Antitrust Law Daily Wrap Up, PRIVACY NEWS: Verizon settles FCC consumer privacy investigation for unprecedented $7.4M, (Sep 4, 2014)

By Greg Hammond, J.D.

Verizon Communications Inc. has agreed to pay $7.4 million to the U.S. Treasury for allegedly using customers’ personal information for marketing purposes, without first obtaining their consent or providing them with the requisite privacy notice. This marks the largest payment in FCC history for settling an investigation dealing solely with the privacy of telephone customers’ personal information (In the Matter of Verizon, File No. EB-TCD-13-00007027, released September 3, 2014).

Verizon collects personal information regarding its customers’ services and calling habits, including how many calls they make; what services they subscribe to; the destination or numbers called; and the customers’ locations at the time of their calls. Before using customers’ personal information for marketing purposes, telecommunications carriers—such as Verizon—are required to obtain express permission from its customers or to provide written notice of how the company will use such personal data for marketing, giving customers the opportunity to opt out of such uses. The FCC alleged that Verizon violated the Communications Act by failing to provide approximately 2 million new customers with the required opt-out notice, depriving them of information regarding Verizon’s marketing practices and their right to deny access to their personal data for marketing purposes.

“In today’s increasingly connected world, it is critical that every phone company honor its duty to inform customers of their privacy choices and then to respect those choices,” stated Acting Chief of the FCC Enforcement Bureau, Travis LeBlanc. “It is plainly unacceptable for any phone company to use its customers’ personal information for thousands of marketing campaigns without even giving them the choice to opt out.”

In addition to the $7.4 million settlement, the consent decree requires Verizon to, within 30 calendar days of the effective date, designate a compliance officer for customer proprietary network information (CPNI); notify all employees of the company’s CPNI procedures; implement a process to place an opt-out notice on every invoice to every customer for whom Verizon relies on opt-out consent; monitor and test the billing and invoicing systems; test its CPNI opt-out notice mechanisms; implement a process for immediately reporting to the compliance officer any problems detected with CPNI opt-out notices; and conduct an extensive review of its CPNI opt-out processes to ensure compliance with CPNI rules and the consent decree.

Within 60 calendar days of the effective date, Verizon must establish operating procedures to ensure Verizon’s compliance with the consent decree and CPNI rules. Finally, within 90 calendar days of the effective date, Verizon is required to develop and distribute a compliance manual to all covered personnel, and must establish and implement a compliance training program on CPNI rules and operating procedures. Verizon must also submit periodic compliance reports during the three-year term of the consent decree.

Companies: Verizon Communications Inc.

News: ConsumerProtection Privacy