FCC Customer Proprietary Network Information (CPNI) and Data Breach Rules (47 CFR 64.2001-2011) CPNI-64.2010: Safeguards on disclosure - authentication for account access (47 CFR 64.2010)

Section 64.2010 establishes safeguards on DISCLOSURE of CPNI through customer-account-access channels. The 2007 + 2009 CPNI Orders strengthened these rules following the HP pretexting scandal + further data-broker abuse. (a) GENERAL DISCLOSURE PROHIBITION - telecommunications carriers MUST TAKE REASONABLE MEASURES TO DISCOVER + PROTECT AGAINST ATTEMPTS TO GAIN UNAUTHORISED ACCESS TO CPNI + may only disclose CPNI based on a customer's verified identification. (b) TELEPHONE ACCESS - carriers must AUTHENTICATE the customer prior to disclosing call detail information based on customer-initiated telephone contact without the use of readily available biographical information / account information; back-up authentication methods may be available (e.g. carriers may provide call detail to customers based on customer authentication or carriers may at the customer's request send the information to an address of record or the customer's telephone number of record). (c) ONLINE ACCOUNT ACCESS - carriers must authenticate using a password not based on readily available biographical information / account information. (d) IN-STORE ACCESS - carriers must authenticate using government-issued photo ID + face-matching to customer record. (e) ACCOUNT ESTABLISHMENT + PASSWORD CREATION - customers must create + maintain account passwords; password reset procedures must NOT rely on readily available biographical information + must include back-up authentication methods (security question that is NOT a readily available biographical question). (f) ACCOUNT CHANGE NOTIFICATION - notify customers when changes are made to passwords / addresses / online account access.