Recently, the Department of Energy released for public comment a proposed privacy Voluntary Code of Conduct for smart grid operators and third parties (the "Proposed Voluntary Code"). A link to the Proposed Voluntary Code can be found here:
As many of you who follow this blog know, I have been trying to follow the various ways in which privacy laws/regulations/policies address location, because I am afraid that the impact will be much bigger than intended. As a result, I noted with interest that the Proposed Voluntary Code defines Account Data to include "all geographic subdivisions smaller than a state, including a street address, city, county precinct, census block, zip code, and their equivalent geo-codes" when combined with a "specific customer". Since combining a "name" with a specific customer also is considered Account Data, it would appear that that the term "specific customer" is not simply a name, but any unique identifier associated with a customer, such as their account number. The Proposed Voluntary Code then defines Customer Data as "customer energy usage data (CEUD)" combined with Account Data. In general, Customer Data can only be shared with third parties under the Proposed Voluntary Code if a customer has specifically consented to the sharing of such information with the third party, in an emergency, as required by law or by regulatory authority, or if aggregated or anonymized.
This construct raises a number of questions in my opinion. For example, I believe it will make it very difficult for government agencies to be able collect and share smart grid data. Perhaps the drafters of the Proposed Voluntary Code did this intentionally because of the vocal - and legitimate - concerns about law enforcement's potential use of the information. However, my sense is that there are a number of other government agencies that could use this data in ways most people would consider positive and beneficial to society. Restricting it to state-level, unless aggregated and/or anonymized, will likely make the information less valuable. In addition, I wonder if other government agencies will begin to use this definition of geolocation privacy - "a geographic subdivision smaller than a state" without considering whether appropriate, necessary or if it even makes sense. (Wyoming had a population of slightly less than 600,000 in 2012; California had a population of approximately 38 million. It would seem that there is a wide disparity in privacy risks based solely upon state boundaries). Finally I am not entirely sure what the term "equivalent geo-codes" is intended to apply to in the definition above, but it would suggest that an operator could not share geo-coded Customer Data at anything more granular than the state level. Can that even be considered "geo-coding"?
As many of you who follow this blog know, I have been trying to follow the various ways in which privacy laws/regulations/policies address location, because I am afraid that the impact will be much bigger than intended. As a result, I noted with interest that the Proposed Voluntary Code defines Account Data to include "all geographic subdivisions smaller than a state, including a street address, city, county precinct, census block, zip code, and their equivalent geo-codes" when combined with a "specific customer". Since combining a "name" with a specific customer also is considered Account Data, it would appear that that the term "specific customer" is not simply a name, but any unique identifier associated with a customer, such as their account number. The Proposed Voluntary Code then defines Customer Data as "customer energy usage data (CEUD)" combined with Account Data. In general, Customer Data can only be shared with third parties under the Proposed Voluntary Code if a customer has specifically consented to the sharing of such information with the third party, in an emergency, as required by law or by regulatory authority, or if aggregated or anonymized.
This construct raises a number of questions in my opinion. For example, I believe it will make it very difficult for government agencies to be able collect and share smart grid data. Perhaps the drafters of the Proposed Voluntary Code did this intentionally because of the vocal - and legitimate - concerns about law enforcement's potential use of the information. However, my sense is that there are a number of other government agencies that could use this data in ways most people would consider positive and beneficial to society. Restricting it to state-level, unless aggregated and/or anonymized, will likely make the information less valuable. In addition, I wonder if other government agencies will begin to use this definition of geolocation privacy - "a geographic subdivision smaller than a state" without considering whether appropriate, necessary or if it even makes sense. (Wyoming had a population of slightly less than 600,000 in 2012; California had a population of approximately 38 million. It would seem that there is a wide disparity in privacy risks based solely upon state boundaries). Finally I am not entirely sure what the term "equivalent geo-codes" is intended to apply to in the definition above, but it would suggest that an operator could not share geo-coded Customer Data at anything more granular than the state level. Can that even be considered "geo-coding"?
The comment period closes on October 14.
No comments:
Post a Comment