Brief Description: Protecting customer proprietary network information.

Sponsors: Representatives P. Sullivan, Simpson, Wallace and Ericks.

Hearing Date: 2/2/06

Staff: Kara Durbin (786-7133).

Background:

Customer proprietary network information (CPNI) is the data collected by communications company about a consumer's telephone calls. It includes the time, date, duration and destination number of each call, the type of network a consumer subscribes to, and any other information that appears on the consumer's telephone bill.

The Telecommunications Act of 1996, section 222, requires that telecommunications companies obtain a customer's express approval prior to sharing their CPNI with third parties. In 1998, the FCC adopted rules implementing section 222. The rules required "opt-in" consent from the customer before a carrier could use CPNI. An opt-in approach usually requires affirmative consent from the customer before the CPNI can be used or disclosed, while an opt-out approach would allow the carrier to use the CPNI unless the customer affirmatively requests that his or her CPNI not be used for marketing purposes after being informed of the option to opt-out.

Shortly after the FCC rules were adopted, the 10th Circuit Court of Appeals struck down the FCC's "opt-in" approach on First Amendment grounds. In response to the 10th Circuit's decision, the FCC adopted new rules that permit carriers to follow an opt-out approach.

In 2002, the Washington Utilities and Transportation Commission (WUTC) adopted its own, stricter CPNI rules, which required opt-in consent for many uses of CPNI and imposed restrictions on the manner in which carriers could use and disclose CPNI among affiliates, agents, and subcontractors. These rules were challenged in federal district court, and in 2003 were permanently enjoined from enforcement by the court.

There are no state laws that create civil or criminal penalties for wrongful disclosure of CPNI.

Summary of Bill:

The WUTC is directed to adopt rules that (1) limit or prohibit the sale, use, or disclosure of customer proprietary network information (CPNI) without customer approval and (2) establish safeguards to protect CPNI from the unauthorized sale, use or disclosure by agents, contractors, and employees. Violation of a WUTC rule is subject to a $1,000 penalty per offense. A violation of a WUTC rule is also a violation of the Consumer Protection Act.

Any privacy rules adopted by the WUTC with respect to CPNI apply to both wireless and wireline carriers.

It is a gross misdemeanor to (1) misrepresent a person's identity in order to obtain or attempt to obtain a person's telephone records or (2) attempt to cause an employee or agent of a telecommunications carrier to wrongfully disclose a person's telephone records. Any employee, contractor, or agent of a telecommunications carrier who wrongfully and knowingly discloses a customer's telephone records is guilty of a gross misdemeanor. If a person is involved in trafficking information that he or she knows has been obtained in violation of this bill, he or she is also guilty of a gross misdemeanor.

Appropriation: None.

Fiscal Note: Requested on January 27, 2006.

Effective Date: The bill takes effect 90 days after adjournment of session in which bill is passed.