Cybersecurity Policy Report, FCC Defends AT&T Forfeiture Order in Location Data Case, (Oct 4, 2024)

By Lynn Stanton

Despite its claims to the contrary, AT&T, Inc., had the right to a jury trial and “simply chose to dispense with that opportunity” in a case involving a financial forfeiture for selling wireless location data without confirming that customers consented to sharing it, the FCC has told the U.S. Court of Appeals for the Fifth Circuit (New Orleans).

AT&T is challenging a forfeiture order issued by the FCC against it in the spring, along with similar orders against T-Mobile US, Inc., and Verizon Communications, “for illegally sharing access to customers’ location information without consent and without taking reasonable measures to protect that information against unauthorized disclosure” (CPR, April 29). AT&T was fined more than $57 million, unchanged from an earlier notice of apparent liability (CPR, Feb. 28, 2020).

In its brief, the FCC said AT&T’s practice of selling customers’ location data “endangered the privacy, and safety, of millions of the company’s customers. In one highly publicized incident, a rogue sheriff submitted thousands of illegitimate requests, enabling him to track the locations of his unwitting acquaintances, including a judge. This abuse went on for years, even though the sheriff, as supposed proof of authorization for access, routinely uploaded patently non-compliant documents, such as pages from his personal insurance policies and from office training manuals. Even after this alarming vulnerability became public, AT&T was slow to address the flaws in its program, leaving its customers’ location information unprotected for nearly another full year. In the order under review, the Federal Communications Commission properly determined that AT&T’s dangerous failure to protect customers’ location data warranted the imposition of a monetary forfeiture,” Brief for Respondents at 1-2, AT&T, Inc., v. Federal Communications Commission and United States of America, No. 24-60223 (5th Cir. Sept. 27, 2024).

The FCC argued that AT&T, which claims that it was unconstitutionally deprived of a jury trial, could have sought “a de novo jury trial in district court” but “instead opted to pay the forfeiture at once and to seek relief in this Court rather than in district court. Even apart from that waiver, the Seventh Amendment’s jury trial right does not apply to the Commission’s regulation of common carriers such as AT&T,” Brief for Respondents at 2.

“AT&T’s other arguments are likewise unpersuasive. It points to no credible indication of bias in the administration of this case. Congress gave sufficient guidance to inform the Commission’s choice between administrative processes for enforcement. The Commission’s authority to penalize AT&T for failing to protect location data is plain on the face of the statute. And AT&T points to no clear error of judgment in the Commission’s finding of liability or its assessment of a $57 million penalty it deemed necessary to deter AT&T—a leading telecommunications carrier with some $122 billion in revenue last year—from engaging in similar misconduct in the future,” the FCC added, Brief for Respondents at 3.

News: FederalLegislation LitigationEnforcement DataPrivacy