The FCC has issued a Notice of Apparent Liability for Forfeiture (NAL) against TerraCom, Inc. (TerraCom) and YourTel America, Inc. (YourTel) for apparent willful and repeated violations of Sections 201(b) and 222(a) of the Communications Act and the FCC’s rules. As part of their provision of Lifeline service, TerraCom and YourTel collected the names, addresses, Social Security numbers, copies of driver’s licenses, and other proprietary information from low-income Americans, and stored the information in electronic forms on Internet servers without password protection or encryption that could be accessed by anyone. After an investigative reporter discovered that the sensitive information was publicly accessible and notified TerraCom and YourTel of the problem, the two companies sent the reporter a cease and desist letter and notified the FCC’s Enforcement Bureau that they had been the victims of a data breach. However, the Enforcement Bureau then began investigating TerraCom and YourTel for their failure to protect the confidentiality of subscribers’ personal information from misappropriation by third parties. The NAL ends the investigation and proposes a total forfeiture of $10,000,000 for TerraCom and YourTel for their apparent violations of the Communications Act. The FCC notes that the action is its first data security case and the largest privacy action in its history.
