CPNI Statement

The operating procedures of Consolidated Telephone Company (CTC) ensure compliance with the FCC’s CPNI Rules. Such procedures are as follows:

CPNI Use

1. We use, disclose or permit access to CPNI to protect our rights and property, our Customers, and other carriers from fraudulent, abusive or unlawful use of, or subscription to, our services.
2. We use, disclose or permit access to CPNI to provide or market service offerings among the categories of service – local, interexchange and CMRS – to which the Customer already subscribes. When we provide different categories of service, and a Customer subscribes to more than one service category, we share the Customer’s CPNI with the affiliate that provides service to the Customer; but if a Customer subscribes to only one service category, we do not share the customer’s CPNI with an affiliate without the Customer’s approval.
3. We use, disclose or permit access to CPNI derived from our provision of CMRS for the provision of Customer Premises Equipment (CPE) and information services, without Customer approval.
4. We use, disclose or permit access to CPNI derived from our provision of local exchange or interexchange service for the provision of CPE and call answering, voice mail or messaging, voice storage and retrieval services, fax store-and-forward, and protocol conversion, without Customer approval.
5. Without Customer approval, we do not use, disclose or permit access to CPNI to provide or market service offerings within a category of service to which the Customer does not already subscribe, except that we use, disclose or permit access to CPNI to: (a) provide inside wiring installation, maintenance and repair services; (b) conduct, when we provide CMRS, research on the health effects of CMRS; and (c) market, when we provide local service or CMRS, services formerly known as adjunct-to-basic services such as, but not limited to, speed dialing, computer-provided directory assistance, call monitoring, call tracing, call blocking, call return, repeat dialing, call tracking, call waiting, caller ID, call forwarding, and certain Centrex features.
6. We do not use, disclose or permit access to CPNI to identify or track Customers that call competing service providers. For example, as a local exchange carrier, we do not use local service CPNI to track Customers that call local service competitors.

CPNI Approvals

1. When Customer approval to use, disclose or permit access to Customer CPNI is required, we obtain approval through written, oral or electronic methods. If we rely on oral approval, we understand we bear the burden of demonstrating that such approval was given in compliance with the CPNI rules. We honor a Customer’s approval or disapproval until the Customer revokes or limits such approval or disapproval. We maintain all records of Customer approvals for at least one year.
2. Subject to “opt-out” approval requirements, we use a Customer’s individually identifiable CPNI to market communications-related services to that Customer, and we disclose that CPNI to our affiliates that provide communications-related services. We also allow these to obtain access to such CPNI to market communications-related services.
3. If we disclose or allow access to Customers’ individually identifiable CPNI to our joint ventures or independent contractors, we will require, in order to safeguard that information, their entry into confidentiality agreements that: (a) require their use of the CPNI only for the purpose of marketing or providing the communications-related services for which the CPNI has been provided; (b) disallow their permitting any other party to use, allow access to, or disclose the CPNI to any other party, unless they are required to make disclosure under force of law; and (c) require that they have in place appropriate protections to ensure the ongoing confidentiality of the CPNI.

CPNI Notice Requirements

1. We individually notify and inform each Customer of his or her right to restrict the use or disclosure of, and access to, CPNI along with a solicitation of approval, in compliance with FCC Rule 64.2008. We maintain records of that notification, whether oral or written, for at least one year.
2. Our notifications provide information sufficient to enable our Customers to make informed decisions as to whether to permit the use or disclosure of, or access to, their CPNI. Our notifications: (a) contain a statement that the Customer has a right, and we have a duty, under federal law, to protect the confidentiality of CPNI; (b) specify the types of information that constitute CPNI and the specific entities that will receive CPNI, describe the purposes for which the CPNI will be used, and inform the Customer of his or her right to disapprove those uses and deny or withdraw access to CPNI use at any time. With regard to the latter, we indicate that any approval, or disapproval, will remain in effect until the Customer affirmatively revokes or limits such approval or denial, in compliance with FCC Rule 64.2008.
3. We advise the Customer of the precise steps the Customer must take in order to grant or deny access to CPNI, and we clearly state that a denial of approval will not affect the provision of any services to which the Customer subscribes. However, we may provide a brief statement, in clear and neutral language, that describes the consequences directly resulting from the lack of access to CPNI. In addition, we may state that the Customer’s consent to use his or her CPNI may enhance our ability to offer products and services tailored to meet the Customer’s needs and that we will disclose the Customer’s CPNI to any person upon the affirmative written request of the Customer.
4. Our notifications are comprehensible and not misleading and, if written, are legible, sufficiently in large type, and placed in an area readily apparent to the Customer. And, if any portion of a notification is in another language, all portions of the notification will be in that language.
5. We do not include in the notification any statement that attempts to encourage a Customer to freeze third-party access to CPNI.
6. For “opt-out” approvals, our notifications satisfy (1) – (5). We do not use oral notifications except to obtain limited, one-time use of CPNI for inbound and outbound customer telephone contacts for the duration of the call. When we use oral notice in this manner, we comply with (1) – (5), except that, if none of the following situations are relevant to the limited use for which we seek CPNI, we will not: (a) advise Customers, if they have opted out previously, that no action is needed to maintain the “opt-out” election; (b) advise Customers that we may share CPNI with our named or unnamed affiliates or third parties if the limited CPNI usage does not result in use by, or disclosure to, an affiliate or third party; (c) disclose the means by which a Customer can deny or withdraw future access to CPNI, so long as we explain that the scope of the approval is limited to one-time use; and (d) disclose the precise steps a Customer must take to grant or deny access to CPNI, so long as we clearly communicate that the Customer can deny access to his or her CPNI for the call.
7. In addition, for “opt-out” approvals, we wait at least 30 days after giving Customers notice and an opportunity to opt-out before assuming Customer approval to use, disclose, or permit access to CPNI and notify Customers of the applicable waiting period for a response before approval is assumed. For electronic notifications, we recognize that the waiting period begins to run on the date the notification is sent and, for mail notifications; it begins to run on the third day following the date the notification was mailed. For e-mail opt-out notices, in addition to other requirements, we: (a) obtain express, verifiable, prior approval to send notices by e-mail regarding their service in general or their CPNI, in particular; (b) allow Customers to reply directly to e-mails in order to opt-out; (c) use another means of communicating the notice if the e-mail is returned as undeliverable before considering the Customer to have received notice; and (d) ensure that the subject line in the e-mail clearly and accurately identifies the subject matter of the e-mail.
8. In addition, for “opt-out” approvals, we provide notices to our customers every two years, and we make available to every customer a method to opt-out that is of no additional cost to the Customer and is available 24 hours a day, seven days a week. We may satisfy this requirement through a combination of methods, but we allow Customers to opt-out at no cost and whenever they choose.
9. For “opt-in” approvals, we provide notification to Customers through oral, written or electronic methods that satisfy the requirements of (1) – (5).

CPNI Safeguards

1. We have implemented a system by which the status of a Customer’s CPNI approval can be clearly established prior to the use of the CPNI.
2. We have implemented procedures on customer privacy in accordance with Title 47 Section 222.
3. We have trained our personnel as to when they are, and are not, authorized to use CPNI, and we have an express disciplinary process in place to deal with employee failures.
4. We authenticate the identity of a customer prior to disclosing CPNI based on a customer-initiated telephone contact, online account access, or in-store visit.
5. We disclose call detail information (CDI) in a customer-initiated call only: after the customer provides a pre-established password; or, at the customer’s request, by sending CDI to the customer’s address of record; or by calling back the customer at his or her telephone number of record.
6. We disclose CPNI to a customer in person at our retail location(s) only when the customer presents a valid photo ID and ID matches the name on the account.
7. We have established passwords with customers in order to authenticate customers. Neither passwords nor the backup method for authentication rely on customers’ readily available biographical information.
8. We have established password protection for customers’ online accounts.
9. We include terms specifying the confidentiality and use of CPNI in our contracts with business customers that are served by a dedicated account representative.
10. We notify a customer immediately of changes in: a customer’s password, a customer’s response to back-up means of authentication, online account, or address of record.

CPNI Recordkeeping and Reporting

1. We maintain a record of our own and our affiliates’ sales and marketing campaigns that use Customers’ CPNI. The record includes a description of each campaign, the specific CPNI that was used in the campaign, and what products and services were offered as part of the campaign. We retain these records for at least one year.
2. We have established a supervisory review process regarding compliance with the CPNI rules for outbound marketing situations and we maintain compliance records for at least one year. Specifically, our sales personnel obtain supervisory approval of any proposed outbound marketing request for customer approval of the use of CPNI.
3. We have a corporate officer who acts as agent for the Company and signs a compliance certificate on an annual basis stating that the officer has personal knowledge that the Company has established operating procedures adequate to ensure compliance with applicable CPNI rules. We provide a Statement accompanying the Certificate that explains our operating procedures and demonstrates compliance with the CPNI rules.
4. We are prepared to provide written notice within five business days to the FCC of any instance where the opt-out mechanisms do not work properly to such a degree that consumers’ inability to opt-out is more than an anomaly. That notice would be in the form of a letter and would include the Company’s name, a description of the opt-out mechanism(s) used, the problem(s) experienced, the remedy proposed and when it would be/was implemented, whether relevant state commission(s) were notified and what action was taken, a copy of any notice provided to customers, and contact information. We would submit the notice even if other methods by which consumers may opt-out were offered.
5. We are prepared to notify the U.S. Secret Service and FBI within seven business days after the occurrence of an intentional, unauthorized (or exceeding authorization), access to, use of, or disclosure of CPNI. We may also notify the customer of such breach, after consulting with the investigatory agency(ies), if we believe there is an extraordinarily urgent need to notify a customer (or class of customers) in order to avoid immediate or irreparable harm. We will notify the customer of the breach after seven business days following notification to the FBI and Secret Service, if such agencies have not requested that we postpone disclosure to the customer.
6. We will maintain records of any discovered breaches, notices to the Secret Service and FBI, and their responses, for at least two years.