The broadband industry's fight against net neutrality rules is also targeting new privacy regulations that Internet service providers really don't want to follow.

The new privacy rules haven't even been formulated yet. When the Federal Communications Commission reclassified broadband providers as common carriers in order to impose net neutrality rules, it also stated its intent to enforce Section 222 of Title II, which requires telecommunications carriers to protect the confidentiality of customers' proprietary information.

However, the commission's existing privacy rules cover telephone service rather than broadband, so the FCC said it will conduct a separate rulemaking proceeding before implementing any privacy requirements on Internet providers.

ISPs anticipate having to follow some version of the FCC's Customer Proprietary Network Information (CPNI) rules that are applied to phone service, and they claim it will be a major burden. The extra work caused by protecting customer privacy is one of the recurring themes in declarations made by ISPs as part of the lawsuit filed on May 1 by the American Cable Association and National Cable & Telecommunications Association.

There are 137 mentions of CPNI in the cable companies' petition.

"Petitioners’ members would face extensive burdens to comply with Section 222(c)(1), including the creation of processes to ensure that CPNI is not used in marketing without customer approval," the petition states.

Lots of cable companies already have to comply with CPNI requirements because they offer phone service. The FCC's CPNI rules cover not only the traditional Public Switched Telephone Network but also the VoIP telephony service offered by cable companies and other Internet providers.

Cox Communications, the nation's third largest cable and broadband company, with six million subscribers, already offers voice service and describes its compliance with CPNI rules on its website.

But Cox complained in the lawsuit against the FCC that applying CPNI rules to broadband will force it to "evaluate its current processes for authenticating individuals who contact Cox via phone, online, or in retail locations to obtain BIAS-related [broadband Internet access service] customer data to determine whether it is protecting customer information using processes that specifically comply with the requirements of Section 222... Cox also will be forced to evaluate all of its contracts with vendors that come into contact with BIAS-related customer data to ensure that the contracts provide sufficient protection to comply with the requirements of Section 222. In some cases, renegotiation of the contracts likely will be required."

Mediacom, which has more than 1 million broadband customers and also complies with CPNI rules for phone service, argued that it must take immediate steps to comply with Section 222 for broadband even though the FCC hasn't issued specific rules. Mediacom wrote:

The Order creates significant ambiguity as to the precise measures that Mediacom must take in order to comply with Section 222. On the one hand, the Order states that it is forbearing from applying the FCC's rules implementing Section 222 to BIAS providers. But at the same time, the FCC already has interpreted Section 222 in the context of voice telephony to require certain procedures as the "minimum" needed to comply with statutory obligations. These procedures include specific authentication protocols that must be followed before releasing CPNI through phone calls, the company's website, or in retail stores; "immediate" customer notification when changes are made to a customer's account; and mandatory law-enforcement and customer notification if there is a breach of CPNI. Given these ambiguities, Mediacom will have no choice but to implement new procedures to comply with Section 222, including updating operating manuals, implementing necessary technical or software updates, and training its customer support staff. The substantial costs involved in taking these potentially unneeded steps cannot be recouped if the Order's reclassification is vacated.

CPNI rules for phone service prevent companies from using customer information to market new services without the customer's permission. They also require companies to report to customers and to law enforcement when customer information is disclosed without customer permission.

Phone providers "may use, disclose or permit access to your customer information in these circumstances: (1) as required by law; (2) with your approval; and (3) in providing the service from which the customer information is derived," the FCC says.

Small cable companies say burdens will fall heavily on them

The petition also included declarations about CPNI from small cable operators, at least some of which actually would be facing CPNI rules for the first time, since they don't offer phone service. The statements all follow the same template, often using identical wording.

"To the extent this duty mandates that telecommunications carriers require customers to provide passwords during support calls or photo identification during in-store visits before disclosing CPNI, it would impose serious and irreparable harm on small carriers, like WinDBreak, that have strong personal relationships with their customers," wrote CEO William Bauer of WinDBreak Cable, which has 440 customers in rural Nebraska and Wyoming.

That sentence was repeated in the declarations of four other small cable companies, namely Bagley Utilities in Minnesota; Cable Communications of Willsboro (CCW) in New York; Mountain Zone Broadband in Alpine, Texas; and Watson Cable Company in Georgia. The small providers went on to say that their personal, informal relationships with customers would be harmed by password or photo identification requirements.

Small providers also complained about having to renegotiate contracts with partners in order to comply with stricter privacy rules, as well as the potential burden of upgrading computer systems.

Bagley Utilities, for example, "may have to renegotiate its contracts with [Momentum Telecom, a contractor that activates customers' service and monitors the network for outages] to ensure that CPNI is never used for marketing or sales purposes, and to ensure that Momentum Telecom takes necessary precautions to ensure the confidentiality of CPNI," General Manager Michael Jensen wrote.

"Any misjudgment by Bagley Utilities about the statute's requirements could have catastrophic consequences. Bagley Utilities understands that the FCC can impose large penalties—sometimes millions of dollars—for violations of CPNI rules," Bagley wrote. This statement about fines was repeated word-for-word by the five small providers.

Since the FCC hasn't implemented the privacy rules yet, it could take these companies' concerns into account and draft rules that aren't too onerous but still protect customer data. The FCC's net neutrality order makes it clear that new privacy rules are necessary for consumers, though.

"Privacy needs are no less important when consumers communicate over and use broadband Internet access than when they rely on [telephone] services," the FCC wrote. "As broadband Internet access service users access and distribute information online, the information is sent through their broadband provider. Broadband providers serve as a necessary conduit for information passing between an Internet user and Internet sites or other Internet users, and are in a position to obtain vast amounts of personal and proprietary information about their customers. Absent appropriate privacy protections, use or disclosure of that information could be at odds with those customers’ interests."

UDPATE: The FCC issued an enforcement advisory this afternoon, saying that broadband providers will have to comply with "the statutory provisions of Section 222" once the net neutrality order takes effect June 12, even though broadband-specific rules have not been issued yet. ISPs can ask the FCC for guidance on complying with Section 222, if they want to.

"During this period [until broadband-specific rules are issued], the Enforcement Bureau intends to focus on whether broadband providers are taking reasonable, good-faith steps to comply with Section 222, rather than focusing on technical details," the FCC said. "By examining whether a broadband provider’s acts or practices are reasonable and whether such a provider is acting in good faith to comply with Section 222, the Enforcement Bureau intends that broadband providers should employ effective privacy protections in line with their privacy policies and core tenets of basic privacy protections."