Antitrust Law Daily Wrap Up, PRIVACY NEWS: AT&T to pay $25M to settle FCC data breach investigation, (Apr 9, 2015)

By Linda O’Brien, J.D., LL.M.

The Federal Communications Commission (FCC) has entered a $25 million settlement with AT&T Services, Inc. to settle an investigation into consumer privacy violations at AT&T’s call centers in Mexico, Colombia, and the Philippines (In the Matter of AT&T Services, Inc., File No. EB-TCD-14-00016243, released April 8, 2015).

The data breaches involved the unauthorized disclosure of almost 280,000 U.S. customers’ names, partial Social Security numbers, and unauthorized access to protected account-related data, known as customer proprietary network information (CPNI). This is the FCC’s largest privacy and data security enforcement action to date.

In May 2014, the Enforcement Bureau launched its investigation into a data breach that took place at an AT&T call center in Mexico between November 2013 and April 2014. During this period, three call center employees were paid by third parties to obtain customer information — specifically, names and at least the last four digits of customers’ Social Security numbers — that could then be used to submit online requests for cellular handset unlock codes. The three call center employees accessed more than 68,000 accounts without customer authorization, which they then sold to third parties who used that information to submit 290,803 handset unlock requests through AT&T’s online customer unlock request portal.

The Enforcement Bureau also learned during the course of its investigation that AT&T had additional data breaches at other call centers in Colombia and the Philippines. AT&T informed the Bureau that approximately 40 employees at the Colombian and Philippine facilities had also accessed customer names, telephone numbers, and at least the last four digits of customer Social Security numbers to obtain unlock codes for AT&T mobile phones. Approximately 211,000 customer accounts were accessed in connection with the data breaches in the Colombian and Philippine facilities.

The failure to reasonably secure customers’ proprietary information violates a carrier’s statutory duty under the Communications Act to protect that information, and also constitutes an unjust and unreasonable practice in violation of the Act, according to the FCC.

As a condition of consent order, AT&T will pay a $25 million civil penalty. The company will also notify all customers whose accounts were improperly accessed. AT&T will pay for credit monitoring services for all consumers affected by the breaches in Colombia and the Philippines.

Additionally, AT&T will be required to improve its privacy and data security practices by appointing a senior compliance manager who is a certified privacy professional, conducting a privacy risk assessment, implementing an information security program, preparing an appropriate compliance manual, and regularly training employees on the company’s privacy policies and the applicable privacy legal authorities. AT&T will file regular compliance reports with the FCC.

“Consumers trust that their phone company will zealously guard access to sensitive personal information in customer records,” said Travis LeBlanc, Chief of the Enforcement Bureau in a FCC news release. “Today’s agreement shows the Commission’s unwavering commitment to protect consumers’ privacy by ensuring that phone companies properly secure customer data, promptly notify customers when their personal data has been breached, and put in place robust internal processes to prevent against future breaches. We hope that all companies will look to this agreement as guidance.”

Companies: AT&T Services, Inc.

News: Privacy ConsumerProtection