	Background

In response to a petition filed by the Electronic Privacy Information Center (EPIC) concerning numerous websites advertising the sale of personal telephone records, the Federal Communications Commission conducted a rulemaking to determine the extent of the problem and construct regulations in response to consumer concerns. Data brokers claimed to be able to provide this information fairly quickly, in a few hours to a few days. Data brokers are thought to employ three different practices to obtain customer telephone records without the approval of the customer. The first method occurs when an employee of one of the phone companies sells the records to the data broker. The second method occurs through a practice called "pretexting," where a data broker pretends to be the owner of the phone and obtains the records from the telephone company under false pretenses. The third method is employed when a data broker obtains the customer's telephone records by accessing the customer's account on the Internet. Pretext calling for customer telephone records occurs when the data broker or investigator pretends to be the cell phone account holder and persuades phone company employees to release the information. In response to these concerns, Congress, the Federal Communications Commission (FCC), and the Federal Trade Commission (FTC) have acted to prevent the unauthorized disclosure of phone records. For further information, see CRS Report RL34120, Federal Information Security and Data Breach Notification Laws , by [author name scrubbed]. In 2006, Congress enacted the Telephone Records and Privacy Protection Act, which makes pretexting for the acquisition of telephone records a federal offense. Telephone Records and Privacy Protection Act

Section 3 of the Telephone Records and Privacy Protection Act makes it a crime to knowingly and intentionally obtain, or attempt to obtain, "confidential phone records information" of a covered entity (defined as a telecommunications carrier or an IP-enabled voice service provider) by making false statements or representations to an employee of a covered entity, making false or fraudulent statements to a customer of a covered entity, providing a document to a covered entity knowing that the document is false or fraudulent, or accessing customer accounts via the Internet without prior authorization from the customer to whom the information pertains. Federal Trade Commission Act

The FTC may bring a law enforcement action against a pretexter of telephone records for deceptive or unfair practices. Section 222 of the Communication Act of 1934, as amended, establishes a duty of every telecommunications carrier to protect the confidentiality of CPNI. It does not include subscriber list information, such as name, address, and phone number. The CPNI Order and subsequent orders issued by the Commission govern the use and disclosure of customer proprietary network information by telecommunications carriers. The certification must contain a list of customer complaints regarding unauthorized disclosure of CPNI for the previous year.
Telephone records contain a large amount of intimate personal information. Recent years have seen a rise in the use of this information for marketing and even for criminal purposes. The purchase and sale of telephone record information, therefore, became a booming business. Websites and data brokers claiming to be able to obtain the phone records for any phone number within a few days abounded. However, the methods by which these data brokers obtained their information came under intense fire from public interest groups concerned about consumer privacy.
Consumer groups and news outlets reported that telephone records were being obtained fraudulently by data brokers or other individuals without the knowledge or consent of the customers to whom the records related. Data brokers are thought to employ three different practices to obtain customer telephone records without the approval of the customer. The first method occurs when an employee of one of the phone companies sells the records to the data broker. The second method occurs through a practice called "pretexting," where a data broker pretends to be the owner of the phone and obtains the records from the telephone company under false pretenses. The third method is employed when a data broker obtains the customer's telephone records by accessing the customer's account on the Internet.
In response to increased concern over the unauthorized disclosure of private telephone records, Congress and other regulatory agencies have taken a number of steps to improve the security of this information. Congress enacted the Telephone Records and Privacy Protection Act of 2006, which makes "pretexting" a federal offense. The Federal Trade Commission has instituted a number of enforcement actions against data brokers. And the FCC recently amended its regulations governing the disclosure of Customer Proprietary Network Information (CPNI) in an attempt to address the concerns raised by Congress, the Electronic Privacy Information Center (EPIC), and other consumer groups regarding the unauthorized disclosure of such information.
This report discusses recent efforts to protect the privacy of customer telephone records and efforts to prevent the unauthorized use, disclosure, or sale of such records by data brokers. In addition, it provides a brief overview of the confidentiality protections for customer information established by the Communications Act of 1934. It does not discuss the legal framework for the disclosure by telephone companies of phone records to the government. For an overview of laws that address disclosure of telephone records to the government, see CRS Report RL33424, Government Access to Phone Calling Activity and Related Records: Legal Authorities, by [author name scrubbed], [author name scrubbed], and [author name scrubbed]. For an overview of federal law governing wiretapping and electronic eavesdropping, see CRS Report 98-326, Privacy: An Overview of Federal Statutes Governing Wiretapping and Electronic Eavesdropping, by [author name scrubbed] and [author name scrubbed] (pdf). This report will be updated when warranted.