§  64.5107   Approval required for use of customer proprietary network
information.

   (a) A TRS provider may obtain approval through written, oral,
   electronic, or sign language methods.

   (1) A TRS provider relying on oral or sign language approval shall bear
   the burden of demonstrating that such approval has been given in
   compliance with the Commission's rules in this part.

   (2) Approval or disapproval to use, disclose, or permit access to a
   customer's CPNI obtained by a TRS provider must remain in effect until
   the customer revokes or limits such approval or disapproval. A TRS
   provider shall accept any such customer revocation, whether in written,
   oral, electronic, or sign language methods.

   (3) A TRS provider must maintain records of approval, whether oral,
   written, electronic, or sign language, during the time period that the
   approval or disapproval is in effect and for at least one year
   thereafter.

   (b) Use of opt-in and opt-out approval processes. (1) Opt-in approval
   requires that the TRS provider obtain from the customer affirmative,
   express consent allowing the requested CPNI usage, disclosure, or
   access after the customer is provided appropriate notification of the
   TRS provider's request consistent with the requirements set forth in
   this subpart.

   (2) With opt-out approval, a customer is deemed to have consented to
   the use, disclosure, or access to the customer's CPNI if the customer
   has failed to object thereto within the waiting period described in
   § 64.5108(d)(1) of this subpart after the TRS provider has provided to
   the customer appropriate notification of the TRS provider's request for
   consent consistent with the rules in this subpart.

   (3) A TRS provider may only use, disclose, or permit access to the
   customer's individually identifiable CPNI with the customer's opt-in
   approval, except as follows:

   (i) Where a TRS provider is permitted to use, disclose, or permit
   access to CPNI without customer approval under § 64.5105 of this
   subpart.

   (ii) Where a TRS provider is permitted to use, disclose, or permit
   access to CPNI by making use of customer opt-in or opt-out approval
   under paragraph (?)(4) of this section.

   (4) A TRS provider may make use of customer opt-in or opt-out approval
   to take the following actions with respect to CPNI:

   (i) Use its customer's individually identifiable CPNI for the purpose
   of lawfully marketing TRS-related services to that customer.

   (ii) Disclose its customer's individually identifiable CPNI to its
   agents and its affiliates that provide TRS-related services for the
   purpose of lawfully marketing TRS-related services to that customer. A
   TRS provider may also permit such persons or entities to obtain access
   to such CPNI for such purposes.

   [ 79 FR 40613 , July 5, 2013]