AT&T: We Own Our Subscribers’ Data

On Friday, when AT&T goes into its next court hearing on a lawsuit about alleged spying on its customers, the carrier will also be instituting a privacy policy for Internet and video services that says it owns subscriber account information.

“While your account information may be personal to you, these records constitute business records that are owned by AT&T. As such, AT&T may disclose such records to protect its legitimate business interests, safeguard others, or respond to legal process,” reads the policy, which becomes effective Friday. It covers only the carrier’s Internet services, such as AT&T/Yahoo DSL, and its emerging U-verse and Homezone TV services. U-verse delivers TV and video over a fast form of DSL, and Homezone is a combination of DSL and satellite TV. Both are set for commercial launch before September.

AT&T is facing a class-action lawsuit led by the Electronic Frontier Foundation, a civil rights group that says the carrier handed over information on use of its Internet access services to the U.S. National Security Agency. Alleged law enforcement programs to collect information from carriers and Internet companies have raised alarm about how much information people may give up when they use the Internet or make a phone call.

The new policy document isn’t a change in approach, according to AT&T. The carrier wrote it to explain its policies for the video services and in the process reworked language it had used in earlier policies.

“These policies clarify long-standing AT&T policy,” said company spokeswoman Tiffany Nels. “We eliminated a lot of the legalese and used a lot of plain English.”

That’s not necessarily cause for relief, according to Sherwin Siy, staff counsel at the Electronic Privacy Information Center in Washington, D.C.

“Everything they say they will do under the new policy could be read into the old policy,” Siy said. “Even a privacy policy that may look good in the abstract, if it’s sufficiently vague and it’s not specific in how it provides protection for consumers, really does nothing other than provide the company with a way out of taking responsibility for the uses of customer information.”

One new item in the document is a policy involving AT&T’s video services. The carrier will collect information about what subscribers watch and record, Nels said. That data will help the company “personalize the viewing experience” through services such as show recommendations, she said.

In addition, subscribers have to agree to the policy as part of their contract with AT&T. The video services will require a home visit for setup, and at that time the customer will have to sign a copy of the rules, Nels said. DSL subscribers are understood to agree to the policy by continuing to use the service; that aspect hasn’t changed, Nels said.

The Cable Communications Policy Act of 1984 forbids cable and satellite TV providers from collecting subscriber viewing information, according to Michael Overing, an attorney and an adjunct professor in the Annenberg School for Communication at the University of Southern California.

“Because they’re not regulated in the same way by the FCC, they can collect the data on your viewing preferences,” Overing said. “The problem … is that this data’s going to be collected in a database. … The federal government sees those databases as a real opportunity to look for criminals.”

Without discussing whether AT&T’s video services are subject to the Cable Act, Nels said the carrier’s policies meet the privacy requirements of that law.

-Stephen Lawson, IDG News Service (San Francisco Bureau)

Check out our CIO News Alerts and Tech Informer pages for more updated news coverage.