On October 24, 2014, the FCC issued a press release announcing its proposal to fine TerraCom, Inc. and YourTel America, Inc. $10 million for alleged violations of the Communications Act of 1934 for violating the privacy of its phone customers' personal information when it allegedly stored the information online in an accessible format (see 47 U.S.C § 151, et seq.). The FCC claims TerraCom and YourTel stored Social Security numbers, names, addresses, driver's licenses and other sensitive personal information on internet servers that were accessible to the public.

According to the FCC's announcement, both companies' privacy policies claimed that the companies had technology and security features in place to safeguard the privacy of customer information from unauthorized access or improper use. However, the FCC found that from September 2012 to April 2013, sensitive personal information the companies collected was stored on the internet in a format that was accessible and readable by anyone. The FCC further alleged that even after the companies learned of this security breach, they failed to notify all potentially affected consumers.

This case marks the FCC's first data security enforcement action. The Notice of Apparent Liability can be found on the FCC's website.

Update: On July 9, 2015, the FCC issued a press release announcing that it entered into a consent decree under which TerraCom and YourTel America have agreed to pay $3.5 million to resolve the investigation into whether the companies failed to properly protect the confidentiality of personal information they received from more than 300,000 consumers. The settlement also resolves the FCC’s investigation into YourTel’s alleged failure to comply with Commission instructions to remove ineligible Lifeline subscribers.