div class="breadcrumb-container">

CPNI Compliance Policies of

City of LaGrange, Georgia

The following summary describes the policies of the City of LaGrange, Georgia (“City”) that are designed to protect the confidentiality of Customer Proprietary Network Information (“CPNI”) and to assure compliance with the rules of the Federal Communications Commission (“FCC”) set forth in 47 C.F.R. Part 64, Subpart U, Section 2001 et seq.


CPNI is “(A) information that relates to the quantity, technical configuration, type, destination, location, and amount of use of a telecommunications service subscribed to by any customer of a telecommunications carrier, and that is made available to the carrier by the customer solely by virtue of the carrier-customer relationship; and (B) information contained in the bills pertaining to telephone exchange service or telephone toll service received by a customer of a carrier.”


City’s policy, administered by its CPNI Compliance Manager Alan Slaughenhaupt, establishes the procedures and safeguards regarding City’s use and disclosure of CPNI set forth below.


I. USE, DISCLOSURE OF, AND ACCESS TO CPNI


City will use, disclose, or permit access to CPNI only in its provision of the communications service from which such information is derived; for services necessary to, or used in, the provision of such communications service, including the publishing of directories; to initiate, render, bill and collect for communications services; to protect the rights or property of City, or to protect users or other carriers or service providers from fraudulent, abusive or unlawful use of, or subscription to, such services; to provide inside wiring installation, maintenance, or repair services; as required by law; or as expressly authorized by the customer.


City does not use CPNI to market services. In the event that City later wishes to use CPNI for marketing or to seek customer approval for such use, such proposed use is subject to a supervisory review process that shall involve the CPNI Compliance Manager. If such use is approved, City shall modify these policies and conduct additional training as needed to assure compliance with the FCC’s rules.


City does not use, disclose or permit access to CPNI to identify or track customers that call competing service providers.


City does not use, disclose or permit access to any information provided by the customer when creating an account for our MyVoice Desktop or App Client.


In accordance with Section 222(b) of the Act, 47 U.S.C. § 222(b), when City receives or obtains proprietary information from another carrier for purposes of providing a telecommunications service, it only uses such information for such purpose, and does not use such information for its own marketing efforts.


II. SAFEGUARDS AGAINST DISCLOSURE OF CPNI TO UNAUTHORIZED PARTIES


Above and beyond the specific FCC requirements, City will take reasonable measures to discover and protect against attempts to gain unauthorized access to CPNI. If any employee becomes aware of new methods that are being used or could be used by third parties to attempt to obtain unauthorized access to CPNI, or of possible changes to City’s existing policies that would strengthen protection of CPNI, they should report such information immediately to City’s CPNI Compliance Manager so that City may evaluate whether existing policies should be supplemented or changed.


A. Inbound Calls to City Requesting CPNI

City does not provide Call Detail Information to inbound callers. CDI is a subset of CPNI that includes any information that pertains to the transmission of specific telephone calls, including, for outbound calls, the number called, and the time, location, or duration of any call and, for inbound calls, the number from which the call was placed, and the time, location, or duration of any call.

For CPNI other than CDI, prior to revealing any CPNI or account information to the caller, City requires an inbound caller to authenticate their identity through means that is appropriate for the information sought and which adheres to City’s duty to safeguard CPNI.


B. Online Accounts

To create an online account from which Customer can obtain some of their CPNI, such as billing information or App Access, Customer must enter a PIN that has been randomly assigned by the City and sent to the customer’s address of record. Because the PIN is randomly assigned, it is not expected to match any of Customer’s account or biographical information. The Customer may then set their own password. If the Customer forgets their password, they may request that a new temporary password be sent to their address of record.

City of LaGrange does not transfer does not collect, disclose, or transfer any personal information for MyVoice Desktop or App to third parties. MyVoice Desktop and App login information is provided to the customer upon installation of the product and the password cannot be accessed by any personnel, only reset upon customer request.


C. In-Person Disclosure of CPNI at City Offices

City may disclose a customer’s CPNI to an authorized person visiting a City office upon verifying that person’s identity through a valid, non-expired government-issued photo ID (such as a driver’s license, passport, or comparable ID) matching the customer’s account information.


D. Notice of Account Changes

When an address of record or password is created or changed, City will send a notice to customer’s prior address of record notifying them of the change. This notification is not required when the customer initiates service. The notice will not reveal the changed information and will direct the customer to notify City if they did not authorize the change. City does not use any online accounts, passwords or back-up authentication methods for accounts the change of which would require notice to customers.


III. REPORTING CPNI BREACHES TO LAW ENFORCEMENT


Any City employee that becomes aware of any breaches, suspected breaches or attempted breaches must report such information immediately to the City CPNI Compliance Manager. Such information must not be reported or disclosed by any employee to any non-employee, including the potentially affected customer, except in express conformance with the procedures described below. Any employee that fails to report such information will be subject to disciplinary action that may include termination.

It is City’s policy that employees should not be discouraged from reporting information about breaches that may have been caused in part by their own actions or omissions. Once a breach has occurred, the most important objective is to attempt to limit the damage to customers, make any adjustments as needed to prevent a recurrence of the breach, and to alert law enforcement promptly. Therefore, although employees who violate City’s CPNI compliance procedures are subject to discipline, the sanctions may be substantially reduced where employees promptly self-report violations if appropriate.

Nothing in this policy authorizes any employee to violate Georgia law. In the event of an apparent conflict between Georgia law and the FCC’s CPNI requirements or the requirements of this policy, the City CPNI Compliance Manager will consult the City’s legal counsel.


A. Identifying a “Breach”

A “breach” has occurred when a person, without authorization or exceeding authorization, has intentionally gained access to, used, or disclosed CPNI. If an employee has information about an incident and is not certain that the incident would not constitute a breach under this definition, the incident must be reported to the CPNI Compliance Manager.

If a City employee determines that an unauthorized person is attempting to gain access to CPNI but does not succeed at doing so, no breach has occurred. However, the incident must be reported to City’s CPNI Compliance Manager who will determine whether to report the incident to law enforcement or take other appropriate action. City’s Compliance Manager will determine whether it is appropriate to update City’s CPNI policies or training materials in light of the new information; the FCC’s rules require City on an ongoing basis to “take reasonable measures to discover and protect against activity that is indicative of pretexting.”


B. Notification Procedures

As soon as practicable, and in no event later than seven (7) business days upon learning of a breach, the City CPNI Compliance Manager shall electronically notify the United States Secret Service (USSS) and the Federal Bureau of Investigation (FBI) by accessing the following link:https://www.cpnireporting.gov. City will not notify customers or disclose a breach to the public until 7 full business days have passed after such notification and thereafter will promptly inform the customers whose CPNI was disclosed unless otherwise directed by the USSS or FBI.


IV. RECORD RETENTION


The CPNI Compliance Manager is responsible for assuring that City maintains for at least two years a record, electronically or in some other manner, of any breaches discovered, notifications made to the USSS and the FBI pursuant to these procedures, and notifications of breaches made to customers. The record must include, if available, dates of discovery and notification, a detailed description of the CPNI that was the subject of the breach, and the circumstances of the breach.

City maintains a record, for a period of at least one year, of those limited circumstances in which CPNI is disclosed or provided to third parties. If City later changes its policies to permit the use of CPNI for marketing, it will maintain a record, for at least one year, of supervisory review of marketing that proposes to use CPNI or to request customer approval to use or disclose CPNI.

City maintains a record of all customer complaints related to its handling of CPNI, and records of City’s handling of such complaints, for at least two years. The CPNI Compliance Manager will assure that all complaints are reviewed and that City considers any necessary changes to its policies or practices to address the concerns raised by such complaints.

City will have the City Manager, as its authorized officer and agent, sign a compliance certificate on an annual basis stating that the officer has personal knowledge that City has established operating procedures that are adequate to ensure its compliance with FCC’s CPNI rules. The certificate for each year will be filed with the FCC by March 1 of the ubsequent year, and will be accompanied by a summary or copy of this policy that explains how City’s operating procedures ensure that it is in compliance with the FCC’s CPNI rules. In addition, the filing must include an explanation of any actions taken against data brokers and a summary of all customer complaints received in the past year concerning the unauthorized release of CPNI.


V. TRAINING


All City employees with access to CPNI receive a summary of City’s CPNI policies and are informed that (i) any use or disclosure of CPNI or other act or omission not in compliance with such policies will result in disciplinary action, including the termination of employment where appropriate, and (ii) employees who knowingly facilitate the unauthorized disclosure of a customer’s confidential information may be subject to criminal penalties.


VI. Inquiries


Any inquiries about City Privacy Policies can be directed to: telecomorders@lagrangega.org