Wednesday, November 01, 2017

A discussion on CPNI

A coworker and I were chatting over Skype last night about the billing account number and if it is considered 'CPNI'.

So what is CPNI, and is the billing account number CPNI?

CPNI is calling usage for marketing purposes essentially.


An FCC request for comments regarding broadband CPNI , if you like reading these kind of things:


https://apps.fcc.gov/edocs_public/attachmatch/FCC-16-39A1.pdf?platform=hootsuite


Summary:
"we consider the following types of information to constitute CPNI in the broadband context: (1) service plan information, including type of service (e.g., cable, fiber, or mobile), service tier (e.g., speed), pricing, and capacity (e.g., information pertaining to data caps); (2) geo-location; (3) media access control (MAC) addresses and other device identifiers; (4) source and destination Internet Protocol (IP) addresses and domain name information; and (5) traffic statistics. "


Or in more customer friendly terms more specific to VOIP / Switched Calling:



"Customer proprietary network information (CPNI) is information related to the quantity, technical configuration, type, destination, location, and the amount of telecommunications a customer uses that [provider] has access to by virtue of the customer-provider relationship. CPNI does not include the Customer name, address and telephone number, nor does it include Internet access services."



However, the BAN appears to be PII as it is the 'financial account number' of the customer.

California, which is often more strict the the Feds, does not consider the BAN alone PII unless linked with the password  or PIN that would allow access to the customer account (SB1368, section 2.e.3):

No comments: