| 53 | | - | An Act concerning customer energy usage data privacy and supplementing Title 48 of the Revised Statutes. Be It Enacted by the Senate and General Assembly of the State of New Jersey: 1. As used in P.L. , c. (C. ) (pending before the Legislature as this bill): "Advanced metering infrastructure" or "AMI" means an integrated system of smart meters, communications networks, and data management systems that enables two-way communication between an electric public utility and customers that can be processed in real-time. "Anonymized data" means a data set containing individual sets of information where all identifiable characteristics and information including, but not limited to, name, address, or account number, are removed so that one cannot reasonably re-identify any individual customer within the data set. "Authorized third party" means a third party to which an electric public utility has disclosed a customer's CEUD with the customer's informed consent. "Board" means the New Jersey Board of Public Utilities or any successor agency. "Customer" means a person or entity, or their authorized agent, who is an end-user of electricity distributed by an electric public utility in this State and whose CEUD is collected through AMI. "Customer energy usage data" or "CEUD" means any data concerning a customer's electricity usage that is generated by advanced metering infrastructure and collected by an electric public utility, which includes, but is not limited to, kilowatts, kilowatt/hours, or any other data that the meter collects, such as voltage, current, rate, or billing cycle. "Data portability" means a feature that allows a customer 1or authorized third party1 to obtain 1[their] the customer's1 CEUD in a customer-accessible local file, in a standardized, electronic, machine-readable format. "Disclosure" means the sale, sharing, offering, or theft by any means of a customer's CEUD to or by a third party. "Electric public utility" means a public utility, as that term is defined in R.S.48:2-13, that transmits and distributes electricity to end users within this State and that uses AMI to collect CEUD. "Informed consent" means the authorization provided by a customer who has received sufficient information from the electric public utility to ensure the customer has full knowledge and understanding of how and to whom the customer's CEUD is disclosed to third parties. "Interval usage" means the granular, incremental power quality and energy usage data measured in watts. "Plan" means the data access plan required pursuant to section 3 of P.L. , c. (C. ) (pending before the Legislature as this bill). "Third party" means any entity or person that is not the electric public utility that initially collected a customer's CEUD through AMI. 2. A customer shall have full ownership and complete control of the customer's CEUD. An electric public utility shall disclose a customer's CEUD only to an authorized third party 2that is licensed by the board pursuant to section 29 of P.L.1999, c.23 (C.48:3-78), or that demonstrates to the board that its cybersecurity and information security systems are at least as effective as those of entities that are licensed by the board pursuant to section 29 of P.L.1999, c.23 (C.48:3-78)2 , except as provided in subsection a. of section 4 of P.L. , c. (C. ) (pending before the Legislature as this bill). An electric public utility shall use CEUD only to provide electric public utility service in the ordinary course of business and according to law. 3. a. Within 90 calendar days of the effective date of P.L. , c. (C. ) (pending before the Legislature as this bill), the board shall establish Statewide standardized privacy requirements that each electric public utility shall be required to adopt as part of the data access plan required by subsection b. of this section. The standardized privacy requirements shall include 2[provisions]2 : (1) 2provisions2 committing the electric public utility to protect CEUD from unauthorized disclosure or destruction by using reasonable security procedures and practices; (2) 2provisions2 requiring each electric public utility, in the event of an unauthorized disclosure of CEUD, to notify all customers, the board, and, if appropriate, law enforcement of the event; and (3) any other CEUD privacy and transparency requirements the board deems appropriate. b. Within 90 calendar days of the issuance of the Statewide standardized privacy requirements established by subsection a. of this section, the board shall require each electric public utility to file with the board, in a form and manner to be determined by the board, a data access plan. 2The board may also require an authorized third party to submit a data access plan to the board.2 The plan shall require each electric public utility 2or authorized third party, as applicable2 to address CEUD disclosure, access, and privacy, and billing reconciliation procedures. Each plan shall require an electric public utility 2or authorized third party, as applicable2 to develop practices and procedures that shall 2[ensure]2 : (1) 2ensure2 customers 1and their authorized third parties1 have real-time or near real-time access to their ongoing and historical CEUD, made available on a digital platform no later than 24 hours after the CEUD was collected by the AMI, in a form that allows for data portability; (2) 2ensure2 customers are provided with sufficient information, including, but not limited to, the names of third parties and the intended use of CEUD by third parties, to provide informed consent in writing authorizing a third party to receive the customer's CEUD, except that the customer shall have the ability 1to1 deny consent and to revoke informed consent at any time; (3) 2ensure that2 an electric public utility contractually requires authorized third parties that have access to CEUD to abide by the provisions of this section; (4) 2ensure2 the use of CEUD shall assist the State in achieving the clean energy goals provided in the Energy Master Plan; (5) 2ensure2 the use of CEUD improves the reliability of electricity distribution by increasing system and customer transparency, improving efficiency of distribution system planning, and accelerating outage recovery; (6) 2ensure2 an electric public utility collects five-minute interval usage data that shall be made available to the customer pursuant to paragraph (1) of this subsection; (7) 2ensure that2 AMI and CEUD shall improve the efficiency of rates charged to customers, including rate design and billing accuracy; and (8) 2include2 any other information the board deems appropriate. c. The board shall have 30 calendar days to review and approve a plan submitted by an electric public utility 2or authorized third party, as applicable2. A plan shall be deemed approved by the board if the board fails to approve or reject a plan within 30 calendar days of the date of submission. 2d. An electric public utility or authorized third party that submits a data access plan pursuant to this section may include an existing energy data usage consent waiver in the plan. If the board finds that the existing energy data usage consent waiver satisfies the requirements of P.L. , c. (C. ) (pending before the Legislature as this bill), the third party to which the consent waiver applies shall be deemed to satisfy the requirement to obtain informed, written consent pursuant to paragraph (2) of subsection b. of this section, and shall not be required to obtain additional written consent.2 4. a. The provisions of P.L. , c. (C. ) (pending before the Legislature as this bill) shall not preclude an electric public utility from: (1) using CEUD for analysis, reporting, or program management if it is anonymized data; or (2) disclosing CEUD as required or permitted under State or federal law or by an order of the board. b. The provisions of P.L. , c. (C. ) (pending before the Legislature as this bill) shall not apply if a customer chooses to disclose the customer's CEUD to a third party that is not subject to the provisions of P.L. , c. (C. ) (pending before the Legislature as this bill). 5. This act shall take effect immediately. |
|---|
| 53 | + | An Act concerning customer energy usage data privacy and supplementing Title 48 of the Revised Statutes. Be It Enacted by the Senate and General Assembly of the State of New Jersey: 1. As used in P.L. , c. (C. ) (pending before the Legislature as this bill): "Advanced metering infrastructure" or "AMI" means an integrated system of smart meters, communications networks, and data management systems that enables two-way communication between an electric public utility and customers that can be processed in real-time. "Anonymized data" means a data set containing individual sets of information where all identifiable characteristics and information including, but not limited to, name, address, or account number, are removed so that one cannot reasonably re-identify any individual customer within the data set. "Authorized third party" means a third party to which an electric public utility has disclosed a customer's CEUD with the customer's informed consent. "Board" means the New Jersey Board of Public Utilities or any successor agency. "Customer" means a person or entity, or their authorized agent, who is an end-user of electricity distributed by an electric public utility in this State and whose CEUD is collected through AMI. "Customer energy usage data" or "CEUD" means any data concerning a customer's electricity usage that is generated by advanced metering infrastructure and collected by an electric public utility, which includes, but is not limited to, kilowatts, kilowatt/hours, or any other data that the meter collects, such as voltage, current, rate, or billing cycle. "Data portability" means a feature that allows a customer 1or authorized third party1 to obtain 1[their] the customer's1 CEUD in a customer-accessible local file, in a standardized, electronic, machine-readable format. "Disclosure" means the sale, sharing, offering, or theft by any means of a customer's CEUD to or by a third party. "Electric public utility" means a public utility, as that term is defined in R.S.48:2-13, that transmits and distributes electricity to end users within this State and that uses AMI to collect CEUD. "Informed consent" means the authorization provided by a customer who has received sufficient information from the electric public utility to ensure the customer has full knowledge and understanding of how and to whom the customer's CEUD is disclosed to third parties. "Interval usage" means the granular, incremental power quality and energy usage data measured in watts. "Plan" means the data access plan required pursuant to section 3 of P.L. , c. (C. ) (pending before the Legislature as this bill). "Third party" means any entity or person that is not the electric public utility that initially collected a customer's CEUD through AMI. 2. A customer shall have full ownership and complete control of the customer's CEUD. An electric public utility shall disclose a customer's CEUD only to an authorized third party, except as provided in subsection a. of section 4 of P.L. , c. (C. ) (pending before the Legislature as this bill). An electric public utility shall use CEUD only to provide electric public utility service in the ordinary course of business and according to law. 3. a. Within 90 calendar days of the effective date of P.L. , c. (C. ) (pending before the Legislature as this bill), the board shall establish Statewide standardized privacy requirements that each electric public utility shall be required to adopt as part of the data access plan required by subsection b. of this section. The standardized privacy requirements shall include provisions: (1) committing the electric public utility to protect CEUD from unauthorized disclosure or destruction by using reasonable security procedures and practices; (2) requiring each electric public utility, in the event of an unauthorized disclosure of CEUD, to notify all customers, the board, and, if appropriate, law enforcement of the event; and (3) any other CEUD privacy and transparency requirements the board deems appropriate. b. Within 90 calendar days of the issuance of the Statewide standardized privacy requirements established by subsection a. of this section, the board shall require each electric public utility to file with the board, in a form and manner to be determined by the board, a data access plan. The plan shall require each electric public utility to address CEUD disclosure, access, and privacy, and billing reconciliation procedures. Each plan shall require an electric public utility to develop practices and procedures that shall ensure: (1) customers 1and their authorized third parties1 have real-time or near real-time access to their ongoing and historical CEUD, made available on a digital platform no later than 24 hours after the CEUD was collected by the AMI, in a form that allows for data portability; (2) customers are provided with sufficient information, including, but not limited to, the names of third parties and the intended use of CEUD by third parties, to provide informed consent in writing authorizing a third party to receive the customer's CEUD, except that the customer shall have the ability 1to1 deny consent and to revoke informed consent at any time; (3) an electric public utility contractually requires authorized third parties that have access to CEUD to abide by the provisions of this section; (4) the use of CEUD shall assist the State in achieving the clean energy goals provided in the Energy Master Plan; (5) the use of CEUD improves the reliability of electricity distribution by increasing system and customer transparency, improving efficiency of distribution system planning, and accelerating outage recovery; (6) an electric public utility collects five-minute interval usage data that shall be made available to the customer pursuant to paragraph (1) of this subsection; (7) AMI and CEUD shall improve the efficiency of rates charged to customers, including rate design and billing accuracy; and (8) any other information the board deems appropriate. c. The board shall have 30 calendar days to review and approve a plan submitted by an electric public utility. A plan shall be deemed approved by the board if the board fails to approve or reject a plan within 30 calendar days of the date of submission. 4. a. The provisions of P.L. , c. (C. ) (pending before the Legislature as this bill) shall not preclude an electric public utility from: (1) using CEUD for analysis, reporting, or program management if it is anonymized data; or (2) disclosing CEUD as required or permitted under State or federal law or by an order of the board. b. The provisions of P.L. , c. (C. ) (pending before the Legislature as this bill) shall not apply if a customer chooses to disclose the customer's CEUD to a third party that is not subject to the provisions of P.L. , c. (C. ) (pending before the Legislature as this bill). 5. This act shall take effect immediately. |
|---|