BASIS, PURPOSE, AND STATUTORY AUTHORITY The basis and purpose for these rules is to provide regulations concerning the collection and disclosure of personal information obtained by a public utility or telecommunications service provider within the normal course of business. The rules provide procedures to protect the personal information of customers of public utilities and customers of telecommunications service providers. These rules are issued under the authority of 40-3-102, 40-4-101, and 40-2-108, C.R.S. RULE (4 CCR) 723-7-1. APPLICABILITY. These rules apply to all public utilities and telecommunications service providers regulated under title 40, Article 15, Parts 2 and 3, C.R.S. RULE (4 CCR) 723-7-2. DEFINITIONS. 723-7-2.1 Personal information means any personally identifiable information obtained through an exchange of information between a person and a public utility from which judgments can be made about that person's character, habits, avocations, finances, occupation, general reputation, credit, health, or any other personal characteristics. Personal information does not mean: 723-7-2.1.1 A person's name and address; 723-7-2.1.2 A person's telephone number if the telephone number is published in a current telephone directory or is scheduled for publication in the next telephone directory; and 723-7-2.1.3 Standard Industrial Code (SIC) information used for the purposes of directory publishing. 723-7-2.2 Public utility means the same as that defined in 40-1-103 C.R.S., and for the purposes of these rules includes Telecommunications Service Providers regulated under Title 40, Article 15, Parts 2 and 3, C.R.S. 723-7-2.3 Person means any individual, firm, partnership, corporation, company, association, joint stock association, or other legal entity. 723-7-2.4 Customer means any person who has applied for, been accepted, or is currently receiving a service from a public utility. 723-7-2.5 Published means authorized for voluntary disclosure by the individual identified in the listing. 723-7-2.6 Third party means a person who is neither the customer, a public utility, nor a public utility affiliate. 723-7-2.7 723-7-2.8 New service connection means the start-up of new utility service that occurs as a result of a move. This includes new listing for telephone service. 723-7-2.9 Non-published service means telephone numbers that are not published in the telephone directory and are not otherwise available through directory assistance. 723-7-2.10 Non-listed service means telephone numbers that are not published in the telephone
directory but are available through directory assistance. RULE (4 CCR) 723-7-3. COLLECTION. 723-7-3.1 A public utility shall be restricted to collecting only that personal information which is useful to provide, bill and collect for services including information on credit worthiness to the extent useful to comply with Commission Rules on customer deposit and discontinuance of service found at 4 CCR 723-2 (telephone), 4 CCR 723-3 (electricity), and 4 CCR 723-4 (gas). 723-7-3.2 For purposes of 3.1, information on credit worthiness to the extent useful to comply with Commission Rules may include, but not limited to: employer, employer's phone number, landlord information, and previous utility supplier. RULE (4 CCR) 723-7-4. RIGHT OF THE CUSTOMER TO REVIEW AND AMEND. 723-7-4.1 A public utility shall notify the customer in writing of the customer's right to request any or all personal information the public utility holds concerning that customer, including a true copy if requested. Such notice shall be given one time to all customers, and also within a reasonable time after an order for new service is placed or confirmed, but not later than three months after the first bill. Interexchange telecommunications service providers are required to provide such notice only to their presubscribed one-plus customers. Upon such request and upon verification of the customer's identity, the public utility shall give the customer the personal information or a true copy, if requested and must take all necessary steps to explain the information to the customer. 723-7-4.2 A customer may request in writing an amendment of the personal information held by a public utility. The public utility shall within 30 days of the date of receipt of the request: 723-7-4.2.1 Correct any portion of a record which the customer believes is not accurate, relevant, timely, or complete, subject to the customer providing sufficient information to verify the accuracy of the correction, and inform the customer in writing of the corrections made in accordance with his or her request; or 723-7-4.2.2 Inform the customer in writing of its refusal to amend the record in accordance with the request, give reason for the refusal, clearly note any portion of the record which is disputed, and include in its records the customer's concise statement of disagreement. 723-7-4.2.2.1 A public utility shall also inform the customer of their right to file a formal complaint with the Colorado Public Utilities Commission regarding disputed personal information. RULE (4 CCR) 723-7-5. DISCLOSURE TO THIRD PARTIES. A public utility may not disclose personal information to any third party as defined in Rule 2.6, except as provided in this rule. 723-7-5.1 Method of Disclosure. 723-7-5.1.1 A written request for personal information by a third party must either be signed by the customer or accompanied by a disclosure form which has been signed by the customer authorizing a public utility to disclose personal information to a specific third party. A request for information which is not on a disclosure form shall include, at a minimum, the information required by Rules 5.1.3.1 through 5.1.3.3.
723-7-5.1.2 The burden shall be on the third party requesting the personal information to obtain authorization for disclosure from the customer. 723-7-5.1.3 A public utility, at the request of a third party desiring personal information, shall provide the third party with a disclosure form with which the customer may authorize disclosure of its personal information to the third party. The third party must obtain customer authorization each time it requests personal information unless the customer has signed a disclosure form authorizing the release of all personal information to any third party at any time. The disclosure form shall include the following information: 723-7-5.1.3.1 The personal information being requested. 723-7-5.1.3.2 The purpose for which the personal information may be disclosed. 723-7-5.1.3.3 The identity of the third party to whom the personal information may be disclosed. 723-7-5.1.3.4 A statement of the customer's right to review and amend records containing personal information which are maintained by a public utility as stated in Rule 4 of these rules. 723-7-5.1.4 Requests for personal information made in person or by telephone by a third party may be honored only after the public utility verifies that the customer has given authorization to release the personal information. 723-7-5.1.5 A public utility may also disclose personal information, where, on its own initiative, it has secured authorization to do so by obtaining from the customer a signed disclosure form as described in Rule 5.1.3 723-7-5.2 Governmental Requests. Requests from federal, state or local governments, or one of their agencies including, but not limited to: the Colorado Public Utilities Commission, the United States Department of Housing and Urban Development, the Colorado Department of Revenue, the Internal Revenue Service, local housing authorities, state and local departments of social services and federal, state and local law enforcement agencies will be honored subject to the following conditions: 723-7-5.2.1 Written requests for personal information shall not be honored unless the request is written on official letterhead. 723-7-5.2.2 Telephone requests for personal information may not be answered while the caller waits unless the employee of the public utility receiving the call knows the caller is an authorized governmental representative. In all cases in which the employee receiving the call does not know the caller, he or she must obtain the office telephone number of the caller and return the call to verify authorization before disclosing personal information. 723-7-5.2.3 In person requests may be honored only after verification that the person requesting the personal information properly represents a governmental agency. 723-7-5.3 Blocking. 723-7-5.3.1 Per call blocking and per call unblocking enable a customer to control the disclosure of his or her name and telephone number to a subscriber of Caller Identification by temporarily changing the public or private status indicator of the telephone number. A customer must dial a code before each call to change the indicator from public to private or, in the case of per call unblocking of blocked lines, from private to public. Per line
blocking provides a permanent private indicator on a customer's line. Once per line blocking is established the private status can be changed by the customer only temporarily (for individual calls) by using per call unblocking. 723-7-5.3.2 Any public utility, or other telecommunications service provider, offering a Caller Identification service or any comparable service that identifies to the called party the name or telephone number, or both, of the calling party shall offer per call blocking using the activation code *67, per call unblocking using the activation code *82 for blocked lines, and per line blocking as services available to customers. 723-7-5.3.3 Per call blocking and per call unblocking shall be offered at no charge to the calling party. Per line blocking shall be offered at no charge for the first request of each subscriber. Domestic violence programs and law enforcement agencies shall always be offered per line blocking at no charge. 723-7-5.4 Last Call Return. 723-7-5.4.1 Last call return, upon dialing the activation code *69, automatically redials the number of the last incoming call to that line, whether the call was answered or not. The end-user does not have to know the number of the calling party. If the calling party's number is blocked by the calling party, last call return will not return the call. If the called number is busy, last call return will redial the called number for a limited period of time. A tone alerts the customer when the called line is available. 723-7-5.4.2 Any public utility, or other telecommunications service provider, offering a last call return service or any comparable service which allows a customer to dial a code that will cause the feature to automatically redial the number of the last incoming call to that line, including a feature which automatically redials the number of the last incoming call to that line whether the call was answered or not, shall offer per call blocking and per line blocking as services available to customers and shall prevent last call return-type features from returning blocked calls. 723-7-5.5 Call Trace. 723-7-5.5.1 Call trace allows a called party to initiate an automatic trace of the last call received. After receiving the call which is to be traced, the customer dials the *57 activation code and the traced telephone number is automatically sent to the telecommunications service provider for further action. The customer originating the trace will not receive the traced telephone number. The results of a trace will be furnished only to law enforcement agencies or authorities upon proper request by them. 723-7-5.5.2 Any public utility, or other telecommunications service provider, offering a Caller Identification service or any comparable service that identifies to the called party the name or telephone number, or both, of the calling party shall offer call trace. 723-7-5.6 Automatic Number Identification. 723-7-5.6.1 Automatic Number Identification ( ANI ): ANI allows a calling party's billing telephone number to be delivered as part of the telephone call completion and to be revealed to some called parties. 723-7-5.6.2 Any telecommunications service provider that provides ANI to any person shall provide such service under a contract or tariff that prohibits such person from reusing or selling the telephone number or billing information without first (A) notifying the originating telephone subscriber and (B) obtaining such subscriber's affirmative consent for such
reuse and sale. 723-7-5.6.3 Any telecommunications service provider must notify its customers, on at least an annual basis, that their telephone number may be identified to a called party. Any telecommunications service provider shall also inform its subscribers of services that deliver and reveal ANI that they are restricted from reusing or reselling a customer's ANI information. The notice to customers must provide: 723-7-5.6.3.1 An explanation that calling party telephone numbers, including non-listed or non-published numbers, may be revealed to called parties, and that called parties are restricted from reusing or selling calling parties' telephone numbers; 723-7-5.6.3.2 An explanation of which types of called parties (e.g., a non-exclusive, generic list of examples, specifically including reference to toll-free 1-800 type numbers and subscribers of the Integrated Services Digital Network (ISDN)) to whom the calling party's number may be revealed; and 723-7-5.6.4 All telecommunications service providers providing or participating in the provision of ANI service shall periodically, as specified by the Commission, produce a report to the Commission indicating the following: 723-7-5.6.4.1 How and when privacy safeguards, such as the safeguards currently required of providers of Caller Identification services, can be available as a result of technological advancements to ANI and associated technologies; and 723-7-5.6.4.2 How privacy safeguards similar to those provided with Caller Identification service, information necessary to the provision of 911 services, and toll billing information can concurrently be provided through ANI and associated services. 723-7-5.7 Any public utility, or other telecommunications service provider, offering a Caller Identification service or any comparable service that identifies to the called party the name or telephone number, or both, of the calling party, including ANI, shall conduct a thorough customer education program pursuant to the current Commission guidelines. These customer education programs shall be conducted upon the telecommunications service provider's introduction of the service and, thereafter, upon initiation of telecommunications service to a new customer. If the telecommunications service provider presently offers such a service, it shall conduct a customer education program for its existing customers and for future customers upon initiation of telecommunications service. This requirement is separate and distinct from the notification requirement contained in Rule 5.6.3. 723-7-5.8 Tariff Filing Requirements. Any telecommunications service provider offering the services described in Rules 5.3 through 5.6 shall file tariffs or price lists, as required by the Commission, specifying the rates, terms and conditions associated with the offering of such services in compliance with these rules. Such filings shall also describe, consistent with Rule 5.7, the effects of blocking, last call return, call trace, and ANI as they relate to disclosure of identifying information to third parties. 723-7-5.9 Exceptions. Rule 5 shall not apply to the following situations: 723-7-5.9.1 Requests for personal information authorized by Title 16, Article 15.5 C.R.S, or in the form of warrants, subpoenas duces tecum, or similar legal requests. 723-7-5.9.2 Requests for a customer's typical or estimated average monthly gas, steam or electric bill, if such information is requested by a licensed real estate broker or others with similar purchase or sale interests in the customer's property.
723-7-5.9.3 Personal information provided to the Colorado Department of Social Services and any energy assistance programs. 723-7-5.9.4 Personal information provided to emergency service providers. 723-7-5.9.5 Personal information necessary for the billing and collection of amounts owed to a public utility or to a provider of service using the facilities of a public utility. 723-7-5.9.6 When a public utility which offers basic service under Part 2 of Article 15, Title 40, provides the name address and telephone number (including those which are non-listed or non-published) of each of its customers to: 723-7-5.9.6.1 All persons who choose to participate in equal access balloting for oneplus interexchange telecommunications service; and 723-7-5.9.6.2 All persons who offer a telecommunications service in a non-equal access exchange which is specifically designed to compete with feature group C service of the one-plus telecommunications service provider in that exchange. Under Rule 5.9.6, the name, address and telephone numbers of non-listed and non-published customers can only be used once by these persons whenever these names, addresses and telephone numbers are permitted to be used under this Rule. 723-7-5.9.7 When a telecommunications service provider offers a Caller Identification service or any comparable service that identifies to the called party the name or telephone number, or both, of the calling party, and such provider is in compliance with Rules 5.3, 5.4, 5.5, 5.6, 5.7 and 5.8 of these rules. RULE (4 CCR) 723-7-6. DUAL PARTY RELAY SERVICES. 723-7-6.1 Information obtained by a public utility which is obtained through the relay of messages for a dual party relay system as defined in Section 40-17-102(3), C.R.S., shall be protected in accordance with Section 40-17-105(1), C.R.S. No written or electronic script shall be retained beyond the duration of the relayed call unless the destination telephone number is busy when the disabled person makes his or her initial call through the relay operator, in which case the relay operator will store the call until the destination telephone number is no longer busy. 723-7-6.2 Relay operators are prohibited from intentionally altering a relayed conversation. RULE (4 CCR) 723-7-7. REQUESTS FOR WAIVERS FROM THESE RULES. 723-7-7.1 A public utility desiring a waiver from these rules regulating the collection and disclosure of personal information may make that request by application and upon good cause shown may be granted a waiver by the Commission.