You are on page 1of 10

Marlene H. Dortch, Secretary Federal Communications Commission 445 12th Street, SW Suite TW- !

25 Washin"ton, DC 2#554

Annual 47 C.F.R. 64.2009(e) CPNI Certification EB oc!et 06"#6


nnual $4.2##%&e' C()* Certi+ication +or 2#1! Date Filed, -anuary 2., 2#14 )ame o+ Com/any co0ered 1y this certi+ication, Dun2ir2 and Fredonia Tele/hone Com/any Form 4%% Filer *D, 3#3.43 )ame o+ Si"natory, 4urt W. Maytum Title o+ Si"natory, (resident5CT6 *, 4urt W. Maytum, certi+y that * am an o++icer o+ the Com/any named a1o0e, and actin" as an a"ent o+ the Com/any, that * ha0e /ersonal 2no7led"e that the Com/any has esta1lished o/eratin" /rocedures that are ade8uate to ensure com/liance 7ith the Commission9s C()* rules. See 4. C.F.:. ; $4.2##1 et seq. ttached to this certi+ication is an accom/anyin" statement e</lainin" ho7 the Com/any9s /rocedures ensure that the Com/any is in com/liance 7ith the re8uirements set +orth in section $4.2##1 et seq. o+ the Commission9s rules. The Com/any has not ta2en any actions &/roceedin"s instituted or /etitions +iled 1y a com/any at either state commission, the court system, or at the Commission a"ainst data 1ro2ers' a"ainst data 1ro2ers in the /ast year. Com/anies must re/ort on any in+ormation that they ha0e 7ith res/ect to the /rocesses /rete<ters are usin" to attem/t to access C()*, and 7hat ste/s com/anies are ta2in" to /rotect C()*. The Com/any has not recei0ed any customer com/laints in the /ast year concernin" the unauthori=ed release o+ C()* &num1er o+ customer com/laints a com/any has recei0ed related to unauthori=ed access to C()*, or unauthori=ed disclosure o+ C()*, 1ro2en do7n 1y cate"ory or com/laint, e.g., instances o+ im/ro/er access 1y em/loyees, instances o+ im/ro/er disclosure to indi0iduals not authori=ed to recei0e the in+ormation, or instances o+ im/ro/er access to online in+ormation 1y indi0iduals not authori=ed to 0ie7 the in+ormation'. The com/any re/resents and 7arrants that the a1o0e certi+ication is consistent 7ith 4.. C.F.:. ; 1.1. 7hich re8uires truth+ul and accurate statements to the Commission. The com/any also ac2no7led"es that +alse statements and misre/resentations to the Commission are /unisha1le under Title 13 o+ the >.S. Code and may su1?ect it to en+orcement action. Si"ned@5s5 4urt W. Maytum@@@@@@@@@@@@@@@@@@@@@@@@@@ 4urt W. Maytum (resident A CT6 cc, Telecommunications Consumers Di0ision, Bn+orcement Cureau Cest Co/y and (rintin", *nc.

B<hi1it 1 $N%IR% AN FRE &NIA 'E(EP)&NE C&*PAN+ ,'A'E*EN' E-P(AININ. )&/ ')E C&*PAN+0, &PERA'IN. PR&CE $RE, EN,$RE C&*P(IANCE /I') ')E FCC0, CPNI R$(E, I. Cu1to2er Pro3rietar4 Net5or! Infor2ation (6CPNI7) C()* is de+ined in Section 222&+' o+ the Communications ct as & ' in+ormation that relates to the 8uantity, technical con+i"uration, ty/e, destination, and amount o+ use o+ a telecommunications ser0ice su1scri1ed to 1y any customer o+ a telecommunications carrier, and that is made a0aila1le to the carrier 1y the customer solely 1y 0irtue o+ the carriercustomer relationshi/D and &C' in+ormation contained in the 1ills /ertainin" to tele/hone e<chan"e ser0ice or tele/hone toll ser0ice recei0ed 1y a customer o+ a carrier &e<ce/t that C()* does not include su1scri1er list in+ormation'. Eenerally, C()* includes /ersonal in+ormation re"ardin" a consumer9s use o+ his or her telecommunications ser0ices. C()* encom/asses in+ormation such as, &a' the tele/hone num1ers called 1y a consumerD &1' the tele/hone num1ers callin" a customerD &c' the time, location and duration o+ a consumer9s out1ound and in1ound /hone calls, and &d' the telecommunications and in+ormation ser0ices /urchased 1y a consumer. Call detail in+ormation &also 2no7n as Fcall recordsG' is a cate"ory o+ C()* that is /articularly sensiti0e +rom a /ri0acy stand/oint and that is sou"ht 1y /rete<ters, hac2ers and other unauthori=ed entities +or ille"itimate /ur/oses. Call detail includes any in+ormation that /ertains to the transmission o+ a s/eci+ic tele/hone call, includin" the num1er called &+or out1ound calls', the num1er +rom 7hich the call 7as /laced &+or in1ound calls', and the date, time, location and5or duration o+ the call &+or all calls'. II. $1e an8 i1clo1ure of CPNI I1 Re1tricte8 The Com/any reco"ni=es that C()* includes in+ormation that is /ersonal and indi0idually identi+ia1le, and that /ri0acy concerns ha0e led Con"ress and the FCC to im/ose restrictions u/on its use and disclosure, and u/on the /ro0ision o+ access to it 1y indi0iduals or entities inside and outside the Com/any. The Com/any has desi"nated a C()* Com/liance 6++icer 7ho is res/onsi1le +or, &1' communicatin" 7ith the Com/any9s attorneys and5or consultants re"ardin" C()* res/onsi1ilities, re8uirements and restrictionsD &2' su/er0isin" the trainin" o+ Com/any em/loyees and a"ents 7ho use or ha0e access to C()*D &!' su/er0isin" the use, disclosure, distri1ution or access to the Com/any9s C()* 1y inde/endent contractors and ?oint 0enture /artnersD &4' maintainin" records re"ardin" the use o+ C()* in mar2etin" cam/ai"nsD and &5' recei0in", re0ie7in" and resol0in" 8uestions or issues re"ardin" use, disclosure, distri1ution or /ro0ision o+ access to C()*.

Com/any em/loyees and a"ents that may deal 7ith C()* ha0e 1een in+ormed that there are su1stantial +ederal restrictions u/on C()* use, distri1ution and access. *n order to 1e authori=ed to use or access the Com/any9s C()*, em/loyees and a"ents must recei0e trainin" 7ith res/ect to the re8uirements o+ Section 222 o+ the Communications ct and the FCC9s C()* :ules &Su1/art > o+ (art $4 o+ the FCC :ules'. Ce+ore an a"ent, inde/endent contractor or ?oint 0enture /artner may recei0e or 1e allo7ed to access or use the Com/any9s C()*, the a"ent9s, inde/endent contractor9s or ?oint 0enture /artner9s a"reement 7ith the Com/any must contain /ro0isions &or the Com/any and the a"ent, inde/endent contractor or ?oint 0enture /artner must enter into an additional con+identiality a"reement 7hich /ro0ides' that, &a' the a"ent, inde/endent contractor or ?oint 0enture /artner may use the C()* only +or the /ur/ose +or 7hich the C()* has 1een /ro0idedD &1' the a"ent, inde/endent contractor or ?oint 0enture /artner may not disclose or distri1ute the C()* to, or allo7 access to the C()* 1y, any other /arty &unless the a"ent, inde/endent contractor or ?oint 0enture /artner is e</ressly and s/eci+ically re8uired to do so 1y a court order'D and &c' the a"ent, inde/endent contractor or ?oint 0enture /artner must im/lement a//ro/riate and s/eci+ic sa+e"uards acce/ta1le to the Com/any to ensure the con+identiality o+ the Com/any9s C()*. III. Protection of CPNI 1. The Com/any may, a+ter recei0in" an a//ro/riate 7ritten re8uest +rom a customer, disclose or /ro0ide the customer9s C()* to the customer 1y sendin" it to the customer9s address or record. ny and all such customer re8uests, &1' must 1e made in 7ritin"D &2' must include the customer9s correct 1illin" name and address and tele/hone num1erD &!' must s/eci+y e<actly 7hat ty/e or ty/es o+ C()* must 1e disclosed or /ro0idedD &4' must s/eci+y the time /eriod +or 7hich the C()* must 1e disclosed or /ro0idedD and &5' must 1e si"ned 1y the customer. The Com/any 7ill disclose C()* u/on a++irmati0e 7ritten re8uest 1y the customer to any /erson desi"nated 1y the customer, 1ut only a+ter the Com/any calls the customer9s tele/hone num1er o+ record and5or sends a noti+ication to the customer9s address o+ record to 0eri+y the accuracy o+ this re8uest. 2. The Com/any 7ill /ro0ide a customer9s /hone records or other C()* to a la7 en+orcement a"ency in accordance 7ith a//lica1le le"al re8uirements. !. The Com/any retains all customer /ass7ords and Fshared secretG 8uestion-ans7er com1inations in secure +iles that may 1e accessed only 1y authori=ed Com/any em/loyees 7ho need such in+ormation in order to authenticate the identity o+ customers re8uestin" call detail in+ormation o0er the tele/hone. 4. Com/any em/loyees authenticate all tele/hone re8uests +or C()* in the same manner 7hether or not the C()* consists o+ call detail in+ormation. That is, Com/any em/loyees must, &a' 1e +urnished the customer9s /re-esta1lished /ass7ord &or correct ans7ers to the 1ac2-u/ Fshared secretG com1inations'D &1' send the re8uested in+ormation to the customer9s /ostal or electronic Faddress o+ recordG &see de+inition a1o0e'DG or &c' call the customer 1ac2

at the customer9s Ftele/hone num1er o+ recordG &see de+inition a1o0e' 7ith the re8uested in+ormation. 5. *+ a customer su1scri1es to multi/le ser0ices o++ered 1y the Com/any and an a++iliate, the Com/any is /ermitted to share the customer9s C()* re"ardin" such ser0ices 7ith its a++iliate. *+ a customer does not su1scri1e to any telecommunications or non-telecommunications ser0ices o++ered 1y an a++iliate, the Com/any is not /ermitted to share the customer9s C()* 7ith the a++iliate 7ithout the customer9s consent /ursuant to the a//ro/riate notice and a//ro0al /rocedures set +orth in Sections $4.2##., $4.2##3 and $4.2##% o+ the FCC9s :ules. $. When an e<istin" customer calls the Com/any to in8uire a1out or order ne7, additional or modi+ied ser0ices &in-1ound mar2etin"', the Com/any may use the customer9s C()* other than call detail C()* to assist the customer +or the duration o+ the customer9s call i+ the Com/any /ro0ides the customer 7ith the oral notice re8uired 1y Sections $4.2##3&c' and $4.2##3&+' o+ the FCC9s :ules and a+ter the Com/any authenticates the customer. The Com/any discloses or releases call detail in+ormation to customers durin" customerinitiated tele/hone contacts only 7hen the customer /ro0ides a /re-esta1lished /ass7ord. *+ the customer does not /ro0ide a /ass7ord, call detail in+ormation is released only 1y sendin" it to the customer9s address o+ record or 1y the carrier callin" the customer at the tele/hone num1er o+ record. *+ the customer is a1le to /ro0ide to the Com/any durin" a customerinitiated tele/hone call, all o+ the call detail in+ormation necessary to address a customer ser0ice issue &i.e., the tele/hone num1er called, 7hen it 7as called, and, i+ a//lica1le, the amount char"ed +or the call' 7ithout Com/any assistance, then the Com/any may ta2e routine customer ser0ice actions related to such in+ormation. &Ho7e0er, under this circumstance, the Com/any may not disclose to the customer any call detail in+ormation a1out the customer account other than the call detail in+ormation that the customer /ro0ides 7ithout the customer +irst /ro0idin" a /ass7ord.' .. The Com/any uses, discloses, and5or /ermits access to C()* in connection 7ith Com/any-initiated mar2etin" o+ ser0ices to 7hich a customer does not already su1scri1e +rom the Com/any &out-1ound mar2etin"' only /ursuant to the notice and a//ro0al /rocedures set +orth in Sections $4.2##., $4.2##3, and $4.2##% o+ the FCC9s :ules. ll /ro/osed out-1ound mar2etin" acti0ities are re0ie7ed 1y the Com/any9s C()* Com/liance 6++icer +or com/liance 7ith the C()* restrictions and re8uirements in the Communications ct and the FCC :ules. 3. The Com/any maintains a//ro/riate /a/er and5or electronic records that allo7 its em/loyees, inde/endent contractors and ?oint 0enture /artners to clearly esta1lish the status o+ each customer9s 6ut-out and5or 6/t-*n a//ro0als &i+ any' /rior to use o+ the customer9s C()*. These records include, &i' the date&s' o+ any and all o+ the customer9s deemed 6/t-out a//ro0als and5or 6/t-in a//ro0als, to"ether 7ith the dates o+ any modi+ications or re0ocations o+ such a//ro0alsD and &ii' the ty/e&s' o+ C()* use, access, disclosure and5or distri1ution a//ro0ed 1y the customer.

%. Ce+ore a customer9s C()* can 1e used in an out-1ound mar2etin" acti0ity or cam/ai"n, the Com/any9s records must 1e chec2ed to determine the status o+ the customer9s C()* a//ro0al. Com/any em/loyees, inde/endent contractors and ?oint 0enture /artners are re8uired to noti+y the C()* Com/liance 6++icer o+ any access, accuracy or security /ro1lems they encounter 7ith res/ect to these records. *+ ne7, additional or e<tended a//ro0als are necessary, the C()* Com/liance 6++icer 7ill determine 7hether the Com/any9s F6/t-6ut C()* )oticeG or F6/t-*n C()* )oticeG must 1e used 7ith res/ect to 0arious /ro/osed out-1ound mar2etin" acti0ities. 1#. The C()* Com/liance 6++icer 7ill maintain a record o+ each out-1ound mar2etin" acti0ity or cam/ai"n, includin", &i' a descri/tion o+ the cam/ai"nD &ii' the s/eci+ic C()* that 7as used in the cam/ai"nD &iii' the date and /ur/ose o+ the cam/ai"n, and &i0' 7hat /roducts and ser0ices 7ere o++ered as /art o+ the cam/ai"n. This record shall 1e maintained +or a minimum o+ one year. 11. The Com/any9s em/loyees and 1illin" a"ents may use C()* to initiate, render, 1ill and collect +or telecommunications ser0ices. The Com/any may o1tain in+ormation +rom ne7 or e<istin" customers that may constitute C()* as /art o+ a//lications or re8uests +or ne7, additional or modi+ied ser0ices, and its em/loyees and a"ents may use such customer in+ormation &7ithout +urther customer a//ro0al' to initiate and /ro0ide the ser0ices. Hi2e7ise, the Com/any9s em/loyees and 1illin" a"ents may use customer ser0ice and callin" records &7ithout customer a//ro0al', &a' to 1ill customers +or ser0ices rendered to themD &1' to in0esti"ate and resol0e dis/utes 7ith customers re"ardin" their 1illsD and &c' to /ursue le"al, ar1itration, or other /rocesses to collect late or un/aid 1ills +rom customers. 12. The Com/any9s em/loyees and a"ents may use C()* 7ithout customer a//ro0al to /rotect the Com/any9s ri"hts or /ro/erty, and to /rotect users and other carriers +rom +raudulent, a1usi0e or ille"al use o+ &or su1scri/tion to' the telecommunications ser0ice +rom 7hich the C()* is deri0ed. Cecause alle"ations and in0esti"ations o+ +raud, a1use and ille"al use constitute 0ery sensiti0e matters, any access, use, disclosure or distri1ution o+ C()* /ursuant to this Section must 1e e</ressly a//ro0ed in ad0ance and in 7ritin" 1y the Com/any9s C()* Com/liance 6++icer. 1!. The Com/any9s em/loyees, a"ents, inde/endent contractors and ?oint 0enture /artners may N&' use C()* to identi+y or trac2 customers 7ho ha0e made calls to, or recei0ed calls +rom, com/etin" carriers. )or may the Com/any9s em/loyees, a"ents, inde/endent contractors or ?oint 0enture /artners use or disclose C()* +or /ersonal reasons or /ro+it. 14. Com/any /olicy mandates that +iles containin" C()* 1e maintained in a secure manner such that they cannot 1e used, accessed, disclosed or distri1uted 1y unauthori=ed indi0iduals or in an unauthori=ed manner. 15. (a/er +iles containin" C()* are 2e/t in secure areas, and may not 1e used, remo0ed, or co/ied in an unauthori=ed manner.

1$. Com/any em/loyees, a"ents, inde/endent contractors and ?oint 0enture /artners are re8uired to noti+y the C()* Com/liance 6++icer o+ any access or security /ro1lems they encounter 7ith res/ect to +iles containin" C()*. 1.. The Com/any may /ermit its customers to esta1lish online accounts, 1ut must re8uire an a//ro/riate /ass7ord to 1e +urnished 1y the customer 1e+ore he or she can access any C()* in his or her online account. (ass7ords may )6T 1e 1ased u/on readily o1taina1le 1io"ra/hical in+ormation &e.g., the customer9s name, mother9s maiden name, social security num1er or date o+ 1irth' or account in+ormation & e.g., the customer9s tele/hone num1er or address'. 13. Customers may o1tain an initial or re/lacement /ass7ord, &i' i+ they come in /erson to the Com/any9s 1usiness o++ice, /roduce a dri0er9s license, /ass/ort or other "o0ernmentissued identi+ication 0eri+yin" their identity, and correctly ans7er certain 8uestions re"ardin" their ser0ice and addressD or &ii' i+ they call a s/eci+ied Com/any tele/hone num1er +rom their tele/hone num1er o+ record, and then 7ait at that num1er until a Com/any re/resentati0e calls them 1ac2 and o1tains correct ans7ers to certain 8uestions re"ardin" their ser0ice and address. 1%. The Com/any 7ill noti+y customers immediately o+ certain chan"es in their accounts that may a++ect /ri0acy or security matters. a. The ty/es o+ chan"es that re8uire immediate noti+ication include, &a' chan"e or re8uest +or chan"e o+ the customer9s /ass7ordD &1' chan"e or re8uest +or chan"e o+ the customer9s address o+ recordD &c' chan"e or re8uest +or chan"e o+ any si"ni+icant element o+ the customer9s online accountD and &d' a chan"e or re8uest +or chan"e to the customer9s res/onses 7ith res/ect to the 1ac2-u/ means o+ authentication +or lost or +or"otten /ass7ords. 1. The notice may 1e /ro0ided 1y, &a' a Com/any call or 0oicemail to the customer9s tele/hone num1er o+ recordD &1' a Com/any te<t messa"e to the customer9s tele/hone num1er o+ recordD or &c' a 7ritten notice mailed to the customer9s address o+ record &to the customer9s /rior address o+ record i+ the chan"e includes a chan"e in the customer9s address o+ record'. c. The notice must identi+y only the "eneral ty/e o+ chan"e and must not re0eal the chan"ed in+ormation. d. The Com/any em/loyee or a"ent sendin" the notice must /re/are and +urnish to the C()* Com/liance 6++icer a memorandum containin", &a' the name, address o+ record, and tele/hone num1er o+ record o+ the customer noti+iedD &1' a co/y or the e<act 7ordin" o+ the te<t messa"e, 7ritten notice, tele/hone messa"e or 0oicemail messa"e com/risin" the noticeD and &c' the date and time that the notice 7as sent.

2#. The Com/any must /ro0ide an initial notice to la7 en+orcement and a su1se8uent notice to the customer i+ a security 1reach results in the disclosure o+ the customer9s C()* to a third /arty 7ithout the customer9s authori=ation. a. s soon as /ractica1le &and in no e0ent more than se0en &.' days' a+ter the Com/any disco0ers that a /erson &7ithout authori=ation or e<ceedin" authori=ation' has intentionally "ained access to, used or disclosed C()*, the Com/any must /ro0ide electronic noti+ication o+ such 1reach to the >nited States Secret Ser0ice and to the Federal Cureau o+ *n0esti"ation 0ia a central re/ortin" +acility accessed throu"h a lin2 maintained 1y the FCC at htt/,55777.+cc."o05e15c/ni. 21. The Com/any 7ill /ro0ide customers 7ith access to C()* at its retail locations i+ the customer /resents a 0alid /hoto *D and the 0alid /hoto *D matches the name on the account. 22. The Com/any ta2es reasona1le measures to disco0er and /rotect a"ainst acti0ity that is indicati0e o+ /rete<tin" includin" re8uirin" Com/any em/loyees, a"ents, inde/endent contractors and ?oint 0enture /artners to noti+y the C()* Com/liance 6++icer immediately 1y 0oice, 0oicemail or email o+, &a' any sus/icious or unusual call re8uestin" a customer9s call detail in+ormation or other C()* &includin" a call 7here the caller +urnishes an incorrect /ass7ord or incorrect ans7er to one or 1oth o+ the Fshared secretG 8uestion-ans7er com1inations'D &1' any sus/icious or unusual attem/t 1y an indi0idual to chan"e a customer9s /ass7ord or account in+ormation &includin" /ro0idin" inade8uate or ina//ro/riate identi+ication or incorrect Faddress or record,G Ftele/hone num1er o+ recordG or other si"ni+icant ser0ice in+ormation'D &c' any and all disco0ered instances 7here access to the Com/any9s electronic +iles or data1ases containin" /ass7ords or C()* 7as denied due to the /ro0ision o+ incorrect lo"ins and5or /ass7ordsD and &d' any com/laint 1y a customer o+ unauthori=ed or ina//ro/riate use or disclosure o+ his or her C()*. The C()* Com/liance 6++icer 7ill re8uest +urther in+ormation in 7ritin", and in0esti"ate or su/er0ise the in0esti"ation o+, any incident or "rou/ o+ incidents that reasona1ly a//ear to entail /rete<tin".

I9. CPNI Co23liance &fficer *n addition to the s/eci+ic matters re8uired to 1e re0ie7ed and a//ro0ed 1y the Com/any9s C()* Com/liance 6++icer, em/loyees and a"ents, inde/endent contractors and ?oint 0enture /artners are stron"ly encoura"ed to 1rin" any and all other 8uestions, issues or uncertainties re"ardin" the use, disclosure, or access to C()* to the attention o+ the Com/any9s C()* Com/liance 6++icer +or a//ro/riate in0esti"ation, re0ie7 and "uidance. The e<tent to 7hich a /articular em/loyee or a"ent 1rou"ht a C()* matter to the attention o+ the C()* Com/liance 6++icer and recei0ed a//ro/riate "uidance is a material consideration in any disci/linary action 1rou"ht a"ainst the em/loyee or a"ent +or im/ermissi1le use, disclosure or access to C()*.

9. i1ci3linar4 Proce8ure1 The Com/any has in+ormed its em/loyees and a"ents, inde/endent contractors and ?oint 0enture /artners that it considers com/liance 7ith the Communications ct and FCC :ules re"ardin" the use, disclosure, and access to C()* to 1e 0ery im/ortant. Iiolation 1y Com/any em/loyees or a"ents o+ such C()* re8uirements 7ill lead to disci/linary action &includin" remedial trainin", re/rimands, un+a0ora1le /er+ormance re0ie7s, /ro1ation, and termination', de/endin" u/on the circumstances o+ the 0iolation &includin" the se0erity o+ the 0iolation, 7hether the 0iolation 7as a +irst time or re/eat 0iolation, 7hether a//ro/riate "uidance 7as sou"ht or recei0ed +rom the C()* Com/liance 6++icer, and the e<tent to 7hich the 0iolation 7as or 7as not deli1erate or malicious'. Iiolation 1y Com/any inde/endent contractors or ?oint 0enture /artners o+ such C()* re8uirements 7ill lead to /rom/t disci/linary action &u/ to and includin" remedial trainin" and termination o+ the contract'.

B<hi1it 2 $N%IR% AN FRE &NIA 'E(EP)&NE C&*PAN+ ,'A'E*EN' &F AC'I&N, 'A%EN A.AIN,' A'A BR&%ER, . Durin" Calendar Jear 2#1!, the Com/any has instituted the +ollo7in" /roceedin", or +iled the +ollo7in" /etitions, a"ainst data 1ro2ers 1e+ore the Federal Communications Commission, )6)B C. Durin" Calendar Jear 2#1!, the Com/any has instituted the +ollo7in" /roceedin", or +iled the +ollo7in" /etitions, a"ainst data 1ro2ers 1e+ore the )BW J6:4 C6MM*SS*6), )6)B C. Durin" Calendar Jear 2#1!, the Com/any has instituted the +ollo7in" /roceedin", or +iled the +ollo7in" /etitions, a"ainst data 1ro2ers 1e+ore the +ollo7in" +ederal or state courts, )6)B

B<hi1it ! $N%IR% AN FRE &NIA 'E(EP)&NE C&*PAN+ ,$**AR+ &F C$,'&*ER C&*P(AIN', RE.AR IN. $NA$')&RI:E RE(EA,E &F CPNI . Durin" Calendar Jear 2#1!, the Com/any has recei0ed the +ollo7in" num1er o+ customer com/laints related to unauthori=ed access to, or disclosure o+, C()* due to im/ro/er access 1y Com/any em/loyees, )6)B C. Durin" Calendar Jear 2#1!, the Com/any has recei0ed the +ollo7in" num1er o+ customer com/laints related to unauthori=ed access to, or disclosure o+, C()* due to im/ro/er disclosure to indi0iduals not authori=ed to recei0e the in+ormation, )6)B C. Durin" Calendar Jear 2#1!, the Com/any has recei0ed the +ollo7in" num1er o+ customer com/laints related to unauthori=ed access to, or disclosure o+, C()* due to im/ro/er access to online in+ormation 1y indi0iduals not authori=ed to 0ie7 the in+ormation, )6)B D. Durin" Calendar Jear 2#1!, the Com/any has 1ecome a7are o+ the +ollo7in" /rocesses that /rete<ters are usin" to attem/t to access its C()*, )6)B