Customer Proprietary Network Information (CPNI)

Customer proprietary network information (CPNI) is the data collected by a telecommunications service provider about a consumer's telephone calls. CPNI includes the time, date, duration and destination number of each call, the type of network a consumer subscribes to, and any other customer specific information that appears on a telephone bill. The FCC's rules apply to all telecommunications services providers, including wireline, wireless and interconnected VoIP service providers.

All telecommunications service providers must file annual certifications with the FCC. These annual certifications must include a comprehensive outline of CPNI policies, reports on any unauthorized disclosure of protected information, and a statement regarding the internal use of CPNI.

The FCC's rules mandate that affected service providers protect all CPNI from unauthorized disclosure. These rules include specific requirements for password protection, customer notification, and disclosure to law enforcement about any security breaches. Federal CPNI rules further require carriers to obtain opt-in consent from customers before disclosing their CPNI to a carrier's joint venture partner or independent contractor for marketing purposes.

The FCC has made clear that it will vigilantly enforce CPNI violations. Recently the FCC put all affected service providers on notice that it will infer that a service provider did not sufficiently protect customer CPNI if a third party obtains unauthorized access to a customer’s CPNI. The FCC has warned carriers that it may assess forfeitures if it determines that the carrier procedures are insufficient. To emphasize the point, the FCC has issued forfeitures against numerous carriers pertaining to CPNI violations ranging from failure to respond to an FCC Letter of Inquiry ("LOI") to failing to maintain an adequate CPNI certification.

Therefore, it is essential that all telecommunications service provider continually review existing CPNI policies and make necessary modifications to ensure that they comply with the new rules.