5th Circuit Judges Question Both Sides During AT&T Data Fine Argument

On a 3-2 vote in April, commissioners imposed fines against the three major wireless carriers for allegedly failing to safeguard data on customers' real-time locations years earlier (see 2404290044). Commissioners Brendan Carr and Nathan Simington dissented.

Notices of apparent liability against the carriers were handed down in 2020 under Republican Chairman Ajit Pai after the Enforcement Bureau investigated reports that a Missouri sheriff used a location-finding service operated by Securus, a provider of communications services to correctional facilities. It was alleged that the sheriff used location information of wireless customers without their consent between 2014 and 2017 (see 2002280065).

Judge Catrina Haynes, appointed by President George W. Bush, and Judges Stuart Duncan and Cory Wilson, President Donald Trump appointees, heard arguments in the AT&T case Monday.

AT&T already had “all sorts of protections” in place, which is why just one firm, Securus, jeopardized customer data, said Akin’s Pratik Shah, who argued on behalf of the carrier. “There’s no evidence that any of the other providers … posed some undue risk,” he said. Securus provided “falsified records saying that they got customer consent. It wasn’t like AT&T didn’t check the record.”

Said Judge Wilson, “These are fine arguments, but they’re arguments to the FCC, and the FCC found against you on that.” He added, “There’s also evidence to support [the FCC’s] finding."

Shah also argued that AT&T should have faced a maximum fine of $2 million. However, the carrier endured some of the largest fines for providing location data to companies like AAA and LifeLock, which posed no risk, he said. This is “an absurd result.”

Judges should look to the “plain text” of the Communications Act in overturning the fine, Shah argued. The FCC asserts that location data is customer proprietary network information, but the data “clearly falls outside the statutory definition of CPNI,” he said. AT&T collected the location data because it provides voice and services, “the latter of which is undisputedly not part” of the telecom carrier “customer relationship.” As such, “AT&T wears two hats -- they get the information as a result of both hats.”

Judge Haynes said, “Your conclusion says that we should set aside the commission’s forfeiture order,” asking why the panel shouldn’t send it to a district course to hear the case. “That’s what you’re saying you should have had the right to,” she said: “Why would we just throw it out and say, 'Y’all go home?'”

A 'Continuing Failure'

AT&T sold the location information of millions of customers to third parties “without any way of verifying whether those disclosures had been authorized or consented to,” argued Adam Sorensen, a lawyer representing the FCC. After a bad actor “exploited these vulnerabilities … thousands of times, over a period of four years, the commission investigated,” he said. The agency “ultimately penalized AT&T for its continuing failure to implement adequate safeguards for its customers’ data."

Haynes questioned whether an FCC administrative law judge should have at least taken testimony from AT&T. The carrier had “no chance to argue, nothing, nothing, nothing,” she said: “Why is that sufficient?” Why does it make sense for the FCC to make a decision when AT&T hasn’t even had a hearing?

AT&T had the option of a jury trial if it chose not to pay the fine, Sorenson replied. “AT&T is not challenging the evidentiary basis of the commission’s findings,” he said. Hayes retorted, “Well, they can’t here."

Sorenson argued that the fine was “more akin to a charging document.” The FCC can’t actually collect the penalty “by statute” and must rely on DOJ to bring a collection action, he said. In this case, AT&T voluntarily paid the penalty because it wanted the 5th Circuit to review the legal issues, he said.

“AT&T paid the fine -- a jury trial is never going to happen,” Judge Wilson said. “They chose to give up their Seventh Amendment rights” to a trial, “which was really not a choice.”

AT&T is “basically arguing that they didn’t screw up, but that can’t really be what their appeal to us is,” Haynes said: “We’re not going to have a hearing where we have witnesses come in and all of that.”

Sorenson replied that AT&T was fined because it had inadequate safeguards for its data. The facts aren’t in dispute, he said. “AT&T had absolutely no ability to verify whether these disclosures were consented to at any point.” The Securus incident, which “touched all this off, really should have put [AT&T] on notice that there were gaping holes" in its "location-based services program.”