article: SECTION 1. SHORT TITLE; TABLE OF CONTENTS. (a) Short Title.--This Act may be cited as the ``Protecting Consumer Phone Records Act''. (b) Table of Contents.--The table of contents for this Act is as follows: Sec. 1. Short title; table of contents. Sec. 2. Unauthorized acquisition, use, or sale of confidential customer proprietary network telephone information. Sec. 3. Enhanced confidentiality procedures. Sec. 4. Penalties; extension of confidentiality requirements to other entities. Sec. 5. Enforcement by Federal Trade Commission. Sec. 6. Concurrent enforcement by Federal Communications Commission. Sec. 7. Enforcement by States. Sec. 8. Preemption of State law. Sec. 9. Consumer outreach and education. SEC. 2. UNAUTHORIZED ACQUISITION, USE, OR SALE OF CONFIDENTIAL CUSTOMER PROPRIETARY NETWORK TELEPHONE INFORMATION. (a) In General.--It is unlawful for any person-- (1) to acquire or use the customer proprietary network information of another person without that person's affirmative written consent, which shall include electronic consent that meets the requirements of the Electronic Signatures in Global and National Commerce Act (15 U.S.C. 7001 et seq.); (2) to misrepresent that another person has consented to the acquisition or use of such other person's customer proprietary network information in order to acquire such information; (3) to obtain unauthorized access to the data processing system or records of a telecommunications carrier or an IP- enabled voice service provider in order to acquire the customer proprietary network information of 1 or more other persons; (4) to sell, or offer for sale, customer proprietary network information; or (5) to request that another person obtain customer proprietary network information from a telecommunications carrier or IP-enabled voice service provider, knowing that the other person will obtain the information from such carrier or provider in any manner that is unlawful under this subsection. (b) Exceptions.-- (1) Application with section 222 of communications act of 1934.--Subsection (a) does not prohibit a telecommunications carrier or an IP-enabled voice service provider or any third party that lawfully obtains customer proprietary network information from a carrier or provider from engaging in any act or practice that was not prohibited by section 222 of the Communications Act of 1934 (47 U.S.C. 222) or regulations that are consistent with the provisions of section 222, as that section and those regulations were in effect on the day before the date of enactment of this Act. (2) Application of other laws.--This Act does not prohibit any act or practice otherwise authorized by law, including any lawfully authorized investigative, protective, or intelligence activity of a law enforcement agency or the United States, a State, or a political subdivision of a State, or an intelligence agency of the United States. (3) Treatment of ip-enabled voice service providers.-- Notwithstanding any other provision of this section, an IP- enabled voice service provider may engage in any act or practice with respect to customer proprietary network information in which a telecommunications carrier may engage under paragraph (1) of this subsection. (4) Caller id.--Nothing in this Act prohibits the use of caller identification services by any person to identify the originator of telephone calls received by that person. (c) Private Right of Action for Providers.-- (1) In general.--A telecommunications carrier or IP-enabled voice service provider may bring a civil action in an appropriate State court, or in any United States district court that meets applicable requirements relating to venue under section 1391 of title 28, United States Code, or for any judicial district in which the carrier or service provider resides or conducts business-- (A) based on a violation of this section or the regulations prescribed under this section to enjoin such violation; (B) to recover for actual monetary loss from such a violation, or to receive $11,000 in damages for each such violation, whichever is greater; or (C) both. (2) Treble damages.--If the court finds that the defendant willfully or knowingly violated this section or the regulations prescribed under this section, the court may, in its discretion, increase the amount of the award to an amount equal to not more than 3 times the amount available under paragraph (1) of this subsection. (3) Inflation adjustment.--The $11,000 amount in paragraph (1)(B) shall be adjusted for inflation as if it were a civil monetary penalty, as defined in section 3(2) of the Federal Civil Penalties Inflation Adjustment Act of 1996 (28 U.S.C. 2461 note). (d) Private Right of Action for Consumers.-- (1) In general.--An individual who has been injured as a direct result of his or her confidential proprietary network information being obtained, used, or sold in violation of this section may file a civil action in any court of competent jurisdiction against the person who caused the injury by violating this section. (2) Remedies.--A court in which such civil action has been brought may award damages of not more than $11,000 for each violation of this section with respect to the plaintiff's customer proprietary network information. (3) Treble damages.--If the court finds that the defendant willfully or knowingly violated this section or the regulations prescribed under this section, the court may, in its discretion, increase the amount of the award to not more than 3 times the damages determined by the court under paragraph (2). (4) Inflation adjustment.--The $11,000 amount in paragraph (2) shall be adjusted for inflation as if it were a civil monetary penalty, as defined in section 3(2) of the Federal Civil Penalties Inflation Adjustment Act of 1996 (28 U.S.C. 2461 note). (e) Civil Penalty.-- (1) In general.--Any person who violates this section shall be subject to a civil penalty of not more than $11,000 for each violation or each day of a continuing violation, except that the amount assessed for any continuing violation shall not exceed a total of $11,000,000 for any single act or failure to act. (2) Separate violations.--A violation of this section with respect to the customer proprietary network information of 1 person shall be treated as a separate violation from a violation with respect to the customer proprietary network information of any other person. (f) Limitation.--Nothing in this Act or section 222 of the Communications Act of 1934 (47 U.S.C. 222) authorizes a customer to bring a civil action against a telecommunications carrier or an IP- enabled voice service provider. (g) Definitions.--In this section: (1) Customer proprietary network information.--The term ``customer proprietary network information'' has the meaning given that term by-- (A) section 222(i)(1) of the Communications Act of 1934 (47 U.S.C. 222(i)(1)) with respect to telecommunications carriers; and (B) section 715(b)(1) of such Act with respect to IP-enabled voice service providers. (2) IP-enabled voice service.--The term ``IP-enabled voice service'' means the provision of real-time 2-way voice communications offered to the public, or such classes of users as to be effectively available to the public, transmitted through customer premises equipment using TCP/IP protocol, or a successor protocol, for a fee (whether part of a bundle of services or separately) with interconnection capability such that the service can originate traffic to, or terminate traffic from, the public switched telephone network. (3) Telecommunications carrier.--The term ``telecommunications carrier'' has the meaning given it by section 3(44) of the Communications Act of 1934 (47 U.S.C. 3(44)). SEC. 3. ENHANCED CONFIDENTIALITY PROCEDURES. (a) In General.--Within 180 days after the date of enactment of this Act, the Federal Communications Commission shall-- (1) revise or supplement its regulations, to the extent the Commission determines it is necessary, to require a telecommunications carrier or IP-enabled voice service provider to protect-- (A) the security and confidentiality of customer proprietary network information (as defined in section 222(i)(1) of the Communications Act of 1934 (47 U.S.C. 222(i)(1)) or as defined in section 715(b)(1) of such Act with respect to IP-enabled voice service providers); (B) customer proprietary network information against any anticipated threats or hazards to its security or confidentiality; and (C) customer proprietary network information from unauthorized access or use that could result in substantial harm or inconvenience to its customers; and (2) ensure that any revised or supplemental regulations are similar in scope and structure to the Federal Trade Commission's regulations in part 314 of title 16, Code of Federal Regulations, as such regulations are in effect on the date of enactment of this Act, taking into consideration the differences between financial information and customer proprietary network information. (b) Compliance Certification.--Each telecommunications carrier and IP-enabled voice service provider to which the regulations under subsection (a) and section 222 or 715 of the Communications Act of 1934 apply shall file with the Commission annually a certification that, for the period covered by the filing, it has been in compliance with those requirements. SEC. 4. PENALTIES; EXTENSION OF CONFIDENTIALITY REQUIREMENTS TO OTHER ENTITIES. (a) Penalties.--Title V of the Communications Act of 1934 (47 U.S.C. 501 et seq.) is amended by inserting after section 508 the following: ``SEC. 509. PENALTIES FOR CONFIDENTIAL CUSTOMER PROPRIETARY NETWORK INFORMATION VIOLATIONS. ``(a) Civil Forfeiture.-- ``(1) In general.--Any person determined by the Commission, in accordance with paragraphs (3) and (4) of section 503(b), to have violated section 2 of the Protecting Consumer Phone Records Act shall be liable to the United States for a forfeiture penalty. A forfeiture penalty under this subsection shall be in addition to any other penalty provided for by this Act. The amount of the forfeiture penalty determined under this subsection shall not exceed $30,000 for each violation, or 3 times that amount for each day of a continuing violation, except that the amount assessed for any continuing violation shall not exceed a total of $3,000,000 for any single act or failure to act. ``(2) Recovery.--Any forfeiture penalty determined under paragraph (1) shall be recoverable pursuant to section 504(a) of this Act. ``(3) Procedure.--No forfeiture liability shall be determined under paragraph (1) against any person unless such person receives the notice required by section 503(b)(3) or section 503(b)(4) of this Act. ``(4) 2-year statute of limitations.--No forfeiture penalty shall be determined or imposed against any person under paragraph (1) if the violation charged occurred more than 2 years prior to the date of issuance of the required notice or notice or apparent liability.''. (b) Extension of Confidentiality Requirements to IP-Enabled Voice Service Providers.-- (1) In general.--Title VII of the Communications Act of 1934 (47 U.S.C. 601 et seq.) is amended by adding at the end thereof the following: ``SEC. 715. PROTECTION OF CUSTOMER PROPRIETARY NETWORK INFORMATION BY IP-ENABLED VOICE SERVICE PROVIDERS. ``(a) In General.-- ``(1) General duty of confidentiality.--An IP-enabled voice service provider has a duty to protect the confidentiality of proprietary information of, and relating to, other IP-enabled voice service providers, telecommunications carriers, equipment manufacturers, and customers, including telecommunications carriers reselling telecommunications services provided by another telecommunications carrier or an IP-enabled voice service provider. ``(2) Carrier information.--An IP-enabled voice service provider that receives or obtains proprietary information from a telecommunications carrier or another IP-enabled voice service provider for purposes of providing any telecommunications service shall use such information only for such purpose, and shall not use such information for its own marketing efforts. ``(3) Customer proprietary network information.--Within 90 days after the date of enactment of the Protecting Consumer Phone Records Act, the Commission shall initiate a rulemaking proceeding to apply the requirements of section 222, and regulations thereunder, to IP-enabled voice service providers to the same extent, in the same manner, and subject to the same penalties for failure to comply with those requirements as are applicable to telecommunications carriers. ``(b) Definitions.--In this section: ``(1) Customer proprietary network information.--The term `customer proprietary network information' has the meaning given that term by section 222(i) of this Act, except that-- ``(A) the reference in section 222(i)(1)(B) of this Act to telephone exchange service or telephone toll service shall be considered to refer also to IP-enabled voice service; and ``(B) it does not include information that is related to non-voice service features bundled with IP- enabled voice service. ``(2) IP-enabled voice service.--The term ``IP-enabled voice service'' means the provision of real-time 2-way voice communications offered to the public, or such classes of users as to be effectively available to the public, transmitted through customer premises equipment using IP protocol, or a successor protocol, for a fee (whether part of a bundle of services or separately) with interconnection capability such that the service can originate traffic to, or terminate traffic from, the public switched telephone network. ``(3) Other terms.--Except as provided in paragraph (1), any term used in subsection (a) that is defined or used in section 222 of this Act has the same meaning as when used in that section.''. (2) Duty of telecommunications carriers with respect to cpni from ip-enabled voice service providers.--Section 222(a) of the Communications Act of 1934 (47 U.S.C. 222(a)) is amended by inserting after ``carrier.'' the following: ``A telecommunications carrier has the same duties under this section with respect to the confidentiality of proprietary information of, or relating to, an IP-enabled voice service provider, and with respect to customer proprietary network information received or obtained from an IP-enabled voice service provider, as it has under this section with respect to another telecommunications carrier.''. (c) Telecommunications Carrier Notification Requirement.--Section 222 of the Communications Act of 1934 (47 U.S.C. 222), is amended-- (1) by redesignating subsection (h) as subsection (i); (2) by inserting after subsection (g) the following new subsection: ``(h) Notice of Violations.-- ``(1) In general.--The Commission shall by regulation require each telecommunications carrier to notify a customer within 14 calendar days after the carrier or provider is notified of, or becomes aware of, an incident in which customer proprietary network information relating to such customer was disclosed to someone other than the customer in violation of this section or section 2 of the Protecting Consumer Phone Records Act. ``(2) Law enforcement and homeland security related delays.--Notwithstanding paragraph (1), a telecommunications carrier may delay the required notification for a reasonable period of time if-- ``(A) a Federal or State law enforcement agency determines that giving notice within the 14-day period would materially impede a civil or criminal investigation; or ``(B) a Federal national security agency or the Department of Homeland Security determines that giv
summary: Protecting Consumer Phone Records Act - Makes it unlawful to: (1) acquire or use customer proprietary network information without written consent; (2) represent that another person has consented in order to acquire such information; (3) obtain unauthorized access to certain systems or records in order to acquire such information; (4) sell or offer for sale such information; or (5) request that another person unlawfully obtain such information. Amends the Communications Act of 1934 to provide for a civil forfeiture penalty for violation of this Act. Imposes on IP-enabled voice service providers a duty to protect the confidentiality of specified proprietary information. Requires the Federal Communications Commission (FCC) to require each telecommunications carrier to notify customers of unlawful disclosure of such information. Prohibits a commercial mobile services provider from providing any customer's wireless telephone number information to any wireless directory assistance service without express prior customer authorization. Requires de-listing on customer request without cost to the customer. Prohibits providers from publishing the information without such authorization. Prohibits fees for exercising these rights. Preempts any inconsistent state or local requirements. Requires that violations of certain provisions of this Act be enforced by the Federal Trade Commission (FTC) and treated as unfair or deceptive acts or practices. Gives the FCC concurrent enforcement jurisdiction. Provides for enforcement by states and preemption of state law. Requires public education about the protection afforded such information.