Warning: FCC Cracking Down on CPNI

If you offer CLEC or VoIP services and you don't know about the FCC's rules on private data, contact your lawyer immediately to learn about CPNI rules.

by Alex Goldman ISP-Planet Managing Editor [June 6, 2008]

CPNI (rules covering Customer Proprietary Network Information) is to CLECs what HIPAA is to hospitals. You have personal information about your clients and you and your employees need to be trained how to handle it, and you need to share your plans on how to do it with the FCC.

ISP-Planet just received a quick note from tech lawyer Kris Twomey.

He writes:

As you know, I never send out emails suggesting that something is urgent when it's really not. This one is extremely urgent though. The FCC is cracking down on CLEC and VoIP providers' annual CPNI compliance statements. What is that? CPNI stands for customer proprietary network information. CPNI consists of call detail records, calling feature information, unlisted telephone numbers, and other private customer data. CLECs and VoIP providers are generally allowed to use the information internally to market additional services, but can not give this information to outside vendors. That seems obvious to all of you I imagine, but not everybody has common sense. CLECs have always been required to file annual statements attesting that they do not hand out private customer information. Starting this year though, VoIP providers are also now required to file annual CPNI statements.

Why the sudden urgency? I just received a letter sent to one of my former clients by the FCC Enforcement Bureau asking where their CPNI compliance statement is. I bet they never filed one and now they're going to have to explain why they shouldn't be fined $100,000.

In addition to the annual compliance statements, every CLEC and VoIP provider needs to have a manual that describes how employees should handle CPNI. I have drafted a forty page compliance manual and can have it customized for your company. You also need to formally train all employees that handle CPNI so that they understand how to protect CPNI.

This is a new requirement. It now includes VoIP providers, as of December 8, 2007. So it's possible that the FCC will be lenient with anyone who has a plan to comply. But I am not a lawyer. You should contact yours today. Twomey will be briefing his clients soon.

Fines so far: CBeyond was fined $255,000, AT&T was fined $355,000, and even small carriers are facing fines of $100,000.

— End