Before the FEDERAL COMMUNICATIONS COMMISSION Washington, D.C. 20554 In the Matter of ) ) Protecting the Privacy of Customers of Broadband ) WC Docket No. 16-106 and Other Telecommunications Services ) ) COMMENTS OF CTIA Thomas C. Power Senior Vice President and General Counsel Debbie Matties Vice President, Privacy Scott K. Bergmann Vice President, Regulatory Affairs CTIA 1400 Sixteenth Street, NW Suite 600 Washington, DC 20036 (202) 785-0081 May 26, 2016 TABLE OF CONTENTS INTRODUCTION AND SUMMARY ..........................................................................................1 I. The Commission Lacks Authority To Adopt the Proposed Regulations. ...................14 A. The Commission Does Not Have Authority To Reclassify Broadband Services as a “Telecommunications Service” Under Title II of the Communications Act. ..........................................................................................15 B. Even If the Commission Has Authority to Classify Broadband Service as a Telecommunications Service, It Lacks Authority To Extend Section 222 to ISPs’ Provision of Broadband Service. .....................................16 1. The Text of Section 222, as Enacted and Subsequently Amended, Unambiguously Forecloses Application to Broadband Service. ...............16 2. The Legislative History of Section 222 Likewise Demonstrates That Application to Broadband Service Is Impermissible. ........................19 3. The Commission Implicitly Acknowledged Section 222’s Inapplicability to ISPs’ Provision of Broadband Service by Forbearing from Applying Its CPNI Rules in the Open Internet Order. .........................................................................................................23 C. Regardless Whether Section 222 Could Be Extended to Broadband Service, the Proposed Rules Exceed Other Limitations in Section 222. .........23 1. Read Holistically, Section 222 Does Not Permit the Commission to Interpret Section 222(a) to Protect Any Category of Customer Information Beyond CPNI. ........................................................................25 2. Regardless Whether 222(a) Could Be Construed to Vest the Commission with Authority to Define “Proprietary Information” Beyond CPNI, That Category Cannot and Should Not Be Extended to De-Identified Data. ................................................................................35 a. Section 222(c)(1) Unambiguously Excludes De-Identified Data. ...............................................................................................35 b. The NPRM Approach to De-Identified Information Unreasonably Departs from the Uniform Approach Taken by Other Agencies and Organizations and Will Cause Public Interest Harms. ....................................................................37 3. CPNI Is a Narrow and Specifically Defined Category Under Section 222(h) and May Not Be Interpreted to Include Other Information. ...............................................................................................44 4. Any Rules Under Section 222 Cannot Prohibit Data Practices and Instead Must Allow ISPs to Obtain Customer Approval to Use, Disclose, or Permit Access to CPNI. .........................................................45 5. Any Rules Under Section 222 Must Permit ISPs to Use, Disclose, or Permit Access to Information They Receive or Obtain Other Than by Providing Service.........................................................................48 6. The Commission Cannot and Should Not Adopt Prohibitions or Restrictions on ISPs’ Use of Arbitration. ..................................................50 a. Arbitration Benefits Wireless Consumers .....................................50 1) Arbitration provides a fair and effective remedy for the many injured consumers for whom the judicial system is not a realistic option. ......................................... 50 2) Class-action lawsuits provide little benefit to consumers. ........................................................................ 54 b. In Any Event, The Commission Lacks Authority To Prohibit Or Regulate Arbitration. ..................................................55 1) Under the Federal Arbitration Act (“FAA”), arbitration provisions are valid and enforceable, unless another federal statute evinces a “contrary congressional command” that overrides the FAA. ........... 55 2) The Communications Act of 1934 does not override the FAA. ............................................................................ 56 3) Any Commission rule regulating arbitration would not receive Chevron deference and would be invalidated. ........................................................................ 58 D. The Alternative Statutory Bases that the Commission Identifies Fail To Provide Authority for Regulating Broadband Customer Privacy.............59 1. Neither Section 201(b) Nor Section 202 Provides a Basis for Regulating the Privacy Practices of Broadband Providers. .......................60 2. Section 705 Does Not Provide Authority for Regulating the Privacy Practices of Broadband Providers. ................................................63 3. The Proposed Rules Are Inconsistent with Section 706. ...........................65 4. Title III Does Not Provide Authority To Promulgate the Proposed Rules for Wireless ISPs. ............................................................................71 II. The Proposed Rules Restricting ISPs’ Uses and Disclosures of Information Collected from and About Customers in the Ordinary Course of Business Are Unconstitutional. .......................................................................................................73 A. The Proposed Use Restrictions Are Speaker-Based and Fail To Survive Strict Scrutiny Under Sorrell v. IMS Health, Inc. ...............................76 B. Even Under Central Hudson’s Intermediate Scrutiny Test, the Proposed Rules Fail at Every Step. ....................................................................78 ii 1. Because Commercial Speech Promotes the Public Interest, the Commission Bears the Burden of Justifying Restrictions on ISP Speech at Every Step of the Inquiry. .........................................................78 2. The Commission Can Invoke an Interest in Protecting “Privacy” Only Insofar as It Identifies a Particularized Privacy Harm Supported by Record Evidence. .................................................................81 3. The Proposed Rules Are Facially Unconstitutional Because They Lack Any Nexus to Privacy and Are Likely Unconstitutional as Applied to Each ISP Use Case. ..................................................................82 a. Rules Restricting First-Party Marketing Based on Information Collected in the Ordinary Course of Business Without Third-Party Disclosure or Access Fail at Every Step of the Central Hudson Analysis. ............................................84 b. Rules Restricting First-Party Marketing Based on Customer Profiles Developed Through Evaluating Online Activity Without Third-Party Disclosure or Access Fare No Better Under Central Hudson. ..................................................................88 c. Rules Restricting First-Party Delivery of Third-Party Blind Advertising Without Third-Party Disclosure or Access Likewise Fail Central Hudson at Both the State Interest and Tailoring Steps. ..............................................................................90 d. Rules Indiscriminately Restricting ISP Uses that Involve Disclosing or Permitting Access to Customer Information to Unaffiliated Third Parties Fail in Most Cases to Advance a State Interest and Certainly Are Not Narrowly Tailored. ...........91 III. Any Proposed Rules Should Be Based on the Sensitivity of the Data Protected and the Needs for ISPs to Adapt to Changing Technological Developments....................................................................................................................94 IV. The NPRM Approach to Notice of Privacy Policies Degrades the Customer Experience, Fails to Protect Privacy, and Imposes Substantial Costs. .......................98 A. There Is No Need for Expanded Notice Requirements Related to Privacy Policies and Changes Thereto. ..............................................................98 B. If the Commission Nevertheless Adopts the Proposed Notice Rules, It Should Implement the Following Modifications to Preserve ISP Flexibility. ...........................................................................................................101 V. The NPRM Approaches to Customer Choice Ignore Realities of the Broadband Ecosystem and Are Inconsistent with Established Privacy Regulation, Rendering Them Ineffective and Counterproductive. ...........................106 A. The NPRM Starts from an Improper Baseline Assumption About the Use and Disclosure of, and Access to, Information in the Broadband Ecosystem............................................................................................................107 iii 1. The NPRM Incorrectly Assumes That Broadband Customers Currently Receive No Choice, and That Opt-In Approval Is the Only Effective Remedy. ...........................................................................108 2. The NPRM Uncritically Extends the Voice CPNI Model, Ignoring Differences Between the Broadband and Traditional Voice Ecosystems That Undermine the Rules. ..................................................110 3. Harmonizing Privacy Rules Governing Different Regulated Services Could Reduce ISP Costs,