§ 64.5108   Notice required for use of customer proprietary network
information.

   (a) Notification, generally. (1) Prior to any solicitation for customer
   approval to use, disclose, or permit access to CPNI, a TRS provider
   shall provide notification to the customer of the customer's right to
   deny or restrict use of, disclosure of, and access to that customer's
   CPNI.

   (2) A TRS provider shall maintain records of notification, whether
   oral, written, electronic, or sign language, during the time period
   that the approval is in effect and for at least one year thereafter.

   (b) Individual notice. A TRS provider shall provide individual notice
   to customers when soliciting approval to use, disclose, or permit
   access to customers' CPNI.

   (c) Content of notice. Customer notification shall provide sufficient
   information in clear and unambiguous language to enable the customer to
   make an informed decision as to whether to permit a TRS provider to
   use, disclose, or permit access to, the customer's CPNI.

   (1) The notification shall state that the customer has a right to deny
   any TRS provider the right to use, disclose or permit access to the
   customer's CPNI, and the TRS provider has a duty, under federal law, to
   honor the customer's right and to protect the confidentiality of CPNI.

   (2) The notification shall specify the types of information that
   constitute CPNI and the specific entities that will use, receive or
   have access to the CPNI, describe the purposes for which CPNI will be
   used, and inform the customer of his or her right to disapprove those
   uses, and deny or withdraw the customer's consent to use, disclose, or
   permit access to access to CPNI at any time.

   (3) The notification shall advise the customer of the precise steps the
   customer must take in order to grant or deny use, disclosure, or access
   to CPNI, and must clearly state that customer denial of approval will
   not affect the TRS provider's provision of any services to the
   customer. However, TRS providers may provide a brief statement, in
   clear and neutral language, describing consequences directly resulting
   from the lack of access to CPNI.

   (4) TRS providers shall provide the notification in a manner that is
   accessible to the customer, comprehensible, and not misleading.

   (5) If the TRS provider provides written notification to the customer,
   the notice shall be clearly legible, use sufficiently large type, and
   be placed in an area so as to be readily apparent to a customer.

   (6) If any portion of a notification is translated into another
   language, then all portions of the notification must be translated into
   that language.

   (7) A TRS provider may state in the notification that the customer's
   approval to use CPNI may enhance the TRS provider's ability to offer
   products and services tailored to the customer's needs. A TRS provider
   also may state in the notification that it may be compelled to disclose
   CPNI to any person upon affirmative written request by the customer.

   (8) The notification shall state that any approval or denial of
   approval for the use of CPNI outside of the service for which the TRS
   provider is the default provider for the customer is valid until the
   customer affirmatively revokes or limits such approval or denial.

   (9) A TRS provider's solicitation for approval to use, disclose, or
   have access to the customer's CPNI must be proximate to the
   notification of a customer's CPNI rights to non-disclosure.

   (d) Notice requirements specific to opt-out. A TRS provider shall
   provide notification to obtain opt-out approval through electronic or
   written methods, but not by oral or sign language communication (except
   as provided in paragraph (f) of this section). The contents of any such
   notification shall comply with the requirements of paragraph (c) of
   this section.

   (1) TRS providers shall wait a 30-day minimum period of time after
   giving customers notice and an opportunity to opt-out before assuming
   customer approval to use, disclose, or permit access to CPNI. A TRS
   provider may, in its discretion, provide for a longer period. TRS
   providers shall notify customers as to the applicable waiting period
   for a response before approval is assumed.

   (i) In the case of an electronic form of notification, the waiting
   period shall begin to run from the date on which the notification was
   sent; and

   (ii) In the case of notification by mail, the waiting period shall
   begin to run on the third day following the date that the notification
   was mailed.

   (2) TRS providers using the opt-out mechanism shall provide notices to
   their customers every two years.

   (3) TRS providers that use email to provide opt-out notices shall
   comply with the following requirements in addition to the requirements
   generally applicable to notification:

   (i) TRS providers shall obtain express, verifiable, prior approval from
   consumers to send notices via email regarding their service in general,
   or CPNI in particular;

   (ii) TRS providers shall either:

   (A) Allow customers to reply directly to the email containing the CPNI
   notice in order to opt-out; or

   (B) Include within the email containing the CPNI notice a conspicuous
   link to a Web page that provides to the customer a readily usable
   opt-out mechanism;

   (iii) Opt-out email notices that are returned to the TRS provider as
   undeliverable shall be sent to the customer in another form before the
   TRS provider may consider the customer to have received notice;

   (iv) TRS providers that use email to send CPNI notices shall ensure
   that the subject line of the message clearly and accurately identifies
   the subject matter of the email; and

   (v) TRS providers shall make available to every customer a method to
   opt-out that is of no additional cost to the customer and that is
   available 24 hours a day, seven days a week. TRS providers may satisfy
   this requirement through a combination of methods, so long as all
   customers have the ability to opt-out at no cost and are able to
   effectuate that choice whenever they choose.

   (e) Notice requirements specific to opt-in. A TRS provider may provide
   notification to obtain opt-in approval through oral, sign language,
   written, or electronic methods. The contents of any such notification
   shall comply with the requirements of paragraph (c) of this section.

   (f) Notice requirements specific to one-time use of CPNI. (1) TRS
   providers may use oral, text, or sign language notice to obtain
   limited, one-time use of CPNI for inbound and outbound customer
   telephone, TRS, or point-to-point contacts for the duration of the
   call, regardless of whether TRS providers use opt-out or opt-in
   approval based on the nature of the contact.

   (2) The contents of any such notification shall comply with the
   requirements of paragraph (c) of this section, except that TRS
   providers may omit any of the following notice provisions if not
   relevant to the limited use for which the TRS provider seeks CPNI:

   (i) TRS providers need not advise customers that if they have opted-out
   previously, no action is needed to maintain the opt-out election;

   (ii) TRS providers need not advise customers that the TRS provider may
   share CPNI with the TRS provider's affiliates or third parties and need
   not name those entities, if the limited CPNI usage will not result in
   use by, or disclosure to, an affiliate or third party;

   (iii) TRS providers need not disclose the means by which a customer can
   deny or withdraw future access to CPNI, so long as the TRS provider
   explains to customers that the scope of the approval the TRS provider
   seeks is limited to one-time use; and

   (iv) TRS providers may omit disclosure of the precise steps a customer
   must take in order to grant or deny access to CPNI, as long as the TRS
   provider clearly communicates that the customer can deny access to his
   or her CPNI for the call.

   Effective Date Note: At  78 FR 40613 , July 5, 2013, § 64.5108 was added.
   This section contain information collection and recordkeeping
   requirements and will not become effective until approval has been
   given by the Office of Management and Budget.

   return arrow Back to Top