Reports filed under this part will be presumed to be confidential under § 0.457(d)(1) of this chapter. Notice of any requests for inspection of outage reports will be provided pursuant to § 0.461(d)(3) of this chapter except that the Chief of the Public Safety and Homeland Security Bureau may grant, without providing such notice, an agency of the states, the District of Columbia, U.S. territories, Federal Government, or Tribal Nations direct access to portions of the information collections affecting its respective jurisdiction after the requesting agency has certified to the Commission that it has a need to know this information and has protections in place to safeguard and limit the disclosure of this information as described in the Commission's Certification Form for NORS and DIRS Sharing (Certification Form). Sharing is restricted by the following terms:

(a) Requesting Agencies granted direct access to information collections must report immediately to any affected service providers and to the Commission any known or reasonably suspected unauthorized use or improper disclosure, manage their agency's access to outage reports by managing user accounts in accordance with the Commission's rules, coordinate with the Commission to manage an unauthorized access incident, and answer any questions from the Commission regarding their agency's access, use, or sharing of reports.

(b) Agencies granted direct access to information collections may share copies of the filings, and any confidential information derived from the filings, outside their agency on a strict need-to-know basis when doing so pertains to a specific imminent or on-going public safety event. The agency must condition the recipients' receipt of confidential NORS and DIRS information on the recipients' certification, on a form separate from the Certification Form, that they will treat the information as confidential, not publicly disclose it absent a finding by the Commission that allows them to do so, and securely destroy the information by, at a minimum, securely cross-cut shredding, or machine-disintegrating, paper copies of the information, and irrevocably clearing and purging digital copies, when the public safety event that warrants access to the information has concluded.

(c) Except as permitted pursuant to paragraph (b) of this section, agencies granted direct access to information collections may not share filings, or any confidential information derived from the filings, with non-employees of the agency, including agency contractors, unless such sharing is expressly authorized in writing by the Commission.

(d) Agencies granted direct access to information collections may disseminate aggregated and anonymized information to the public. Such information must be aggregated from at least four service providers and must be sufficiently anonymized so that it is not possible to identify any service providers by name or in substance.

(e) Consequences for an Agency's failure to comply with these terms may result in, among other measures, termination of direct access to reports by the Commission for a time period to be determined by the Commission based on the totality of the circumstances surrounding the failure.

[86 FR 22825, Apr. 29, 2021]