EPIC and CDT Urge FCC to Reconsider Invasive Know Your Customer Rulemaking Proposal 

In comments filed Monday, EPIC and the Center for Democracy & Technology urged the FCC to reconsider a proposed rule to expand Know Your Customer (KYC) requirements for originating voice service providers.  

The proposal would mandate that the government collect more personal data from and about individual customers in an effort tocombat illegal robocalls and scam traffic. While EPIC and CDT support this goal, the FCC’s strategy to achieve it is misguided. 

The potential expansion of the agency’s KYC requirements would require the FCC to “obtain, at a minimum, the name, physical address, government-issued identification number, and an alternate telephone number of any new and renewing customer,” and retain that data for four years beyond the end of the customer-carrier relationship. 

This kind of mandatory collection of identification documents from every phone subscriber would seriously harm anonymous access to phones, burden freedom of expression, and put every subscriber at risk. The FCC did not demonstrate that this data collection could achieve its goal of limiting robocalls as most robocalls originate oversees and this data collection would not affect foreign actors. EPIC and CDT urge the FCC to significantly narrow its proposal or rescind it altogether. 

“The Commission should not impose such a sweeping identity documentation requirement on individuals seeking access to voice services, as it would impose severe privacy harms on all phone subscribers and cut off vulnerable populations that lack these documents from an essential service that has become a lifeline for most Americans,” EPIC and CDT’s comments read. “A significant loss of privacy and equitable access to communications, in exchange for a proposal with unclear and likely limited benefits, is not a tradeoff the Commission should impose on Americans.” 

EPIC routinely files comments with federal agencies in response to requests for comment on proposed rules that would have privacy ramifications. EPIC has also long advocated for the inclusion of data minimization in privacy laws and regulations.