Subject: A Proposed Report Outline and Text, Addressing Issue 2: Consumer Privacy
Please consider the following outline and text for use in developing the work group's report to the Commission. Position statements have been included, not so much as a representation of SDG&E's positions, but rather as concepts upon which future refinements can be made. Although this may appear to be redundant to the good work Carl Silsbee has done, I thought it would be useful to have in writing an alternative structure to evaluate when determining how best to proceed. If you would like to discuss, add to, modify, or delete any items in advance of discussions at next Tuesday's meeting in Los Angeles, please call me at (619) 654-1240. Thanks,
1. Issues Overview
In Decision 95-12-063 (Restructuring Decision), the Commission concluded "a utility has access to considerable information about its customers" which creates "a major marketing advantage that could allow it to target and sign up preferred customers before its competitors can."[1] It is this conclusion, and the Commissions desire to neutralize a utility's inherent advantage, that predominantly drives the Customer Information and Education (CI&E) work group's need to resolve customer-specific information access issues.
Additional guidance for the CI&E work group actually comes from two sources: (1) the Restructuring Decision, and (2) the Joint Assigned Commissioners' Ruling of May 17, 1996 (Ruling). The specific purpose of the later was to "further define the issues to be discussed by the working groups" who were to develop plans to meet the objectives of the former.[2] Though issues identified under each are related, issues not described within the body of the Restructuring Decision were introduced by the Ruling.
1.1. D.95-12-063 (Restructuring Decision)
1.1.1. Fair Access to Customer-Specific Information
Ordering Paragraph 20 of the Restructuring Decision begins: "Customer-specific information necessary for the distribution functions of the utility shall be made available to all competitors in the generation sector, on terms that are fair to all competitors."[3] In a restructured world, where generation companies are completely separate from distribution companies, an easy solution would be to prevent the dissemination of UDC information to any generation company. All competitors would then be treated equally.
However the Restructuring Decision clearly states that "some utility generation assets will remain under the ownership of the utility."[4] Under that condition, regulatory control over what information is made available to utility personnel simultaneously representing distribution and generation business interests becomes virtually impossible. Utility personnel representing both sides of the business will by default have access to information otherwise unavailable to both generation competitors, and more importantly, providers of other energy services. For that reason, the Commission has made it clear that valuable information available to the utility as a generation competitor shall likewise be made available to all other generation competitors.
1.1.2. Protection of Proprietary Information
The second sentence of Ordering Paragraph 20 addresses the need to control potential misuse of information that is proprietary to customers. It states: "All generation providers, including the monopoly utility, shall obtain a customer's consent before accessing any proprietary information about the customer." [Underlining added.] Some customer-specific information may have been obtained by utilities only upon acceptance of specific customer conditions governing how that information may be used. Before using or releasing that information for purposes other than originally specified, utilities and other generation providers must first obtain customers' consent.
1.2. Joint Assigned Commissioners' Ruling of May 17, 1996 (Ruling)
1.2.1. Accessible Information
Ruling item number 7, under the Consumer Choice Issue Area, specifically addresses an expansion of issues surrounding access to customer information. Recognizing the "importance of customer information to direct access providers in a competitive market," the assigned commissioners directed the working group to consider "what customer information can be provided."[5]
Neither the Restructuring Decision nor the Ruling address other utility proprietary information accessibility. Both refer instead only to information describing customers. Therefore, for purposes of this report, other utility information is not an issue.
1.2.2. Customer Privacy
Although nowhere addressed in the Restructuring Decision, in their Ruling, Commissioners Neeper and Knight introduced "customer privacy" as an issue for the Direct Access Working Group (DAWG) to consider. Proprietary information has a foundation based on ownership. Customer privacy however is much broader and more complex. Privacy is not as much a function of ownership as it is control over information. Control is usually determined to be important if information about individuals could potentially be misused in a way that causes individual harm, which in turn is not outweighed by resulting benefits to society. At issue is whether or not the use of utility collected customer information, as envisioned by the Commission, could cause harm to customers, and if so, what mitigating controls would be necessary.
1.2.3. The Means By Which to Make Information Available
Once utility collected customer-specific information has been classified as either accessible or inaccessible, the Commission has instructed the work group to determine for accessible information "by what means to make it equally available to direct access providers, including utility affiliates."[6]
2. Historical Overview
2.1. Legal Oversight of Information Dissemination
2.1.1. Electrical Corporations
2.1.1.1. Public Utilities Codes Governing the Release of Customer-specific Information
Sections 585 and 588 of Article 5. Reports, of the Public Utilities Code, have established precedence for the release and use of electrical corporation customer-specific records and information. Both sections were established by the Legislature to enable activities deemed to be beneficial to society. Section 585 allows for the release of customer-specific and other utility proprietary information to participants in rate setting proceedings. Section 588 permits release of specific personal customer information in the course of business performed by the district attorney's office. Both sections make it clear that information made available is to be used only for purposes established within each section, and protected by the receiving parties from other unauthorized use.
2.1.1.2. Other Practices
Customer-specific information is traditionally released by utilities under the following three conditions: (1) to designated parties when required by law or subpoena (e.g. P.U. Codes 585 and 588); (2) to a customer's agent upon written approval by the customer; and (3) without customer pre-approval, to suppliers under contract with, or providing services to utilities (e.g. collection agencies, researchers, and energy service providers).
DSM bidding pilot programs are an example of the later. Implemented at Commission direction, personal information, including usage information, was released to winning bidders in advance of, or in some cases in lieu of customer notification and consent.[7]
2.1.2. Other Utility Corporations
Table _____ summarizes the statutes, codes, regulations, and rules applicable to other utility corporations. The intent of each is also described.
2.2. Unregulated Oversight of Information Dissemination
2.2.1. U.S. Department of Commerce Findings
2.2.2. Trade Organization Oversight
2.2.2.1. Direct Marketing Association
2.2.2.2. U.S. Chamber of Commerce
3.1. Terms and Alternative Positions Defined
The Commission identified two customer information qualities requiring conditional use consideration. The first has to do with ownership rights. The second has to do with the ability to exercise control over others' use of personal information. Following is a discussion of positions associated with each that the Commission should consider when establishing information access policies.
3.1.1. Generation Service Provider
3.1.1.1. Broad Application of The Term - Energy Service Provider
The Commission's use of the term Generation Service Provider is interpreted to mean any provider of the electricity commodity as well as any other energy service traditionally provided by electric utilities in California. For example, as has been successfully argued in resource planning proceedings, provision of energy efficiency services to reduce customer demand for energy using ratepayer subsidies is as much an electric service option as is the provision of the commodity itself. For that reason, any provider of services which impact customers use of electricity is defined to be a generation service provider in the context of the Commission's Restructuring Decision. Any Commission decision pertinent to customer-specific information access should therefore be applicable to this broad definition of energy service provider.
3.1.1.2. Narrow Application of The Term - Only Providers of The Electricity Commodity
(THIS IS WHERE PROPONENTS OF THE NARROW APPLICATION OF THE TERM WOULD STATE THEIR POSITION)
3.1.2. Proprietary Information
Before addressing information use privacy issues, it is important to first identify who owns what information. If parties wishing to control the use of information also own it, there is little disagreement that they have the right to use it in any way that is complementary to laws governing its use. Only when ownership and the desire for privacy related control reside with two different parties does the need to establish governing covenants become necessary.
3.1.2.1. Customer Proprietary Information Positions
3.1.2.1.1. No Utility Information Is Customer Proprietary
(THIS IS WHERE POSITIONS ARE STATED PROPOSING NO UTILITY INFORMATION IS CUSTOMER PROPRIETARY)
3.1.2.1.2. Only Information Linked to Express Written Agreements is Customer Proprietary
Electrical corporations, like businesses in every industry, collect information to perform business functions which enable them to thrive. For all businesses, collected information can, at the time it is collected, be classified as belonging to either the collector or the provider. When the provider of information places conditions upon the information collector on how collected information is to be retained and/or used, ownership and control over that information remains with the provider. Otherwise, ownership resides with the collector who has made significant investments to acquire, store, and maintain the accuracy and reliability of the information.
As with other property rights, ownership of information property does not in itself allow for unfettered use of that information. Rather, use of that information is subject to all statutes, codes, regulations, and rules applicable to it, including those specific to consumer privacy as discussed below.
Following is a list of the information collected by electrical corporations which, when collected, have conditions of use attached to them:
(THIS IS WHERE CONDITIONAL USE DATA / INFORMATION WOULD BE DESCRIBED - SEE JEFF PARROTT)
All other information collected by electrical corporations is proprietary to them.
3.1.2.1.3. All Information is Customer Proprietary
(THIS IS WHERE POSITIONS ARE STATED PROPOSING ALL UTILITY INFORMATION IS CUSTOMER PROPRIETARY)
3.1.2.2. Utility Proprietary Information Positions
3.1.2.2.1. No Utility Information is Utility Proprietary
(THIS IS WHERE POSITIONS ARE STATED PROPOSING NO UTILITY INFORMATION IS UTILITY PROPRIETARY)
3.1.2.2.2. Only Information Not Proprietary to Customers Is Utility Proprietary
Unless information collected by utilities has attached to it providers' conditions of use, that information is proprietary to the utility. However it is the responsibility of each utility to abide by all statutes, codes, regulations, and rules governing utility proprietary information use and dissemination. Where utility actions are not contradictory to governing covenants, utilities have the right to use or release information in ways that benefit the utility.
3.1.2.2.3. All Information is Utility Proprietary
(THIS IS WHERE POSITIONS ARE STATED PROPOSING ALL UTILITY INFORMATION IS UTILITY PROPRIETARY)
3.1.2.3. Legal Positions on Information Ownership
(LAWYERS TO INSERT LEGAL DETERMINANTS FOR INFORMATION OWNERSHIP)
3.1.3. Customer Privacy
The issue of customer privacy addresses "the claim of individuals, groups, or institutions to determine for themselves when, how, and to what extent information about them is communicated to others."[8] It has no foundation in ownership of information. Rather it addresses the degree of control that can be exercised by an individual over others' use of information about him or her.
As was pointed out in a February 1996 report from the Information Access Study Team, control over information use by others is typically granted when information use benefits to society are outweighed by the existence of all three of the following criteria: (1) there is a "legally protected privacy interest;" (2) there is a reasonable expectation of privacy; and (3) the expected invasion of privacy is serious in its nature and impact.[9]
When determining which data meet all three criteria, it is useful to focus on the third criteria first. If specific use of data does not create a serious invasion of privacy, it does not meet the last and therefore the full set of three criteria necessary to exercise control. Information that could potentially create a serious invasion of privacy can be classified as "sensitive personal information." Other customer-specific information that when used does not create a serious invasion of privacy can be classified as "nonsensitive personal information." Finally, information that conveys no customer-specific characteristics other than those attributable to a group of customers in general can be classified as "impersonal information."
Unless information is determined to be sensitive personal information, there are no legal grounds that can be used to give individuals control over the use of others' information about them. Any establishment of such controls would therefore be strictly a matter of policy implementation.
3.1.3.1. Sensitive Personal Information
Use of customer-specific information for the express purposes for which individual's originally provided it eliminates the information from being classified as sensitive personal information. It use will not, when used for those purposes, seriously invade the privacy of individuals.
When information is used in ways other than originally intended by the provider of the information, under some circumstances a serious invasion of privacy could result. Prior to the use of that information, an individual should be notified of the potential use and, if interested, respond in writing authorizing use of the information accordingly ("Opt-In").
Under the Commission's Restructuring Decision, the following information is expected to be used in ways that (1) were specifically prohibited by individuals providing information to electrical corporations, or (2) could seriously invade the privacy of individuals without providing counter benefits to society:
(LIST INFORMATION AND CITE SPECIFIC REASONS FOR ITS INCLUSION AS "SENSITIVE PERSONAL INFORMATION")
3.1.3.2. Nonsensitive Personal Information
All other personal information, when used by qualified energy service providers, is considered nonsensitive personal information.
3.1.3.2.1. Unfettered Access Position
If the Commission's intent is to create an environment under which competition can best flourish, all nonsensitive personal information should be made available to any qualified energy service provider. Present and future statutes, codes, regulations, and rules would govern the use and transferability of this information for each type of organization.
3.1.3.2.1. Usage Prequalification Position
(THIS IS WHERE THOSE WHO RECOMMEND EITHER "OPT-OUT" OR "OPT-IN" PREQUALIFICATIONS TO INFORMATION USAGE WOULD STATE THEIR POSITIONS)
3.1.3.3. Impersonal Information
Information that is impersonal by nature has no impact on customer privacy. Any public policy constraints the Commission decides to apply to personal information should not be applied to impersonal information.
3.2. Price Charged by UDCs for Customer Information
3.2.1. No Charge
3.2.1.1. UDC Funded
3.2.1.2. PGC Funded
3.2.2. Provided at UDC Cost
3.2.3. Provided at Market Price
3.3. Information Clearing House
3.3.1. Information Clearing House Position
3.3.2. No Information Clearing House Position
3.4. Proposed Language for Commission or Legislature Use in Drafting Customer-Specific Information Access Guidelines for Electric Utilities
(SPECIFIC LANGUAGE FOR USE IN LEGISLATION OR RULEMAKING WHICH SUPPORTS EACH POSITION SHOULD BE ADDED HERE)
3.4.1. Unfettered Access to All but Restricted or Sensitive Personal Information, Which Would Both Require Prior Written Approval to Gain Access
3.4.2. Prior Written Approval Required for Access to Any Customer-Specific Information