I just ran across the judgment for an interesting case involving privacy and opt-in consent for disclosing personally identifiable information (PII)…
“NATIONAL CABLE & TELECOMMUNICATIONS ASSOCIATION, PETITIONER v. FEDERAL COMMUNICATIONS COMMISSION AND UNITED STATES OF AMERICA, RESPONDENTS QWEST COMMUNICATIONS INTERNATIONAL INC. AND VERIZON, INTERVENORS”
Basically the District of Columbia Circuit upheld a Federal Communications Commission rule requiring phone carriers to obtain prior opt-in consent from customers before disclosing their PII to partners or independent contractors for marketing purposes
Funny how the telecommunications companies seemed to think that once they had customer PII they should be able share it anyway they chose to under the guise of free speech and the First Amendment.
Of course the NCTA was not happy with the decision.
Here are some good points from a couple of excerpts from the ruling:
“[C]ommon sense supports the commission’s determination that the risk of unauthorized disclosure of customer information increases with the number of entities possessing it,” the court said. “The commission therefore reasonably concluded that an opt-in consent requirement directly and materially advanced the interests in protecting customer privacy and in ensuring customer control over the information.”
“Evidence of abuses between pipelines and marketing affiliates, being different in kind from the abuses that would occur with non-marketing affiliates, could not justify a regulation imposed on those non-marketing affiliate relationships. Id. at 842. In contrast, here the governmental interest and potential harms are the same for customer information in the hands of carriers, affiliates, or third-party marketing partners. The Commission explained that customer information could be illegally obtained by the same methods from any organization, regardless of the nature of the entity.”
Tags: awareness and training, Information Security, IT compliance, IT training, policies and procedures, privacy training, risk management, security training, third party security