(d) Notwithstanding 47 U.S.C. 222(c)(2), and except as provided in paragraphs (d)(1) through (3) of this section, a covered provider; any officer, director, or employee of a covered provider; and any vendor, agent, or contractor of a covered provider that receives or processes line separation requests with the survivor's consent or as needed to effectuate the request, shall treat the fact of the line separation request and any information or documents a survivor submits under this subpart, including any customer proprietary network information, as confidential and securely dispose of the information not later than 90 days after receiving the information, except as provided in paragraphs (d)(2) and (3) of this section.
- (1) A covered provider may only disclose or permit access to information a survivor submits under this subpart pursuant to a valid court order; to the individual survivor submitting the line separation request; to anyone that the survivor specifically designates; to those third parties necessary to effectuate the request (i.e., vendors, contractors, and agents); or, to the extent necessary, to the Commission or the Universal Service Administrative Company for processing of emergency communications support through the Lifeline program for qualifying survivors, as provided in § 54.424 of this chapter.
- (2) A covered provider may retain any confidential record related to the line separation request for longer than 90 days upon receipt of a legitimate law enforcement request.
- (3) A covered provider may maintain a record that verifies that a survivor fulfilled the conditions of a line separation request under this subpart for longer than 90 days after receiving the information as long as the covered provider also treats such records as confidential and securely disposes of them. This record shall not contain the documentation of survivor status described in paragraph (a)(9) of this section or other original records a survivor submits with a request under this subpart.
- (4) A covered provider shall implement data security measures commensurate with the sensitivity of the information submitted with line separation requests, including policies and procedures governing confidential treatment and secure disposal of the information a survivor submits under this subpart, train employees on those policies and procedures, and restrict access to databases storing such information to only those employees who need access to that information.
- (5) A covered provider shall not use, process, or disclose the fact of a line separation request or any information or documentation provided with such a request to market any products or services.