T-Mobile is committed to protecting the privacy and security of our customers’ personal information and, as set forth in our Privacy Statement, we strive to be a leader in protecting all such personal information. In today’s data-centric world, most consumers are familiar with the sensitivity and potential for misuse of information such as social security numbers, credit card numbers, and even demographic information.
As a telecommunications company, however, T-Mobile has access to a unique and highly-regulated form of personal information – known as Customer Proprietary Network Information, or "CPNI.” Despite its complex-sounding name, CPNI is simply the information generated in connection with the telecommunications services we provide to our customers. It includes, for example, call details (the phone numbers you call and the numbers calling you, the call times and dates, etc.) and certain information about customer rate plans and features. (CPNI does not include customers’ names, addresses, or cell phone numbers – although we certainly treat that information with care under our general privacy and security promises.)
For most customers (as well as “authorized users” – which a customer may designate to access and manage the customer’s account information), the most sensitive CPNI is the detailed records of whom they have called or from whom they have received calls. This “call detail” information may be of interest to people who know the customer or even to complete strangers. For example, a jealous boyfriend might be curious about who his girlfriend is talking to – and therefore might want to obtain the girlfriend’s call details. Similarly, a person might wish to obtain call records related to a business competitor in order to know whether the competitor is nearing a deal with a specific supplier.
Although federal law has long-required telecommunications carriers to protect CPNI, in an Order released on April 2, 2007, the Federal Communications Commission (“FCC”) issued revised and expanded CPNI rules in response to several high-profile incidents involving the activities of “data brokers” and “pretexters” who attempt to obtain unauthorized access to such information. These rules became effective December 8, 2007 and T-Mobile has implemented policies and safeguard procedures to help ensure compliance. T-Mobile continually reviews its compliance with such rules and annually certifies compliance to the FCC.
Highlights of FCC’s rules and T-Mobile’s policies
Carriers are prohibited from releasing call detail information to customers during customer-initiated telephone contacts, except when the customer has previously established a password for their account. Otherwise, carriers cannot release call detail information except by sending it to an address of record or by calling the customer at the telephone number of record.
- With the exception of T-Mobile Puerto Rico, T-Mobile does not disclose call details over the telephone in response to customer-initiated telephone contacts. (T-Mobile Puerto Rico may disclose call detail over the telephone in response to a customer-initiated telephone contact, but only after verifying the customer’s account password and a one-time-use Personal Identification Number or “PIN” sent to the customer’s handset via SMS text message during the call.) T-Mobile allows customers the option to establish account passwords for use in connection with calls to customer care, but first verifies the customer’s (or authorized user’s) identity through the use of a randomly-generated PIN delivered via SMS text message.
Carriers must provide mandatory password protection for online account access.
- T-Mobile provides online account access to CPNI only with a password that is initially established through use of a randomly-generated PIN delivered to the customer via SMS text message. For multi-line accounts, the customer may designate himself/herself as the primary account holder, which gives that person access to online account information for all the devices on the account. (This is the equivalent of the customer receiving the bill in the mail that contains the detailed usage information for all lines on the account.) Other users may access detailed online account information related only to their respective device (for example, if a parent provides a device to their child, the child may access online information about that device – including CPNI). The primary account holder, however, may designate additional or more limited online access rights for other users.
Carriers may provide CPNI to customers in a retail location with a valid government issued photo ID.
- T-Mobile generally requires a valid government-issued photo ID matching the customer or authorized user’s account information prior to disclosing CPNI during a visit to a retail store. T-Mobile utilizes a customer-established PIN for authentication of pre-paid accounts at retail locations.
Carriers must notify their customers when a password, address, and certain other account changes occur.
- T-Mobile’s policy is to mail a notice to the customer’s address of record or send an SMS message to the customer’s number of record whenever, among other changes, a password, customer response to a back-up means of authentication for lost or forgotten password, online account, or address of record is created or changed. Any mailed notice is sent only to an address that has been associated with the customer’s account for at least 30 days (except for accounts activated within the last 30 days, in which case the notice is sent to the address provided at account activation). Any such notice does not include or reveal the changed information.
Carriers must establish a notification process for both law enforcement and customers in the event of a CPNI breach. Specifically, carriers must notify the United States Secret Service (“USSS”) and the Federal Bureau of Investigation (“FBI”) after discovering a breach of CPNI.
- T-Mobile’s policy is to notify law enforcement as soon as practicable, but in no event later than seven (7) business days, after a reasonable determination has been made that a breach of its customer’s CPNI has occurred. Similarly, T-Mobile’s policy is to notify customers of the breach no sooner than the eighth business day following completion of the notice to law enforcement unless directed by the U.S. Secret Service or the FBI not to so disclose or notify customers. T-Mobile may extend the period for customer notification pursuant to a written request of a relevant law enforcement agency.
T-Mobile is committed to the protection of its customers’ CPNI and full compliance with the FCC’s CPNI rules. Questions and/or concerns may be directed to firstname.lastname@example.org. A copy of the FCC’s Final Order dated April 2, 2007, is available at:http://hraunfoss.fcc.gov/edocs_public/attachmatch/FCC-07-22A1.pdf.