(a) A TRS provider may obtain approval through written, oral, electronic, or sign language methods.

(1) A TRS provider relying on oral or sign language approval shall bear the burden of demonstrating that such approval has been given in compliance with the Commission's rules in this part.

(2) Approval or disapproval to use, disclose, or permit access to a customer's CPNI obtained by a TRS provider must remain in effect until the customer revokes or limits such approval or disapproval. A TRS provider shall accept any such customer revocation, whether in written, oral, electronic, or sign language methods.

(3) A TRS provider must maintain records of approval, whether oral, written, electronic, or sign language, during the time period that the approval or disapproval is in effect and for at least one year thereafter.

(b) Use of opt-in and opt-out approval processes.

(1) Opt-in approval requires that the TRS provider obtain from the customer affirmative, express consent allowing the requested CPNI usage, disclosure, or access after the customer is provided appropriate notification of the TRS provider's request consistent with the requirements set forth in this subpart.

(2) With opt-out approval, a customer is deemed to have consented to the use, disclosure, or access to the customer's CPNI if the customer has failed to object thereto within the waiting period described in §64.5108(d)(1) of this subpart after the TRS provider has provided to the customer appropriate notification of the TRS provider's request for consent consistent with the rules in this subpart.

(3) A TRS provider may only use, disclose, or permit access to the customer's individually identifiable CPNI with the customer's opt-in approval, except as follows:

(i) Where a TRS provider is permitted to use, disclose, or permit access to CPNI without customer approval under §64.5105 of this subpart.

(ii) Where a TRS provider is permitted to use, disclose, or permit access to CPNI by making use of customer opt-in or opt-out approval under paragraph (?)(4) of this section.

(4) A TRS provider may make use of customer opt-in or opt-out approval to take the following actions with respect to CPNI:

(i) Use its customer's individually identifiable CPNI for the purpose of lawfully marketing TRS-related services to that customer.

(ii) Disclose its customer's individually identifiable CPNI to its agents and its affiliates that provide TRS-related services for the purpose of lawfully marketing TRS-related services to that customer. A TRS provider may also permit such persons or entities to obtain access to such CPNI for such purposes.

[79 FR 40613, July 5, 2013]