carriers to 
use opt-in approval for all CPNI uses should a carrier determine that 
opt-in is more appropriate for its individual circumstances, allowing 
carriers to make decisions regarding their customers and resources.
    43. Furthermore, as noted above, the previously adopted opt-in 
rules were subject to and complied with the requirements of the RFA. 
Accordingly, the Commission has previously undertaken an analysis of 
opt-in and potential alternatives with respect to small carriers. 
Although such analysis does not replace the analysis that the 
Commission must perform in this Order, it provides meaningful guidance. 
In previous CPNI Orders, the Commission received comment from several 
parties on the impact of proposed rules on small carriers. After 
extensive analysis, the Commission found that ``[a]fter consideration 
of possible alternatives, we have concluded that our rules should apply 
equally to all carriers.'' The Commission's reasoning remains valid 
today. Of special importance in this context, the Commission's 
consistent determination, made throughout this proceeding, that ``we 
are unpersuaded that customers of small businesses have less meaningful 
privacy interests in their CPNI.'' This is especially true because, in 
drafting section 222, Congress determined that CPNI protections should 
apply to consumers of ``[e]very telecommunications carrier.''
    44. In this Order, the Commission also describes commenters' 
positions regarding other appropriate approval methods and related 
notice issues and states why those alternatives that the Commission 
does not adopt would not serve the public interest. For example, many 
carriers, including small carriers, proposed that we allow carriers to 
use opt-out approval for all CPNI uses. However, as it points out in 
this Order, the Commission must fulfill its statutorily imposed duty to 
protect consumers' CPNI, while balancing those interests with carriers' 
First Amendment interests. Therefore, as discussed in detail in the 
Order, the Commission concludes that the CPNI rules it adopts--which 
balance in an equitable fashion all consumers'' privacy rights with 
carriers' First Amendment rights--strike the right balance for small 
and large carriers alike. Moreover, the Commission gains assurance from 
knowing that the rules it adopts benefit small carriers and serve the 
public interest by allowing carriers with expanded access to consumers' 
CPNI from its original opt-in rules.
    45. Report to Congress. The Commission will send a copy of this 
Order, including this FRFA, in a report to be sent to Congress pursuant 
to the Congressional Review Act. In addition, the Commission will send 
a copy of this

[[Page 59211]]

Order, including this FRFA, to the Chief Counsel for Advocacy of the 
SBA. A copy of this Order and FRFA (or summaries thereof) will also be 
published in the Federal Register.

Ordering Clauses

    46. Accordingly, it is ordered, pursuant to sections 1, 4(i), 222 
and 303(r) of the Communications Act of 1934, as amended, 47 U.S.C. 
151, 154(i), 222 and 303(r ), that the Third Report and Order and Third 
Further Notice of Proposed Rulemaking in CC Docket Nos. 96-115, 96-149, 
and 00-257 are adopted, and that part 64 of the Commission's rules, 47 
CFR part 64, is amended as set forth in the rule changes. The 
requirements of this Order shall become effective October 21, 2002, 
except Sec. Sec.  64.2007, 64.2008, and 64.2009 which contain 
information collection requirements that have not been approved by OMB. 
The Commission will publish a document in the Federal Register 
announcing the effective date of these rules.
    47. It is further ordered that the collection of information 
contained herein is contingent upon approval by the Office of 
Management and Budget.
    48. It is further ordered that the California Public Utilities 
Commission's Motion to Accept Late-Filed Comments is hereby granted.
    49. It is further ordered that, pursuant to sections 1, 4(i), 10 
and 222 of the Communications Act of 1934, as amended, 47 U.S.C. 151, 
154(i), 160 and 222, MCI WorldCom's Petition for Further 
Reconsideration is granted to the extent indicated herein and otherwise 
denied.
    50. It is further ordered that the Commission's Consumer and 
Governmental Affairs Bureau, Reference Information Center, shall send a 
copy of this Third Report and Order, including the Final Regulatory 
Flexibility Analysis, to the Chief Counsel for Advocacy of the Small 
Business Administration.

List of Subjects in 47 CFR Part 64

    Communications common carriers.

    Federal Communications Commission.
Marlene H. Dortch,
Secretary.

Rule Changes

    For the reasons discussed in the preamble, the Federal 
Communications Commission amends 47 CFR part 64 as follows:

PART 64--MISCELLANEOUS RULES RELATING TO COMMON CARRIERS

    1. The authority citation for part 64 continues to read as follows:

    Authority: 47 U.S.C. 154.

    1a. Revise Sec.  64.2003 to read as follows:


Sec.  64.2003  Definitions.

    Terms in this subpart have the following meanings:
    (a) Affiliate. The term ``affiliate'' has the same meaning given 
such term in section 3(1) of the Communications Act of 1934, as 
amended, 47 U.S.C. 153(1).
    (b) Communications-related services. The term ``communications-
related services'' means telecommunications services, information 
services typically provided by telecommunications carriers, and 
services related to the provision or maintenance of customer premises 
equipment.
    (c) Customer. A customer of a telecommunications carrier is a 
person or entity to which the telecommunications carrier is currently 
providing service.
    (d) Customer proprietary network information (CPNI). The term 
``customer proprietary network information (CPNI)'' has the same 
meaning given to such term in section 222(h)(1) of the Communications 
Act of 1934, as amended, 47 U.S.C. 222(h)(1).
    (e) Customer premises equipment (CPE). The term ``customer premises 
equipment (CPE)'' has the same meaning given to such term in section 
3(14) of the Communications Act of 1934, as amended, 47 U.S.C. 153(14).
    (f) Information services typically provided by telecommunications 
carriers. The phrase ``information services typically provided by 
telecommunications carriers'' means only those information services (as 
defined in section 3(20) of the Communications Act of 1934, as amended, 
47 U.S.C. 153(2)) that are typically provided by telecommunications 
carriers, such as Internet access or voice mail services. Such phrase 
``information services typically provided by telecommunications 
carriers,'' as used in this subpart, shall not include retail consumer 
services provided using Internet websites (such as travel reservation 
services or mortgage lending services), whether or not such services 
may otherwise be considered to be information services.
    (g) Local exchange carrier (LEC). The term ``local exchange carrier 
(LEC)'' has the same meaning given to such term in section 3(26) of the 
Communications Act of 1934, as amended, 47 U.S.C. 153(26).
    (h) Opt-in approval. The term ``opt-in approval'' refers to a 
method for obtaining customer consent to use, disclose, or permit 
access to the customer's CPNI. This approval method requires that the 
carrier obtain from the customer affirmative, express consent allowing 
the requested CPNI usage, disclosure, or access after the customer is 
provided appropriate notification of the carrier's request consistent 
with the requirements set forth in this subpart.
    (i) Opt-out approval. The term ``opt-out approval'' refers to a 
method for obtaining customer consent to use, disclose, or permit 
access to the customer's CPNI. Under this approval method, a customer 
is deemed to have consented to the use, disclosure, or access to the 
customer's CPNI if the customer has failed to object thereto within the 
waiting period described in Sec.  64.2009(d)(1) after the customer is 
provided appropriate notification of the carrier's request for consent 
consistent with the rules in this subpart.
    (j) Subscriber list information (SLI). The term ``subscriber list 
information (SLI)'' has the same meaning given to such term in section 
222(h)(3) of the Communications Act of 1934, as amended, 47 U.S.C. 
222(h)(3).
    (k) Telecommunications carrier or carrier. The terms 
``telecommunications carrier'' or ``carrier'' shall have the same 
meaning as set forth in section 3(44) of the Communications Act of 
1934, as amended, 47 U.S.C. 153(44).
    (l) Telecommunications service. The term ``telecommunications 
service'' has the same meaning given to such term in section 3(46) of 
the Communications Act of 1934, as amended, 47 U.S.C. 153(46).

    4. Amend Sec.  64.2005 by revising paragraphs (a) introductory 
text, and (a)(2); (b) introductory text, and (b)(1) to read as follows:


Sec.  64.2005  Use of customer proprietary network information without 
customer approval.

    (a) Any telecommunications carrier may use, disclose, or permit 
access to CPNI for the purpose of providing or marketing service 
offerings among the categories of service (i.e., local, interexchange, 
and CMRS) to which the customer already subscribes from the same 
carrier, without customer approval.
* * * * *
    (2) If a telecommunications carrier provides different categories 
of service, but a customer does not subscribe to more than one offering 
by the carrier, the carrier is not permitted to share

[[Page 59212]]

CPNI with its affiliates, except as provided in Sec.  64.2007(b).
    (b) A telecommunications carrier may not use, disclose, or permit 
access to CPNI to market to a customer service offerings that are 
within a category of service to which the subscriber does not already 
subscribe from that carrier, unless that carrier has customer approval 
to do so, except as described in paragraph (c) of this section.
    (1) A wireless provider may use, disclose, or permit access to CPNI 
derived from its provision of CMRS, without customer approval, for the 
provision of CPE and information service(s). A wireline carrier may 
use, disclose or permit access to CPNI derived from its provision of 
local exchange service or interexchange service, without customer 
approval, for the provision of CPE and call answering, voice mail or 
messaging, voice storage and retrieval services, fax store and forward, 
and protocol conversion.
* * * * *

    5. Revise Sec.  64.2007 to read as follows:


Sec.  64.2007  Approval required for use of customer proprietary 
network information.

    (a) A telecommunications carrier may obtain approval through 
written, oral or electronic methods.
    (1) A telecommunications carrier relying on oral approval shall 
bear the burden of demonstrating that such approval has been given in 
compliance with the Commission's rules in this part.
    (2) Approval or disapproval to use, disclose, or permit access to a 
customer's CPNI obtained by a telecommunications carrier must remain in 
effect until the customer revokes or limits such approval or 
disapproval.
    (3) A telecommunications carrier must maintain records of approval, 
whether oral, written or electronic, for at least one year.
    (b) Use of Opt-Out and Opt-In Approval Processes. (1) A 
telecommunications carrier may, subject to opt-out approval or opt-in 
approval, use its customer's individually identifiable CPNI for the 
purpose of marketing communications-related services to that customer. 
A telecommunications carrier may, subject to opt-out approval or opt-in 
approval, disclose its customer's individually identifiable CPNI, for 
the purpose of marketing communications-related services to that 
customer, to its agents; its affiliates that provide communications-
related services; and its joint venture partners and independent 
contractors. A telecommunications carrier may also permit such persons 
or entities to obtain access to such CPNI for such purposes. Any such 
disclosure to or access provided to joint venture partners and 
independent contractors shall be subject to the safeguards set forth in 
paragraph (b)(2) of this section.
    (2) Joint Venture/Contractor Safeguards. A telecommunications 
carrier that discloses or provides access to CPNI to its joint venture 
partners or independent contractors shall enter into confidentiality 
agreements with independent contractors or joint venture partners that 
comply with the following requirements. The confidentiality agreement 
shall:
    (i) Require that the independent contractor or joint venture 
partner use the CPNI only for the purpose of marketing or providing the 
communications-related services for which that CPNI has been provided;
    (ii) Disallow the independent contractor or joint venture partner 
from using, allowing access to, or disclosing the CPNI to any other 
party, unless required to make such disclosure under force of law; and
    (iii) Require that the independent contractor or joint venture 
partner have appropriate protections in place to ensure the ongoing 
confidentiality of consumers' CPNI.
    (3) Except for use and disclosure of CPNI that is permitted without 
customer approval under section Sec.  64.2005, or that is described in 
paragraph (b)(1) of this section, or as otherwise provided in section 
222 of the Communications Act of 1934, as amended, a telecommunications 
carrier may only use, disclose, or permit access to its customer's 
individually identifiable CPNI subject to opt-in approval.

    6. Add Sec.  64.2008 to subpart U to read as follows:


Sec.  64.2008  Notice required for use of customer proprietary network 
information.

    (a) Notification, Generally. (1) Prior to any solicitation for 
customer approval, a telecommunications carrier must provide 
notification to the customer of the customer's right to restrict use 
of, disclosure of, and access to that customer's CPNI.
    (2) A telecommunications carrier must maintain records of 
notification, whether oral, written or electronic, for at least one 
year.
    (b) Individual notice to customers must be provided when soliciting 
approval to use, disclose, or permit access to customers' CPNI.
    (c) Content of Notice. Customer notification must provide 
sufficient information to enable the customer to make an informed 
decision as to whether to permit a carrier to use, disclose, or permit 
access to, the customer's CPNI.
    (1) The notification must state that the customer has a right, and 
the carrier has a duty, under federal law, to protect the 
confidentiality of CPNI.
    (2) The notification must specify the types of information that 
constitute CPNI and the specific entities that will receive the CPNI, 
describe the purposes for which CPNI will be used, and inform the 
customer of his or her right to disapprove those uses, and deny or 
withdraw access to CPNI at any time.
    (3) The notification must advise the customer of the precise steps 
the customer must take in order to grant or deny access to CPNI, and 
must clearly state that a denial of approval will not affect the 
provision of any services to which the customer subscribes. However, 
carriers may provide a brief statement, in clear and neutral language, 
describing consequences directly resulting from the lack of access to 
CPNI.
    (4) The notification must be comprehensible and must not be 
misleading.
    (5) If written notification is provided, the notice must be clearly 
legible, use sufficiently large type, and be placed in an area so as to 
be readily apparent to a customer.
    (6) If any portion of a notification is translated into another 
language, then all portions of the notification must be translated into 
that language.
    (7) A carrier may state in the notification that the customer's 
approval to use CPNI may enhance the carrier's ability to offer 
products and services tailored to the customer's needs. A carrier also 
may state in the notification that it may be compelled to disclose CPNI 
to any person upon affirmative written request by the customer.
    (8) A carrier may not include in the notification any statement 
attempting to encourage a customer to freeze third-party access to 
CPNI.
    (9) The notification must state that any approval, or denial of 
approval for the use of CPNI outside of the service to which the 
customer already subscribes from that carrier is valid until the 
customer affirmatively revokes or limits such approval or denial.
    (10) A telecommunications carrier's solicitation for approval must 
be proximate to the notification of a customer's CPNI rights.
    (d) Notice Requirements Specific to Opt-Out. A telecommunications 
carrier must provide notification to obtain opt-out approval through 
electronic or written methods, but not by oral communication (except as 
provided in paragraph (f) of this section). The

[[Page 59213]]

contents of any such notification must comply with the requirements of 
paragraph (c) of this section.
    (1) Carriers must wait a 30-day minimum period of time after giving 
customers notice and an opportunity to opt-out before assuming customer 
approval to use, disclose, or permit access to CPNI. A carrier may, in 
its discretion, provide for a longer period. Carriers must notify 
customers as to the applicable waiting period for a response before 
approval is assumed.
    (i) In the case of an electronic form of notification, the waiting 
period shall begin to run from the date on which the notification was 
sent; and
    (ii) In the case of notification by mail, the waiting period shall 
begin to run on the third day following the date that the notification 
was mailed.
    (2) Carriers using the opt-out mechanism must provide notices to 
their customers every two years.
    (3) Telecommunications carriers that use e-mail to provide opt-out 
notices must comply with the following requirements in addition to the 
requirements generally applicable to notification:
    (i) Carriers must obtain express, verifiable, prior approval from 
consumers to send notices via e-mail regarding their service in 
general, or CPNI in particular;
    (ii) Carriers must allow customers to reply directly to e-mails 
containing CPNI notices in order to opt-out;
    (iii) Opt-out e-mail notices that are returned to the carrier as 
undeliverable must be sent to the customer in another form before 
carriers may consider the customer to have received notice;
    (iv) Carriers that use e-mail to send CPNI notices must ensure that 
the subject line of the message clearly and accurately identifies the 
subject matter of the e-mail; and
    (v) Telecommunications carriers must make available to every 
customer a method to opt-out that is of no additional cost to the 
customer and that is available 24 hours a day, seven days a week. 
Carriers may satisfy this requirement through a combination of methods, 
so long as all customers have the ability to opt-out at no cost and are 
able to effectuate that choice whenever they choose.
    (e) Notice Requirements Specific to Opt-In. A telecommunications 
carrier may provide notification to obtain opt-in approval through 
oral, written, or electronic methods. The contents of any such 
notification must comply with the requirements of paragraph (c) of this 
section.
    (f) Notice Requirements Specific to One-Time Use of CPNI. (1) 
Carriers may use oral notice to obtain limited, one-time use of CPNI 
for inbound and outbound customer telephone contacts for the duration 
of the call, regardless of whether carriers use opt-out or opt-in 
approval based on the nature of the contact.
    (2) The contents of any such notification must comply with the 
requirements of paragraph (c) of this section, except that 
telecommunications carriers may omit any of the following notice 
provisions if not relevant to the limited use for which the carrier 
seeks CPNI:
    (i) Carriers need not advise customers that if they have opted-out 
previously, no action is needed to maintain the opt-out election;
    (ii) Carriers need not advise customers that they may share CPNI 
with their affiliates or third parties and need not name those 
entities, if the limited CPNI usage will not result in use by, or 
disclosure to, an affiliate or third party;
    (iii) Carriers need not disclose the means by which a customer can 
deny or withdraw future access to CPNI, so long as carriers explain to 
customers that the scope of the approval the carrier seeks is limited 
to one-time use; and
    (iv) Carriers may omit disclosure of the precise steps a customer 
must take in order to grant or deny access to CPNI, as long as the 
carrier clearly communicates that the customer can deny access to his 
CPNI for the call.

    7. Amend Sec.  64.2009 by revising paragraphs (c) and (d) and by 
adding paragraph (f) to read as follows:


Sec.  64.2009  Safeguards required for use of customer proprietary 
network information.

* * * * *
    (c) All carriers shall maintain a record, electronically or in some 
other manner, of their own and their affiliates' sales and marketing 
campaigns that use their customers' CPNI. All carriers shall maintain a 
record of all instances where CPNI was disclosed or provided to third 
parties, or where third parties were allowed access to CPNI. The record 
must include a description of each campaign, the specific CPNI that was 
used in the campaign, and what products and services were offered as a 
part of the campaign. Carriers shall retain the record for a minimum of 
one year.
    (d) Telecommunications carriers must establish a supervisory review 
process regarding carrier compliance with the rules in this subpart for 
outbound marketing situations and maintain records of carrier 
compliance for a minimum period of one year. Specifically, sales 
personnel must obtain supervisory approval of any proposed outbound 
marketing request for customer approval.
* * * * *
    (f) Carriers must provide written notice within five business days 
to the Commission of any instance where the opt-out mechanisms do not 
work properly, to such a degree that consumers' inability to opt-out is 
more than an anomaly.
    (1) The notice shall be in the form of a letter, and shall include 
the carrier's name, a description of the opt-out mechanism(s) used, the 
problem(s) experienced, the remedy proposed and when it will be/was 
implemented, whether the relevant state commission(s) has been notified 
and whether it has taken any action, a copy of the notice provided to 
customers, and contact information.
    (2) Such notice must be submitted even if the carrier offers other 
methods by which consumers may opt-out.

[FR Doc. 02-23199 Filed 9-19-02; 8:45 am]
BILLING CODE 6712-01-P