The media reported this week that AT&T is changing its privacy policy governing customer phone records. The new policy, which goes into effect next week, states that AT&T owns customers’ phone records data and will use that information “to protect its legitimate business interests, safeguard others, or respond to legal process.” The previous policy did not assert AT&T’s ownership of customer records, and it assured customers that AT&T would disclose data only in response to a subpoena, court order or other legal process as permitted and/or “required by law.” The new policy conspicuously omits the language that a response to legal process must be “required by law.”

This is bad news for consumers. First, AT&T’s claim of ownership of the information contained in customer records undermines the custodial obligation that the company has to safeguard customers’ calling and billing information. Even if this information is technically “owned” by AT&T (because it’s part of AT&T’s business records), AT&T ought to recognize customers’ continued interest in the privacy and security of such sensitive information. Second, AT&T is going to require customers to consent to the new policy as a condition of receiving service. The laws that prohibit phone companies from disclosing customer information to the government have exceptions for, among other things, customer consent. If AT&T were charged with improper disclosure of customer records to the government (sound familiar?), this change in policy would allow AT&T to claim that customers had consented to disclosure in order “to safeguard others” or to respond to “legal process.” Remember — the response to “legal process” no longer needs to be “required by law.” Would a written request from the Attorney General for access to the entire call database — absent the certification or showing of connection to terrorism required by law — suffice? Because of the tremendous consolidation in the telecommunications industry, customers have very few choices — if any, in some parts of the country — when it comes to land line telephone providers. Customers will have to choose in some instances between foregoing home phone service or foregoing strong privacy protections. (Note that this policy would only apply going forward, so AT&T could not use this as a defense to charges that it has illegally disclosed customer data to the NSA.)

One more thing: AT&T states in its new policy that it reserves the right to monitor and disclose the viewing habits of subscribers to its new video service. Cable and satellite companies are prohibited by law from doing so, but when Congress wrote the law in 1984, it did not cover telephone companies because it did not anticipate that telephone companies would provide video services.

This entry was posted on Friday, June 23rd, 2006 at 5:32 pm and is filed under Consumer Privacy, Security & Freedom. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.