TMUS T Mobile US Inc

By Drew FitzGerald 

Federal Communications Commission enforcers told the country's top cellphone carriers to pay more than $200 million in penalties for allegedly mishandling sensitive location data, a punishment at least one of the companies has already vowed to contest.

The telecom regulator is seeking more than $91 million from T-Mobile US Inc., $57 million from AT&T Inc., $48 million from Verizon Communications Inc. and $12 million from Sprint Corp. T-Mobile said in a statement that it ended its location-sharing program in February 2019 and would fight the proposed fine.

"While we strongly support the FCC's commitment to consumer protection, we fully intend to dispute the conclusions of this NAL and the associated fine," a T-Mobile spokeswoman said, referring to the notices of apparent liability through which the five-member commission disclosed the fines. Spokespeople for AT&T, Verizon and Sprint said they were still reviewing the notices.

The FCC said the proposed penalty amounts reflected the length of time each carrier had shared information without proper safeguards and the number of entities that had access to the data. The Wall Street Journal reported Thursday that the FCC was seeking the fines.

The carriers can challenge the penalties proposed under the FCC's decision, which would also charge the companies for each future time they share cellphone coordinates without user permission.

"The FCC has long had clear rules on the books requiring all phone companies to protect their customers' personal information," FCC Chairman Ajit Pai said in a statement Friday. And since 2007, these companies have been on notice that they must take reasonable precautions to safeguard this data and that the FCC will take strong enforcement action if they don't."

Cellular location data is different from other location information that companies glean from smartphone apps and other sources. Users can often turn off settings that reveal their whereabouts to marketers, but phone companies need to know a phone's rough location to provide wireless service.

Privacy advocates and some government officials said the regulator's action didn't go far enough. Democratic Commissioner Geoffrey Starks said the FCC's investigation took too long and should have calculated the number of consumers actually affected by the alleged lapses.

"The FCC's investigation is a day late and a dollar short," fellow Democratic Commissioner Jessica Rosenworcel said in a statement, adding that a 30-day grace period for potential future violations amounted to a "get-out-of-jail-free" card.

Section 222 of the Communications Act requires phone companies to protect their customers' sensitive personal information, including location data. The enforcement action revealed Friday accuses the carriers of failing to make reasonable efforts to police third-party data handlers that had access to the information.

Sen. Ron Wyden (D., Ore.) urged the commission to investigate wireless service providers' stewardship of such sensitive information in a 2018 letter that highlighted alleged misuse of the data by Securus Technologies, a prison phone service provider. The Securus service, which was marketed as a tool to ferret out contraband cellphones in prisons and jails, allowed law enforcement clients to spot devices -- including those belonging to people who weren't incarcerated -- without a court order.

The FCC on Friday highlighted one case of a Missouri sheriff whose verification documents provided to Securus included copies of his personal health and auto-insurance policies. The commission said in a statement that carriers and those acting on their behalves need to secure customers' express consent before disclosing the data.

Securus said it discontinued the tool in May 2018.

Industry executives have said cellphone companies didn't generate much revenue from their contracts with middlemen offering location-based services. But some carriers struggled to quickly cut off the companies before they could develop an alternative system for services that subscribers might welcome, like highway towing companies.

T-Mobile Chief Executive John Legere said in early 2019 that the wireless company was "completely ending location aggregator work" within months. "We're doing it the right way to avoid impacting consumers who use these types of services for things like emergency assistance," he wrote on Twitter at the time.

T-Mobile agreed to merge with Sprint in an all-stock combination that was worth $26 billion when it was announced in early 2018. The two carriers won a federal court ruling earlier this month that paves the way for a transaction that would reshape the wireless industry. Executives have said they hope to close the merger on April 1.

--Sarah Krouse contributed to this article.

Write to Drew FitzGerald at andrew.fitzgerald@wsj.com

(END) Dow Jones Newswires

February 28, 2020 17:57 ET (22:57 GMT)

Copyright (c) 2020 Dow Jones & Company, Inc.