Markey Drafts Bill Responding to Carrier IQ Kerfuffle
Wireless companies would have to disclose monitoring software installed on mobile devices under draft legislation released Monday by Rep. Ed Markey, D-Mass. The Mobile Device Privacy Act reacts to software from Carrier IQ used by carriers to collect certain user data from cellphones, including dialed phone numbers and visited URLs. While carriers say the data collection is for customer support, the controversy has resulted in more than 50 class-action lawsuits in courts across the country. Privacy advocates celebrated the Markey bill while the wireless industry was silent.
Sign up for a free preview to unlock the rest of this article
Communications Daily is required reading for senior executives at top telecom corporations, law firms, lobbying organizations, associations and government agencies (including the FCC). Join them today!
Markey plans to talk to colleagues and stakeholders before formally introducing the legislation, he said. The House Commerce Committee member and co-chair of the Privacy Caucus previously asked the FTC to investigate Carrier IQ. Earlier this month, House Commerce Democrats asked for a hearing about Carrier IQ (CD Jan 13 p12). House Commerce Republicans didn’t comment. Sen. Al Franken, D-Minn., has been focused on the issue in the Senate. The FTC told Markey it had received his request, but the agency’s policy is not to announce investigations, his spokeswoman said. Markey has not spoken to Franken, she said.
"Consumers have the right to know and to say no to the presence of software on their mobile devices that can collect and transmit their personal and sensitive information,” Markey said Monday. “While consumers rely on their phones, their phones relay all sorts of information about them, often without their knowledge or consent. I am concerned about the threat to consumers’ privacy posed by electronic monitoring software on mobile phones, such as the software developed by Carrier IQ.”
Under the Markey bill, disclosure of cellphone monitoring software is required at the point of sale. It’s also required after sale if the carrier, manufacturer or OS maker later installs the software, or if the consumer downloads an app containing monitoring software. The rules apply to carriers, manufacturers, mobile app stores and others in the wireless business. Companies would have to disclose the presence of the software, what information can be collected and transmitted, who receives the transmissions and how the data will be used. Companies also would be required to get the “express consent” of a consumer before the software begins collecting and transmitting data.
The bill requires those receiving personal data to implement information security policies. Companies also would have to file with the FTC and FCC all agreements on the transmission of personal data from the software to a third party. The draft bill charges the FTC with making the disclosure and consent rules. The FTC and FCC are tasked with enforcing the rules. States could bring civil actions on behalf of residents under the draft bill. Persons injured by a violation of the law could also bring action in a state or federal court.
"Opt-in/opt-out is a capability that we are able to provide and have been doing so in a number of markets,” Carrier IQ Vice President Andrew Coward said. “Utilizing this option is a decision for each network operator balancing a number of factors including the critical need to ensure optimal network and device performance and consumer concerns about privacy."
Public interest groups supported the Markey draft. “People need to be able to ensure that their mobile device is just a ’smartphone’ and not a ’spyphone,'” Consumer Watchdog advocate John Simpson said. In particular, Simpson praised the bill’s provisions enabling actions by states attorneys and private citizens. “Wireless users deserve to know what’s happening with their phones,” said Free Press adviser Joel Kelsey. “Third-party companies with no relationship to the consumer must not be allowed to collect or sell user data under a veil of secrecy."
Verizon said it’s reviewing the draft bill, but declined to comment further. “Sprint is committed to respecting and protecting the privacy and security of each customer’s personally identifiable information and other customer data,” a Sprint Nextel spokeswoman said. “We follow and implement policies that are transparent and demonstrate our accountability for customer privacy.” CTIA and the Telecom Industry Association declined to comment. CEA, AT&T and T-Mobile didn’t respond to requests for comment.
Upset consumers have flooded federal courts with class action lawsuits against Carrier IQ and wireless manufacturers, forcing the courts to try to consolidate the many cases. In a Jan. 19 order on one case, the U.S. District Court in San Jose, Calif., said more than 50 complaints “have been filed to-date in federal district courts throughout the United States by plaintiffs purporting to bring class actions on behalf of cellular telephone and other device users on whose devices software made by defendant Carrier IQ, Inc., is or has been embedded.” The court said a “motion is pending before the Judicial Panel on Multidistrict Litigation to transfer the [Carrier IQ] cases to this jurisdiction for coordinated and consolidated pretrial proceedings.” Under the order, Carrier IQ must respond 45 days after the filing of a consolidated amended complaint.
Franken hopes to pass his own Location Privacy Protection Act (S-1223) “as soon as possible,” his spokeswoman said. If that bill was already law, she said “users would have learned a long time ago that Carrier IQ was receiving sensitive information from their wireless devices.”