47 U.S.C. § 551 — Protection of subscriber privacy

(a) Notice and definitions.
(1) When a cable operator makes an agreement to provide cable or another service, and at least yearly afterward, it must give the subscriber a separate written notice that clearly and prominently explains—
(A) what personally identifiable information it collects or will collect and how it uses it;
(B) the nature, frequency, and purpose of possible disclosures, including the types of people who may receive the information;
(C) how long it will keep the information;
(D) when and where the subscriber may access it under subsection (d); and
(E) this section’s limits on collection and disclosure and the subscriber’s right under subsections (f) and (h) to enforce those limits. For subscribers who made the agreement before this section took effect, the notice was due within 180 days after that date and at least yearly afterward.
(2) Except in subsection (h)—
(A) “personally identifiable information” does not include aggregate data that does not identify particular people. This section does not otherwise define that term;
(B) “other service” includes wire or radio communications service provided through a cable operator’s facilities used to provide cable service^*; and
(C) “cable operator” also includes a person^* who is owned or controlled by, or under common ownership or control with, a cable operator and provides wire or radio communications service.
(b) Collection.
(1) Unless paragraph (2) applies, a cable operator may not use its cable system^* to collect a subscriber’s personally identifiable information without that subscriber’s prior written or electronic consent.
(2) The operator may collect it to obtain information needed to provide the subscriber’s cable or other service, or to detect unauthorized reception of cable communications.
(c) Disclosure.
(1) Unless paragraph (2) applies, a cable operator may not disclose a subscriber’s personally identifiable information without prior written or electronic consent. It must also take needed steps to prevent unauthorized access by anyone other than the subscriber or operator.
(2) Disclosure is allowed when—
(A) needed to provide, or conduct a legitimate business activity related to, the subscriber’s service;
(B) subject to subsection (h), made under a court order, if the person directed by the order tells the subscriber about it;
(C) it consists of subscriber names and addresses, if the operator gave the subscriber a chance to prohibit or limit disclosure and the disclosure does not reveal, directly or indirectly, how much the subscriber viewed or used a service or the nature of a transaction over the system; or
(D) it is to a government entity as authorized by chapters 119, 121, or 206 of title 18, except it may not include records showing the subscriber’s choice of video programming^* from the operator.
(d) Subscriber access.—A cable subscriber must be allowed to see all personally identifiable information about that subscriber collected and kept by the operator, at reasonable times and a convenient place designated by the operator. The subscriber must have a reasonable chance to correct an error.
(e) Destruction.—The operator must destroy the information when it is no longer needed for the purpose collected and there is no pending access request or access order under subsection (d) or a court order.
(f) Civil action and damages.
(1) Anyone harmed by an operator’s violation may sue in a United States^* district court.
(2) The court may award actual damages, but at least liquidated damages of $100 for each day of violation or $1,000, whichever is greater; punitive damages; and reasonable attorney fees and other reasonably incurred litigation costs.
(3) This remedy is in addition to any other lawful remedy available to a subscriber.
(g) State^* regulation.—This subchapter does not prohibit a State or franchising authority^* from enacting or enforcing laws consistent with this section to protect subscriber privacy.
(h) Government access under a court order.—Except as provided in subsection (c)(2)(D), a government entity may obtain a cable subscriber’s personally identifiable information under a court order only if, in the related court proceeding—
(1) it offers clear and convincing evidence that the subject is reasonably suspected of criminal activity and that the information sought would be material evidence in the case; and
(2) the subject gets an opportunity to appear and challenge the entity’s claim.