Regulating the use and sharing of energy consumption data: assessing California's SB 1476 smart meter privacy statute.

• Author: Forbush, John R.

1. INTRODUCTION

   The rise of digital technologies has permanently altered how human beings interact, communicate, and function in the modern world. The marriage of enhanced data processing and internet-based communication enables average citizens and industry to easily access information and efficiently marshal control over complex systems in the physical and virtual world. While these advances have led to breakthroughs in efficiency, convenience, and an ability to tap new markets, the ubiquity of networked digital applications raises questions regarding the loss of individual autonomy, anonymity, and privacy to faceless, unaccountable corporate and government databases. In 2010 alone, both Google, Inc. and Facebook, arguably the world's leading providers of personalized web-based services, acknowledged inappropriate (and potentially illegal) collection of personal data as well as unauthorized dissemination of user information to third parties. (1) Increasingly, networked devices and services that purport to better our lives are being used as portals to collect data about our preferences, behavior, and lifestyles. (2)

   Over the next decade, technological changes in the electricity sector will force utilities, regulators, and ratepayers to balance the availability of powerful new capabilities and service offerings with legitimate concerns about consumer privacy. Through what is currently referred to as the "smart grid," electric utilities will be given access to detailed and granular electricity consumption information as a means to improve service reliability, reduce generation costs through reductions in "peak demand," and accommodate the introduction of renewable energy sources and plug-in electric vehicles into the nation's energy portfolio. (3) The U.S. government adopted the creation of a more efficient and reliable electric grid in the Energy Independence and Security Act ("EISA") of 2007 and has since directed nearly $4 billion in federal funding for smart grid technology deployments and demonstration projects. (4) The key to enabling this vision of a "smarter" grid lies in achieving three overarching capabilities: (1) activating communication and digital sensors with capabilities to automate the electricity distribution and transmission systems, (2) providing digitally enhanced metering systems for all customers, and (3) linking direct interfaces between metering systems and customers through "home area network" technologies. (5)

   From a privacy perspective, there are concerns that, in the course of helping grid operators establish real-time situational awareness over large swaths of the electric power system, these so-called "smart" technologies will also be collecting, aggregating, and reporting detailed energy consumption information from individual residences. (6) The potential for utilities and other vendors to collect and aggregate energy consumption data from individual homes and businesses raises significant questions about the access, use, and ownership of energy consumption information. (7) Although electric utilities have long accessed customer energy usage for billing purposes, the collection of energy consumption data has not previously raised privacy concerns because (1) electrical meters had to be physically accessed to obtain usage data directly from buildings, (2) traditional meters recorded energy usage over longer time periods and were not capable of collecting the type of granular, appliance specific data possible with smart meters, and (3) under the traditional model, utilities have not had the means nor the economic incentive to share consumer energy consumption data with third party vendors and others. (8)

   Recognizing that the collection and storage of data derived from smart meters and appliances raises potential for surveillance of customers and related "physical, financial, and reputational risks," (9) California recently became the first U.S. state to establish guidelines and protections for the collection and treatment of energy consumption data. (10) California Senate Bill ("SB") 1476 requires aggregators of energy consumption data to obtain consumer consent before sharing customer information with third parties; mandates that third parties may only have access to such data when they are contracting with the utility to provide energy management-related services; stipulates that data be kept secure from unauthorized parties; and mandates that electricity ratepayers "opt in" to authorize any sharing of their energy consumption data for any "secondary commercial purpose[s]." (11) In an effort to spur investment, SB 1476 provides protections for utilities regarding liability of third party service providers and establishes a clear right to continue using customer information once ratepayer consent is obtained. (12) Outside of California, there is a dearth of regulation providing guidance on how to treat energy consumption data in the private and public sectors. (13) Assuming the role of legal and policy "laboratory" for the nation, the California smart meter privacy law will serve as a model and case study for state and federal policymakers as smart grid technology proliferates and its capabilities evolve. (14)

   The aim of this article is to analyze California's SB 1476 from a privacy perspective, assessing whether and how this statute will impact the energy efficiency goals of the smart grid movement, and evaluate the law's suitability for wider adoption in other jurisdictions. Section II of the article explains what is meant by the term "smart grid" and will review the energy efficiency and economic rationales supporting smart grid implementation. Section III will explore the attendant privacy concerns raised by smart grid technology. Section IV will provide an overview of the origins and current state of privacy law in the United States. Section V will examine the provisions and record of the Gramm-Leach-Bliley ("GLB") Act, a law passed by the U.S. Congress to regulate treatment of consumer financial information. GLB's privacy provisions will then be compared with California's approach to regulating smart grid information in order to develop a normative ideal of what future privacy regulations in the energy space should aspire towards. Section VI will examine California's SB 1476 smart grid privacy statute in detail and assess its impact on four key areas of privacy protection law: (1) limits on data sharing, (2) disclosure of privacy practices, (3) opting out, and (4) data security requirements. (15) This section will compare the California privacy law with Gramm-Leach's impact on the same areas of information privacy regulation and evaluate the effectiveness and suitability of each in the smart grid arena. Finally, the article's conclusion will advocate that a national standard modeled after aspects of the California law be adopted in order to set minimum consumer protections for energy consumption data. A national approach is preferable to a patchwork of state regulations because the nature of electricity and consumer consumption data allows these commodities to be easily transmitted, stored, and traded across state lines. A national regulatory model would provide consumers greater transparency to evaluate the trade-offs of giving their utility access to their energy consumption data and would establish clear standards for smart grid component manufacturers to innovate and operate within.

2. WHAT IS THE SMART GRID AND WHY IS IT NEEDED?

   It is a truism of the electric power industry that our nation's twenty-first century economy runs on a twentieth century electric grid. (16) Today, through a system that appears remarkably similar to what was envisioned by Thomas Edison and Nicholas Tesla a century ago, electricity is generated at large-scale power plants, transmitted over high-voltage wires to distribution substations, and distributed to customer homes or places of business where it is instantaneously consumed. (17) The modern grid is, in many ways, rather dumb. "The flow of energy and information is predominately static and one directional, from the generators to the consumer," which prevents operators from responding in real-time to fluctuations in consumer demand or disruptions in service. (18) In today's grid, energy and information each flow in a single direction, opposite from one another: energy is sent to the energy customer while daily, weekly, or monthly usage data flows back to the utility for billing purposes. (19) While the reliable and secure delivery of a commodity as valuable and unstable as electricity remains a marvel of human ingenuity, the reality is that much of the grid's antiquated technology is ill equipped to meet the complex energy challenges of the twenty-first century. (20)

   While the cost of producing electricity is variable throughout a given day, electric utilities charge the same average rate for electricity throughout because they do not presently have the capability to communicate the actual cost of electricity production to ratepayers. (21) This is a costly problem because electricity generation is most expensive during "peak load" periods, when the demand for electricity approaches the system's overall production capacity. (22) Since electricity is a unique commodity that must be consumed the instant it is produced, electric utilities often will utilize "'peaker plants,"' which tend to be less energy and cost efficient, "when energy demand threatens to exceed supply levels." (23) Since "system reliability," meeting the public's demand for electricity with adequate supply, (24) is the highest priority of the electric industry, (25) "utilities invest in quickly dispatchable generation resources that are only used when required" and "[t]hese peak resources are very expensive and used irregularly." (26)

   Therefore, in order to more evenly distribute the demand for power throughout the day, a primary motivator for smart grid is the...