(A PDF version is also available
with more accurate formatting.)
Before
the
Federal Communications Commission
Washington, D.C. 20554
In the Matter of
Telecommunications Carriers'
Use Of Customer
Proprietary Network Information |
)
)
)
)
) |
CC Docket No. 96-115 CC
Docket No. 96-149 |
To: The Commission
REPLY COMMENTS OF THE ELECTRONIC PRIVACY INFORMATION CENTER, AMERICAN
CIVIL LIBERTIES UNION, AMERICAN LIBRARY ASSOCIATION, CENTER FOR DIGITAL
DEMOCRACY, CENTER FOR MEDIA EDUCATION, COMPUTER PROFESSIONALS FOR SOCIAL
RESPONSIBILITY, CONSUMER ACTION, CONSUMER FEDERATION OF AMERICA, JUNKBUSTERS,
MEDIA ACCESS PROJECT, NATIONAL CONSUMERS LEAGUE, NETACTION, PRIVACYACTIVISM,
PRIVACY JOURNAL, PRIVACY RIGHTS CLEARINGHOUSE, PRIVACY TIMES, PUBLIC CITIZEN
LITIGATION GROUP, AND US PIRG
November 16, 2001
Pursuant to the
notice published by the Federal Communications Commission on October 2, 2001
regarding Telecommunications Carriers' Use of Customer Proprietary Network
Information and Other Customer Information, the Electronic Privacy Information
Center, American Civil Liberties Union, American Library Association, Center
for Digital, Democracy, Center for Media Education, Computer Professionals
for Social Responsibility, Consumer Action, Consumer Federation of America,
Junkbusters, Media Access Project, National Consumers League, NetAction, Privacyactivism,
Privacy Journal, Privacy Rights Clearinghouse, Privacy Times, Public Citizen
Litigation Group, and US PIRG submit the following comments and incorporate
the original filing by reference.
The commentators again urge the
Commission to meet its fundamental responsibility to protect the privacy
rights of those using the Nation's telecommunications system by implementing
an opt-in approach towards telecommunications carriers' use of customer
proprietary network information (CPNI) pursuant to section 222 of the Communications
Act of 1996. In promulgating section 222, Congress addressed a particular
privacy concern: "protecting the confidentiality of proprietary information."
[1] These reply comments demonstrate that an opt-out approach
to the use of CPNI does not adequately protect this articulated concern
because opt-out systems have systematically failed to give consumers control
over their personal information. Therefore, employing an opt-in approach
is consistent with the First Amendment and is the only reasonable fit with
Congressional intent to protect the privacy of telephone subscribers' personal
information.
I.
Opt-out approaches have been Proven Insufficient to Adequately Protect Customer
Privacy as Mandated by Congress in the Enactment of Section 222
A.
Opt-Out Notices Fail to Protect Customers' Legitimate Privacy Interest
There is substantial
evidence establishing that an opt-in approach is the only effective method
to protect sensitive private information because opt-out approaches are not
calculated to reasonably inform consumers about their privacy options.
Not only is the burden on the customer to pay for and return their opt-out
notice, such notices are vague, incoherent, and often concealed in a pile
of less important notices mailed from the same source.
[2] The importance
of the notices, as well as their purpose, is rarely brought to the customer's
attention in any coherent fashion. Studies have revealed that, "the
majority of the general public is still unaware of the exact nature of marketing
uses and the availability of opt-out choices."
[3] AT&T cites
U.S. v. Playboy for the proposition that speculation about the inadequacy
of opt-out is insufficient to justify the heightened restrictions imposed
by an opt-in regime.
[4]
AT&T's reliance on
Playboy is faulty for two reasons. The
restrictions at issue in
Playboy were content based.
[5] If a statute regulates speech based on its content, it must
be narrowly tailored to promote a compelling government interest.
[6] If a less restrictive alternative would serve the government's
purpose, the legislature must use that alternative.
[7] In contrast, the
regulations at interest here trigger only intermediate scrutiny under the
Central Hudson analysis,
[8] under which analysis
the means propounded need not be the least restrictive means. Under
Central
Hudson, the government may regulate commercial speech that is neither
misleading nor unlawful if: (1) there is substantial interest in support of
its regulation; (2) the restriction on commercial speech directly and materially
advances that interest; and (3) the regulation is narrowly drawn.
[9] The Supreme Court has carefully detailed
the difference between the "narrowly tailored" fit required under
strict scrutiny, and that required under intermediate scrutiny.
With respect to
this prong, the differences between commercial speech and noncommercial speech
are manifest. In Fox, we made clear that the "least restrictive means"
test has no role in the commercial speech context. "What our decisions
require," instead, "is a ‘fit' between the legislature's
ends and the means chosen to accomplish those ends,' a fit that is not
necessarily perfect, but reasonable; that represents not necessarily the single
best disposition but one whose scope is ‘in proportion to the interest
served,' that employs not necessarily the least restrictive means but
… a means narrowly tailored to achieve the desired objective."
[10] Therefore, because
the CPNI regulations are subject to intermediate scrutiny, unlike in
Playboy
the Commission need not prove that an opt-in regime is the least restrictive
alternative, only that it is a "means narrowly tailored to achieve the
desired objective."
[11] AT&T's
reliance on
Playboy also fails to account for the fact that the Commission's
decision to promulgate an opt-in regime relies on more than "anecdote
and supposition,"
[12] because it was the result of careful calculation and assessment
of both approaches before the Commission chose to favor the more protective
opt-in approach.
[13] In addition, there is substantial evidence that
opt-out regimes implemented in other circumstances or by other agencies have
failed to protect the customer privacy that was the impetus of the regulation.
The recent experience
of consumers with the Gramm-Leach-Blilely Act demonstrates the failure of
the opt-out regime to adequate protect sensitive personal information. Gramm-Leach-Bliley
Act requires banks, insurance agencies, and brokerage firms to send notice
and opportunity to opt-out to customers before sharing their non-public information.
[14] According to the law, these financial privacy notices are
supposed to be written in a "clear and conspicuous" style; however,
few institutions implementing GLB have provided consumers with "clear
and conspicuous"
[15]
notices, as those terms would be defined by most customers. Opt-out notices
mailed out by financial institutions in compliance with the GLBA were unintelligible
and couched in language several grade levels above the reading capacity of
the majority of Americans.
[16] Several experts have highlighted
the inadequacy of such statements. Mark Hochhauser, PhD, a readability
consultant, reviewed sixty GLBA opt-out notices, calculating that they averaged
at a 3rd or 4th year college reading level rather than the junior high level
comprehensible to the general public.
[17] For example:
If you prefer
that we not disclose nonpublic personal information about you to nonaffiliated
third parties, you may opt out of those disclosures, that is, you may direct
us not to make those disclosures (other than disclosures permitted by law).
[18] AT&T states:
"As for those customers who decline to opt out, there is no reason to
believe that they place a high value on keeping their CPNI private, and thus
no basis for concluding that an opt in requirement materially furthers any
interest in protecting privacy." Expert studies illustrate that, in
fact, few consumers recall seeing notices even when the notices are required
to be clear and conspicuous, which suggests that when businesses do not want
consumers to see a notice, consumers will not.
[19] Sprint Corporation
asserts that an opt-out regime is adequate to protect consumer privacy, relying
upon the fact that in the interim period following U.S. West, "no serious
problems associated with carriers' use of their customers' CPNI
have arisen."
[20]
However, the period following U.S. West has not been
an opt-out regime; instead, there have been no uniform regulations following
the 10th Circuit's vacating of the CPNI regulations. However, a true
opt-out regime, as implemented under GLBA, has generated numerous complaints,
as consumers view the financial institutions' unintelligible notices
as an attempt to hoodwink them.
[21] In fact, the opt-out approach promulgated under the
GLBA has proven so ineffective that the Federal Trade Commission has scheduled
an Interagency Public Workshop to address some of the concerns that have been
raised "about the clarity and effectiveness of some of the privacy notices"
sent out by financial institutions in response to the GLBA.
[22] Specifically, the concerns
raised by consumers have included complaints that "the notices are confusing
and/or misleading and that the opt-out disclosures are hard to find."
[23] In light of the difficulty faced by another government commission
in the implementation of an opt-out approach, it is reasonable for the Commission
to have chosen opt-in as a narrowly tailored privacy protection.
B.
Silence Does Not Constitute Customer Approval
Section 222(c)(1) requires a
telecommunications carrier to obtain a customer's approval before it can
use, disclose, or allow access to that customer's CPNI. [24] Those advocating an opt-out
approach rely upon the assumption that customer silence, or inaction, signals
approval (permission and intent). [25] This assumption runs counter to all other
commercial transactions, in which "approval" requires an affirmative
action by an informed consumer.
[26] Therefore, the assertion that an opt-out regime is sufficient
to meet the requirements of section 222(c)(1) fails to account for the real,
legal, and commercial definitions of approval. [27]
II.
An Opt-In System Improves Information Flow, Increases Quality
of the Telecommunications Service, and Reduces Prices
Proponents of
an opt-out approach argue that such a system is economically preferable, as
it increases the amount of information available to both producers and consumers,
allows telecommunications carriers to improve services offered by tailoring
these services to specific customers, and reduces prices.
[28] This assertion erroneously assumes that the only costs at
issue are those of production, without accounting for increased transaction
costs incurred by the consumer in seeking to exercise privacy rights created
by statute.
[29]
Opt-out regimes create an economic
incentive for businesses to make it difficult for consumers to exercise
their preference not to disclose personal information to others. Because
opt-out systems do not require businesses to create inducements for consumers
to choose affirmatively to disclose personal information, these systems
encourage firms to engage in strategic behavior and thus inflate consumer
transaction costs. [30]
In contrast, an opt-in system would permit consumers who
wish to protect their privacy to do so, while encouraging telecommunications
carriers to eliminate consumer transaction costs.
[31] Because carriers profit from the use of consumer
information, and thus want as much information as possible, carriers would
have an incentive to make it as easy as possible for consumers to consent
to the use of their personal information. Such a system might include
a comprehensible list of the benefits to opting-in, contained within a clearly
marked mailing, with a pre-paid stamped envelope. This would preclude
the transaction costs involved with attempting to contact via phone customers
with the authority to opt-in. It also reduces the strategic behavior
costs associated with opt-out—the costs associated with providing
consumers a message that they don't want consumers to receive—because
the telecommunications carriers would have an incentive to lower costs associated
with providing customers a message that they are very eager to have the
customer receive. [32]
Finally, opt-in may decrease the amount of information
in the marketplace, but it permits telecommunications carriers to target
products at those who have specified an interest in such information: thereby
decreasing the wasted costs associated with targeting uninterested customers. [33]
III. Legal Scholars
Believe Opt-In is Both Fair and Efficient
Legal scholars
who have considered the issue of opt-in versus opt-out have invariably concluded
that the opt-in regime is both more likely to safeguard privacy interests
and is more economically efficient. Opt-in upholds the primary purpose of
privacy legislation: to ensure that consumers are given some effective means
of control over the use of personal information held by others. As Professor
Mark Budnitz explained:
Consumers should
have the ability to opt in because a choice to opt in gives consumers, in
the first instance, greater control over their personal information. . .
. Consumers may fail to opt out for a variety of reasons that have little
to do with whether they truly want a company to collect and disseminate information
about them. For example, they may not understand the nature of the information
that will be collected, aggregated, and disseminated; how the company will
use the information for its internal purposes; the nature of third parties
to whom the data may be distributed; or what those third parties may do with
the data. . . . Moreover, the opt-out method is easy for companies to abuse.
The opt-in approach is far more consistent with consumer control because it
assumes consumers do not want their privacy invaded. Therefore, consumers
automatically are protected from invasions. If consumers are willing to give
away their privacy or to trade it in return for a benefit they desire, they
have the ability to do so.
[34] In the specific
context of CPNI, legal scholars have determined that the opt-in rule promotes
markets efficiency. As Professor Paul Schwartz has observed:
The goal regarding
individually identified CPNI should be to find a way to permit consumers to
make informed decisions about use of their information at the least cost to
them. To reach this goal, companies should be forced to internalize not only
their own costs but at least some of their customers'. Such action, by raising
the "price" of personal information and privacy violations, will
improve efficiency in "privacy price discrimination."
[35] Professor Julie
Cohen's review of the nature of consent obtained under the two regimes
emphasizes the significance of opt-in as the more efficient way to allocate
the burden to act where information asymmetries exist:
If we reconceptualized
the government interest in protecting data privacy as an interest in correcting
information asymmetries in the market for personally-identified data, the
Central Hudson analysis (or a more stringent review) might proceed quite differently.
In particular, an explicitly economic approach to regulation of speech markets
would save regulations like the opt-in rule challenged in U.S. West, which
focus on the quality as well as the fact of consent.
[36] Professor Daniel
Solove, reviewing this recent literature on opt-in versus opt-out regimes,
writes:
Thus, providing
people with opt-out rights and privacy policies does little to give individuals
much control over the information collected and used. Regulation mandating
that consumers opt-in rather than opt-out will more effectively control the
flow of information between unequal parties.
[37]
Professor Solove concludes, "effective
privacy regulation must require an opt-in system which requires
a meaningful range of choices as well as addresses inequalities in knowledge
and power and other impediments to voluntary and informed consent." [38]
IV. Conclusion
The Commission
has a fundamental responsibility, mandated by Congress, to implement adequate
mechanisms for protecting the privacy of telecommunications customers.
The U.S. West court vacated the initial rulemaking because there was no showing
of specific harm that would result to customers upon implementation of the
less speech-restrictive opt-out approach. These comments illustrate
that there is ample evidence of such harm that has resulted to consumers upon
implementation of similar systems. In the light of such tangible evidence,
the Commission's responsibility to protect the privacy of telecommunications
customers can only be met by implementing an opt-in approach.
CERTIFICATE OF SERVICE
I, Marc Rotenberg, certify that copies of the foregoing Reply Comments
of Electronic Privacy Information Center will
be sent by first class mail to the parties listed below.