Click here for Adobe Acrobat version
Click here for Microsoft Word version
********************************************************
NOTICE
********************************************************
This document was converted from Microsoft Word.
Content from the original version of the document such as
headers, footers, footnotes, endnotes, graphics, and page numbers
will not show up in this text version.
All text attributes such as bold, italic, underlining, etc. from the
original document will not show up in this text version.
Features of the original document layout such as
columns, tables, line and letter spacing, pagination, and margins
will not be preserved in the text version.
If you need the complete document, download the
Microsoft Word or Adobe Acrobat version.
*****************************************************************
Before the
Federal Communications Commission
Washington, D.C. 20554
)
)
)
In the Matter of ) File No. EB-06-TC-3543
Dialaround Enterprises Inc. ) NAL/Acct. No. 20083217 0003
Apparent Liability for Forfeiture ) FRN: 0004938064
)
)
)
NOTICE OF APPARENT LIABILITY FOR FORFEITURE
Adopted: November 29, 2007 Released: November 29, 2007
By the Chief, Enforcement Bureau:
I. INTRODUCTION
1. In this Notice of Apparent Liability for Forfeiture ("NAL"), we find
that Dialaround Enterprises Inc. ("Dialaround") apparently violated
section 64.2009(e) of the Commission's rules by failing to have a
corporate officer with personal knowledge execute an annual
certificate stating that the company has established operating
procedures adequate to ensure compliance with the Commission's rules
governing protection and use of customer proprietary network
information ("CPNI"). Protection of CPNI is a fundamental obligation
of all telecommunications carriers as provided by section 222 of the
Communications Act of 1934, as amended ("Communications Act" or
"Act"). Based upon our review of the facts and circumstances
surrounding this apparent violation and, in particular, the serious
consequences that may flow from inadequate concern for and protection
of CPNI, we propose a monetary forfeiture of $100,000 against
Dialaround for its apparent failure to comply with section 64.2009(e)
of the Commission's rules.
II. Background
2. The Enforcement Bureau ("Bureau") has been investigating the adequacy
of procedures implemented by telecommunications carriers to ensure
confidentiality of their subscribers' CPNI, based on concerns
regarding the apparent availability to third parties of sensitive,
personal subscriber information. For example, some companies, known as
"data brokers," have advertised the availability of records of
wireless subscribers' incoming and outgoing telephone calls for a fee.
Data brokers have also advertised the availability of call information
that related to certain landline toll calls.
3. As part of our inquiry into these issues, the Bureau sent a Letter of
Inquiry ("LOI") to Dialaround on November 20, 2006, directing it to
produce the compliance certificates for the previous five (5) years
that it had prepared pursuant to section 64.2009(e) of the
Commission's rules. On December 1, 2006, Dialaround submitted a
document in response to the Bureau's LOI, and a letter claiming that
Dialaround "does not have access to any CPNI," but that it filed its
certificate out of an abundance of caution. On February 12, 2007, the
Bureau sent a supplemental LOI to Dialaround directing it to answer
questions regarding its assertion that it does not have access to
CPNI. Dialaround submitted a response to the Bureau's supplemental LOI
on February 28, 2007, and supplemented that response on March 14,
2007. Dialaround's explanation regarding its access to CPNI is not
persuasive. The certification submitted by Dialaround does not satisfy
the requirements set forth in the rule. Accordingly, we issue this
proposed forfeiture.
III. Discussion
4. Section 222 imposes the general duty on all telecommunications
carriers to protect the confidentiality of their subscribers'
proprietary information. The Commission has issued rules implementing
section 222 of the Act. The Commission required carriers to establish
and maintain a system designed to ensure that carriers adequately
protected their subscribers' CPNI. Section 64.2009(e) is one such
requirement. Pursuant to section 64.2009(e):
A telecommunications carrier must have an officer, as an agent of the
carrier, sign a compliance certificate on an annual basis stating that the
officer has personal knowledge that the company has established operating
procedures that are adequate to ensure compliance with the rules in this
subpart. The carrier must provide a statement accompanying the certificate
explaining how its operating procedures ensure that it is or is not in
compliance with the rules in this subpart.
5. The Bureau's November 20, 2006 LOI directed Dialaround to produce the
company's compliance certificates for the previous five (5) years that
it had prepared in compliance with section 64.2009(e) of the
Commission's rules. On December 1, 2006, Dialaround submitted its
response. The response consists of a cover letter and a February 6,
2006 certification and explanatory letter. The certification produced
by Dialaround does not meet the requirements of our rule. In
particular, it does not contain a statement by an officer that
"[Dialaround] has established operating procedures that are adequate
to ensure compliance with the [CPNI] rules. . . ." Further, the
company does not provide a statement accompanying the certificate
explaining how its operating procedures ensure that it is or is not in
compliance with the CPNI rules. Accordingly, Dialaround's submission,
on its face, does not comply with section 64.2009(e) of the
Commission's rules. Further, Dialaround has not provided any
additional information in response to our request demonstrating that
it has otherwise complied with the Commission's CPNI rules by
preparing and maintaining a certificate that satisfies the
requirements of section 64.2009(e).
6. We conclude that Dialaround has apparently failed to comply with the
requirement that it have an officer certify on an annual basis that
Dialaround has established operating procedures adequate to ensure
compliance with the Commission's CPNI rules. For this apparent
violation, we propose a forfeiture.
IV. Forfeiture Amount
7. Section 503(b) of the Communications Act authorizes the Commission to
assess a forfeiture of up to $130,000 for each violation of the Act or
of any rule, regulation, or order issued by the Commission under the
Act. The Commission may assess this penalty if it determines that the
carrier's noncompliance is "willful or repeated." For a violation to
be willful, it need not be intentional. In exercising our forfeiture
authority, we are required to take into account "the nature,
circumstances, extent, and gravity of the violation and, with respect
to the violator, the degree of culpability, any history of prior
offenses, ability to pay, and such other matters as justice may
require." In addition, the Commission has established guidelines for
forfeiture amounts and, where there is no specific base amount for a
violation, retained discretion to set an amount on a case-by-case
basis.
8. The Commission's forfeiture guidelines do not address the specific
violation at issue in this proceeding. In determining the proper
forfeiture amount in this case, however, we are guided by the
principle that there may be no more important obligation on a
carrier's part than protection of its subscribers' proprietary
information. Consumers are increasingly concerned about the security
of their sensitive, personal data that they must entrust to their
various service providers, whether they are financial institutions or
telephone companies. Given the increasing concern about the security
of this data, and evidence that the data appears to be widely
available to third parties, we must take aggressive, substantial steps
to ensure that carriers implement necessary and adequate measures to
protect their subscribers' CPNI, as required by the Commission's
existing CPNI rules. Additionally, in three recent actions, the
Commission has issued Notices of Apparent Liability for Forfeiture in
the amount of $100,000 against carriers for failure to maintain
certifications in compliance with section 64.2009(e) of the
Commission's rules. In this case, Dialaround has apparently failed to
implement necessary and adequate measures, as required, to protect the
subscribers' CPNI data entrusted to it, as evidenced by the apparent
insufficiency of the required compliance certification. Based on all
the facts and circumstances present in this case, we believe the
proposed forfeiture of $100,000 is warranted.
9. Dialaround will have the opportunity to submit further evidence and
arguments in response to this NAL to show that no forfeiture should be
imposed or that some lesser amount should be assessed. For example,
Dialaround may present evidence that it has compelling financial
arguments to reduce the proposed forfeiture or that it has maintained
a history of overall compliance. To support a claim of inability to
pay, the petitioner must submit: (1) federal tax returns for the most
recent three-year period; (2) financial statements prepared according
to generally accepted accounting practices (GAAP); or (3) some other
reliable and objective documentation that accurately reflects the
petitioner's current financial status. Any claim of inability to pay
must specifically identify the basis for the claim by reference to the
financial documentation submitted. The Commission will fully consider
any such arguments made by Dialaround in its response to this NAL.
V. Conclusion and Ordering Clauses
10. We have determined that Dialaround Enterprises Inc. has apparently
violated Section 64.2009(e) of the Commission's rules by failing to
prepare and maintain a certification in compliance with the rule. We
find Dialaround Enterprises Inc. apparently liable for $100,000.
11. ACCORDINGLY, IT IS ORDERED THAT, pursuant to Section 503(b) of the
Communications Act of 1934, as amended, Section 1.80(f)(4) of the
Commission's rules, and authority delegated by Sections 0.111 and
0.311 of the Commission's rules, DIALAROUND ENTERPRISES INC. IS LIABLE
FOR A MONETARY FORFEITURE in the amount of one hundred thousand
dollars ($100,000) for willfully or repeatedly violating Section
64.2009 of the Commission's rules, by failing to prepare and maintain
a certificate that complies with 64.2009(e).
12. IT IS FURTHER ORDERED THAT, pursuant to section 1.80 of the
Commission's rules, within thirty days of the release date of this
NOTICE OF APPARENT LIABILITY, DIALAROUND ENTERPRISES INC. SHALL PAY
the full amount of the proposed forfeiture or SHALL FILE a written
statement seeking reduction or cancellation of the proposed
forfeiture.
13. Payment of the forfeiture must be made by check or similar instrument,
payable to the order of the Federal Communications Commission. The
payment must include the NAL/Acct. No. and FRN No. referenced above.
Payment by check or money order may be mailed to Forfeiture Collection
Section, Finance Branch, Federal Communications Commission, P.O. Box
358340, Pittsburgh, PA 15251. Payment by overnight mail may be sent to
Mellon Client Service Center, 500 Ross Street, Room 670, Pittsburgh,
PA 15262-0001. Attn: FCC Module Supervisor. Payment by wire transfer
may be made to ABA Number 043000261, receiving bank Mellon Bank, and
account number 911-6229. Please include your NAL/Acct. No. with your
wire transfer remittance. Requests for payment of the full amount of
this NAL under an installment plan should be sent to Chief, Credit and
Management Center, 445 12th Street, S.W., Washington, D.C. 20554.
14. IT IS FURTHER ORDERED that a copy of this Order shall be sent by
Certified Mail, Return Receipt Requested to Dialaround Enterprises
Inc. at its address of record.
FEDERAL COMMUNICATIONS COMMISSION
Kris A. Monteith
Chief, Enforcement Bureau
See 47 C.F.R. S:64.2009(e).
CPNI is defined as information that relates to the quantity, technical
configuration, type, destination, location, and amount of use of a
telecommunications service subscribed to by any customer of a
telecommunications carrier, and that is made available to the carrier by
the customer solely by virtue of the customer-carrier relationship. See 47
U.S.C. S: 222(h)(1)(A); 47 C.F.R. S: 64.2003(d).
See, e.g. http://www.epic.org/privacy/iei/.
See id.
Letter from Marcy Greene, Deputy Division Chief, Telecommunications
Consumers Division, Enforcement Bureau, Federal Communications Commission,
to Thomas D'Aurio, Vice President of Finance, Dialaround Enterprises Inc.
(November 20, 2006) ("LOI").
Letter from Thomas D'Aurio, Vice President of Finance, Dialaround
Enterprises Inc., to Marcy Greene, Deputy Division Chief,
Telecommunications Consumers Division, Enforcement Bureau, Federal
Communications Commission (December 1, 2006) ("response").
Letter from Marcy Greene, Deputy Division Chief, Telecommunications
Consumers Division, Enforcement Bureau, Federal Communications Commission,
to Thomas D'Aurio, Vice President of Finance, Dialaround Enterprises Inc.
(February 12, 2007) ("supplemental LOI").
Letter from Thomas D'Aurio, Vice President of Finance, Dialaround
Enterprises Inc., to Marcy Greene, Deputy Division Chief,
Telecommunications Consumers Division, Enforcement Bureau, Federal
Communications Commission (February 28, 2007) ("supplemental response").
Letter from Thomas D'Aurio, Vice President of Finance, Dialaround
Enterprises Inc., to Marcy Greene, Deputy Division Chief,
Telecommunications Consumers Division, Enforcement Bureau, Federal
Communications Commission (March 14, 2007) ("second supplemental
response").
Section 222 of the Communications Act provides that: "Every
telecommunications carrier has a duty to protect the confidentiality of
proprietary information of, and relating to, other telecommunications
carriers, equipment manufacturers, and customers, including
telecommunication carriers reselling telecommunications services provided
by a telecommunications carrier." 47 U.S.C S: 222.
In the Matter of Implementation of the Telecommunications Act of 1996:
Telecommunications Carriers' Use of Customer Proprietary Network
Information and Other Customer Information and Implementation of the
Non-Accounting Safeguards of Sections 271 and 272 of the Communications
Act of 1934, as amended, Order and Further Notice of Proposed Rulemaking,
13 FCC Rcd 8061 (1998) ("CPNI Order"); see also In the Matter of
Implementation of the Telecommunications Act of 1996: Telecommunications
Carriers' Use of Customer Proprietary Network Information and Other
Customer Information and Implementation of the Non-Accounting Safeguards
of Sections 271 and 272 of the Communications Act of 1934, as amended,
Order on Reconsideration and Petitions for Forbearance, 14 FCC Rcd 14409
(1999); In the Matter of Implementation of the Telecommunications Act of
1996: Telecommunications Carriers' Use of Customer Proprietary Network
Information and Other Customer Information and Implementation of the
Non-Accounting Safeguards of Sections 271 and 272 of the Communications
Act of 1934, as amended; 2000 Biennial Regulatory Review -- Review of
Policies and Rules Concerning Unauthorized Changes of Consumers' Long
Distance Carriers, Third Report and Order and Third Further Notice of
Proposed Rulemaking, 17 FCC Rcd 14860 (2002).
47 C.F.R. S: 64.2009(e).
47 C.F.R. S:64.2009(e).
47 C.F.R. S: 64.2009(e).
Section 503(b)(2)(B) provides for forfeitures against common carriers of
up to $130,000 for each violation or each day of a continuing violation up
to a maximum of $1,325,000 for each continuing violation. 47 U.S.C. S:
503(b)(2)(B). See Amendment of Section 1.80 of the Commission's Rules and
Adjustment of Forfeiture Maxima to Reflect Inflation, 15 FCC Rcd 18221
(2000); Amendment of Section 1.80 of the Commission's Rules and Adjustment
of Forfeiture Maxima to Reflect Inflation, 19 FCC Rcd 10945 (2004)
(increasing maximum forfeiture amounts to account for inflation).
47 U.S.C. S: 503(b)(1)(B) (the Commission has authority under this section
of the Act to assess a forfeiture penalty against a common carrier if the
Commission determines that the carrier has "willfully or repeatedly"
failed to comply with the provisions of the Act or with any rule,
regulation, or order issued by the Commission under the Act); see also 47
U.S.C. S: 503(b)(4)(A) (providing that the Commission must assess such
penalties through the use of a written notice of apparent liability or
notice of opportunity for hearing). Here, as described above, Dialaround's
actions were willful as it apparently failed to prepare the required
compliance certification.
Southern California Broadcasting Co., 6 FCC Rcd 4387 (1991).
See 47 U.S.C. S: 503(b)(2)(D); see also The Commission's Forfeiture Policy
Statement and Amendment of Section 1.80 of the Commission's Rules, 12 FCC
Rcd 17087 (1997) ("Forfeiture Policy Statement"); recon. denied, 15 FCC
Rcd 303 (1999).
Forfeiture Policy Statement, 12 FCC Rcd 17098-99, P: 22.
AT&T, Inc., Notice of Apparent Liability for Forfeiture, 21 FCC Rcd 751
(Enf. Bur. rel. Jan. 30, 2006); Alltel Corp., Notice of Apparent Liability
for Forfeiture, 21 FCC Rcd 746 (Enf. Bur. rel. Jan 30, 2006); Cbeyond
Communications LLC, Notice of Apparent Liability for Forfeiture, 21 FCC
Rcd 4316 (Enf. Bur. rel. April 21, 2006).
47 U.S.C. S: 503(b)(4)(A).
47 U.S.C. S: 503(b)(4)(C); 47 C.F.R. S: 1.80(f)(3).
47 C.F.R. S: 1.80(b)(4) (discussing factors the Commission or its designee
will consider in deciding appropriate forfeiture amount).
47 U.S.C. S: 503(b).
47 C.F.R. S: 1.80(f)(4).
47 C.F.R. S:S: 0.111, 0.311.
(...continued from previous page)
(continued....)
Federal Communications Commission DA 07-4776
2
2
Federal Communications Commission DA 07-4776