The Federal Communications Commission has confirmed a proposal on privacy guidelines for broadband providers on how to handle customer information. The proposal distinguishes between three ways of using a customer's personal data. A certain amount of data may be used by the ISP following assumed consent in the contract for broadband services. This includes the data necessary to provide broadband services and for marketing the type of service purchased by a customer, as well as public safety.
Broadband providers would also be allowed to use customer data for marketing other communications-related services and to share customer data with their affiliates if the subscribers don't opt out of this form of sharing. Finally, opt-in would be required for all other uses and sharing of consumer data, requiring express consent from customers.
The FCC proposal also wants ISPs to provide customers with "clear, conspicuous and persistent notice" about what information they collect, use and share with third parties, and how customers can change their privacy preferences. They would also be required to adopt risk management practices, institute personnel training practices, implement strong customer authentication requirements, identify a senior manager responsible for data security and take responsibility for use and protection of customer information when shared with third parties. In the event of a data breach, ISPs must inform consumers and law enforcement of failures to protect such information.
The proposal will be open for public comment before a final vote by the FCC. It met with resistance from industry groups, who say the regulator is taking a too prescriptive approach. The mobile group CTIA said the FCC's rules would make it more complicated for customers to manage their personal data. The group prefers the FTC privacy model, which apples to all internet companies rather than just ISPs. USTelecom also accused the FCC of creating confusion, by not building on the existing privacy framework and proposals from industry. It also backs the FTC approach and rules that apply to the entire internet sector.
