Data Protection Report - digital privacy, CCPA and cybersecurity

On March 16, 2018, the U.S. Court of Appeals for the District of Columbia Circuit issued its decision on the Federal Communications Commission (FCC) omnibus order of 2015, relating to challenges to four of the FCC’s determinations relating to cell phones.  The appellate court upheld the FCC’s determinations that consumers can revoke consent to receive marketing calls by “any reasonable means” that clearly expresses the desire to receive no further messages from the caller, and an exception for certain “emergency” healthcare-related calls.  On the other hand, the court set aside the FCC’s decision regarding the definition of an “automatic telephone dialing system” (ATDS), and how callers can deal with reassigned numbers where the previous owner had consented to receive marketing calls.


On July 10, 2015, the FCC released a 105 page omnibus declaratory ruling and order (Order) under the Telephone Consumer Protection Act (TCPA), sometimes known as “Do Not Call.”  In general, the TCPA makes it unlawful to make any call (except for a call made for emergency purposes or made with “the prior express consent of the called party”) using any ATDS to any telephone number assigned to a cellular telephone service.  TCPA permits private plaintiffs to sue for $500 per call, up to $1500 per call for willful or knowing violations.

A.         Revocation of consent

In its 2015 Order, the FCC ruled that the consumer could revoke consent “at any time and through any reasonable means that clearly expresses a desire not to receive further messages.”  The FCC stated that “reasonable means” would be based on the totality of the circumstances, including whether the caller “could have implemented mechanisms to effectuate a requested revocation without incurring undue burdens.”  The court upheld the FCC’s determination and pointed out that:

  • “callers will have every incentive to avoid TCPA liability by making available clearly-defined and easy-to-use opt-out methods.  If recipients are afforded such options, any effort to sidestep the available methods in favor of idiosyncratic or imaginative revocation requests might well be seen as unreasonable”; and
  • although the Order “precludes unilateral imposition of revocation rules by callers, it does not address revocation rules mutually adopted by contracting parties.  Nothing in the Commission’s order thus should be understood to speak to the parties’ ability to agree upon revocation procedures.”

B.         Healthcare-related exception

The FCC Order granted an exemption even from the prior express consent requirement for certain non-telemarketing, healthcare calls as long as the recipient (called party) is not charged.  The FCC set forth seven conditions for these free, health care calls:

  1. voice calls and text messages must be sent, if at all, only to the wireless telephone number provided by the patient;
  2. voice calls and text messages must state the name and contact information of the healthcare provider (for voice calls, these disclosures would need to be made at the beginning of the call);
  3. voice calls and text messages are strictly limited to the purposes permitted in the Order [“health care” messages can include “appointment and exam confirmations and reminders, wellness checkups, hospital pre-registration instructions, pre-operative notifications, and home healthcare instructions.”]; must not include any telemarketing, solicitation, or advertising; may not include accounting, billing, debt-collection, or other financial content; and must comply with HIPAA privacy rules;
  4. voice calls and text messages must be concise, generally one minute or less in length for voice calls and 160 characters or less in length for text messages;
  5. a healthcare provider may initiate only one message (whether by voice call or text message) per day, up to a maximum of three voice calls or text messages combined per week from a specific healthcare provider;
  6. a healthcare provider must offer recipients within each message an easy means to opt out of future such messages, voice calls that could be answered by a live person must include an automated, interactive voice- and/or key press-activated opt-out mechanism that enables the call recipient to make an opt-out request prior to terminating the call, voice calls that would be answered by an answering machine or voice mail service must include a toll-free number that the consumer can call to opt out of future healthcare calls, text messages must inform recipients of the ability to opt out by replying “STOP,” which will be the exclusive means by which consumers may opt out of such messages; and
  7.  a healthcare provider must honor the opt-out requests immediately.

The federal appellate court upheld this exemption, holding that the FCC “did not restrict communications that HIPAA required be permitted to flow freely.  It simply declined to make certain exchanges even less burdensome that they would have been by default.”  The court found that the FCC was empowered to draw a distinction between healthcare calls for emergency purposes and calls that were not (“telemarketing solicitation, or advertising content, or which include accounting, billing, debt-collection, or other financial content”).  The court found that the FCC “adequately explained its reasons” for the distinction and therefore its actions were not arbitrary or capricious.

C.        Construction of autodialer/ATDS

The FCC Order proposed which devices for making calls qualify as an ATDS, which is equipment that “has the capacity” to “store or produce telephone numbers to be called, using a random or sequential number generator,” and “to dial such numbers.”  The FCC determined that the “capacity” of calling equipment “includes its potential functionalities” or “future possibility”—taking into account possible upgrades or modifications—not only its “present ability.”  The court, however, set aside this broad definition of ATDS as an “unreasonable, and impermissible, interpretation” of the TCPA because such a construction would include all smartphones (their ability to download applications constituted “capacity”).  The court found “untenable” to construe “capacity” to include the “most ubiquitous type of phone equipment known, used countless times each day for routine communications by the vast majority of people in the country.”

D.        Calling reassigned numbers

Finally, the Order addressed whether, and when, a caller violates the TCPA by calling a wireless number that has been reassigned from a consenting party to another person without the caller’s knowledge.  The FCC proposed that the term “called party” refers not to “the intended recipient of a call” but instead to “the current subscriber,” which the court held valid.  On the other hand, the panel set aside the FCC’s determination of a one-call safe harbor for such calls.  The FCC’s construction would allow the caller to continue to reasonably rely on the consent provided by the “previous subscriber” for one call, rather than implementing a strict liability approach.  The court found that a caller’s reasonable reliance on the previous subscriber’s consent would be just as reasonable for subsequent calls if the caller did not receive any indication of the number’s reassignment, and therefore determined that the agency’s concluding that such calls violate the TCPA, excluding a one-call safe harbor, was arbitrary and capricious.