Comcast 2015 Annual Report Download - page 26

retransmission consent with local broadcast television stations, and subjecting such negotiations to the
good-faith requirements under the FCC’s rules. Any such reclassification could influence the U.S. Copyright
Office to extend the compulsory license to OVDs.
Privacy and Data Security Regulation
The Communications Act generally restricts the nonconsensual collection and disclosure to third parties of
cable customers’ personally identifiable information by cable operators, except for rendering service, conduct-
ing legitimate business activities related to the service, and responding to legal requests. We are also subject
to various state and federal regulations that provide privacy protections for customer proprietary network
information (“CPNI”) related to our voice services. The FCC expects broadband Internet access service pro-
viders such as us to take reasonable, good faith steps to comply with existing statutory requirements to
protect broadband CPNI and plans to propose new privacy and data security rules for broadband ISPs in
2016. The FCC has recently imposed substantial civil penalties and remediation obligations on several
companies for alleged privacy and data security violations. In 2015, Comcast entered into a settlement with a
California regulatory commission regarding Comcast’s inadvertent disclosure of customer telephone numbers
for which customers had requested non-published or non-listed status.
The FTC exercises authority over privacy protections generally, using its existing authority over unfair and
deceptive acts or practices to apply greater restrictions on the collection and use of personally identifiable
and other information relating to consumers. It also has undertaken numerous enforcement actions against
parties that do not provide sufficient security protections against the loss or unauthorized disclosure of this
type of information. We also are subject to stringent data security and data retention requirements on website
operators and online services that are directed to children under 13 years of age, or that knowingly collect or
post personal information from children under 13 years of age. Other privacy-oriented laws have been
extended by courts to online video providers and are increasingly being used in privacy lawsuits, including
class actions, against providers of video materials online.
We are also subject to state and federal “do not call” laws regarding telemarketing and state and federal laws
regarding unsolicited commercial emails, as well as FCC regulations relating to automated telemarketing
calls, texts or SMS messages. The FTC and state attorneys general also have initiated efforts to increase and
enforce transparency requirements about the collection and use of consumer information, even in an
aggregated, non-customer-identifiable form, which may require ongoing review of new and rapidly evolving
technologies and methods for delivering content and advertising to ensure that appropriate notice is given to
consumers and consent is obtained where required.
We are also subject to state and federal laws and regulations regarding data security that primarily apply to
sensitive personal information that could be used to commit identity theft. Most states have security breach
notification laws that generally require a business to give notice to consumers and government agencies
when certain information has been disclosed due to a security breach, and the FCC has adopted security
breach rules for voice services. Several states have also enacted general data security requirements to safe-
guard consumer information, including the proper disposal of consumer information.
The National Institute of Standards and Technology, in cooperation with other federal agencies and owners
and operators of U.S. critical infrastructure, including us, have developed a voluntary framework that provides
a prioritized, flexible, repeatable, performance-based and cost-effective approach to cybersecurity risk. It is a
compendium of existing cross-sector cyber-defense processes, practices and protocols that can help
companies identify, assess and manage their cyber risks and vulnerabilities, and several government agen-
cies have encouraged compliance with this framework. Additionally, in December 2015, Congress enacted
the Cybersecurity Act of 2015, which is intended to encourage and facilitate the sharing of security threat and
defensive measure information with government agencies and other companies, in order to strengthen the
23 Comcast 2015 Annual Report on Form 10-K