N.Y. Smart Grid Policy Statement Calls for "Timely" Access to Data for Authorized Third Parties

Customer data should be made available, "in a timely manner to third parties who are authorized by the customer to receive it, and utilities should be compensated for their costs of providing such access," under the New York PSC's recently adopted smart grid policy statement.

Published Friday, the statement specifies that New York utilities and third-party providers, "must take appropriate actions to protect customer privacy when proposing projects that involve the collection and use of customer data."

"With respect to third-party access to customer data held by the utility, our principles make such data available in a timely manner to third parties who are authorized by the customer to receive it, and utilities are compensated for the utility's costs of providing such access," the statement says.

The PSC said that authorization for such access, "must be given affirmatively, through an opt-in process that reflects and records the customer's informed consent."

"Such authorization must specify the purposes for which the third party is authorized to use the data, define the term during which the authorization will remain valid, and identify a means through which a customer can withdraw his/her authorizations," the statement holds.

Furthermore, the statement endorsed the following principles pertaining to third party collection and use of customer data:

- Data policies and practices must be clear, transparent, and explained to customers.

- No customer data should be collected without the express consent of the customer.

- Only data relevant to the specific purpose should be collected.

- Data acquired for one purpose should not to be used for others.

- All reasonable steps should be taken to prevent the loss, theft, or unauthorized modification of customer data.

- Customers should have the right to access, confirm, and demand correction of their personal data.

- All third-party entities handling customer data should be held responsible for complying with the same privacy principles.

"Although the principles articulated above will generally apply to all customer data, as the data becomes more detailed and powerful, more detailed and specific procedures and safeguards may be needed to ensure appropriate privacy protections," the PSC said.

"We will likely revisit this issue, perhaps conducting the privacy impact assessments recommended by NIST, as the proper management of smart meter and other granular customer data become more relevant, and may conduct further process to clarify our privacy policies respecting the smart grid before further deploying smart grid technologies that impact the collection and use of customer energy usage data," the PSC said.

"One such issue that may need further development is whether electric customers in New York should be allowed to 'opt-out' of a smart meter installation," the PSC said.

The policy statement also addresses, broadly, issues related to cost/benefit analyses, cost recovery, interoperability standards, and related smart grid issues (Case 10–E–0285).