The FCC this week levied more than $13.3 million in fines on some 660 small telecommunications companies for failing to adhere to new FCC guidelines regarding customer privacy. After complaints in recent years surfaced about data brokers illegally gleaning consumer information from many carriers (like in the HP scandal), the FCC crafted new regulations for carriers aimed at protecting this data, and a new reporting method aimed at ensuring carriers are protecting Customer Proprietary Network Information (CPNI).

Carriers were supposed to do a number of things differently, including getting explicit consumer approval before handing over any data. The FCC also required that telcos assign a CPNI compliance officer, tasked with highlighting the exact measures carriers are taking to protect consumer data. Apparently, many carriers figured paying the fine (as much as $20,000 for many operators) was a less strenuous process.

According to the COO of one (compliant) carrier we spoke to, the CPNI certification process itself is simple. "It is a one page notarized document to certify that an officer of the company has personal knowledge that the company has established operating procedures to ensure compliance with the FCC’s CPNI rules," he tells us. The certification also requires the officer document any pretexting attempts or consumer complaints each year.

"Why a carrier would not take the minimal amount of time to file the certification, and avoid the fine, is beyond me," he says. He surmises that many carriers may not have known about the requirement (since the FCC doesn't contact carriers in advance to remind them), or cutbacks left work undone. "Perhaps the employees who were previously paid to surf the FCC website, just in case the FCC imposes a requirement on a carrier, have been laid off," he says.

"I have long stressed the importance of protecting the sensitive information that telecommunications carriers collect about their customers," interim FCC chief Michael Copps said in a prepared announcement (pdf). "The broad nature of this enforcement action hopefully will ensure substantial compliance with our CPNI rules going forward as the Commission continues to make consumer privacy protection a top priority."