TMUS T Mobile US Inc

By Drew FitzGerald 

Federal Communications Commission enforcers told the country's top cellphone carriers to pay more than $200 million in penalties for allegedly mishandling sensitive location data, a punishment at least one of the companies has already vowed to contest.

The telecom regulator is seeking more than $91 million from T-Mobile US Inc., $57 million from AT&T Inc., $48 million from Verizon Communications Inc. and $12 million from Sprint Corp. T-Mobile said in a statement that it would fight the proposed fine.

The FCC said the proposed penalties reflect the amount of time each carrier had shared information without proper safeguards and the number of entities that had access to the data. The Wall Street Journal reported Thursday that the FCC was seeking the fines.

The commission voted to levy the fines through notices of apparent liability, which the companies can challenge. The FCC decision would also charge the companies for each future time they share cellphone coordinates without user permission.

"The FCC has long had clear rules on the books requiring all phone companies to protect their customers' personal information," FCC Chairman Ajit Pai said in a statement. And since 2007, these companies have been on notice that they must take reasonable precautions to safeguard this data and that the FCC will take strong enforcement action if they don't."

Cellular location data is different from other location information that companies glean from smartphone apps and other sources. Users can often turn off settings that reveal their whereabouts to marketers, but phone companies need to know a phone's rough location to provide wireless service.

Democratic Commissioner Geoffrey Starks said the commission's investigation took too long and should have calculated the number of consumers affected by the alleged lapses.

"The FCC's investigation is a day late and a dollar short," fellow Democratic Commissioner Jessica Rosenworcel said in a statement, adding that a 30-day grace period for potential future violations amounted to a "get-out-of-jail-free" card.

Section 222 of the Communications Act requires phone companies to protect their customers' sensitive personal information, including location data. The enforcement action revealed Friday accuses the carriers of failing to make reasonable efforts to police third-party data handlers that had access to the information.

Sen. Ron Wyden (D., Ore.) urged the commission to investigate wireless service providers' stewardship of such sensitive information in a 2018 letter that highlighted alleged misuse of the data by Securus Technologies, a prison phone service provider. The Securus service, which was marketed as a tool to ferret out contraband cellphones in prisons and jails, allowed law enforcement clients to spot devices -- including those belonging to people who weren't incarcerated -- without a court order.

The FCC on Friday highlighted one case of a Missouri sheriff whose verification documents provided to Securus included copies of his personal health and auto-insurance policies. The commission said in a statement that carriers and those acting on their behalves need to secure customers' express consent before disclosing the data.

Securus said it discontinued the tool in May 2018.

Industry executives have said cellphone companies didn't generate much revenue from their contracts with middlemen offering location-based services. But some carriers struggled to quickly cut off the companies before they could develop an alternative system for services that subscribers might welcome, like highway towing companies.

T-Mobile Chief Executive John Legere said in early 2019 that the wireless company was "completely ending location aggregator work" within months. "We're doing it the right way to avoid impacting consumers who use these types of services for things like emergency assistance," he wrote on Twitter at the time.

--Sarah Krouse contributed to this article.

Write to Drew FitzGerald at andrew.fitzgerald@wsj.com

(END) Dow Jones Newswires

February 28, 2020 15:39 ET (20:39 GMT)

Copyright (c) 2020 Dow Jones & Company, Inc.