363:38 Duties and Responsibilities of Service Providers. –
I. No service provider shall:
(a) Share, disclose, or otherwise make accessible to any third party a customer's individual customer data, except as provided in paragraph V or upon the express consent of the customer.
(b) Sell individual customer data for any purpose without the express consent of the customer.
(c) Provide an incentive or discount to the customer for accessing individual customer data, provided, however, that nothing shall prevent a service provider from providing consideration to a customer for reducing demand as part of a demand response, energy management, or energy efficiency program in which customer usage data is required to measure or verify such reduction.
II. Service providers shall:
(a) Collect, store, use, and disclose only as much individual customer data as is necessary to accomplish primary purposes.
(b) Use individual customer data solely for primary purposes.
III. A service provider that allows customer access to electric, natural gas, or water consumption data shall allow customer access to that data without requiring disclosure of that customer's individual customer data to third parties.
IV. A service provider shall use reasonable security procedures and practices to protect individual customer data from unauthorized access, use, destruction, modification, or disclosure.
V. (a) Nothing in this section shall preclude a service provider from using aggregate customer data for analysis, reporting, or program management after information that identifies an individual customer is removed.
(b) Nothing in this section shall preclude a service provider from disclosing a customer's individual data to a third party for system, grid, or operational needs, or the research, development, and implementation of new rate structures and tariffs, demand response, customer assistance, energy management, or energy efficiency programs, provided that the service provider for contracts entered into after January 1, 2017, has required by contract that the third party implement and maintain reasonable security procedures and practices appropriate to the nature of the information, to protect the personal information from unauthorized access, use, destruction, modification, or disclosure, and to prohibit the use of the data for a secondary commercial purpose not related to the primary purpose of the contract without the express consent of the customer.
(c) Nothing in this section shall preclude a service provider from disclosing electric, natural gas, or water consumption data required under state or federal law, or which is identified as information subject to warrant or subpoena or by an order of the commission.
Source. 2016, 258:1, eff. Aug. 14, 2016. 2019, 86:2, eff. Aug. 17, 2019.