Post # 68 - New CPUC Smart Meter Privacy Rules

In late 2009. the California Public Utilities Commission ruled that the big three investor-owned utilities in California -- Pacific Gas & Electric, Southern California Edison and San Diego Gas & Electric -- would have to provide their customers with real-time residential usage data through smart meters by the end of 2011 (to see the order, click here). In addition, the CPUC directed PG&E, SCE and SDG&E to also provide that usage data on a “near real time basis” to companies that those consumers choose to work with.

In a new draft decision, he CPUC has now taken the process a step further by outlining the privacy rules for how that data can be shared and stored between the utilities and other companies that customers choose to work with.

The information they have to hand out includes bill-to-date, bill forecast data, projected month-end tiered rate, a rate calculator, and notifications to customers as they cross rate tiers.

Because the CPUC can’t directly control the third party companies that consumers may contract with, the CPUC created rules for devices that will access the data from the smart meter.

For consumers who want to share their information with an outside company, a utility tariff will require that any home area network device that is “locked” to a certain third party, which will start transferring information from the smart meter, must be in compliance with the CPUC requirements. The utilities have six months to create those tariffs. They also must start a pilot study within six months to provide real-time or near-real-time pricing information to their customers.

For devices that aren’t locked into a particular third party, the utility will be charged with making consumers aware of “the potential uses and abuses of usage data should the customer forward or otherwise provide the data to another entity.”

Although companies such as demand response giant EnerNOC would like data access as soon as possible and argue that existing California legislation provides adequate privacy protection, see here, consumer advocates and others, such as the Electronic Frontier Foundation, are calling for even more stringent measures.

The decision by the CPUC also leaves some ambiguity over what to do if customers pick a device that bypasses the smart meter. However, the easiest (and cheapest) way to get the information will be to go through the meter, so at the end of the day, startups and consumer giants alike will probably choose to take the data straight from the horse’s mouth -- even if it means playing by the CPUC's rules.

Post # 44 - DOE Weighs In On Smart Grid Privacy

In Post No. 7, I discussed aspects of the Federal Communication Commission's National Broadband Plan (NBP). Released last Spring at the direction of Congress, the NBP is the FCC's plan to improve broadband internet access in the United State. The NBP includes recommendations specifically addressing Smart Grid applications -- including recommendations directed to the U.S. Department of Energy. Among those recommendations are that (a) DOE evaluate consumer data accessibility policies when evaluating Smart Grid grant applications; (b) DOE report on the states’ progress toward enacting consumer data accessibility, and (c) DOE develop best practices guidance for the states.

Last week, in response to those particular NBP recommendations, DOE released “Data Access and Privacy Issues Related to Smart Grid Technologies.” In preparing this report, DOE surveyed industry, state and federal practices with respect to Smart Grid technologies, focusing on the issue of residential consumer data security and privacy. DOE says that smart meters became a "focal point" of the report due to their "ability to measure, record and transmit granular individual consumption.” But the report also notes that a truly effective smart grid will consist of "hundreds of technologies and thousands of components, most of which do not generate data relevant to consumer privacy."

Among the report’s findings:

• There is considerable consensus that consumer education and flexibility regarding smart grid technologies, as well as the pace of deployment of such technologies, will be critical to their long-term success.
• Many smart grid technologies generate granular or detailed consumer-specific energy-usage data (CEUD) that could reveal personal details about the lives of consumers, "such as their daily schedules (including times when they are at or away from home or asleep), whether their homes are equipped with alarm systems, whether they own expensive electronic equipment such as plasma TVs, and whether they use certain types of medical equipment."　Because data of this nature is both valuable and sensitive, adequate privacy protections are necessary.
• Utilities should continue to have access to CEUD and be able to use CEUD for utility-related business purposes.
• There is “almost universal consensus” that consumers should be able to access their CEUD. Moreover, consumers should be able to decide whether and for what purposes, other than the provision of electrical power, any third-party should be authorized to access their CEUD.
• Although the report focused on residential consumer data security and privacy, many commentators agree that the energy-usage data of commercial or organizational consumers of utilities should be treated as CEUD and commercial or organizational consumers should be able to protect the privacy of their energy-usage data.
• The deployment of smart grid technologies should be flexible and take into consideration the special circumstances of rural, low-income, minority and elderly electric utility consumers.
• States should focus on whether, or how, they should regulate the process through which consumer can authorize third-party access to their CEUD.
• A central "clearinghouse" for available information about practices and information relating to the regulation of the privacy and data protection aspects of the Smart Grid technologies should be created.

DOE's privacy report was release in conjunction with a second report, “Communications Requirements of Smart Grid Technologies,” also issued in response to the NBP. The second report report examines how the communications needs of utilities and the electrical grid are likely to evolve as smart grid technologies become more widely used. This report recommends that to improve overall coordination, utilities and other smart grid constituents should be represented on key federal industry committees that address communications- and network-related security and reliability issues.