Why privacy pros should care about the FCC’s broadband privacy rules

[Commentary]

1. Under Travis LeBlanc’s leadership, the Federal Communications Commission’s Enforcement Bureau has been very aggressive in bringing enforcement actions involving privacy and data security and obtaining settlements in the tens of millions of dollars. The new privacy Notice of Proposed Rulemaking would significantly expand the scope of FCC enforcement authority so that it reached a wide range of Internet service provider customer data as well as Internet advertising involving customer data obtained directly by ISPs. Although the FCC would likely bring enforcement actions against the ISP only, in response to this heightened risk, ISPs would likely impose strict privacy and security requirements on vendors who have access to Internet access provider customer data. The requirements would likely include indemnification obligations for violations attributable to the vendor and proof of sufficient insurance coverage from vendors to hold the ISP harmless for those violations.
2. The proposal would place heavy importance on providing rapid notice of any form of unauthorized or excessive access to routine customer information that is not sensitive.
3. Use of ISP customer data would be a complex and risky activity. These data would need to be coded and treated very differently to ensure compliance and audit logging would need to be put in place for all these data, regardless of their sensitivity.
4. The proposal would likely create consumer confusion and significantly lengthen and complicate privacy notices. Consumers are unlikely to understand if asked to consent to ISP uses of information that the consumer choices apply only to the ISP and would have no bearing on use of consumer data elsewhere in the Internet ecosystem.
5. The proposal would further complicate the stove-piped landscape of U.S. privacy regulation and add a fourth, highly specific layer of regulation to ISP customer data over and above the FTC privacy framework, ECPA, COPPA, state ISP and online privacy laws, and the privacy provisions of the cable and satellite portions of the Communications Act already regulate.
6. By significantly expanding privacy, breach notice and security regulation in this area, the proposal would set a precedent that would likely be invoked at the state and federal level to call for more extensive breach notice, information security and privacy requirements, creating further uncertainty and potential regulatory complexity.
7. And there is some risk that complex privacy and security requirements, coupled with significant potential enforcement risk may discourage broadband investment in less profitable areas.

[Halpert is a partner in the Communications, Electronic Commerce & Privacy Practice of DLA Piper U.S. LLP]