The Republican-led House Communications Subcommittee wants to look at protecting CPNI (Customer Proprietary Network Information) beyond the 1996 Communications Act requirement on telecom nets.

It is yet another dive into the different regulatory standard for networks versus edge platforms.

"Under the Communications Act of 1996, telecommunications carriers must protect the confidentiality of..the personal information that consumers relay when communicating over telecommunications networks," the subcommittee explained in scheduling the hearing. "However, consumers today communicate across many other types of networks via apps, and online platforms and services."

There are many pages of CPNI rules dictating access and use.

The Subcommittee says it is "critical that consumers' personal information is protected no matter what kind of network they're using."

Both the Act and FCC rules require telecoms and interconnected VoIP providers to protect CPNI, which includes phone numbers called and the frequency, duration and timing of calls, and requires providers to file annual reports to certify compliance.

CPNI is considered sensitive info and FCC rules require customer approval (opt-in) for its use by third parties or for other than providing the telecom service--routing calls, for example--or marketing the providers own services within a category of service the subscriber already gets or preventing fraud. .

"[W]e thank Chairman Pai for his swift response on this 50th Anniversary of the Commission’s original EEO decision," said MMTC acting President Maurita Coley. "The Chairman’s decision to urge that EEO enforcement be moved from the Media Bureau to the FCC’s Enforcement Bureau speaks volumes about his willingness to listen, and to act, on proposals from civil rights and social justice advocates about diversity. The FCC’s bold decision 50 years ago in a divided nation to stop discrimination in broadcast hiring paved the way for diverse leaders such as Chairman Pai and former Acting Chairwoman Mignon Clyburn – the first Indian-American and African-American woman FCC Chairs, respectively – to rise to leadership positions that were previously inaccessible to people of color. The action today will help the world to see that ensuring equal opportunity is serious business at this FCC, and it sets an example for other industries, such as the tech industry, that have missed the mark.”

Few industries collect more intricate data about a person’s media consumption than cable operators — and few are as highly regulated.

Cable operators, as the conduit by which most of us access entertainment and internet, are privy to reams of customer information ranging from what shows an individual watches, what room in their house they watch it in, the websites they surf and the credit cards they use.

But the industry and the government, perhaps anticipating the onslaught of privacy issues collecting that information could bring, have put in place safeguards to ensure that data is protected.

Related: Specter of D.C. Crackdown Looms Over Edge

The Cable Act of 1996 severely limits what a cable operator can do with the data it obtains. According to Section 661 of the act, a cable operator can use personally identifiable data only to deliver service to that person. It can share that information with a third party only with the prior written consent of the customer, or to comply with a court order.

While that would seem to hamstring operators, they have been able to use the data they glean from customer habits mainly to improve service — like being able to detect and rectify service problems in specific areas of their networks — and to offer additional services. As one operator put it, if they notice a customer isn’t taking phone service from the cable company, or may be downloading content that would warrant a faster internet speed, they can contact that customer directly.

Privacy Pledge

Cable operators have also gone the extra mile. Many, such as Comcast, Cox Communications and Charter Communications, have pledged to never sell personal customer information to third parties. But even with those restrictions, operators can still do a lot with the data.

Most operators are reluctant to talk about how they use the information.

In an email message, Cox spokesman Todd Smith said the cable company, like others, uses personalized data to improve the customer experience.

“We know that when customers interact with us they want it to be efficient and respectful of them and their time,” Smith said in the email message. “We leverage data from interactions to enhance our ongoing efforts to improve the experience. We are specifically doing a lot of work right now to map several what we’re calling Customer Journeys (everything from marketing and order process, to install and promotion rolloffs/renewals). The quality of information we gather during these processes helps us better serve existing and new customers in the future.”

Privacy on the Edge: Legislators' Questions

At Canoe Ventures, the advanced advertising consortium that includes Comcast, Cox and Charter, head of business development, sales and marketing Chris Pizzurro said that while the uses of customer data are many, so are the restrictions.

For example, Pizzurro said MSOs regularly extract household IDs and device IDs from settops and broadband routers, “so the cable operator knows what is going on in your home; making sure the system is running the way it should.”

The operator can also use that information to market its own products and services to customers. But for Canoe, the restraints are tight. Pizzurro said that Canoe can only use customer information like household IDs and device IDs for troubleshooting purposes.

“It’s all very specific and geared toward our service assurance product,” Pizzurro said. “We can’t go out willy-nilly and use it for targeting purposes or other advanced ads things.”

Canoe Ventures, which originally was formed as an interactive advertising vehicle for cable operators, abandoned that tack about five years ago and has mainly concentrated on dynamic ad insertion of video-on-demand streams. That business has picked up considerably in the last half-decade. Pizzurro said five years ago, reaching 1 million ads viewed in a month would be a Holy Grail moment for the company. Today, 1 billion monthly ad views are commonplace.

“We’ve grown 20% quarter over quarter over the last five years,” Pizzurro said. “With all the data that’s flying through the system, we’ve managed to be good stewards and shepherds without incident.”

Pivotal Research Group analyst Brian Wieser said if any new regulation comes out of the Facebook hearings, it will likely be focused on the social-media platform and would probably benefit Google the most. The cable industry would have little to worry about, he added.

“If the entire industry is forced to implement it, you will probably see a deceleration in growth for the overall industry,” Wieser said. “My guess is that Facebook and Google will probably take share. There are going to be some smaller players who won’t justify being in business.”

SIDEBAR | CPNI 101 | by John Eggerton

Cable operators, in the provision of their traditional video service, have long had fairly strict rules about what they can and can’t do with the personal information they collect from subscribers (Customer Propriety Network Information, or CPNI).

According to the Federal Trade Commission, they must provide reasonable access to personal records they retain and provide an opportunity to correct any errors. They also may not disclose any of that information to a third party without “written permission” from their customers.

There are different, but similarly strict, rules regarding voice-over-internet protocol phone service information.

The bipartisan co-chairs of the Congressional Privacy Caucus have written to FCC Chairman Tom Wheeler to say they are worried existing privacy protections covering cable and satellite subs will be lost when the FCC adopts its third-party navigation (set-top) proposal.

In a letter to FCC Chairman Tom Wheeler dated May 11, Reps. Joe Barton (R-Tex.) and Diana DeGette (D-Colo.) said that the FCC's proposal as currently constituted could hurt consumers.

FCC Chairman Tom Wheeler has proposed requiring MPVDs to make programming streams and data available to third parties. While that data is protected under FCC cable and satellite privacy rules, when it gets into the hands of edge-provider third parties, those rules no longer apply and the FCC has said it does not have authority to apply new rules to the edge, but will instead require them to self-certify they are abiding by similar privacy rules or MVPDs don't have to provide the data.

The MVPD privacy rules require them to clearly explain data-collection and use to customers and prohibit them from  collecting personally identifiable information without consent. Subs also can sue in federal courts should the protections be violated.

But the legislators fear that under the FCC's proposed regime, should an MPVD conclude a third party had violated that self-certification, the only way to protect customer information would be to shut off the data and programming streams to those boxes. "This outcome will harm consumers equally if not more so than ti would the third party in violation..." Said Barton and DeGette.

The pair said the FCC should be spurring robust competition in navigation devices, but not at the expense of privacy, or loss of service through no fault of the customer.

Wheeler has said the proposal is a work in progress and the final product would reflect the input, and there has been a lot of it, that the commission has been getting.

RELATED:Advertisers Warn Hill on FCC Broadband CPNI Item | NCTA, ACA Join Senate Letter on Broadband CPNI

Protect Internet Freedom, a group whose view of that freedom differs markedly from FCC chairman Tom Wheeler, has reached out to the FCC to ask why its comments on broadband privacy have not yet shown up in the FCC's docket on the proposal.

That comes as Wheeler is scheduled to testify at a Senate Judiciary Committee hearing Wednesday (May 11) on his proposed broadband CPNI (customers proprietary network information) framework, which includes requiring customers to opt in to the use of their information by third parties for marketing purposes, which is not required of edge providers like Google or Yahoo!

The group, which has attacked net neutrality as a Communist-like takeover of the Internet and calls the privacy rules a "farce," says its supporters have submitted more than 2,200 comments (via an online form) over the past two weeks, but none have yet to appear. At press time the docket only had 27 comments total.

The letter actually came from a law firm asked to look into the comments' absence. It submitted a handful of comments it said had FCC status numbers showing they had been received but had yet to be posted.

The letter said counsel assumed there was a valid reason and would endeavor to rectify any problem the FCC identified with the submissions, but said it was unclear "why the FCC's comment submission platform has failed to make some comments publicly available while withholding others from public view."

"The FCC is required by law to make public all officially submitted comments in a timely manner," said Protect Internet Freedom in a statement. "It’s also very ironic that this substantial delay comes at the same time that the FCC is proactively working with other groups that are launching an anti zero-rating campaign to help facilitate their comment submissions."

An FCC spokesperson said the commission had been in contact with the group and also said it was ready to rectify any problem with the submissions.

“On Tuesday, Protect Internet Freedom asked FCC staff about the status of comments the group had attempted to transmit via an automated script on its website," an FCC spokesperson said. "FCC staff advised Protect Internet Freedom that the Commission did not have record of receiving the majority of the comments in ECFS, the Commission's electronic comment and filing system."

As to the suggestion it had helped the anti-zero rating plan commenters, the spokesperson said. "FCC staff stands ready to provide technical assistance to all individuals and groups wishing to file comments in any proceeding.”

RELATED:Advertisers Warn Hill on FCC Broadband CPNI Item | Group Seeks FCC Answer on Missing Broadband Privacy Comments

The heads of the major ISP/cable/telco trade associations have told Congress the FCC needs to back off new opt-in-centric rules on broadband CPNI (customer proprietary network information), and instead adopt an FTC-like approach to privacy.

That came in a letter to the leaders of the Senate Judiciary Committee, which is holding a hearing May 11 on the new FCC privacy framework, from the heads of the American Cable Association, National Cable & Telecommunications Association, CTIA, USTelecom and the Internet Commerce Coalition.

It was a busy day in the letter-writing department as advertising trade groups registered similar concerns to the senators.

The FTC does not have privacy rules, but instead enforced broadband privacy through enforcement actions--filing court suits or settling complaints--using its authority to go after false or deceptive advertising if companies strayed from promises made in privacy policies.

But the FTC's authority to regulate broadband privacy went away when the FCC reclassified Internet access as a Title II service beyond the reach of the FTC.

The associations advised Congress that there was nothing in the Title II reclassification that warrants departure from that FTC approach based on effective notice by ISPs to consumers and meaningful choice over their data--but not a mandatory opt-in regime.

They are not happy with the FCC proposal to make opt-in the default for sharing most consumer information with third parties for targeted marketing purposes, meaning they would have to affirmatively agree to it.

"This would lead to absurd results, such as restricting an ISP’s ability to market accessories that work with a consumer’s device," they told the senators. "It also would make it difficult for consumers to have access to discounted offers from their providers. This broad opt-in requirement, irrespective of the sensitivity of data, would be inconsistent with common Internet practice and would harm consumer welfare. More important, it would be confusing to require consumers to opt-in to ISP data use and sharing because consumers would likely not understand how the opt-in regime would apply."

The groups were the same ones who advised the FCC to use the FTC approach before FCC Chairman Wheeler unveiled his opt-in approach to sharing data with third-party marketers.

They said they support a "Reasonable framework," but said Congress might need to help the FCC "realign" its proposal with the FTC approach to make it so.

Cable operators large and small have called on the FCC to extend the comment period for its broadband CPNI rulemaking proposal from the end of next month until early July.

A divided FCC approved the proposal March 31 and released it April 1.

Armed with new (under Title II IPS reclassification) authority over broadband customer information--like what sites they have been surfing--the FCC has proposed a privacy framework that includes requiring subs to opt into the use of their data for most third-party marketing.

In a motion for extension of time, The American Cable Association and the National Cable & Telecommunications Association joined with CTIA, US Telecom, and Consumer Technology Association all asked for another 45 days to file comments and an additional 45 days for reply comments. That would extend the comment period from 87 days to 120.

They said the time the FCC allotted was not enough given that the notice itself contained over 500 questions and the ramifications of what the FCC's answers would be.

They said they agreed with the Association of National Advertisers, which made the initial extension request (http://www.multichannel.com/news/content/ana-asks-fcc-extend-broadband-c...), that more time was needed.

"The Notice proposes to establish sweeping and unprecedented privacy, data security, and data breach rules for BIAS [broadband internet access service] providers that raise difficult and complex legal, technical, and policy issues with broader implications for the complicated Internet ecosystem and online advertising marketplace," they told the commission.

They also pointed to a number of other comment deadlines happening at about the same time, including for set-top boxes (April 22 and May 23), EAS (May 9 and June 7), comments on an NTIA Internet of Things inquiry (May 23) and the general activity surrounding the incentive auction.

[G]ranting an extension here would enable all stakeholders – and the Commission itself – to pursue policymaking at a more rationale and productive pace," they argued. It would also delay action on a proposal they all have major issues with.

Stakeholders were not keeping their thoughts private on the FCC's politically partisan vote on a Notice of Proposed Rulemaking (NPRM) on new privacy rules for broadband customer information.

"Today’s FCC action unfortunately mistakes a good headline for actual headway in advancing consistent standards of privacy protection and fair competition," said the Natioanal Cable & Telecommunications Association. "Under the FCC's proposal, ISPs would have far more onerous requirements than the ones imposed on other large online entities that have access to a wider range of user information than ISPs.  

"Recently, a cross-section of the broadband industry put forward a technology-neutral privacy framework guided by principles of transparency, data security, and consumer choice. In contrast, today’s FCC proposal will only lead to greater consumer confusion about how their online data is protected, rather than furthering an approach grounded in greater consistency and fairness among all Internet participants.  As broadband providers long committed to protecting the privacy of our customers, we hope that a more considered review of the facts and the potential negative consequences of its proposal will convince the Commission to move in a different direction.”

Comcast Senior EVP David Cohen blogged that the FCC proposal could harm consumers.

"The unfortunate result of the FCC’s extreme regulatory proposals will be more consumer confusion and less competition – and a bunch of collateral damage to innovation and investment along the way," said Cohen. "This is most disappointing because it is entirely avoidable, since the Administration, the Federal Trade Commission, and others have examined this issue and marketplace for many years and have reached very different conclusions."

“The FCC has invented a privacy crisis, then exploited that crisis to claim vast new powers,” said Berin Szoka, President of TechFreedom, calling it a "naked power grab."

"To be sure, privacy is a societal concern, but the FCC's proposal is a solution in search of a problem," said Adonis Hoffman, chairman of Business in the Public Interest and former chief of staff to commissioner Mignon Clyburn, who supported the proposal.

"First of all, the Federal Trade Commission (FTC) should remain the principal privacy enforcer. They have the expertise, institutional knowledge and experiential insight to handle the range of privacy issues sure to arise… The other troubling part of the FCC plan is that it leaves the real privacy perpetrators outside the reach of the rule. Google, which collects and houses more data than all ISPs combined, should be covered, but it is not."

"[The] NPRM misses the elephant in the room and shifts the burden to ISPs who are junior players in the data collection game," said Hoffman. "This is yet another unintended consequence spawned by Title II regulation."

USTelecom president Walter McCormick was equally displeased.

“While we support the effort to ensure strong consumer privacy protections, rules should be consistent across the broadband economy," he said. "Today’s proposal falls short by espousing tentative conclusions that are not in sync with the framework that has applied for years and is incorporated into a proposal presented to the commission by USTelecom and other major trade associations. The FCC’s proposed tentative conclusions, if adopted, will create a morass of regulations in the Internet privacy space and fail to provide a platform allowing consumers to count on privacy rules that are evenly applied across the Internet economy. We urge the commission to take the time to consider the systems at work in the larger Internet ecosystem that have supported so much innovation, and implement rules that are consistent with the Federal Trade Commission’s longstanding and effective approach to privacy that has applied across the Internet, including to broadband providers, for years.”

Larry Irving, former head of the National Telecommunications & Information Administration, saw some issues with the proposal.

"In today’s decision, the FCC starts on a path toward imposing new privacy requirements on broadband Internet Service Providers. At first glance, this rulemaking appears to advance consumer privacy interests on the Internet. Yet, on closer analysis, it may actually lead to greater consumer confusion," he said. "The Commission’s action will require it to create a new set of principles, regulations and interpretations, and will likely lead to increased litigation. It would have been better for the FCC to embrace the FTC’s existing effective and successful unified Internet privacy framework."

"[T]his is just one more instance of the Obama Administration's FCC seemingly relishing the opportunity to impose, without any sound justification, harsher, costlier regulations on Internet service providers than on Internet content providers like Google," said Free State Foundation President Randolph May. "The FCC's imposition of a sweeping opt-in requirement for ISPs that doesn't apply to big Internet content providers distorts competition. And in the end, the likely result of this bureaucratic overreach is that the nation's consumers will be harmed by a reduction in relevant information that will be made available to them."

But there were plaudits as well.

“Broadband service providers occupy a unique position in the Internet ecosystem," said Public Knowledge staff attorney Meredith Rose. "As gatekeepers to the Internet, they have, by their very nature, access to every bit of data that their customers send and receive online. And, as they move aggressively into advertising markets, they have every incentive to exploit their access to this data and remove all consumer agency in determining where and for what purpose their personal data is used. Without clear guidelines on how this data can be used, consumers face a very real threat of having personal data exposed, sold to third parties without their knowledge, or misused in other fashions.

“The FCC has rightly recognized the duty ISPs have to protect their customers’ privacy. The law is clear, and the FCC must adopt the strong protections obligated by Section 222 of the Communications Act.

“Consumers face real privacy harms from their ISPs. Earlier this month, the FCC levied a $1.3 million fine against Verizon over the company’s secret tracking of its customers. Other ISPs have programs that repackage and sell their users’ browsing histories to online marketers, even as most of their customers remain in the dark about what’s being done with their data."

CPNI rule fan Free Press signaled the FCC was going in the right direction.

“The FCC is asking the right questions in its call for comments," said Free Press policy counsel Gaurav Laroia. "An effective framework must consider the issues of pay-for-privacy, deep-packet inspection, upselling services, competition and data security.

“Chairman Wheeler deserves credit for acknowledging the role that ISPs have as the gatekeepers to the Internet. By virtue of their position, ISPs have near-unfettered access to our Internet traffic, allowing them to build comprehensive profiles of their users by surveilling the websites they visit and tracking the services they use online. This is why Congress directed the FCC to take special care in protecting against use of this information without users’ affirmative consent.”

“The FCC plan is consistent with privacy rules that have long applied to phone providers,” said Linda Sherry, director of national priorities for Consumer Action. “Under law, your phone company can’t sell or share information with third parties about your phone activity without your consent. The notice of proposed rulemaking released today would require Internet providers to meet similar consumer privacy standards.”