CaptionCall’s $ 34.6 M FCC Settlement: The Cost of Excessive Data Retention

Written By

Sanjeev Yadav

Published on

July 18th, 2024

FCC Findings & Settlement:

The FCC investigation revealed the following:

Unlawful Data Retention by CaptionCall: The company unlawfully retained customer call data for three years. This was in clear violation of the FCC rule that prohibits retention of call information beyond the duration of the call as per section 225 of the Communications Act of 1934 and section 64.604(a)(2)(i)-(ii) of the TRS Rules.
False & Wrong Submissions: Submitted wrong information to the TRS Fund administrator concerning the reimbursement claims related to IP CTS.

To resolve the FCC investigation, CaptionCall and the FCC Enforcement Bureau reached a settlement on the 9^th of July 2024 for a sum of $34.6 Million as stipulated in the ‘Consent Decree’. The settlement amount is to be bifurcated in the following manner:

$ 12 Million: TRS Fund reimbursement
$ 13.6 Million: Relinquishing claims for IP CTS minutes
$ 5 Million: Civil Penalty
$ 4 Million: Investment in privacy, data protection improvements, and user awareness.

The settlement further states the following:

Develop a Compliance Plan to comply with provisions of ‘Communication Laws’ and the ‘Consent Decree’. The plan must contain the following:

Operating Procedure: Within 120 days, CaptionCall shall engage an independent accessor to access all of CaptionCall’s processes to ensure that internal compliance reporting happens on a regular basis, non-compliance incidents are managed properly, and vendor agreements are updated to be compliant with Communication Laws.
TRS Privacy and Data Protection Program: CaptionCall will develop and implement a privacy & data protection program within 120 days. The program requires CaptionCall to designate a Data Privacy Officer. It further requires them to develop a data retention schedule that specifies the data retention period, the purpose of data collection, usage, disclosure, etc.
- The policy shall also ensure the safe removal and disposal of user data by sanitizing or destroying data-bearing electronic media when required. It further stipulates that the IP CTS software should be used after taking privacy & security into consideration, and the software should be tested to check for call content retention.
- The decree also stipulates that CaptionCall should develop policies for Incident Response, Vendor Oversight, risk assessment, and subsequent changes to the privacy program.
Marketing and Call Captioning: The decree stipulates that CaptionCall, within 30 days, shall update marketing agreements, retain and maintain all records and agreements for 2 years, and ensure compliance with regulatory inquiries and obligations.
Resubmissions to the TRS Fund Administrator: Within 60 days, CaptionCall shall submit the resubmission to the TRS Fund Administrator with detailed descriptions, estimates, and documentation for each resubmission related to the reported non-compliance issues.

The consent decree further requires CaptionCall to update its compliance manual, maintain and update its compliance training program, report non-compliance, file compliance reports, etc. You can read the detailed CaptionCall Consent Decree on the FCC website.

What CaptionCall Could Have Done Differently: Our Take

CaptionCall’s situation underscores the importance of data management and compliance strategies. CaptionCall could have avoided this situation if they would have:

Implemented a Data Retention Policy: CaptionCall should have created and implemented a data retention policy. The policy should have a clearly defined data retention period that aligns with the intended purpose of data collection and relevant data privacy regulations.
Enforced a Data Destruction Policy: A robust ‘Data Destruction Policy’ was essential. CaptionCall should have had a policy that specifies which data needs to be destroyed, its frequency, and the method to be used – like degaussing or data erasure software like BitRaser. The policy should also have included a mechanism to verify the effectiveness of the data destruction process.
Complied with Communication Laws: As a telecommunication company CaptionCall was subject to communication laws and FCC regulations. Adherence to laws and regulations would have helped them avoid this situation.
Be Sensitive to Customer Privacy: The company should have prioritized the privacy of its customers by ensuring that all data processing processes were transparent, secure, and compliant. They should have implemented protocols for removing sensitive information as per prevalent regulations and communicated their privacy practices clearly to their customers.
Conducted Regular Audits & Training: CaptionCall had been storing call content for over 3 years, which clearly violated the provisions of communication law and FCC regulations. Regular Internal audits would have revealed this breach beforehand, which would have allowed CaptionCall to take corrective action and prevent further violations. Training employees on the need for data disposal practices would have helped CaptionCall take corrective action much before.

Conclusion

The $34.6 Million settlement between CaptionCall and the FCC highlights the importance of adhering to data retention and privacy regulations. The investigation and subsequent settlement will serve as a stark reminder to the telecommunication industry about the potential cost of excessive data retention and non-compliance. By implementing robust data management policies, including clear data retention and destruction practices, and maintaining rigorous compliance with communication laws, companies can protect themselves from similar legal and financial repercussions.

FAQs

What led to CaptionCall's $34.6 million settlement with the FCC?

The FCC settlement followed an investigation revealing that the company unlawfully retained the customer’s private call content, provided inaccurate information to the TRS administrator, and engaged in excessive data retention.

How did CaptionCall violate FCC data retention rules?

CaptionCall unlawfully retained customer call data for three years. This was in clear violation of the FCC rule that prohibits retention of call information beyond the duration of the call as per section 225 of the Communications Act of 1934 and section 64.604(a)(2)(i)-(ii) of the TRS Rules.

What financial penalties did CaptionCall face as part of the settlement?

To resolve the FCC investigation, CaptionCall and the FCC Enforcement Bureau reached a settlement on the 9th of July 2024 for a sum of $34.6 Million.

How can companies avoid excessive data retention issues?

Companies should implement a data retention policy. The policy should have a clearly defined data retention period that aligns with the intended purpose of data collection and relevant data privacy regulations.

About The Author

Sanjeev Yadav

37 posts

Sanjeev is a passionate writer with an engineering background, strong research skills, and unbridled enthusiasm to learn. With a rich experience of 12+ years across industries, he brings a fresh perspective to writing on technology and compliance. He enjoys watching movies and sitcom’s in his free time.

CaptionCall’s $ 34.6 M FCC Settlement: The Cost of Excessive Data Retention

Let’s get started

Stellar Brings to The World Future-Ready Data Solutions