47 U.S.C. § 222 — Privacy of customer information

This section requires telephone and telecommunications companies ("carriers") to protect the privacy of certain information. (a) In general. Every telecommunications carrier must protect the confidentiality of private information belonging to other carriers, equipment makers, and customers. This includes carriers that resell another carrier's telecommunications services. (b) Confidentiality of carrier information. If a carrier receives private information from another carrier in order to provide a telecommunications service, it can only use that information for that purpose. It cannot use the information for its own marketing. (c) Confidentiality of customer proprietary network information. (1) A carrier that gets "customer proprietary network information" (CPNI) by providing service to a customer can only use, share, or allow access to that customer's identifiable CPNI for two purposes: (A) providing the telecommunications service the information came from, or (B) services needed for, or used in, providing that service, including publishing phone directories. The carrier may go beyond this only if the law requires it or the customer approves. (2) If a customer makes a written request, the carrier must share that customer's CPNI with any person the customer names. (3) A carrier may use, share, or allow access to "aggregate" customer information (information with individual identities removed) for purposes beyond what paragraph (1) allows. But a local exchange carrier can only do this if it also offers that same aggregate information to other carriers or people, on reasonable terms, when they reasonably ask for it. (d) Exceptions. A carrier is still allowed to use, share, or give access to CPNI gotten from its own customers, directly or through its agents, in these situations: (1) To start, provide, bill for, and collect payment for telecommunications services. (2) To protect the carrier's own rights or property, or to protect customers and other carriers from fraud, abuse, or unlawful use of services. (3) To provide telemarketing calls that come in from the customer, or referral or administrative services, during that same call — but only if the customer started the call and agreed to this use. (4) To provide call-location information about a user of mobile phone service or IP-based voice service, when needed for emergencies: (A) to a 911 center, emergency medical or fire service, police, or a hospital emergency or trauma unit, to respond to that user's call for help; (B) to inform the user's legal guardian or immediate family of the user's location, if the emergency involves risk of death or serious injury; or (C) to a company that manages databases solely to help deliver emergency services. (e) Subscriber list information. Even with the limits in subsections (b), (c), and (d), a carrier that provides regular telephone service must supply "subscriber list information" (used for phone directories) to anyone who asks, for the purpose of publishing directories in any format. This must be timely, cannot be bundled with other products, and must be offered under fair, nondiscriminatory rates and terms. (f) Authority to use location information. Under subsection (c)(1), a customer is not considered to have approved use, sharing, or access to two specific kinds of information unless the customer gave clear, advance, express permission: (1) Call-location information for mobile phone or IP-voice users, except as allowed under subsection (d)(4); or (2) Information from an automatic crash-notification system, except to run that system. (g) Subscriber listed and unlisted information for emergency services. Even with the limits in subsections (b), (c), and (d), a carrier providing regular telephone service — or a provider of IP-based voice service — must supply certain listed and unlisted subscriber information it possesses or controls (including about other carriers' subscribers) to emergency-service and emergency-support providers. This must be timely, not bundled, and offered under fair, nondiscriminatory rates and terms, and it can only be used to deliver or help deliver emergency services. (h) Definitions. (1) "Customer proprietary network information" (CPNI) means: (A) information about the quantity, technical setup, type, destination, location, and amount of a customer's use of a telecommunications service, that the carrier gets only because of its relationship with the customer; and (B) information in the customer's phone bills, whether for local or long-distance service. It does not include subscriber list information. (2) "Aggregate customer information" means data covering a group of services or customers, with individual identities and traits removed. (3) "Subscriber list information" means information identifying subscribers' listed names along with their phone numbers, addresses, or business categories (as assigned when service began), or any combination of these — but only if the carrier or its affiliate has published it, or accepted it for publication, in some kind of directory. (4) "Public safety answering point" means a facility set up to receive emergency calls and send them to emergency responders. (5) "Emergency services" means 911 emergency services and emergency notification services. (6) "Emergency notification services" means services that warn the public about an emergency. (7) "Emergency support services" means database-management services that support emergency services.