Federal Communications Commission

In a widely anticipated step, FCC Chairman Ajit Pai has released a draft Notice of Proposed Rulemaking (“NPRM”) on the legal framework that governs broadband providers and related net neutrality questions.

Most notably from a privacy perspective, the draft NPRM proposes to find that broadband Internet access service is an “information service” under the Communications Act, reversing the 2015 “telecommunications service” classification that had brought broadband providers under the statutory privacy requirements of Title II of that Act.

The draft NPRM states that the 2015 reclassification “stripped FTC authority over Internet service providers,” in light of the common carrier exemption in Section 5 of the FTC Act.  By reversing the FCC’s prior finding that broadband is a common carrier service, the draft NPRM proposes to “return jurisdiction over Internet service providers’ privacy practices to the FTC, with its decades of experience and expertise in this area.”
Continue Reading FCC Chairman Pai Proposes New Regulatory Framework for Broadband ISPs, Seeks Comment on Net Neutrality Rules

On April 24th, the Electronic Privacy Information Center (“EPIC”) and a coalition of 37 other civil society groups sent a letter urging the Federal Communications Commission (“FCC”) to act on an August 2015 petition to repeal the FCC’s data retention mandate under 47 C.F.R. §42.6 (“Retention of Telephone Toll Records”).

The mandate requires communications carriers that “offer[] or bill[] toll telephone service” to retain the following customer billing records for a period of 18 months: (1) the “name, address, and telephone number of the caller,” (2) the “telephone number called,” and (3) the “date, time, and length of the call.”  Carriers are required to retain such information regardless of whether they are billing their own toll service customers or billing customers for another carrier.
Continue Reading Advocacy Groups Urge FCC to End Data Retention Mandate

Senators Ed Markey (D-MA) and Richard Blumenthal (D-CT) reintroduced a pair of bills today relating to the cybersecurity of cars and aircraft, which would impose affirmative security, disclosure, and consent requirements on manufacturers and air carriers.  The Security and Privacy in Your Car (“SPY Car”) Act and Cybersecurity Standards for Aircraft to Improve Resilience (“Cyber AIR”) Act were each introduced but not enacted in a previous session of Congress.  In a joint press release, the Senators noted that the legislation was designed to “implement and improve cybersecurity standards for cars and aircraft.”

The SPY Car Act

The SPY Car Act would require cars manufactured for sale in the U.S. to comply with “reasonable measures to protect against hacking attacks,” including measures to isolate critical software systems from non-critical systems, evaluate security vulnerabilities, and “immediately detect, report, and stop attempts to intercept driving data or control the vehicle.”  It would also require “driving data” collected by cars to be “reasonably secured to prevent unauthorized access,” including while such data is in transit to other locations or subsequently stored elsewhere.  Violations of these cybersecurity requirements are subject to civil penalties of up to $5,000 per violation.
Continue Reading Senators Reintroduce Cybersecurity Legislation for Cars and Planes

On March 2nd, Democratic members of the House Energy and Commerce Committee introduced three pieces of legislation that would expand the Federal Communications Commission’s (FCC) authority over the cybersecurity practices of communications network providers.

The first bill, the “Securing IoT Act of 2017” (introduced by Rep. Jerry McNerney…
Continue Reading House Democrats Propose Three Bills that Would Bolster FCC Influence over Cybersecurity

On November 3, Judge Vince Chhabria of the U.S. District Court of the Northern District of California held that federal law does not bar the California Public Utilities Commission (CPUC) from requiring telecommunications companies to hand over, under an adequate protective order, confidential subscriber data to The Utility Reform Network (TURN) as part of an investigation into state market competitiveness.

However, Judge Chhabria also rejected a motion for summary judgment filed by CPUC and TURN because it has not yet been demonstrated that the proposed protective order would, in fact, adequately protect the companies from competitive harm.  Because such protection is a necessary predicate to avoiding a conflict with FCC regulations, Judge Chhabria reasoned, the adequacy of the protective order must be determined before CPUC can force companies to turn over such sensitive data.
Continue Reading California Judge Upholds CPUC Order to Share Confidential Subscriber Data, But Subject to Adequate Protective Order

A variety of advocacy groups and industry stakeholders filed comments yesterday in response to a petition by non-profit Public Knowledge to halt operation of the Dedicated Short-Range Communications (DSRC) service.  The nascent DSRC service, which operates in the 5.9 GHz band, enables vehicle-to-vehicle and vehicle-to-infrastructure communications to protect the safety…
Continue Reading Consumer Groups, Stakeholders React to Petition Requesting Halt in Vehicle-to-Vehicle Communications Service Due to Cybersecurity Concerns

Yesterday, the FCC released an Enforcement Advisory to remind political campaigns about their obligations under the Telephone Consumer Protection Act (“TCPA”).  The Advisory did not set forth any new rules for calls and texts; rather, it confirmed existing rules and reminded political campaigns that they are subject to them.

The Advisory first confirmed that prerecorded or autodialed calls to mobile phones are prohibited, except in cases of emergencies, federal debt collection, or with the prior express consent of the recipient.  The Advisory then summarized the requirements for prerecorded or autodialed calls to landline phones, including identification and line seizure requirements. 
Continue Reading FCC Releases TCPA Enforcement Advisory Directed to Political Campaigns

Last Friday, the Federal Communications Commission (“FCC”) rejected a petition from consumer advocates asking the FCC to extend its Open Internet Order by requiring edge providers such as Facebook and Amazon to follow the privacy regulations of Section 222 and to require those edge providers to honor “Do Not Track”…
Continue Reading FCC Says It Will Not Require Websites to Honor ‘Do Not Track’

By Hannah Lepow

Yesterday the FCC announced that it has entered into a $595,000 settlement agreement with Cox Communications to resolve an investigation into whether the company failed to protect its customers’ personal information when it suffered a data breach in 2014.  This is the first privacy  and data security…
Continue Reading Cox Communications to Pay $595,000 in Data Breach Settlement