Those seeking account information from telephone companies will have to provide a password under new privacy rules approved earlier this month by the Federal Communications Commission.
The rules are aimed at preventing pretexting, the practice of impersonating a phone customer to gain access to his phone records.
In addition to the password protection, the rules also require carriers to ask for customers’ permission when sharing private account information with business partners and independent contractors. Phone companies have contended that such an “opt-in” requirement violates their First Amendment right to communicate with customers – a position that was backed by a federal court in 1999. Under the new rules, consumers must also be notified immediately when changes are made to their passwords, addresses, or online accounts.
The FCC has been working on phone privacy rules since the issue was raised by the Electronic Privacy Information Center, a nonprofit privacy rights group, in 2005. Marc Rotenberg, executive director of the organization, praised the agency’s action.
The rules included one provision that Rotenberg and both Democrats on the Commission strongly oppose, however. The provision requires that law enforcement agencies like the FBI and the Secret Service be informed of a privacy breach before consumers are. The delay would be seven days or perhaps indefinite, depending on the circumstances. In filings, the Justice Department said it needed the provision to keep from tipping off investigative targets.
Earlier this year President Bush signed a law criminalizing pretexting and imposing penalties, including up to 10 years in prison. The new law gives police a weapon to punish perpetrators but leaves out requirements on how phone companies should protect their customers’ private data. Law enforcement agencies were explicitly exempted from that law.
Significance: This new set of rules shifts the focus from prosecution to prevention, and places responsibility on the phone companies to abide by a specific set of rules to protect consumer data.