ERCOT Notifies PUCT of Inadvertent Transmission of Data Which Could Have Revealed Number of Competitor's ESI IDs

ERCOT notified the Public Utility Commission of Texas, "of its violation of Section 1.3.1(k) of the ERCOT Protocols," due to the transmission of a file to two unintended recipients which could have been interpreted to match the number of ESI IDs identifiable to another LSE.

"On February 18, 2014, a single Customer Billing and Contact Information (CBCI) Response File (Response File) containing ESI IDs identifiable to a Competitive Retailer (CR) (Intended Recipient) was inadvertently sent to an unintended CR. The same Response File was also sent to a second unintended CR (collectively Unintended Recipients) on February 26, 2014. ERCOT was made aware of the disclosure by one of the Unintended Recipients on February 28, 2014. ERCOT believes that information in the Response File, as distributed to Unintended Recipients, could have been interpreted to match the number of ESI IDs identifiable to Intended Recipient, and therefore ERCOT files this Notice of Protocol Violation," ERCOT said.

"On a monthly basis, CRs submit CBCI files to ERCOT, which include ESI ID and Customer contact information. ERCOT validates the data received by each CR to ensure that (a) all mandatory data elements are present, and (b) the file meets formatting requirements. If a submitting CR fails to include all the mandatory data elements in its CBCI file submission, or the submitted file does not meet formatting requirements, ERCOT sends the submitting CR a Response File indicating the deficiencies in the submitted file," ERCOT said.

"ERCOT's investigation found that in January 2014, ERCOT staff identified that a Market Participant setup script was missing certain folder paths, which prevented the CBCI process from successfully completing in limited situations. To remedy the setup script issue, ERCOT staff copied what it believed to be an empty folder path to the setup script," ERCOT said.

"On January 22, 2014, Intended Recipient sent ERCOT its CBCI file for January 2014. During ERCOT's validation process of the CBCI file, ERCOT systems identified errors in Intended Recipient's submission. That day, ERCOT sent Intended Recipient a Response File that included the ESI IDs for which there were errors. The same Response File was sent to Unintended Recipients on February 18, 2014 and February 26, 2014, respectively, because the folder path to the setup script was linked to Intended Recipient's Response File data. The disclosed Response File containing Intended Recipient's data did not contain any information that would otherwise make possible the identification of any individual Customer by matching such information with the ESI ID," ERCOT said.

"ERCOT has effectively deleted the folder path containing the Response File information for Intended Recipient, and confirmed that the Response File at issue was sent to the two Unintended Recipients. ERCOT contacted Unintended Recipients, and requested permanent deletion of the Response File containing Intended Recipient's data. Both Unintended Recipients have verified destruction of the Response File. ERCOT has notified Intended Recipient of the disclosure, and communicated that the disclosed Response File data has been destroyed by Unintended Recipients," ERCOT said.

"ERCOT appreciates the severity of the violation that has occurred, and will make every effort to ensure the problem does not recur. ERCOT regrets the disruption that this event has caused, and sincerely apologizes to Intended Recipient and Unintended Recipients," ERCOT said.