Sec.  64.2008   Notice required for use of customer proprietary network
information.

   (a) Notification, Generally. (1) Prior to any solicitation for customer
   approval, a telecommunications carrier must provide notification to the
   customer of the customer's right to restrict use of, disclosure of, and
   access to that customer's CPNI.

   (2) A telecommunications carrier must maintain records of notification,
   whether oral, written or electronic, for at least one year.

   (b) Individual notice to customers must be provided when soliciting approval
   to use, disclose, or permit access to customers' CPNI.

   (c)  Content  of Notice. Customer notification must provide sufficient
   information  to enable the customer to make an informed decision as to
   whether to permit a carrier to use, disclose, or permit access to, the
   customer's CPNI.

   (1) The notification must state that the customer has a right, and the
   carrier has a duty, under federal law, to protect the confidentiality of
   CPNI.

   (2) The notification must specify the types of information that constitute
   CPNI and the specific entities that will receive the CPNI, describe the
   purposes for which CPNI will be used, and inform the customer of his or her
   right to disapprove those uses, and deny or withdraw access to CPNI at any
   time.

   (3) The notification must advise the customer of the precise steps the
   customer  must take in order to grant or deny access to CPNI, and must
   clearly state that a denial of approval will not affect the provision of any
   services to which the customer subscribes. However, carriers may provide a
   brief statement, in clear and neutral language, describing consequences
   directly resulting from the lack of access to CPNI.

   (4) The notification must be comprehensible and must not be misleading.

   (5) If written notification is provided, the notice must be clearly legible,
   use sufficiently large type, and be placed in an area so as to be readily
   apparent to a customer.

   (6) If any portion of a notification is translated into another language,
   then all portions of the notification must be translated into that language.

   (7) A carrier may state in the notification that the customer's approval to
   use CPNI may enhance the carrier's ability to offer products and services
   tailored  to  the  customer's  needs.  A carrier also may state in the
   notification that it may be compelled to disclose CPNI to any person upon
   affirmative written request by the customer.

   (8) A carrier may not include in the notification any statement attempting
   to encourage a customer to freeze third-party access to CPNI.

   (9) The notification must state that any approval, or denial of approval for
   the  use  of CPNI outside of the service to which the customer already
   subscribes from that carrier is valid until the customer affirmatively
   revokes or limits such approval or denial.

   (10)  A telecommunications carrier's solicitation for approval must be
   proximate to the notification of a customer's CPNI rights.

   (d) Notice Requirements Specific to Opt-Out. A telecommunications carrier
   must provide notification to obtain opt-out approval through electronic or
   written  methods, but not by oral communication (except as provided in
   paragraph (f) of this section). The contents of any such notification must
   comply with the requirements of paragraph (c) of this section.

   (1)  Carriers  must  wait a 30-day minimum period of time after giving
   customers notice and an opportunity to opt-out before assuming customer
   approval to use, disclose, or permit access to CPNI. A carrier may, in its
   discretion, provide for a longer period. Carriers must notify customers as
   to the applicable waiting period for a response before approval is assumed.

   (i) In the case of an electronic form of notification, the waiting period
   shall begin to run from the date on which the notification was sent; and

   (ii) In the case of notification by mail, the waiting period shall begin to
   run on the third day following the date that the notification was mailed.

   (2) Carriers using the opt-out mechanism must provide notices to their
   customers every two years.

   (3) Telecommunications carriers that use e-mail to provide opt-out notices
   must comply with the following requirements in addition to the requirements
   generally applicable to notification:

   (i) Carriers must obtain express, verifiable, prior approval from consumers
   to send notices via e-mail regarding their service in general, or CPNI in
   particular;

   (ii) Carriers must allow customers to reply directly to e-mails containing
   CPNI notices in order to opt-out;

   (iii)  Opt-out  e-mail  notices  that  are  returned to the carrier as
   undeliverable must be sent to the customer in another form before carriers
   may consider the customer to have received notice;

   (iv) Carriers that use e-mail to send CPNI notices must ensure that the
   subject line of the message clearly and accurately identifies the subject
   matter of the e-mail; and

   (v) Telecommunications carriers must make available to every customer a
   method to opt-out that is of no additional cost to the customer and that is
   available 24 hours a day, seven days a week. Carriers may satisfy this
   requirement through a combination of methods, so long as all customers have
   the ability to opt-out at no cost and are able to effectuate that choice
   whenever they choose.

   (e) Notice Requirements Specific to Opt-In. A telecommunications carrier may
   provide notification to obtain opt-in approval through oral, written, or
   electronic methods. The contents of any such notification must comply with
   the requirements of paragraph (c) of this section.

   (f) Notice Requirements Specific to One-Time Use of CPNI. (1) Carriers may
   use oral notice to obtain limited, one-time use of CPNI for inbound and
   outbound  customer  telephone  contacts  for the duration of the call,
   regardless of whether carriers use opt-out or opt-in approval based on the
   nature of the contact.

   (2) The contents of any such notification must comply with the requirements
   of paragraph (c) of this section, except that telecommunications carriers
   may omit any of the following notice provisions if not relevant to the
   limited use for which the carrier seeks CPNI:

   (i)  Carriers  need  not  advise customers that if they have opted-out
   previously, no action is needed to maintain the opt-out election;

   (ii) Carriers need not advise customers that they may share CPNI with their
   affiliates or third parties and need not name those entities, if the limited
   CPNI usage will not result in use by, or disclosure to, an affiliate or
   third party;

   (iii) Carriers need not disclose the means by which a customer can deny or
   withdraw future access to CPNI, so long as carriers explain to customers
   that the scope of the approval the carrier seeks is limited to one-time use;
   and

   (iv) Carriers may omit disclosure of the precise steps a customer must take
   in order to grant or deny access to CPNI, as long as the carrier clearly
   communicates that the customer can deny access to his CPNI for the call.

   [ 67 FR 59212 , Sept. 20, 2002]