The FCC admonished a national wireless phone carrier for a 2015 data breach in which a third party gained unauthorized access to personal information collected by the carrier to run credit checks on customers.

Section 222(a) of the Communications Act requires telecommunications carriers to “protect the confidentiality of proprietary information of, and relating to . . . customers.” It also requires carriers to “take every reasonable precaution” to protect personal customer information. Section 201(b) of the Act requires practices related to interstate or foreign telecommunications to be “just and reasonable.”

In September 2015, the carrier discovered a data breach that affected 15 million customers, and compromised data such as names, social security numbers, addresses, and other identifying information. The FCC began investigating the breach in October 2015 and learned that the carrier relied on a vendor to keep personal customer information safe. The FCC found that the vendor failed to use reasonable measures to protect the carrier’s personal customer information. Among other deficiencies, the vendor failed to patch known, critical vulnerabilities on the servers where it processed the carrier’s sensitive customer information, failed to protect database passwords, and failed to monitor for unauthorized access or suspicious activity. Further, the FCC found that the carrier did not reasonably oversee the vendor and ignored several “red flags.” For example, the FCC concluded that the carrier (1) did not take meaningful action to review or improve the vendor’s security practices following a similar 2013 data breach, (2) lacked general knowledge regarding the vendor’s systems, and (3) consistently failed to follow up with the vendor regarding its compliance with contractual security requirements.

The FCC therefore determined that the carrier’s data security practices were unjust and unreasonable and issued an order admonishing the carrier. The FCC explained in its order that the carrier was ultimately responsible for the vendor’s failings, because “while [providers] can outsource functions, they cannot transfer accountability.”

Although the FCC found that a monetary forfeiture against the carrier was warranted and would have been consistent with past precedent, Section 503(b)(6)(B) of the Act limited it to admonishment because the violations took place more than one year prior to the issuance of the FCC’s order. Section 503(b)(6)(B) states that the FCC cannot issue a forfeiture for a violation that occurs more than one year prior to the issuance of a notice of forfeiture or notice of apparent liability. The FCC stated that it was nevertheless sending a “strong signal” to carriers that they are responsible for the actions of third parties acting on their behalf.