Smart Metering Systems and Data Sharing

International Journal of Law and Information Technology, 2014, 22, 215–253
doi: 10.1093/ijlit/eau001
Advance Access Publication Date: 18 March 2014
Article
Downloaded from https://academic.oup.com/ijlit/article-abstract/22/3/215/755952 by Universidad Tecnológica de Pereira user on 04 November 2019

Smart metering systems and data
sharing: why getting a smart meter
should also mean getting strong
information privacy controls to
manage data sharing
Nancy J. King† and Pernille W. Jessen‡*
ABSTRACT
Smart meters are being installed in consumers’ homes as the world moves to the smart
grid of intelligent energy networks. Smart meters are near real-time communication de-
vices that can collect and communicate a vast amount of personal data about each cus-
tomer’s energy use. Questions about who should have access to such data and for what
purposes raise significant consumer privacy concerns about data sharing. Because data
sharing facilitates secondary uses of energy use data and is essential for third party ac-
cess to the data, data sharing is a critical activity that needs to be analysed from an in-
formation privacy perspective. This article makes three important contributions. First,
it identifies the key privacy and data protection concerns for both the EU and USA
consumers related to data sharing in smart metering systems. Second, it provides a
comparison of EU and US privacy and data protection law as it applies to smart meter-
ing systems, revealing gaps in coverage in both systems. Third, it explains how import-
ant privacy concerns related to data sharing are being addressed in the EU and the
USA, including specific examples of legislation and self-regulatory mechanisms that
have been adopted to protect privacy in smart metering systems. From this compara-
tive analysis, potential privacy-enhancing solutions can be identified. Ultimately it will
be up to government regulators and industry to adopt local solutions, but the goal of
this article is to encourage adoption of regulatory solutions and industry best practices
that are consistent with privacy rights and information privacy principles.
K E Y W O R D S : smart meters, data sharing, privacy, data protection, EU, USA
†
College of Business, Oregon State University, Corvallis, Oregon, USA
‡
School of Business and Social Sciences, Aarhus University, Denmark
*Corresponding author. E-mail: pwj@asb.dk
C The Author (2014). Published by Oxford University Press.

V
All rights reserved. For Permissions, please email: journals.permissions@oup.com.
215
216 Smart metering systems and data sharing
1. INTRODUCTION

Smart meters are being installed in consumers’ homes as the world moves to the
smart grid of intelligent energy networks.1 The EU has made substantial investments
in the smart grid, with the EU seeking to have 80 per cent of customers using smart
meters for the electricity and gas markets by 2020.2 The USA has also set goals to re-
duce energy demand and has made significant investments to promote smart grid
technologies.3 Although the USA has not set a national target for smart meter instal-
lation and adoption has been relatively slow, it is estimated that nearly half of USA
homes will have a smart meter by 2015.4
1 Stephan Renner and others, European Smart Metering Landscape Report, Deliverable D2.1 of the project
‘SmartRegions – Promoting best practices of innovative smart metering services to European regions’ funded by
Intelligent Energy – Europe (Contract N: IEE/09/775/S12.558252, Vienna (February 2011) (European
Smart Metering Landscape Report), available in PDF through Google search (accessed 18 October 2013);
‘Advanced Electric Meter Installations Rising in Homes and Businesses,’ US Energy Information
Administration (EIA), (15 March 2011) 1 (EIA Report) (reporting that 39% of all US electrical customers
had advanced meters as of 2009), <http://www.eia.gov/todayinenergy/detail.cfm?id¼510> accessed 18
October 2013.
2 Commission’s Recommendation of 9 March 2012 on preparation for the roll-out of smart metering sys-
tems (2012/148/EU), Official Journal of the European Union, L 73/11, note 1 (9 March 2012)
(Commission’s Recommendation on Smart Metering Systems); Article 29 Data Protection Working
Party’s Opinion 12/2011 on smart metering, p 2, 00671/11/EN/WP 183 (4 April 2011) (Art 29 Opinion
12/2011) (discussing milestones in the EU’s Third Energy Package adopted in 2009); Opinion of the
European Data Protection Supervisor (EDPS) on the Commission Recommendation on preparations for
the roll-out of smart metering systems, EDPS, p 2 (8 June 2012) (commenting that the roll-out of smart
metering systems for the electricity and gas markets is required under Directive 2009/72/EC concerning
common rules for the internal market in electricity and Directive 2009/73/EC concerning common rules
for the internal market in natural gas (OJ L 211, 14.08.2009, p 95) (EDPS Opinion on Smart Metering
Systems).
3 The USA has also made commitments to improve energy efficiency and update the electric grid, although
it has not set national numerical adoption goals for smart metering systems. A Policy Framework for the
21st Century Grid: Enabling Our Secure Energy Future, Executive Office of the President of the United
States, p 1 (June 2011) (US Energy Framework for the 21st Century) <http://www.whitehouse.gov/
sites/default/files/microsites/ostp/nstc-smart-grid-june2011.pdf> accessed 18 October 2013. Since
Congress adopted the Energy Independence and Security Act of 2007 (EISA), Pub L 110-140, 121 Stat
1492 (2007) (EISA, codified at 42 USC s 17381 et seq.) and the American Recovery and Reinvestment
Act of 2009, Pub L No 111-5, div A, title IV, 123 Stat 115 (2009), the US Department of Energy has
awarded billions of dollars in federal funding for smart grid projects that include support for smart meter
installation to enable conversion to the smart electrical grid. US Energy Framework for the 21st Century,
p 2 (reporting that recipients of the federal funding to upgrade the smart electrical grid include private
companies, service providers, manufacturers and cities and that total public–private investment exceeds $8
billion). See also, Russell Frisby and Jonathan Trotta, ‘The Smart Grid: The Complexities and Importance
of Data Privacy and Security’ (2011) 19 Comm Law Conspectus 297–341, 297 and 305–10 (providing an
overview of US legislation that addresses the smart grid and federal agencies with regulatory responsibil-
ities related to the smart grid).
4 Mark Chediak, ‘Smart-Meter Defiance Slows $29 Billion U.S. Grid Upgrade’ Bloomberg (May 2012)
<http://www.bloomberg.com/news/2012-05-08/smart-meter-defiance-slows-adoption-of-29-billion-grid.
html> accessed 18 October 2013 (reporting statistics for smart meter implementation in the USA, accord-
ing to the Institute for Electric Efficiency, a Washington-based research group financed by investor-owned
utilities) (Chediak). As of September 2011, about 27 million smart meters had been installed in the USA,
ibid.
Smart metering systems and data sharing 217
Smart meters are near real-time communication devices that can collect and com-
municate a vast amount of personal data5 about each customer’s energy use.6 It is

anticipated that smart meters connected to smart grids will facilitate better manage-
ment of the energy supply by making it possible to improve operational efficiency,
reliability of delivery, energy conservation and use of renewable power.7 As end-users
at the household level, consumers will benefit from having access to their smart
meter data and the ability to use the data to help control their household energy
costs and to achieve personal conservation goals. Changing consumers’ behaviour
with regard to household energy consumption is regarded as essential to achieving
the potential benefits of smart grids.8
Questions about who should have access to smart meter data and for what pur-
poses raise significant consumer privacy concerns about data sharing under the
broader topics of privacy and data protection.9 Because data sharing facilitates sec-
ondary uses of energy use data and is essential for third party access to the data, data
sharing is a critical activity that needs to be analyzed from an information privacy
perspective. Further, data sharing in smart metering systems is a global concern
5 The term personal data is used in this article consistent with its definition under the Data Protection
Directive (95/46/EC) and includes the concept of personally identifying information (PII). See Data
Protection Directive, Directive 95/46/EC of the European Parliament and of the Council of 24 October
1995 on the protection of individuals with regard to the processing of personal data and on the free move-
ment of such data, OJ L 281/31, 23.11.95, Art 2 (Data Protection Directive) (providing, ‘personal data’
shall mean any information relating to an identified or identifiable natural person (‘data subject’); an iden-
tifiable person is one who can be identified, directly or indirectly, in particular by reference to an identifica-
tion number or to one or more factors specific to his physical, physiological, mental, economic, cultural or
social identity). The US analysis of privacy concerns may skip the issue of defining personal data in favour
of defining a class of data that is sensitive (eg defining consumer-specific energy usage data or CEUD) and
providing enhanced privacy protections for the data. This approach is likely in the USA due to the lack of
an agreed definition for personal data under US law, which, in turn, is likely due to lack of a generally ap-
plicable federal data protection law that defines personal data. Data Access and Privacy Issues Related to
Smart Grid Technologies, US Department of Energy, 3, 9, 29-30 (5 October 2010) (DOE Data Access
and Privacy Report) <http://www.smartgrid.gov/sites/default/files/Broadband_Report_Data_Privacy_
10_5.pdf> accessed 18 October 2013. Even so, the DOE provides definitions of privacy related terms
used in its report, including definitions for: personal information, PII, composite personal information and
private information. DOE Data Access and Privacy Report, (fn 5) Appendix E. See also discussion of the
US regulatory framework for privacy and data protection in Section 3 of this article.
6 EDPS Opinion on Smart Metering Systems, (n 3) 4–6 (commenting that smart metering systems enable
massive collection of personal information from European households with the potential intrusiveness
increased by the ability to infer information from the data about what members of a household do within
the privacy of their own homes); Guidelines for Smart Grid Cyber Security: Vol 2, Privacy and the Smart
Grid, National Institute of Standards and Technology Interagency Report, NISTIR 7628 (August 2010).
<http://csrc.nist.gov/publications/nistir/ir7628/nistir-7628_vol2.pdf> accessed 18 October 2013
(NISTIR 7628).
7 Simone Pront-van Bommel, ‘Smart Energy Grids within the Framework of the Third Energy Package’
[April 2011] European Energy & Environ L Rev 32–44, 33 ; Paul Lewis Joskow, ‘Creating a Smarter U.S.
Electricity Grid’ (2012) 26(1) J Eco Perspectives 29–48, 30.
8 Pront-van Bommel ibid 36; Stephanie M Stern, ‘Smart-Grid: Technology and the Psychology of
Environmental Behavior Change’ (2011) 86 Chicago-Kent L Rev 139–60, 148–60 (commenting on the
difficulty of changing consumer energy consumption habits and arguing that technology and automation
are an effective tool to achieve this result).
9 EDPS Opinion on Smart Metering Systems (n 2) 4–6; David Wright and others, ‘Sorting out Smart
Surveillance’ (2010) 26 Computer L & Security Rev 343–54, 349 (Table 2) (discussing privacy and data
protection concerns related to power meters).
because smart grids may transcend national borders, as illustrated by the fact that
‘the U.S. electrical grid is connected to other nation’s grids across borders’.10

Further, even when electrical grids do not span national borders, the Internet
facilitates global transmission of smart meter data that will expose consumers to
global privacy risks and give rise to cross-border regulatory challenges for
governments.11
This article makes three important contributions. Firstly, it identifies the key priv-
acy and data protection concerns for both the EU and USA consumers related to
data sharing in smart metering systems.12,13 Secondly, it provides a comparison of
EU and US privacy and data protection law as it applies to smart metering systems,
revealing gaps in coverage in both systems. Thirdly, it explains how important priv-
acy concerns related to data sharing are being addressed in the EU and the USA,
including specific examples of legislation and self-regulatory mechanisms that have
been adopted to protect privacy in smart metering systems. From this comparative
analysis, potential privacy-enhancing solutions can be identified. Ultimately, it will be
up to government regulators and industry to adopt local solutions, but the goal of
this article is to encourage adoption of regulatory solutions and industry best prac-
tices that are consistent with privacy rights and information privacy principles.
This article is organized as follows. Section 2 of the article provides a brief over-
view of smart grids and the technology related to smart metering systems to set the
stage for discussing privacy concerns regarding data sharing in smart metering sys-
tems. Section 3 outlines the regulatory frameworks in the EU and the USA related to
information privacy and analyzes the current lack of laws that expressly address
10 The International Smart Grid Action Network (ISGAN) is an international partnership that was created
to focus on aspects of the smart grid where governments have regulatory authority including policy,
standards and regulation, finance and business models, technology and systems development, user and
consumer engagement and workforce skills and nowledge. US Energy Framework for the 21st Century
(n 3) 60. ISGAN is covered by an Implementing Agreement under the International Energy Agency’s
Framework for International Technology Co-Operation. At least 19 countries including the USA and the
European Commission participate in ISGAN. ibid.
11 US Energy Framework for the 21st Century (n 3) 60 (commenting that ‘the interoperable networked na-
ture of smart technologies may enable certain applications to connect across the Internet’).
12 The scope of this article’s analysis is limited to privacy impacts for energy end-users and it focuses on
consumers who have smart meters installed in their homes to facilitate smart grids. While smart meters
may be installed for electricity, gas and other household energy sources, for simplicity, this article will
focus on smart meters for electricity. It is recognized that end-users/energy users with smart meters con-
nected to smart grids may be households, small or medium sized business enterprises and even large cor-
porations and conglomerates. This article focuses on information privacy concerns of households,
referred to in this article as consumers or customers. Further, in the smart grids of the future, consumers
may become home energy producers as well as end-users, for example, when they acquire electric vehicles
or solar power producing equipment that may produce excess power that could be sold on the smart
grid. Pront-van Bommel (n 7) 36.
13 The scope of the article addresses data protection concerns as well as traditional privacy rights, including
potential impairment of the individual’s right to ‘respect for his or her private and family life, home and
communications,’ as provided by art 8 of the European Convention on Human Rights (ECHR). See gen-
erally, Joseph Savirimuthu, ‘Smart Meters and the Information Panopticon: Beyond the Rhetoric of
Compliance’ (2013) 27(1–2) Intl Rev L, Computers & Technol 161–86, (analysing application of data
protection and privacy rights to smart meters in the context of the UK’s Smart Meter Implementation
Programme (Programme) and proposing a policy framework to address how innovation and privacy
issues can be better addressed in this Programme).
consumer privacy in the context of smart metering systems and data sharing. Section
4 describes the types of consumer data produced by smart metering systems. Section

5 discusses the parties involved in smart meter data sharing, including third party en-
ergy services providers, and the purposes of data sharing. Section 6 identifies impera-
tive privacy and data protection concerns for consumers related to data sharing and
smart metering systems. This section also provides examples of how these issues are
being resolved in laws and regulations, through industry self-regulation or through
privacy-enhancing technology in EU Member States and in the USA. Section 7 con-
cludes that existing legislation regulating data sharing in smart metering systems is
incomplete or non-existent in both the EU and the USA and it urges government
regulators, the smart metering industry and information privacy and security experts
to use the insights from the comparative law analysis provided by this article to shape
solutions to protect consumers’ privacy, whether this be through adoption of indus-
try best practices or new laws.
2 . O VE RV I EW OF S M A RT GR ID S A N D SM A R T M ET ER IN G S Y ST EM S
Generally speaking, smart grids are ‘energy networks that can efficiently integrate the
behaviour and actions of all users connected to them in order to ensure an econom-
ically efficient, sustainable power system with low losses and high quality and security
of supply and safety’.14 Smart grids enable dynamic pricing and more complex tariff
structures that allow customers to buy energy at constantly changing prices, thereby
cutting demand at peak times.15 In addition to facilitating overall better management
of the energy supply, dynamic pricing is considered essential to integrate renewable
energy sources and electrical vehicles into the power grid.16 There is not just one
smart grid, but many, and they ‘exist on various scales, ranging from a [small project
to create a] highly self-sustained network to facilitate a small generated energy supply
to [large projects] that turn the existing local grid into a cross border super grid sim-
ply by making use of the available ICT [information and data communication tech-
nology] infra-structure’.17
14 Commission’s Recommendation on smart metering systems (n 2) para 3(b), n 1 (referencing the defin-
ition of smart grids used by the EU Smart Grid Task Force). In EISA, Congress described 10 characteris-
tics of smart grids. 42 USC s 17381.
15 EDPS Opinion on Smart Metering Systems (n 2) 4.
16 ibid; Frisby and Trotta (n 3) 302–03.
17 Ann-Sofie Vanwinsen, ‘Smart Grids: Legal Growing Pains’ [2012] European Energy & Environ L Rev
142–50, 142 (characterizing smart meters as an indispensable part of smart grids); Pront-van Bommel
(n 7) 36 (commenting that ‘smart grids cannot be developed without the underlying support of highly
advanced innovative information and data communication technologies (ICT)’); Art 29 Opinion 12/
2011, (n 2) 6. ‘Smart grids thus encompass a much wider area than mart metering, but smart metering is
an important first step towards the smart grid: smart meters bring intelligence to the “last mile” between
the grid and the final customer; without this key element, the full potential of the smart grid will not be
realized.’ Final Deliverable of the EU Commission’s Smart Grid Task Force, ‘Expert Group 1:
Functionalities of smart grids and smart meters’, 16 (December 2010) (Final Deliverable EU Smart Grid
Task Force) <http://ec.europa.eu/energy/gas_electricity/smartgrids/doc/expert_group1.pdf> accessed
18 October 2013.
Installation of smart metering systems is important to achieving the goals of smart

grids.18 To illustrate, smart metering systems enable energy suppliers to remotely

manage the energy supply to a household.19 Smart meters also enable suppliers to
implement dynamic pricing, meaning that the price of energy may vary based on
time of use and supply and demand.20 For example, in a jurisdiction that allows dy-
namic pricing, a consumer with a smart meter may pay more per unit of energy to
wash dishes or dry clothes at peak evening times, as compared to consuming the
same amount of energy for these tasks during times in the day when people are likely
to be at work or asleep.
Smart metering systems communicate with energy suppliers or network operators
(intermediary entities that may exist that operate smart metering systems).21 These
systems use Advanced Metering Infrastructure (AMI) that ‘allows utilities to collect,
measure, and analyze energy consumption data for grid management, outage notifi-
cation, and billing purposes via two-way communications’.22 Today’s smart meters
provide the information data and communications (ICT) capacity to measure, re-
cord and transmit very granular household-level energy consumption data.23 They
feature two-way communication between the smart meter and the energy supplier
and also between the smart meter and other third parties, a communication capabil-
ity that distinguishes smart meters from more conventional meters.24
Smart metering systems typically include a mechanism that enables customers to
access data about their households’ energy uses. This mechanism may take many
18 Smart metering systems typically include household-level smart energy meters and related information
technology support systems. See generally, ‘Smart Meters and Smart Meter Systems: A Metering
Industry Perspective’ EEI-AEIC-UTC White Paper, Edison Electric Institute, (March 2011) 7–8 (com-
menting that the combination of electricity meters with two-way communications technology for infor-
mation, monitor and control is commonly referred to as AMI, while the previous systems utilizing
one-way communications to collect meter data were referred to as AMR (Automated Meter Reading)
Systems, but it was not until the Smart Grid initiatives were established that these meters and systems
were referred to as Smart Meters and Smart Meter Systems) <http://www.aeic.org/meter_service/
smartmetersfinal032511.pdf> accessed 18 October 2013.
19 Stern (n 8) 139.
20 Office of Elec & Energy Reliability, US Dep’t of Energy, Demand Response (Demand Response)
<http://energy.gov/oe/technology-development/smart-grid/demand-response> accessed 18 October
2013.
21 Art 29 Opinion 12/2011, (n 2) 9 (discussing smart grid models that include a network operator/DSO,
which owns the grid and is responsible for the installation and running of a smart metering system). For
simplicity, reference to energy supplier will be assumed to include network operators and other interme-
diaries in this article, unless a distinction between the entities is necessary for the privacy analysis herein.
22 Communications Requirements of Smart Grid Technologies, Department of Energy, 12 (5 October
2012) <http://energy.gov/sites/prod/files/gcprod/documents/Smart_Grid_Communications_Require
ments_Report_10-05-2010.pdf>. The US Federal Energy Regulatory Commission (FERC) defines AMI
as ‘meters that measure and record usage data at hourly intervals or more frequently, and provide usage
data to both consumers and energy companies at least once daily’. Instructions and Glossary, Demand
Response & Advance Metering, FERC <http://www.ferc.gov/industries/electric/indus-act/demand-
response/2012/survey.asp> accessed 18 October 2013.
23 DOE Data Access and Privacy Report (n 5) 6, 9 (commenting that ‘the current state of the art, in terms
of the granularity of data collected by utilities [energy suppliers] using advanced metering, cannot yet
identify individual appliances and devices in the home in detail, but this will certainly be within the capa-
bilities of subsequent generations of Smart Grid technologies’).
24 Commission’s Recommendation on Smart Metering Systems (n 2) para 3(b); Art 29 Opinion 12/2011
(n 2) 6; EDPS Opinion on Smart Metering Systems (n 2) 4.
different forms: an in home display on a smart meter; a home area network accessed
using customer’s smart phone; or an individual web-based account on a website pro-

vided by the energy supplier.25 For example, in Denmark, customers with electrical
service from NRGi may have a smart meter produced by Echelon installed in their
homes and may benefit from access to smart meter data.26
When smart metering systems are in place to give consumers access to their smart
meter data, consumers will be able to take an active role in managing household en-
ergy use and energy costs by accessing and using smart meter data.27 Before the
introduction of smart metering systems, electrical energy suppliers (or, in some
cases, network operators) were the only source of consumers’ energy usage data and
this limited consumers’ ability to interact directly with third party companies that
provide smart grid products and services (hereinafter non-utility service providers or
NUSPs).28 After installation of smart metering systems, consumers may have the
ability to directly obtain their energy usage data from smart metering systems and to
share their data with NUSPs and other third parties.29 Examples of new consumer
services that smart metering systems will encourage include energy efficiency analysis
25 ‘Smart Metering Implementation Programme, Data Access and Privacy, Consultation Document’
Department of Energy & Climate Change, United Kingdom, 21-23 (April 2012) (U.K. Smart Meter
Consultation Document) <http://www.decc.gov.uk/assets/decc/11/consultation/smart-metering-imp-
prog/4933-data-access-privacy-con-doc-smart-meter.pdf>; DOE Data Access and Privacy Report (n 5) 7.
The UK Smart Meter Consultation Document proposes to require energy service providers to provide
smart meters that include an in home display that will enable customers to view their energy use data in
near real time. UK Smart Meter Consultation Document, p 21. Home Area Networks (HANS) enable a
consumer to access the data stored on a smart meter in their home through a secure connection. UK
Smart Meter Consultation Document, p 21. In the future, home energy management systems (EMS)
promise to give homeowners the ability to access and operate networked appliances remotely, providing
them with the ability to turn lights, air conditioners, and other appliances and equipment on or off from
other locations, such as their jobs. US Energy Framework for the 21st Century (n 3) 37.
26 See ‘Smart Metering’, Echelon’s Smart Metering Solution, Echelon<http://www.echelon.com/applica
tions/smart-metering/> accessed 18 October 2013, and ‘Echelon Secures $ 16 Million Smart Grid
Project for NRGi in Denmark’, Echelon <http://www.echelon.com/company/news-room/2011/nrgi
project.htm> accessed 18 October 2013. See also, ‘What is Opower?’<http://opower.com/what-is-
opower> (describing Opower as a new customer engagement platform for the utility industry (energy
supplier), with tools to help consumers use energy more efficiently that are available only through con-
sumers’ utility providers including electricity and gas (accessed 18 October 2013). Utilities throughout
the US are participating in Opower. ibid.
27 Kevin Doran, ‘Climate Change And The Future Of Energy: Privacy and Smart Grid: When Progress And
Privacy Collide’ (2010) 41 The University of Toledo L Rev 909–23, 910.
28 Frisby and Trotta (n 3) 302 (discussing who will benefit from the smart grid and the concept of ‘cus-
tomer disintermediation’, an occurrence in which vendors offer attractive energy products and services to
customers that will allow customers to bypass their local utility); Andreas SV Wokutch, ‘Energy
Regulation: The Role of Non-Utility Service Providers in Smart Grid Development: Should They Be
Regulated, And if So, Who Can Regulate Them?’ (2011) 9 J Telecommunications & High Technol L
532–71, 535–38 (describing the role of non-utility service providers).
29 Denmark has established the so called ‘DataHub’ which by its full implementation is supposed to admin-
ister all transactions and communications between all the players in the Danish electricity market, includ-
ing the possibility for customers to easily access their consumption data, change supplier and the
possibility of consenting to third party access to their data. Regarding the DataHub <http://energinet.
dk/EN/El/Datahub2/Sider/DataHub.aspx> accessed 18 October 2013.
and energy management services that are designed to help consumers control house-
hold energy uses and energy bills.30

3. COMPARISON OF EU AND US PRIVACY AND
DATA PROTECTION LAWS
The installation of smart meters is a necessary prerequisite to implementation of
smart grids.31 In fact, unless one of the exceptions applies, EU Member States are
required by the Energy Services Directive to ensure implementation of smart meter-
ing systems that help consumers actively participate in the electricity supply mar-
ket.32 In the USA, there is no analogous federal legislation that mandates installation
of smart meters in customers’ homes. Instead, these decisions are left to the public
or privately owned energy suppliers (‘utilities’), which are regulated by public utility
commissions in the 50 states. There are estimated to be over 3000 electrical energy
suppliers in the USA.33 Although the smart grid and smart metering systems are pri-
marily regulated at the state level by public utility commissions, the US government
has an important policy-making and oversight role and the federal government has
provided substantial financial incentives to encourage smart grid development that
have helped fund smart meter installation.34
In contrast to the EU’s mandate to install smart metering systems, there is no
EU-level legislation that expressly addresses data protection or privacy issues related
to implementation of smart metering systems. The EU’s Data Protection Directive
provides general data protection principles and rules that apply to all processing of
EU residents’ personal data, as implemented through Member State legislation.35
Furthermore, Article 8 of the European Convention on Human Rights (ECHR)
30 Wokutch (n 28) 535–37 (describing types of non-utility services and examples of companies that offer
these services).
32 Art 13 of the Directive 2006/32 of 5 April 2006 on the energy end-use efficiency and energy services and
repealing council Directive 93/76, OJ L 114/64, 27.04.2006 (Energy Services Directive). See also,
Commission’s Recommendation on Smart Metering Systems (n 2) preamble para 2 (referencing the two
directives that require this action by Member States for electricity and natural gas markets); Vanwinsen
(n 17) 142 (commenting that the Energy Services Directive requires Member States to ensure final cus-
tomers are provided with affordable individual meters, but stating that installation of meters is not manda-
tory in all circumstances as Member States have three justifications for not requiring installation of smart
meters: technical impossibility, financial unreasonability and disproportionate benefit in relation to the
potential energy savings). Vanwinsen also discusses the role of soft law and the possible need for new EU
legislation. Vanwinsen (n 17) 142, 149.
33 Over 25 US states have already adopted policies regarding smart grid technology, resulting in different
smart grids at the state level. US Energy Framework for the 21st Century (n 3) 2.
34 The National Science and Technology Council (NSTC) Subcommittee on Smart Grid has taken the lead
to outline the federal policy framework on the smart grid. ibid. See also, Frisby and Trotta (n 3) 305–11
(providing an overview of the many federal agencies involved in regulating the smart grid in the USA). It
is not clear whether the federal government, particularly the Federal Energy Regulatory Commission
(FERC), has the legislative authority to direct the states to implement any particular retail customer poli-
cies or programmes regarding smart meters and consumer privacy. Frisby and Trotta (n 3) 310.
35 See generally, Data Protection Directive (n 5). See also, Proposal of the European Parliament and of the
Council on the Protection of Individuals with Regard to the Processing of Personal Data and on the Free
Movement of Such Data (General Data Protection Regulation), COM (2012) 11 final (25 January 2012)
(Draft Data Protection Regulation).
protects an individual’s ‘right to respect for his or her private and family life, home
and communications’.36 This comprehensive legislative and regulatory framework

gives EU residents personal data protections that will apply to processing of energy
use data in smart metering systems, including data sharing and third party processing
contexts. There are also various sources of EU soft law, including opinions by the
EU’s Data Protection Supervisor and the Article 29 Working Party, that offer specific
guidance on how the Data Protection Directive should apply in the context of smart
metering systems.37 Furthermore, some Member States have adopted legislation or
regulatory guidance that directly addresses data protection and privacy concerns
related to smart metering systems.38
In the USA, there is no national legislation or regulation that expressly addresses
data protection and privacy issues related to implementation of smart metering sys-
tems.39 There is no comprehensive data protection regulation in the USA that is
analogous to the EU’s Data Protection Directive. Some state law exists in the USA
that regulates information privacy in smart metering systems, including legislation
(eg state public utility codes adopted in state statutes) and administrative rules
36 See Article 8 of the European Convention for the Protection of Human Rights and Fundamental
Freedoms (ECHR). In addition to privacy rights articulated in the ECHR, most Member States in the
EU have agreed to an international treaty on data protection known as Convention 108. See Convention
for the Protection of Individuals with regard to Automatic Processing of Personal Data including its add-
itional protocol (CETS 108, 1981 and CETS 181, 2001, hereinafter Convention 108. The scope of the in-
dividual right of privacy under art 8 of the ECHR goes beyond data protection, ‘covering all activities
regarded as constituting private and family life’, and providing an ‘extra layer of safeguards for physical,
personal and psychological development’. Savirimuthu (n 13) 172. In contrast, the scope of data protec-
tion law is generally limited to ‘biographical information of a data subject’. ibid.
37 See generally, Commission’s Recommendation on Smart Metering Systems (n 2); EDPS Opinion on
Smart Metering Systems (n 2); Art 29 Opinion 12/2011 (n 2).
38 See generally, European Smart Metering Landscape Report 2012 (n 1) (summarizing legislation and pro-
posed legislation in EU Member States regarding smart meter implementation programmes). ‘Due to EU
legislation, such as the Energy Services Directive and the 3rd Energy Package, a majority of the countries
in Europe already have or are about to implement some form of legal framework for the installation of
smart meters.’ European Landscape Report 2012 <www.smartregions.net/default.asp?SivuID¼26927>
accessed 2 March 2014. See also, the proposed regulatory guidance on data access and privacy for smart
metering programmes in the UK. UK Smart Metering Implementation Programme, Data Access and
Privacy, Consultation Document’ Department of Energy & Climate Change, United Kingdom, pp 21–23
(April 2012) (UK Smart Meter Consultation Document) <https://www.gov.uk/government/uploads/
system/uploads/attachment_data/file/43043/4933-data-access-privacy-con-doc-smart-meter.pdf>
accessed 2 March 2014.
39 It is important to note that there are typically more primary sources of law in common law countries
such as the USA than found in the many EU Member States (with the exception of the UK) that typically
follow civil law legal traditions. In the USA, legislation, court opinions, administrative law (rules, deci-
sions, orders, etc) and constitutions may all be primary sources of law. However, when there is a conflict,
legislation will typically be superior to administrative law and court opinions and, based on the supremacy
clause of the US Constitution, federal sources of law will be superior to state sources of law. The US
Constitution may create consumer privacy rights that limit government intrusions into consumer privacy,
but it does not restrain private business activities, so the federal constitution is not a source of informa-
tion privacy rights for consumers with regard to business uses of consumer data. See generally, Nancy
King, ‘Fundamental Human Right Principle Inspires U.S. Data Privacy Law, But Protection Are Less
Than Fundamental’ in Challenges of Privacy and Data Protection Law (Cahiers Du Centre De Recherches
Informatique Et Droit 2008) 71–98. However, state constitutions, including California’s constitution,
may include an individual right of privacy that applies in governmental and private business contexts. See,
eg California Constitution, Art I, s 1; Hill v NCAA, 865 P.2d 638 (California, 1994).
(decisions and orders adopted under state administrative law procedures by state
public utility commissions). In states such as California that have adopted legislation

or administrative rules covering the privacy and security of smart metering data, util-
ity customers have judicial and administrative remedies available for privacy viola-
tions.40 However, only a few states have adopted legislation or administrative rules
that regulate the privacy of smart metering systems, so the vast majority of customers
are not covered by laws that ensure privacy protection in smart metering systems.
Where a state has not adopted legislation or administrative rules to protect con-
sumer privacy in smart metering systems, there are various other sources of federal
and state law that may require information privacy protections for consumers in
some contexts, but it is unclear to what extent these laws will apply to smart meter-
ing systems.41 Depending on the context including the type of consumer data that is
being shared, these laws may be applicable to smart metering systems. One source
is federal and state laws that provide general protection for consumers from unfair
and deceptive business practices. For example, section 5 of the Federal Trade
Commission Act applies in situations where businesses fail to protect sensitive con-
sumer data or make promises in company privacy policies that they fail to keep.42
Federal legislation also mandates information privacy protections for personal health
information, financial data, consumer credit data and data collected online that re-
lates to children under the age of 13.43 In most cases these federal laws will not apply
to energy use data produced by smart meters because the scope of these laws is lim-
ited to specific industries and contexts, unlike the generally applicable information
privacy regulation that is provided in the EU’s Data Protection Directive. A third po-
tential source of information privacy in smart metering systems is federal legislation
governing interception of electronic communications and access to stored communi-
cations, particularly if unauthorized interception of energy use data occurs during
40 California Public Utility Code, s 8380 (2012) (CPUC s 8380) (defining electrical or gas consumption
data and establishing information privacy requirements for such data including limitations on data sharing
in state legislation applicable to privately owned and publicly owned public utilities); Decision Adopting
Rules to Protect Privacy and Security of the Electricity Usage Data of the Customers of Pacific Gas and
Electric Company, Southern California Edison Company, and San Diego Gas & Electric Company,
Rulemaking 08-12-009, California Public Utilities Commission (29 July 2011) (CUPC Rulemaking 08-
12-009).
41 See a more detailed discussion and comparison of EU and US information privacy law in Nancy King
and Pernille W Jessen, ‘Profiling the Mobile Customer – Privacy Concerns when Behavioural Advertisers
Target Mobile Phones – Part I’ (2010) 26 Computer Law & Security Rev 455–78.
42 Federal Trade Commission Act, 15 USC s 45 (2012). Unfair practices involve substantial harm to con-
sumers where the harm is not reasonably avoidable by consumers and the benefits of the practices to con-
sumers do not outweigh the harm. Deceptive practices include material misrepresentations or omissions
that are likely to mislead reasonable consumers.
43 Health Insurance Portability and Accountability Act of 1996, Pub L No 104-191, 110 Stat 1936 (codified,
as amended, in 42 USC s 1320d-2 (2012) (HIPAA) (HIPAA and regulations adopted under HIPAA set
the standards for protecting the privacy of personally identifiable health information (PHI)); Gramm-
Leach-Bliley Act of 1999, 15 USC ss 6801–6809 (2012) (requires financial institutions to provide infor-
mation privacy protections for non-public personal information including financial data); Fair Credit
Reporting Act of 1970, 15 USC s 1681 et seq. (requires credit reporting companies and parties that use
credit reports to follow fair information practices principles regarding consumers’ data); Children’s
Online Privacy Protection Act of 1998, 15 USC ss 6501–6506 (2012) (requires online businesses that
target children to protect the personal data of children under 13).
transmission or unauthorized persons access electronically stored energy use data, as

may occur when smart metering system is hacked.44

As in the EU, there is non-binding regulatory guidance that has been issued by
federal privacy regulators in the USA to advise businesses on the nature of privacy
and data protections that should be afforded to consumers in commercial contexts.45
Recent developments include a US Department of Energy-formed task force with
members that include industry stakeholders. One of the key responsibilities of this
task force is to craft a voluntary smart grid privacy code of conduct.46 Another recent
development is the creation of a smart grid privacy seal programme for companies
that use consumer energy data.47 The smart grid privacy seal programme can be
characterized as industry self-regulation. These sources of guidance from government
and the industry are not mandatory, but they do offer insights into best practices for
energy suppliers, third parties that hope to acquire and use consumer energy data,
and state public utility commissions that are engaged in designing practices and poli-
cies to protect consumers’ information privacy.48
44 Electronic Communications Privacy Act, 18 USC s 2510 et seq (2012); Computer Fraud and Abuse Act,
18 USC s 1030 et seq (2012).
45 DOE Data Access and Privacy Report (n 5); ‘Protecting Consumer Privacy in an Era of Rapid Change:
Recommendations for Businesses and Policymakers’ Federal Trade Commission, (2012), 1-112, 15-
71(FTC’s 2012 Report) <http://www.ftc.gov/os/2012/03/120326privacyreport.pdf> accessed 2 March
2014; ‘Consumer Data Privacy in a Networked World: A Framework for Protecting Privacy and
Promoting Innovation in the Global Digital Economy’ The White House, Washington, DC, 1-52, 47-48
(2012) (Obama’s Consumer Privacy Bill of Rights) <http://www.whitehouse.gov/sites/default/files/
privacy-final.pdf> accessed 2 March 2014. See also, Michael Pryor, ‘The White House Consumer Privacy
Bill of Rights: Implication for Smart Grid Privacy Regulation’ Smart Grid Update, DowLohnes, PLLC
(24 February 2012).
46 Angelique Carson, ‘Stakeholders Aim to Craft Smart Grid Privacy Code of Conduct’ The Privacy Advisor
(27 February 2013).
47 See Privacy Smart, Powered by TRUSTe <http://www.futureofprivacy.org/issues/smart-grid/>
accessed 2 March 2014. This privacy seal covers companies that seek to access consumer energy data,
including data from a device like a smart appliance, thermostat or smart meter and for companies that
seek access to energy data from a utility. The privacy seal does not cover collection or use of data by en-
ergy suppliers for billing, operations, demand response, etc. To display the privacy seal, a company must
agree TRUSTe’s Smart Grid Privacy Guidelines. ibid.
48 Unless Congress takes the legislative step of enacting a statute that adopts the National Institute of
Standards and Technology’s guidelines for privacy and the smart grid or it enacts other legislation that
establishes other federal consumer privacy rules applicable to smart metering systems or consumer data,
it is likely that there will be no federal information privacy law that protects consumers’ privacy in this
context. Leaving regulation of the smart grid to the states is consistent with the view that state public util-
ity commissions, as opposed to federal regulatory agencies, should have regulatory authority over public
utilities including energy suppliers. John R Forbush, ‘Regulating the Use and Sharing of Energy
Consumption Data: Assessing California’s SB 1476 Smart Meter Privacy Statute’ Albany Law Review
(2011/2012) 75, 341–77, 341; NISTIR 7628, (n 6). Alternatively, Congress could give a federal adminis-
trative agency, such as the Department of Commerce, authority to adopt administrative rules to protect
consumers’ privacy with regard to their smart meter data, but it is not clear whether Department of
Commerce or the NIST currently has this authority. Further, some commentators argue that state public
utility commissions only have regulatory authority over energy suppliers in their states, and that they do
not have authority to regulate third party energy service companies’ or other third parties’ use of smart
metering data. In situations where no other federal or state laws provide information privacy protections
for consumers’ in smart metering systems, this leaves consumer privacy regarding smart metering data to
weak consumer protection laws and industry self-regulation. See Frisby and Trotta (n 3) 339; DOE
Access and Privacy Report (n 5)15.
4 . T YP E S OF C ON S UM ER D A TA P R OD U C ED
B Y S M A R T ME T E R I N G S YS T E M S

Smart metering systems produce highly detailed energy usage data at the household
level, which some commentators have labelled consumer-specific energy-usage data
(CEUD).49 It can be said that smart meters collect better data about customers’ en-
ergy uses. One reason the data may be better is that smart meters are more ‘intelli-
gent’, meaning that they have the ability to measure, record and transmit granular
individual energy consumption data on a near real-time basis.50 Eventually smart
meter data may enable those who have access to smart metering data to know when
each individual household appliance is turned on and off, to identify what specific ap-
pliances are used in the residence and to have a detailed picture of energy usage over
a long period of time that reveals patterns of energy use.51 In the context of data
sharing, this section discusses consumer data that are directly and indirectly pro-
duced by smart metering systems.
4.1 Consumer data directly produced by smart metering systems

There are two basic types of consumer data that are directly produced by smart
metering systems: (i) message content and (ii) identification and transmittal data
(hereafter, ‘direct’ consumer data produced by smart metering systems). According
to the Article 29 Working Party, the message content data produced by a smart
metering system is likely to include the following types of information:
‘Meter register read. This could be a single reading or a group of readings for a
more complex tariff;
Alerts. The meter may transmit a message informing that an event has trig-
gered the meter’s alarm;
Network level information such as voltages, power outages and power quality;
[and]
Load graphics with various levels of detail.’52
The Article 29 Working Party also lists other types of data processed by smart
metering systems, which this article will refer to as ‘identification and transmittal
data’, including:
‘Unique smart meter ID and/or unique property reference number (even in

the absence of these identifiers, the meter might also be identified by its unique
energy load graph);
Metadata referring to the configuration of the smart meter;
49 DOE Data Access and Privacy Report (n 5) 9.

50 ibid 20; Art 29 Opinion 12/2011 (n 2) 9.
51 EDPS Opinion on Smart Metering Systems (n 2) 5. For an illustration of how frequent meter readings
may provide a detailed timeline of activities occurring inside a metered location such as a home, see
NISTIR 7628 (n 6) 13 (Fig 5-1 Power Usage to Personal Activity Mapping).
52 Art 29 Opinion 12/2011 n 2) 9.
A description of the message being transmitted, for example whether it is a

meter reading or a tampering alert;

A date and time stamp’53
This rich source of data will be very useful to energy suppliers or network oper-
ators for primary uses that include managing the efficiency of the energy grid, provid-
ing energy to customers, billing customers and monitoring whether some customers
may be receiving energy without paying. Furthermore, secondary uses for the data
are likely to be found and third parties are likely to seek access to smart metering
data.
4.2 Indirect consumer data produced by smart metering

systems including profiles
In addition to creating, capturing and communicating the data that is directly pro-
duced by smart metering systems (eg message content and identification and trans-
mittal data), indirect consumer data may also be produced by smart metering
systems (hereafter ‘indirect’ consumer data produced by smart metering systems).
For example, smart metering systems facilitate creation of rich energy-use profiles
about individual consumers or households.54 Unlike direct smart meter data, con-
sumer energy profiles are derived or inferred from the data that is directly produced
by smart metering systems, and the profiling process typically uses automated data
mining methodologies.55 The profiling process may include supplementing direct
smart meter data by combining it with other sources of data about the consumer or
a household, with the aim of producing richer profiles.56 For example, combining dir-
ect smart meter data with demographic information (such as the number of persons
53 ibid.
54 Doran (n 27) 910 (commenting that ‘The essential innovation behind the smart grid is information –
highly detailed [energy] usage data communicated by and between the [energy supplier], the consumer,
and in many instances, third-party vendors…. This information – and the extrapolations that can be
made from it – is what enables the smart grid to be “smart,” [and] it is also what makes the smart grid so
potentially invasive of individual privacy.’). Further,‘the Smart grid data is a double-edged sword. The
sharper the blade in terms of informational granularity, the more it can be wielded to achieve both soci-
etal benefits such as grid reliability and energy efficiency and invasions of privacy’. ibid.
55 See generally, Council of Europe, recommendation on the protection of individuals with regard to auto-
matic processing of personal data in the context of profiling, the Committee of ministers to member
states (Adopted by the Committee of Ministers on 23 November 2010 at the 1099th meeting of the
Ministers’ Deputies <https://wcd.coe.int/ViewDoc.jsp?id¼1710949&Site¼CM&BackColorInternet
¼C3C3C3&BackColorIntranet¼EDB021&BackColorLogged¼F5D383> accessed 2 March 2014;
Mireille Hildebrandt, ‘Defining Profiling: A New Type of Knowledge’ in Mireille Hildebrandt and Serge
Gutwirth (eds), Profiling the European Citizen, Cross-Disciplinary Perspectives (Springer 2008) 17–45
(Profiling the European Citizen). See also, Luiz Costa and Yves Poullet, ‘Privacy and Regulation of 2012’
(2012) 28(3) Computer L & Security Rev 254–62 (discussing profiling and the application of the Data
Protective Directive and Proposed Regulation on Data Protections to consumer profiling); King and
Jessen (n 41) 455–78 (providing background on consumer profiling and analysing the privacy and data
protection concerns in the context of profiling mobile customers).
56 Ana Canhoto and James Backhouse, ‘General Description of the Process of Behavioural Profiling’ in
Mireille Hildebrandt and Serge Gurwirth (eds), Profiling the European Citizen (Springer 2008) 47–63, 55
(discussing the use of internal and external sources of data by an organization that can be considered in
the profile building process).
living in the household, their sex, race, age, income levels, and appliances owned) or
online tracking data about consumers’ search and shopping behaviour would facili-

tate creation of more detailed consumer energy-use profiles that could have wide ap-
plication beyond managing the smart grid and billing customers for energy use.
Taken to extreme, ‘deployment of smart metering [systems] may lead to tracking
the everyday lives of people in their own homes and building detailed profiles of all
individuals based on their domestic activities’.57 Analysis of detailed electricity usage
data may make it possible to infer or predict (based on deductions about the way in
which electronic devices in the home work), ‘when members of a household are
away on holidays or at work, when they sleep and awake, whether they watch televi-
sion or use certain tools or devices, or entertain guests in their free-time, how often
they do their laundry, if someone uses a specific medical device or baby monitor,
whether a kidney problem has suddenly appeared or developed over time, if anyone
suffers from insomnia, or indeed whether individuals sleep in the same room’.58
Potential consumer profiling related to smart metering systems gives rise to privacy
concerns about undermining fundamental privacy rights as well as threats to personal
data protection.59
With an understanding of the direct and indirect consumer data produced by
smart metering systems, this article now examines who is doing the data sharing and
who the data sharing is with. In other words, who are the parties involved in data
sharing?
5. PARTIES AND PURPOSES AND DATA SHARING

The parties involved in data sharing include the direct participants in a smart meter-
ing system (typically the data subject, who is a consumer) and his energy supplier
(generally a data controller) as well as potential third parties.60 The consumer may
be an individual responsible for the electricity account with the supplier, but other
household members should also be included as data subjects given that household
57 EDPS Opinion on Smart Metering Systems (n 2) 5 (commenting that ‘with the sheer amount of informa-
tion that is being amassed by these smart meters, ubiquitous availability of data from other sources, and
advances in data mining technology, the potential for extensive data mining is very significant. Patterns
can be tracked at the level of individual households but also for many households, taken together, aggre-
gated, and sorted by area, demographics, and so on. Profiles can thus be developed, and then applied
back to individual households and individual members of those households.’).
58 EDPS Opinion on Smart Metering Systems (n 2) 5. See also, DOE Data Access and Privacy Report
(n 5) Appendix E (commenting that energy use patterns that identify specific appliances or devices ‘may
indicate a medical problem of a household member or visitor; the inappropriate use of an employer
issued device to an employee that is a household member or visitor; the use of a forbidden appliance in a
rented household’).
59 Profiling has the potential to interfere with fundamental human rights including the right to privacy. For
example, ‘profiling may…increase the informational imbalance between consumers, on the one hand, and
energy suppliers or other third parties who wish to market goods and services to consumers; the more in-
formation a consumer discloses about himself, the easier it will be for any party who wishes to sell him a
product or service to turn such informational advantage to its own benefit, for example, to engage in price
discrimination’. EDPS Opinion on Smart Metering Systems (n 2) 5–6.
60 Art 29 Opinion 12/2011 (n 2) 8–11 (discussing the concept of data controller as it applies to smart
meters).
energy use data also relates to them.61 Third parties may include energy service man-
agement companies with whom the consumer’s energy use data has been shared,

and the data sharing may be carried out by the consumer or his energy supplier,
including automated transfers of smart meter data to third parties.62
It is possible to distinguish between data sharing that is necessary to achieve the
benefits of smart metering systems (primary purposes or uses) and data sharing that
is tangential to these goals (secondary purposes or uses). Even parties directly
involved in smart metering systems may be involved in using or sharing smart meter
data for secondary purposes. For example, an energy supplier may seek to share a
consumer’s smart meter data with a third party advertising company in order to
earn advertising revenues. These distinctions about the parties and purposes of data
sharing are important for this article’s analysis because they lead to insightful discus-
sion about the types of privacy concerns and the nature of privacy and data protec-
tions that should be afforded to consumers regarding data sharing and smart meter
data.
5.1 Third parties involved in data sharing

There is a very long list of third parties that may seek access to smart meter data
about household energy use that is produced by smart meters. For example, law en-
forcement agencies, tax authorities, insurance companies, landlords, employers, com-
mercial data banks, appliance and equipment makers, companies offering consumer
energy management related services, and other third parties may be interested in
acquiring personal energy usage information for widely divergent purposes.63 The ex-
tent of third party requests for smart meter data and potential secondary uses of
smart meter data cannot yet be fully anticipated given that smart meter deployment
is still in its infancy and a full discussion of this topic is certainly outside the scope of
this article.64 This article focuses on new types of third party entities that are particu-
larly important because they are likely to have a ‘prominent’ role in data sharing of
smart meter data. These are the NUSPs mentioned earlier in this article.65 Other
terms used to describe NUSPs are Energy Service Companies (ESC) or Energy
61 DOE Data Access and Privacy Report (n 5) Appendix E-1 (commenting that ‘personal information
within the Smart Grid…. is expanded beyond the normal “individual” component because there could be
negative privacy impacts for all individuals within one dwelling…; the energy use pattern could be con-
sidered unique to a household…similar to how a fingerprint or DNA is unique to an individual’).
62 UK Smart Meter Consultation Document (n 25) 54 (commenting that ‘the term “third party” generally
refers to non-licensed parties, such as energy services companies and switching sites. However, suppliers
wishing to provide services to a customer for whom they are not currently the registered supplier (for ex-
ample, in order to provide a tariff quote to a potential customer) should also be considered to be a “third
party” ’).
63 EDPS Opinion on Smart Metering Systems (n 2) 5–6. The US experience has shown that third-party re-
quests to utilities for data about their customers’ energy usage have come from many sources, including:
energy services providers, law enforcement, regulators, attorneys, researchers, municipalities and real es-
tate agents. Angelique Carson, ‘Consumer Data Privacy Concerns Persist in Smart Grid Plans’ The
Privacy Advisor (21 November 2011); Seminar, ‘Smart-Grid Privacy: Managing Electricity’s Digital
Signature’ International Association of Privacy Professionals (8 December 2011) (IAPP Programme).
64 EDPS Opinion on Smart Metering Systems (n 2) 5–6.
65 See n 28 and accompanying text for a discussion of NUSPs and related sources.
Service Providers (ESPs).66 These new companies are being formed to provide
value-added services to consumers or to other parties, such as energy suppliers (util-

ities), including providing information management services that analyse consumers’
smart meter data and give consumers (or their energy suppliers) advice on how to
better manage consumers’ household’s energy consumption.67 Of course, preventing
and detecting access and sharing by unauthorized third parties, such as hackers and
criminals, needs to be considered when designing privacy and data protection for
smart meter data.68
5.2 Primary and secondary purposes for acquiring

and using smart meter data
Distinguishing primary from secondary purposes for acquiring and using smart meter
data is essential in order to design information privacy protections for data sharing
contexts that involve consumers’ smart meter data. This is true because stronger in-
formation privacy protections will generally be appropriate and necessary when the
data is to be acquired or used for secondary purposes, including consumer consent
mechanisms. In the context of recommending the level of consent that should be
required for secondary uses of smart meter data, the European Data Protection
Supervisor (EDPS) recommends that ‘freely given, specific, informed and explicit
consent be required for all processing that goes beyond processing required for (i)
the provision of energy, (ii) the billing thereof, (iii) detection of fraud consisting of
unpaid use of the energy provided, and (iv) preparation of aggregated data necessary
for the energy-efficient maintenance of the grid (forecasting and settlement)’.69
Presumably, except the four purposes listed by the EDPS, all other purposes for
acquiring and using smart meter data are secondary purposes. The primary versus
secondary purpose distinction is analogous to the view of the US Department of
Energy that energy suppliers should have access and be able to use smart meter data
for ‘utility-related business purposes’.70
66 These new types of third party energy service companies may be called by different names including
Energy Service Providers (ESPs) or Energy Service Companies (ESCs). Commission’s Recommendation
on Smart Metering Systems (n 2) para 20; Art 29 Opinion 12/2011 (n 2) 12. When personal energy use
data is disclosed to a third party energy service provider, it becomes a data controller under the Data
Protection Directive (95/46/EC). ibid. See discussion of Opower n 26, for examples of third party energy
service providers operating in the EU and the USA. See IAPP program: 3rd parties: Energy Services
Providers. In this article the term Non-utility Service Providers (NUSPs) will be used, distinguishing
them from energy suppliers, which are often referred to as utilities in the USA.
67 NISTIR 7628 (n 6) 35.
68 Jaikumar Vijayan, ‘Researcher Releases Smart Meter Hacking Tool’ Computerworld (20 July 2012)
<http://www.computerworld.com/s/article/9229384/Researcher_releases_smart_meter_hacking_
tool> accessed 18 October 2013.
70 The distinction between primary and secondary purposes for using smart meter data is also reflected in
the findings of the US Department of Energy in its study of data access and privacy issues related to smart
meter technologies. For example, the DOE say energy suppliers (utilities) ‘should continue to have access
to CEUD [consumer-specific-energy-usage data] and be able to use that data for utility-related business
purposes like managing their networks, coordinating with transmission and distribution-system operators,
billing for services, and compiling it into anonymized and aggregated energy-usage data for purposes like
reporting jurisdictional load profiles’. DOE Data Access and Privacy Report (n 5) 10 (italics added for
emphasis).
To illustrate, consistent with the EDPS opinion, a primary purpose for using
smart meter data is to enable the energy supplier (and/or the network operator) to

provide energy to the customer and engage in energy management activities associ-
ated with the smart grid. Some of the smart grid related uses of smart meter data in-
clude: offering dynamic pricing of energy, providing usage disaggregation (such as
separating heating and cooling cost by residence) and calculating individual usage
measurement that enables consumers to take action to reduce their energy use and
cost.71 It is important to recognize that some data sharing by the energy supplier
with other businesses may be directly related to the energy supplier’s primary pur-
poses of delivering energy, etc. For example, to manage the business of delivering
electricity to consumers, the energy supplier may need to share it with other compa-
nies such as down-stream energy suppliers. The energy supplier may also need to
use smart meter data to achieve goals related to operational efficiency, energy conser-
vation, enhancing use of renewable power sources and ensuring reliable delivery.
Additionally, data sharing with the energy supplier’s data processors and other con-
tracted agents seems to be a legitimate primary purpose, such as data sharing by the
energy supplier with companies that have been hired to handle customer billing and
collections.72
This EDPS’s definition of primary uses for smart meter data will work well as a
starting point for designing information privacy protections in data sharing contexts.
One drawback in using the limitation is that the EDPS’s definition does not expressly
consider consumers’ access and use of their own energy use data related to smart
metering systems, although the EDPS discusses the need to ensure consumers’
access and control over their own data elsewhere in the opinion.73 The US
Department of Energy advises that ‘Consumers should be able to access CEUD and
decide whether third-parties are entitled to access CEUD for purposes other than
providing electrical power’.74 Clearly, a primary purpose for using smart meter data
is to enable consumers to take advantage of the opportunity to access their house-
holds’ energy usage data and make choices to potentially conserve energy and save
money on their energy bills.75 Access to more detailed energy-use information,
increased control over the household’s energy use and costs, the ability to transfer
one’s data to others, and personal involvement in energy conservation are all poten-
tial benefits to consumers of having access to smart meter data and these consider-
ations justify treating consumers’ access to smart meter data as a primary purpose.76
There is likely to be demand for smart meter data for secondary purposes that are
not directly related to providing energy to customers or managing the energy supply
71 Froehlich and others, ‘Disaggregated End-Use Energy Sensing for the Smart Grid’ IEEE Pervasive
Computing, (January-March 2011)10-1, 28-39.
72 Art 29 Opinion 12/201 (n 2) 8–12 (discussing the role of data processor following instructions of the
data controller).
73 EDPS Opinion on Smart Metering Systems (n 2) 14 (discussing the rights of data subjects to meter read-
ings, profiles, etc). Consumers could choose to share their smart meter data with third parties in exchange
for something of value to be gained. See Commission’s Recommendation on smart metering systems
(n 2) para 20.
75 ibid 11–12.
76 ibid.
and energy use data produced by smart metering systems may have high commercial
value. For example, energy-use patterns and profiles based on smart meter data can

be used for many secondary purposes such as generating targeted and personalized
advertising in online and mobile contexts.77 When smart meter data are combined
with data companies already know about consumers that may include behavioural
and demographic data collected through online tracking, loyalty card use, credit card
and bank card use, etc), smart meter data may reveal where, when and how con-
sumers use products, thus supporting its likely high commercial value for direct mar-
keting purposes.78 The market for smart meter data to be used for secondary
purposes is likely to be stronger in the USA, where data sharing for secondary pur-
poses and commercial data brokers are currently not subject to comprehensive data
protection laws analogous to those in the EU.79 In sum, there is almost unlimited po-
tential to apply data mining technologies to energy use data produced by smart
metering systems and to use the resulting information for primary and secondary
commercial purposes, including many purposes that have not yet been identified.80
6. KEY PRIVACY CONCERNS AND WAYS

T O A D D R E S S TH O S E C O N C E R N S
This section analyses key privacy and data protection concerns associated with the
sharing of smart meter data with direct and third parties, including sharing for pri-
mary and secondary purposes. This analysis considers privacy notions and data pro-
tection principles that both the EU and US policymakers agree on, despite
inconsistencies between the EU and US legislation and regulatory frameworks. For
example, comparing the EU’s Data Protection Directive81 with recent policy state-
ments and guidance from the Federal Trade Commission (FTC)82 and the Obama
administration83 reveals substantial consensus between policymakers in the EU and
the USA on the following seven fair information practice principles (FIPPs) deriving
from the The Organisation for Economic Co-operation and Developments
(OECDs) 1980 privacy guidelines84: (i) Individual Control/Choice,
(ii) Transparency, (iii) Proportionality/Finality (respect for context), (iv) Security,
77 EDPS Opinion on Smart Metering Systems (n 2) 5–6.

78 ibid. See also, The Privacy Advisor (21 November 2011) (commenting ‘tracking consumers’ habits in the
online world represents a $30 billion economy, according to the Direct Marketing Association…. Surely
the details on the ground would be at least as appealing’.).
79 See discussion of the US regulatory framework in Section 3 of this article.
80 Omer Tene and Jules Polonetsky, ‘Privacy in the Age of Big Data: A Time for Big Decisions’ Stanford
Law Review Online, (12 February 2012) 65, 63–69 (calling for development of a privacy and data protec-
tion model that balances the benefits of data for businesses and researchers with individual privacy
rights).
81 Data Protection Directive (n 5) See also, Proposal of the European Parliament and of the Council on the
Protection of Individuals with Regard to the Processing of Personal Data and on the Free Movement of Such
Data (General Data Protection Regulation), at: 1, COM (2012) 11 final (25 January 2012) (Draft Data
Protection Regulation).
82 See generally, FTC’s 2012 Report (n 45).
83 See generally, Obama’s Consumer Privacy Bill of Rights (n 45).
84 OECD Guidelines on the Protection of Privacy and Transborder Flows of Personal Data, OECD 1980,
updated in 2013, see: The OECD Privacy Framework, OECD 2013.
(v) Access and Accuracy, (vi) Limits on Collection, further processing and retention
and (vii) Accountability.85 Additionally, privacy notions encompassing personal au-

tonomy and freedom from undue surveillance are valued privacy rights under both
the EU and US laws.86 Finally, there is substantial support in both the EU and the
USA for applying principles of ‘privacy by design’, which seeks to build privacy pro-
tections into products or services from the outset in order to protect consumers’
privacy.87 It is broadly recognized that privacy by design may be the key to protect-
ing consumers’ data and personal privacy, particularly in the context of Internet con-
nected smart devices and digital data such as smart meters, and that privacy by
design may complement laws and industry self-regulation as mechanisms to ensure
adequate data protection and privacy for consumers.88
85 Comparison of the data protection principles outlined in the FTC’s 2012 Report, Obama’s Consumer
Privacy Bill of Rights and the EU Data Protection Directive reveals that they describe essentially the same
basic principles. The one exception to this apparent consensus on applicable data protection principles is
the EU’s principle regarding restrictions on data export. The principle of restriction on data export to
countries that lack adequate data protection laws is included as a guiding principle in the Data Protection
Directive, but such a principle is not discussed in the FTC’s 2012 Report or in Obama’s Consumer
Privacy Bill of Rights. See generally, FTC’s 2012 Report (n 45); Obama’s Consumer Privacy Bill of
Rights (n 45); Data Protection Directive (n 5); Nancy King and VT Raja, ‘What Do They Really Know
About Me In The Cloud? A Comparative Law Perspective on Protecting Privacy And Security of
Sensitive Customer Data’ (2013) 50(2) American Business L J 413–82, Exhibit A (providing a compari-
son of the privacy and data protection principles from the FTC’s 2012 Report, Obama’s Consumer
Privacy Bill of Rights and the Data Protection Directive).
86 See Treaty of Lisbon amending the Treaty on European Union, the Treaty establishing the European
Community, OJ C 306/1, 17.12.2007 (recognizing Article 8 of the European Convention for the
Protection of Human Rights and Fundamental Freedoms (ECHR) and requiring Members of the
European Union to respect the fundamental rights guaranteed by the Convention), consolidated version
<http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri¼OJ:C:2007:306:0001:0010:EN:PDF> ac-
cessed 18 October 2013. The Charter of Fundamental Rights of the European Union provides:
‘Everyone has the right to the protection of personal data concerning him or her.’ Charter of
Fundamental Rights of the European Union, art 8, 2000 OJ C 364/1 (hereinafter EU Charter) <http://
www.europarl.europa.eu/charter/pdf/text_en.pdf> accessed 18 October 2013. Costa and Poullet (n 55)
255. US law has long recognized privacy as a general notion and as an individual right. US scholars have
been instrumental in developing arguments that personhood, or the right to define one’s self, is a core
privacy value to be protected by law. Samuel Warren and Louis Brandeis, ‘The Right to Privacy’ (1890) 4
Harvard L Rev 193–95 (arguing individuals have a ‘right to be let alone’); Nancy King, ‘Fundamental
Human Right Principle Inspires U.S. Data Privacy Law, But Protection Are Less Than Fundamental’ in (n
39) 71–98, 76 (CRID treatise) (discussing the evolution of privacy law in the USA and concluding US
privacy law falls short of protections data privacy as a fundamental human right).
87 According to Ann Cavoukian, Information and Privacy Commissioner of Ontario, Canada, ‘Privacy by
Design advances the view that the future of privacy cannot be assured solely by compliance with regula-
tory frameworks; rather, privacy assurance must ideally become an organization’s default mode of oper-
ation.’ Comments to Federal Trade Commission’s Privacy Roundtable (24 February 2010) <http://ftc.gov/
os/comments/privacyroundtable/544506-00096.pdf> accessed 2 March 2014. See also, ‘Privacy by
Design: Achieving the Gold Standard in Data Protection for the Smart Grid’ Information & Privacy
Commissioner of Ontario and Toronto Hydro Corporation (June 2010) (Ontario Study on Privacy by
Design); ‘Applying Privacy by Design Best Practices to SDG&G’s Dynamic Pricing Project,’ Information
and Privacy Commissioner, Ontario, Canada and San Diego Gas & Electric, San Diego, California,
(March 2012) 5-6 (SDG&G’s Dynamic Pricing Project & Privacy By Design).
88 Data protection by design is a concept discussed in the EU Commission’s Recommendation on the Roll-
Out of Smart Metering Systems. Commission’s Recommendation on Smart Metering Systems (n 2) para
3(d) (defining data protection by design as ‘data protection by design requires to implement, having re-
gard to the state of the art and the cost of implementation, both at the time of determination of the
With the above guiding principles regarding data protection and privacy in mind,
we identify the following consumer privacy and data protection concerns about the

sharing of smart meter data that need to be adequately addressed through mechan-
isms such as legislation, industry self-regulation and/or privacy by design. Although
the line between data protection and other personal privacy concerns may some-
times be blurred, we focus primarily on concerns about data protection while recog-
nizing that there are important concerns about consumer privacy that go beyond
data protection to touch on notions of personal liberty and autonomy.89
6.1 Who is the data subject when there is a smart meter in a home?
Most data protection and privacy regulation focuses on individual natural persons.90
However, in the context of smart metering systems, possible answers to the question
of ‘who is the data subject’ include: (i) just the subscriber on the account with the
energy supplier, (ii) all family members residing in the home serviced by the energy
supplier, (iii) all family and other residents in the home serviced by the energy sup-
plier, including guests, (iv) all residents and entities in the home serviced by the en-
ergy supplier, including natural persons and legal persons such as home-based
businesses. The risks and possible negative consequences associated with sharing
household energy use data produced by a smart metering system are common con-
cerns for individuals residing together. This is also true whether the individuals are
residing together on a longer-term basis or temporarily while visiting the household,
although the privacy impact related to sharing data that has been collected over a
longer period would likely be greater for longer-term residents. Given the shared
risks and possible negative consequences of sharing smart meter data, a more inclu-
sive definition of data subject that includes a group of natural persons living together
in a residence should be adopted to guide data protection and privacy protections
for smart meter data.91 Additionally, guests of the home should be included in the
privacy protections along with other residents of the home, such that temporary as
well as more permanent residents in the home will have their privacy protected.92
means for processing and at the time of the processing itself, appropriate technical and organizational
measures and procedures in such a way that the processing will meet the requirements of the Directive
95/46/EC and ensure the protection of the rights of the data subject’). Further, the Commission’s
Recommendation on Smart Metering Systems says ‘data protection by default’ requires to implement
mechanisms for ensuring that, by default, only those personal data are processed which are necessary for
each specific purposed of the processing and are especially not collected or retained beyond the minimum
necessary for those purposes, both in terms of the amount of the data and the time of their storage’.
Commission’s Recommendation on Smart Metering Systems (n 2) para 3(e). In the context of the UK’s
proposed framework, see further: Ian Brown, ‘Britain’s Smart Meter Programme: A Case Study in Privacy
by Design’ (2013) Intl Revf L Computers & Technol.
89 For discussion of the distinction between data protection and broader personal privacy notions that in-
clude personal liberty and autonomy, see Costa and Poullet (n 55) 255 (discussing the fundamental
human rights which include privacy and the relation of privacy rights to personal data protection and stat-
ing privacy is not limited to data protection; rather data protection is a ‘simple tool for conserving the dif-
ferent human liberties rather than as an end per se’).
90 See, eg Data Protection Directive (n 5) art 2(a) (data subject refers to an identified or identifiable natural
person).
91 NISTIR 7628 (n 6) Appendix E.2 (supporting privacy protections for households).
92 ibid. (recognizing that smart meter data may reveal presence of a visitor with a medical problem).
A possible weakness of defining the data subject for purposes of smart metering
systems to include all residents of a home and guests is that disputes may arise be-

tween individuals in the home about how to exercise individual control over personal
data and personal privacy. Taking a simple example, if two persons own and reside
in the home and one wishes to share smart meter data with a third party energy ser-
vices provider (NUSP) and the other does not, how will this issue be resolved con-
sistent with the FIPP of individual control?
The UK proposes that consent given by one person currently living in the home
who has access to the smart meter data will be adequate to authorize third party ac-
cess to smart meter data related to the home.93 The data protection of a group of
people versus data protection of an individual person needs further discussion, but
should be resolved in favour of promoting the energy conservation goals of the smart
grid without unduly interfering with the personal data protection and personal au-
tonomy of individual residents. For example, with regard to a smart meter installed
in a domicile occupied by two persons, it may be feasible for one resident to author-
ize sharing of the smart meter data with a third party NUSP about the shared domi-
cile in order for that person to receive advice on conserving energy. He may also
give his consent to have his name, email address, etc, be associated with the smart
meter data and to be used to send him direct marketing solicitations about related or
unrelated products and services. At the same time, it should be possible to preserve
the data protection and privacy rights of the second resident in the shared domicile
to choose whether to have her name, email address and other PII associated with the
smart meter data and to personally decide whether she wants to receive marketing
solicitations. Whether the scope of privacy and data protections accorded natural
persons regarding smart meter data should be extended to legal entities such as busi-
nesses operated in the home is beyond the scope of this article given its focus on
consumers, although some commentators argue no distinction should be made be-
tween different types of energy customers and the privacy protections afforded in
smart metering systems.94
6.2 What data related to smart metering systems should be protected?

More precisely, should only personal data that relates to identified natural persons
be protected or is it appropriate to protect a broader amount of consumer data
related to smart metering systems? This question arises because smart meter data
may not be PII to the extent that the data relates to a device, rather than a natural
93 UK Smart Meter Consultation Document (n 25) 55 (commenting that ideally the verification of consent
by the third party to access smart meter data should be that the person giving consent is a named party
on the energy supply contract for the home, but this may not be practical for third parties that are not
involved in the consumer’s energy supply contract).
94 US regulators are more likely to favour privacy protections for businesses as well as individuals, while EU
data protection regulation has historically only protected individuals. DOE Data Access and Privacy
Report (n 5) 12 (finding all classes of electric utility customers including businesses should be entitled to
the privacy of their own energy-use data, not just residential consumers); Data Protection Directive,
(fn 5) Art. 2(a) (providing data protection only for identifiable natural persons and not for legal entities).
However, the UK government is also considering what protection should be applied to small companies
as well as individuals. See also Brown (n 88).
person (or, as discussed above, a group of natural persons), thus giving rise to argu-
ments that it may be freely collected and shared without compliance with data pro-

tection laws.
At least from the European perspective, household level energy use data produced
by smart meters is likely to be considered personal data covered by the EU’s Data
Protection Directive because it is associated with a unique identification number for
the smart meter installed in a particular household and that number is linked to the
person who is responsible for the account with the energy supplier.95 Likewise, the
California Public Utility Commission, which regulates electricity suppliers in
California, has defined ‘covered information’ to include ‘any usage information ob-
tained through the use of the capabilities of Advanced Metering Infrastructure when
associated with any information that can reasonably be used to identify an individual,
family, household, residence, or non-residential customer, except that covered infor-
mation does not include usage information from which identifying information has
been removed such that an individual, family, household or residence, or non-resi-
dential customer cannot reasonably be identified or re-identified’.96
There is a trend among policymakers in the EU and the USA to put decreasing
reliance on personal data definitions that focus strictly on PII because policymakers
recognize that the association of data to a personal device, such as a computer, mo-
bile phone, etc, raises significant data protection and privacy concerns even if the
identity of the device’s owner is not known. This trend recognizes that tracking and
collecting data about a device such as a computer or smart phone is essentially as
privacy-invasive as tracking and collecting information about the person who owns
the device.97
We think the correct question in the context of data sharing related to smart
metering systems is: ‘What consumer data related to smart meters should be entitled
to fair information practice principles, whether due to privacy by design, legislation
or industry self-regulation?’ And the correct answer to this question should be:
‘FIPPs should be provided for energy usage data and associated data that is
95 Art 29 Opinion 12/2011 (n 2) 8 (concluding that smart metering data is personal data for several reasons
including the fact that most smart metering data is associated with unique identifiers, such as a meter
identification number, that is inextricably linked with the individual who is responsible for the account,
thus enabling that individual to be singled out from other consumers). See also Data Protection Directive
(n 5), recital 26; Draft Data Protection Regulation (n 81) recital 23 and 24, and Art 29 Data Protection
Working Party, Opinion 08/21012 providing further input on the data protection reform discussions
(01574/12/EN, WP 199, 5 October 2012) 5-6 (suggesting that the notion of identifiability also includes
the possibility of singling out and treat differently a natural person).
96 Decision 11-07-056, California Public Utilities Commission of 28 July 2011, in Rulemaking 08-12-009,
p. 50 (CUPC Rulemaking 08-12-009). These rules require certain regulated electrical energy suppliers in
California and third parties that are under contract with these companies or that acquire or access con-
sumer energy usage data from those utilities to provide privacy and data protection for smart meter data
that is defined as covered information as outlined in the Decision. CUPC Rulemaking 08-12-009,
pp 49–50. The rules do not apply to third parties that obtain consumer energy usage data directly from
consumers. CUPC Rulemaking 08-12-009, p 48.
97 Data Protection Directive 95/46/EC (n 5) art 6; FTC’s 2012 Report (n 45) 20. See also, Peter Maass
and Megha Rajagopalan, ‘That’s No Phone. That’s my tracker’ The New York Times (13 July 2012).
reasonably linkable to a specific consumer, smart meter, computer, or household.’98

By focusing on consumer data reasonably linkable to smart meters, data protection

and broader privacy protections will be required for energy use data related to indi-
vidual energy service accounts, which typically will represent a household, including
energy use data linked to a unique identification number for a smart meter.99 This
will be so even when the data does not reveal other PII such as the energy sub-
scriber’s name or address.
Providing information privacy protections for consumer data produced by smart
meters is consistent with recent guidance given by the US Federal Trade
Commission for online privacy, where data associated with the unique identification
numbers of computers or mobile devices is accorded fair information practices be-
cause it enables individualized data collection and potentially privacy intrusive track-
ing of online and mobile consumers, albeit without reference to traditional PII.100
Furthermore, the privacy and data protection concerns related to smart metering sys-
tems are similar to those related to tracking cookies used for online marketing pur-
poses. Cookies may track a particular device, such as a computer or mobile phone,
rather than an individual person, and may not collect or store typical PII such as
names or email addresses. Yet, under EU law, cookie data is considered personal
data requiring online marketers to provide notice and obtain consent before down-
loading a cookie on the user’s computer or using cookie data to generate targeted
advertising solicitations to consumers.101
Although the EU’s Data Protection Directive only directly applies to personal
data related to an identified or identifiable natural person, and the existence and
scope of US data protection laws generally depends on whether a state has adopted
legislation or rules to govern smart metering systems and the definitions therein,
which is often not the case and where adopted may be limited by traditional notions
of PII, advances in technology make it appropriate for contemporary privacy regula-
tion to protect a broader amount of consumer information that encompasses energy
use data that is reasonably linkable to a smart meter, computer or other personal
communication devices. Currently there is a regulatory gap in both the EU and the
USA on the scope of applicable privacy regulation in smart metering systems with
98 This is similar to the FTC’s guidance on when its recommended privacy framework should be applic-
able, with the exception that this paper expands the FTC’s definition of covered information to include
‘household’. FTC’s 2012 Report (n 45) 20.
99 Art 29 Opinion 12/2011 (n 2) 8 (commenting that most smart metering data is associated with unique
identifiers, such as a meter identification number, that is inextricably linked with the individual who is re-
sponsible for the account, thus enabling that individual to be singled out from other consumers).
100 FTC’s 2012 Report (n 45) 20 (commenting that ‘there is significant evidence demonstrating that
technological advances and the ability to combine disparate pieces of data can lead to identification of a
consumer, computer, or device even if the individual pieces of data do not constitute PII’).
101 Directive 2000/31/EC of the European Parliament and of the Council of 8 June 2000 on Certain Legal
Aspects of Information Society Services, in Particular e-Commerce, in the Internal Market, 2000 OJ L
(L 178) 1 (2002), as amended by Directive 20090/136/EC (18.12.2009), OJ L 337 to, among other
things, require member states to implement the revisions in their national laws by 25 May 2011 to re-
quire obtaining consent and giving notice regarding the use of cookies for online tracking and the pro-
cessing of cookie data) (E-Privacy Directive, as amended); Article 29 Data Protection Working Party,
Opinion 2/2010 on online behavioural advertising, p 9 (00909/10/EN, WP 171, 22 June 2010) (Art 29
Opinion 2/2010).
regard to what data are covered by existing privacy and data protection regulation
and whether new legislation or other information privacy protections are needed in

the data sharing context.
6.3 What data are particularly sensitive in the

context of smart metering systems?
Commentators argue at least some smart meter data should be considered sensitive
data with the result that it should be accorded higher levels of information privacy
protection. ‘It is the energy usage data itself and the ability to tie that data to an indi-
vidual or household that makes the data particularly sensitive’.102 Commenter’s point
to the potential for energy usage data produced by smart meters to reveal very per-
sonal behaviour (eg number of persons likely living in the home, whether the resi-
dents are home or away at particular times, what the residents are doing at particular
times, including whether they are sleeping, bathing, watching TV, washing clothes,
etc).103 Some argue smart meters are very intrusive from a personal privacy perspec-
tive because they monitor and collect data in the home, a context that has tradition-
ally been viewed as one of the most private arenas and that involves fundamental
human rights and constitutional rights.104 Accordingly, whether viewed from an EU
fundamental human rights perspective or a USA constitutional law perspective, to
the extent that smart meter data reveals what is going on in the home, at least some
of the data should be accorded heightened privacy protections because the home is a
very private arena that should be free from intrusive surveillance.
In the EU, the starting point for defining sensitive data is the Data Protection
Directive’s special categories of data, which are defined as ‘personal data revealing
the racial origin, political opinions or religious or other beliefs, as well as personal
data on health, sex life or criminal convictions’ of natural persons.105 Special catego-
ries of personal data receive heightened levels of personal data protection beyond
the minimum data protections generally applicable for other types of personal data.
Typically, businesses may not collect, store, or process special categories of con-
sumer, customer or employee data and they may not transfer the data to third parties
102 DOE Data Access and Privacy Report (n 5) 9. See also, EDPS Opinion on Smart Metering Systems
(n 2) 5.
103 ‘Researchers claim smart meters can reveal TV viewing habits’ Metering.com (21 September 2011)
(Metering.com) <http://www.metering.com/node/20028> accessed 18 October 2013.
104 Article 8 of the European Convention for the Protection of Human Rights and Fundamental Freedoms
(ECHR) (providing that ‘everyone has the right to respect for his private and family life, his home and
his correspondence’). Data Protection Directive (n 5) art 4 (preamble para 10) (providing that ‘the ob-
ject of the national laws on the processing of personal data is to protect fundamental rights and free-
doms, notably the right to privacy, which is recognized both in Article 8 of the European Convention
for the Protection of Human Rights and Fundamental Freedoms and in the general principles of
Community law’). Privacy as a fundamental right is also recognized in international law. See, eg,
International Covenant on Civil and Political Rights and Optional Protocol to the International
Covenant on Civil and Political Rights, GA Res 2200 (XXI), UN GAOR, 21st Sess, Supp No 16, UN
Doc A/6316 (1966) (ICCPR). Likewise the privacy of the home is respected under US law. See US
Constitution amend. IV (guaranteeing the right of the people to be secure in their person, houses,
papers and effects, against unreasonable searches and seizures under authority of law).
105 Data Protection Directive (n 5) art 8(1).
unless they have obtained express (opt in) consent to do this.106 Furthermore, some
personal data is not categorized as ‘special’ under the Data Protection Directive, yet

it may still receive heightened data protection beyond the general data protection
provided by the Directive for other types of personal data. For example, telecommu-
nication providers are required to give heightened privacy protections to customers’
location data associated with their mobile phones—carriers are required to obtain
users’ express consent before using or disclosing this information for commercial
purposes unrelated to providing telecommunications services, such as marketing pur-
poses.107 Most smart meter data does not fall within the current definition of special
categories of data under the Data Protection Directive, which provides the clearest
examples of sensitive data under EU law, although subsets of the data may qualify as
special data, for example, smart meter data that relates to an energy consumer’s
health or sex-life.108
There is no comprehensive federal data protection regulation in the USA that is
analogous to the Data Protection Directive, and no similar starting point for analyz-
ing sensitive data like that of the special categories of data in the Directive.109 The
FTC’s 2012 Report, which contains the FTC’s recent policy guidance to guide vol-
untary implementation of FIPPs by US businesses, does address the need to provide
heightened information privacy protections for consumers for sensitive consumer
data and data that is used in a materially different manner than claimed when it was
collected.110 Although the FTC’s 2012 Report list consumer data produced by smart
grids as a type of data that its privacy framework may cover, it appears that most
smart meter data would not be considered sensitive data under the FTC’s 2012
Report.111 This Report lists the following examples of sensitive data: information
about children, financial information, health information, Social Security numbers
(federal government-issued benefit identification numbers) and precise geo-location
data.112 However, even if smart meter data is not considered sensitive data, data
106 ibid. art. 8.

107 E-Privacy Directive (n 100) art 9(1).
108 Data Protection Directive (n 5) art 8.
109 There is no federal legislative definition of sensitive data in the USA that is analogous to the definition
of special categories of personal data in the EU’s Data Protection Directive. The FTC’s 2012 Report is
non-binding guidance issued by the FTC. Such guidance aims to help companies create privacy policies
and implement fair information practice principles including companies engage in industry self-
regulation and it informs companies of the FTC’s viewpoint on what may constitute unfair or deceptive
business practices under the FTC’s statutory authority to enforce section 5 of the Federal Trade
Commission Act. Federal Trade Commission Act, 15 USC s 45 (2012) [hereinafter section 5]. Section
5 broadly prohibits companies from engaging in unfair or deceptive business practices, including those
related to making untrue or misleading privacy promises and failure to secure sensitive customer data.
See generally, Nancy King and Pernille Wegener Jessen, ‘Profiling the Mobile Customer, Part I’ (2010)
26-5 Computer Law & Security Review 455–78.
110 FTC’s 2012 Report (n 45) 60 (articulating this principle as part of its voluntary privacy framework for
companies (except those that handle on limited amounts of non-sensitive consumer data that is not
shared with third parties): ‘Companies should obtain affirmative express consent before (1) using con-
sumer data in a materially different manner than claimed when the data was collected; or (2) collecting
sensitive data for certain purposes’).
111 ibid. 37 and 39 (discussing steps that companies could take to de-identify smart meter data and avoid
the need to comply with the privacy framework outlined in the FTC’s 2012 Report).
112 ibid 59.
sharing may constitute a use of data that is materially different from the use claimed
when the smart meter data was collected, thus triggering the requirement to obtain

the consumer’s affirmative express consent. In such cases, the FTC advises busi-
nesses to obtain consumers’ opt in consent before sharing consumer data that is rea-
sonably identifiable to a person, which would appear to include smart meter data
that is reasonably identifiable to consumers who have smart meters in their homes.
Furthermore, from the US perspective there is some flexibility in the definition of
sensitive data for purposes of enforcement of federal consumer protection laws,
which is primarily the responsibility of the FTC. The FTC advises companies that
deal with consumer data that whether a particular piece of data is sensitive may de-
pend on a number of subjective considerations. Accordingly, whether the data is gen-
erally recognized as sensitive or not, the FTC advises businesses to implement all of
the requirements of the FTC’s framework before collecting any consumer data,
including its recommendation to provide consumers with the ability to access, cor-
rect, and delete their data. The FTC advises businesses that providing such access
will allow consumers to protect themselves when they believe the data are sensitive,
even though others may disagree.113 Additionally, the FTC advises companies that
target their products and services to teenagers to consider additional data protec-
tions, such as shorter data retention periods, and, for social networking sites, to con-
sider implementing more privacy-protective default settings, access and deletion
rights for teens.114
We agree with commentators who argue that some smart meter data at the house-
hold level is sensitive data and that it should be accorded data protections that are
proportionate to the sensitivity of the data.115 In fact, some smart meter data is so
sensitive that it should not be shared with anyone other than the consumer unless
the consumer has given his consent, and then only under conditions that make sure
that the consumer is aware of the implications of giving his consent. For example,
unless the consumer has consented, the energy supplier and third parties should not
be able to acquire sensitive smart meter data, an extreme example being energy use
data that reveals that a consumer is operating a portable kidney dialysis machine in
the home. Consistent with this view, the EDPS recommends a focus on data mini-
mization in designing privacy protections for smart metering systems.116
Additionally, the EDPS points out that the inclusion of privacy enhancing technolo-
gies (PETS) in smart metering systems is consistent with a focus on data minimiza-
tion (one of the seven FIPPs discussed earlier, which seeks to limit data collection,
further processing and retention). Use of PETS in smart metering systems should
allow the parties to achieve the basic objectives of billing and energy-efficient main-
tenance of the grid while minimizing data sharing by keeping fine-grained meter
readings within the smart meter or the household as opposed to communicating this
113 ibid 60.

114 FTC’s 2012 Report (n 45) 60.
115 See discussion of the concept of granularity of the data in Section 6.4 of this article, which is also import-
ant to determining the sensitivity of the data produced by smart metering systems.
116 EDPS Opinion on Smart Metering Systems (n 2) 12. See also, CUPC Rulemaking 08-12-009 (n 40)
68–72, and 138 (discussing Rule 5 that requires energy suppliers in California to follow consumer priv-
acy rules that are based on data minimization).
data to the energy supplier and others.117 More work needs to be done on defining
sensitive data in the context of smart metering systems and designing smart metering

systems to include default mechanisms that adequately protect sensitive data. Focus
on concerns about granularity of smart meter data and data sharing for primary and
secondary purposes will be very important in this effort, so this topic is discussed
next.
6.4 What are the implications of the increasing

granularity of smart meter data?
There are at least two dimensions to the issue of granularity of smart meter data.
First, there is the issue of frequency of recording the data and transmitting the data
to the energy service provider, network operator and/or third parties (frequency of
measurement). Second, there is the issue of whether the smart meter data recorded
and shared reveals only household-level information or may reveal more detailed in-
formation (granularity of detail), for example, detailed energy-use data for individual
appliances, rooms in a dwelling, etc.
Smart metering systems differ in terms of their capability of measuring both fre-
quency of energy consumption and whether they can record data only at the house-
hold level as opposed to recording more detailed data about different energy uses
within the home. Even if the smart metering system has the capacity to record data
at a certain level of frequency, say 5–60 min intervals, and has the capability of com-
municating that data in real-time, the communication of that data to the energy sup-
plier or an intermediary (eg network operator) may be set to a longer interval, for
example, once a day.118 In Ontario, Canada, remote reading of smart meters must
have functionality of at least hourly meter reads and transmission of meter reads may
be as frequent as necessary, although data communication by smart meters must be
done using an approved protocol and file structure.119 Regarding granularity of de-
tail, it is likely that most smart metering systems in use today do not actually record
or communicate smart meter data that reveals different energy-uses within the
household (eg energy usage by different appliances, etc), although new generations
of smart meter technology will have this capacity.120
Depending on whether the data is being shared with an energy supplier, a net-
work operator or a third party, the information privacy concerns and justifications

118 DOE Data Access and Privacy Report (n 5) 20. Data can be sent to the controller in real-time or be
stored in the smart meter. Art 29 Opinion 12/2011 (n 2) 9. Although smart meters have the capability
of generating energy-use data on a real-time or near real-time basis, not all energy suppliers currently
use this capacity and instead may capture and record data on a much less frequent basis, perhaps hourly,
daily or at other intervals. EDPS Opinion on Smart Metering Systems (n 2) 5.
119 Ontario Study on Privacy by Design (n 86) 6–7. The smart meters used in Ontario are required to have
minimum functionality of hourly meter reads. Meter reads are stored in a repository (maintained by the
Independent Electricity System Operator) that can support meter reads from 5–60 min intervals. ibid.
120 DOE Data Access and Privacy Report (n 5) 9 (commenting that although the current state of the art in
terms of granularity of the data collected by energy suppliers using smart metering systems cannot yet
identify individual appliances and devices in the home in detail, ‘this will certainly be within the capabil-
ities of subsequent generations of Smart Grid technologies’). See also, Metering.com (n 102).
for the level of data protection will differ. Also, whether the data sharing is to facili-
tate a primary purpose or a secondary purpose will also be important from a privacy

perspective. The UK circulated a proposed data access and privacy framework that
addresses both of these concerns.121 Generally, the UK’s Proposed Framework estab-
lishes licensing conditions for energy suppliers that set the level of granularity of col-
lection for smart meter data in terms of frequency of collection that is allowed by an
energy supplier, unless that supplier has obtained specified consumer consent.122
The UK’s proposed rules for obtaining consumer consent depend on the frequency
that energy use data is measured by a smart metering system and also focus on
whether smart meter data is to be used for marketing purposes. There are three dif-
ferent consent rules in the UK’s proposed framework. First, to collect smart meter
data once a month (or less frequently) for billing or fulfilling regulated duties, the en-
ergy supplier would not need to obtain consumer consent.123 Second, to obtain
smart meter daily (or less frequently) for any purpose except marketing, the energy
supplier would be required to give the consumer the opportunity to opt out. And
third, the energy supplier would need to obtain opt in consent from consumers to
collect data in increments of one-half hour or less or to use smart meter data for mar-
keting purposes.124 Thus, smart meter data that is relatively less granular in terms of
frequency of measurement would be accorded lower data protection, eg no consent
requirement for data that is not very granular in terms of frequency of measurement
as long as it is not used for a marketing purpose. But as the granularity of the data
increased or the proposed use of the data became secondary, meaning that the pro-
posed use of the data is for marketing, the level of data protection would also in-
crease to include at least opt out consent for more granular data and requiring opt in
consent for the most granular energy consumption data and for marketing uses.
The UK’s Proposed Framework is a good starting point for protecting smart
meter data in data sharing contexts because it sets rules for consumer consent that
are proportional to the granularity of the data collected in terms of frequency of col-
lection and the purposes for which data will be processed by the energy supplier or
third party. Longer intervals between measurements have the effect of aggregating
consumers’ data and masking details about the household’s energy consumption,
thus reducing the potential sensitivity of the data. Focus of the rules on whether
smart meter data is to be used for primary or secondary purposes, such as marketing,
is also consistent with data protection and privacy notices as the use or sharing of
smart meter data for secondary purposes merits stronger regulatory protections
121 See generally, UK Smart Metering Consultation Document (n 25) (UK’s Proposed Framework).
122 ibid 6–7. The government in the UK is proposing a framework for smart meter data access and privacy
that would be imposed through license conditions for energy suppliers. UK Smart Metering
Consultation Document p 45, Annex A (Draft License Conditions).
123 ibid 24.
124 ibid 6–7. There are some exceptions to the proposed consent rules that may justify access by the energy
supplier to deal with situations involving suspicions of energy theft by the customer, etc. UK Smart
Metering Consultation Document (n 25) 37. ‘The key factor in determining whether an activity consti-
tutes marketing should be whether it involves information about branded products and services, or spe-
cific customer propositions’, and does not include generic energy efficiency advice or information about
products and services for which there is no direct charge to the individual consumer. UK Smart
Metering Consultation Document (n 25) 40.
including more rigorous consent mechanisms. However, the UK’s proposed frame-
work fails to consider anticipated advances in smart metering systems that will enable

collection of smart meter data that includes enhanced granularity of detail. And it
fails to consider secondary purposes for collecting data beyond marketing purposes,
including use of smart metering data for secondary purposes related to employment
decisions, insurance rates, etc. In sum, data protection and privacy regulation for
smart metering systems should include consumer consent requirements for data
sharing with energy suppliers and third parties that are proportional to the granular-
ity of detail of the data and frequency of measurement of the data and that distin-
guish between primary and secondary uses for the data.
6.5 Are consumers able to adequately access and

control their own smart meter data?
Whether viewed from an EU or a US perspective, there appears to be consensus that
consumers should have access to smart meter data regarding their energy use con-
sumption and that they should have the right to share this data with third parties.125
Even the commentator who argue that energy suppliers (not consumers) own smart
meter data do not claim that consumers should not have access to their energy con-
sumption data or be able to control whether and for what purposes any third party
should be able to access or receive smart meter data.126 Policy reasons to favour con-
sumer access to smart meter data and control over third party access to their data
include: promoting the development of a competitive open marketplace for energy-
consumption data and empowering consumers to reduce their energy costs by giving
them relevant information and tools to manage their energy use including automated
means to do so. In the EU, these policy reasons support consumer data access and
control rights under the Data Protection Directive and other EU laws.127 State legis-
lation and administrative rules adopted by state public utility commissions may give
US consumers analogous rights of access and control over their smart meter data,
but where consumers do not have data access and control rights, the policy reasons
support industry self-regulation and may inform FTC consumer protection investiga-
tions regarding alleged unfair or deceptive practices related to smart meter data.128
125 See, eg Commission’s Recommendation on Smart Metering Systems (n 2) para 42(a) (stating that the
common minimum functional requirements of every smart metering system for electricity should ‘pro-
vide readings directly to the customer and any third party designated by the consumer’); DOE Data
Access and Privacy Report (n 5) 11 (finding ‘consumers should be able to access CEUD and decide
whether third-parties are entitled to access CEUD for purposes other than providing electrical power’);
UK Smart Metering Consultation Document (n 25) 54 (commenting that from a competition point of
view, it will be important for consumers to be able to authorize third party access to their smart meter
data without their energy suppliers’ involvement).
126 DOE Data Access and Privacy Report (n 5) 11. See Art 29 Opinion 12/2011 (n 2) 20–21.
127 See Art. 29 Opinion 12/2011 (n 2) 20–21 (providing its opinion that the data subjects’ rights of access
to information held about them under the Data Protection Directive means that there is an opportunity
to ensure that data subjects are able to exercise their rights easily using tools that enable direct access to
data).
128 See, eg California Public Utilities Code s 8380 (2012) (prohibiting companies from sharing, disclosing
or otherwise making accessible to any third party a customer’s electrical or gas consumption data with-
out the consent of the customer, with certain exceptions); CUPC Rulemaking 08-12-009 (n 40) 135
(California Public Utility Commission Rule 4(a) requires ‘covered entities shall provide to customers
However, even in the EU, concerns about access to smart meter data have
emerged because smart metering systems are being installed that may not actually

enable consumers to exercise their rights of access and control over smart meter data
due to technical limitations in the smart meters. For example, some smart meters
being tested in Europe may not enable consumers to directly access their data.129
The UK’s Proposed Framework for implementing smart metering systems addresses
this issue by requiring installation of smart meters that provide direct access to con-
sumers’ energy use data to include an in-home display upon installation of a smart
meter that will enable consumers to see energy consumption data in near real-
time.130 Additionally, smart meters to be installed in the UK: must be able to store
13 months of consumption data at half-hour intervals on the meter; enable con-
sumers to access to their data if they choose to access it; be capable of sharing cus-
tomers’ data with third parties across a secure network; and enable consumers to
securely connect smart devices to the meter in order to store their data.131
Although there is no federal information privacy legislation in the USA that pro-
vides consumers with a right of direct access to their smart meter data analogous to
the EU Data Protection Directive, state laws may give US consumers rights of access
to their data.132 Where state laws do not give consumers data access and control
rights, the policy reasons for consumer access that have been discussed previously
support voluntary industry self-regulation to give consumers access and control over
their smart meter data. Further, the policy justifications for giving consumers data
and access rights should inform FTC and state consumer protection investigations
to address consumer complaints that they have been subject to unfair or deceptive
practices related to smart metering systems. There is growing regulatory support in
the USA for giving consumers a legal right to access their data through their energy
suppliers and to give consumers the legal right to transfer the data to third parties of
their choice without restrictions.133 Remaining issues to resolve include how to en-
sure that energy service providers provide data in a form that the consumer and third
parties can use, and whether there is some data that the energy provider need not
upon request convenient and secure access to their covered information…in an easily readable format
that is at a level no less detailed than that at which the covered entity discloses the data to third
parties’).
129 See Art 29 Opinion 12/2011 (n 2) 20–21 (noting that some smart meters may not facilitate direct ac-
cess because they provide only a small text-only display on the meter and do not allow the customer to
access the information already transmitted by the meter, not the display graphics, which are stored in-
side the meter).
130 UK Smart Metering Consultation Document (n 25) 21–22.
131 ibid 21–22.
132 See, eg California Public Utilities Code s 8380 (2012) (prohibiting companies from sharing, disclosing
or otherwise making accessible to any third party a customer’s electrical or gas consumption data with-
out the consent of the customer, with certain exceptions); CUPC Rulemaking 08-12-009 (n 40) 135
(California Public Utility Commission Rule 4(a) requires ‘covered entities shall provide to customers
upon request convenient and secure access to their covered information…in an easily readable format
that is at a level no less detailed than that at which the covered entity discloses the data to third
parties’).
133 NISTIR 7628 (n 6) 21 (finding that smart meter data may be stored in multiple locations to which con-
sumers may not have ready access and recommending that any organization possessing energy use data
about consumers be required to provide access to consumers to their energy use data).
provide, perhaps because it is proprietary in nature and providing the data would
undermine the energy supplier’s competitive advantage.

6.6 To what extent should an energy supplier/utility be allowed
to use smart meter data for secondary purposes or share
it with third parties for secondary uses?
There are arguments about whether energy suppliers and third party service pro-
viders should be able to use smart meter data for commercial purposes such as dis-
closing or sharing it with third parties for purposes of behavioural advertising.134 For
example, in addition to the using the data for its primary purposes, such as billing the
consumer and managing the energy supply, the energy supplier may seek to use the
data for secondary purposes of its own or to share the data with third parties for sec-
ondary uses, such as providing energy conservation services to the consumer or
compiling marketing profiles for the use in targeted marketing. There ‘appears to be
widespread agreement that such practices, if permitted, should require further af-
firmative and informed consent, one jurisdiction requires utilities [energy suppliers]
to obtain regulatory approval before disclosing any potentially sensitive data’.135
As discussed in the previous section, the UK’s Proposed Framework distinguishes
among primary and third parties, with different proposed data access and privacy
rules for the different parties: energy suppliers, network operators and third parties.
It recognizes that energy suppliers and network operators are direct parties to deliv-
ery of energy to the consumer, but third parties are not.136 The UK’s Proposed
Framework also makes important distinctions related to the purposes for acquiring
and using smart meter data, distinguishing between direct and secondary purposes
for using energy consumption data. For example, less data protection/lower cus-
tomer consent requirements are proposed for supplier access to smart meter data to
be used for the primary purposes of billing the customer or fulfilling the supplier’s
statutory and license requirements because these are directly related to the purposes
for which smart metering systems are implemented. On the other hand, more data
protection/high customer consent requirements are proposed for supplier access to
smart meter data that is to be used for other purposes, with the most data protec-
tion/highest level of customer consent requirements reserved for obtaining smart
meter data to be used for marketing purposes.137 The UK’s Proposed Framework is
consistent with current EU law that prohibits collecting and using consumers’ per-
sonal data to produce direct marketing solicitations unless the consumer has given
her express consent.138 As long as the personal data is not being used for direct

135 ibid 1; UK Smart Metering Consultation Document (n 25) 6–7. See also, CUPC Rulemaking 08-12-
009 (n 40) 140–42 (discussing the requirement for energy suppliers to obtain the consumer’s prior, ex-
press, written authorization before disclosing energy consumption data to a third party for a secondary
purpose or using it for a secondary purpose). The CUPC also defines covered information and primary
and secondary purposes for disclosing covered information obtained through the use of smart meters.
CUPC Rulemaking 08-12-009 (n 40) 131–32 (Findings of Fact, paras 12 and 13).
136 UK Smart Metering Consultation Document (n 25) 6–7.
137 ibid 6–7.
138 E-Privacy Directive (n 101) art 13(1).
marketing purposes and it is not sensitive data under the special categories of data
defined in the Data Protection Directive, the energy service provider would be per-

mitted to process the data for a secondary purpose by providing basic data protec-
tions under the Data Protection Directive including giving the consumer notice of
the proposed secondary use and an option to refuse the secondary use of his data.139
The processing of personal data by third parties offering value-added energy ser-
vices should also be lawful and based on one or more of the six grounds for legitim-
ate processing listed in Article 7 of Directive 95/46/EC. Where consent is chosen as
the ground for processing, the consent of the data subject should be freely given, spe-
cific, informed and explicit and be given separately for each value-added service. The
data subject should have the right to withdraw his or her consent at any time. The
withdrawal of consent should not affect the lawfulness of the processing based on
consent before the withdrawal.
By statute, California mandates that energy suppliers may not share, disclose, sell
or otherwise make accessible to any third party a customer’s electrical or gas con-
sumption data or any personally identifiable information for any purpose.140 There
are a few exceptions to this rule that allow third party disclosure of smart meter data
that allow: disclosures required or permitted under state or federal law; disclosures
to third parties of aggregate data that does not include any information about cus-
tomer identity; and disclosures for operational and energy management purposes
including managing the energy supplier’s system, managing the grid, or implement-
ing a demand response energy delivery system (providing that the energy supplier re-
quires by contract that the third party to comply with information privacy and
security rules analogous to those applicable to the energy supplier).141 At the federal
level, non-binding policy guidance issued from the Obama administration recom-
mends that businesses provide transparency about whether and when they share con-
sumers’ data with others and provide heightened levels of transparency and
consumer control (eg obtaining consumers’ consent) if, subsequent to collection,
they decide to use or disclose personal data for purposes that are inconsistent with
the context in which the data was disclosed by the consumer.142
In sum, the California statute directly addresses third party data sharing in the
context of smart meters and does so in a manner that provides strong data protection
for consumers. It is a good model for EU and US regulatory reform to extend those
protections to all consumers with smart meters installed in their homes.
139 ibid. But see discussion of the opt in requirements for downloading cookies to track consumers’ online
behaviour and accessing and using cookie data to produce direct marketing solicitations. E-Privacy
Directive (n 101) art 5(3). See also, DIRECTIVE 2009/136/EC OF THE EUROPEAN
PARLIAMENT AND OF THE COUNCIL of 25 November 2009, amending Directive 2002/22/EC
on universal service and users’ rights relating to electronic communications networks and services,
Directive 2002/58/EC concerning the processing of personal data and the protection of privacy in the
electronic communications sector and Regulation (EC) No 2006/2004 on cooperation between na-
tional authorities responsible for the enforcement of consumer protection laws, O J (L 337/11), para 66
(25 November 2009) (EU Cookie Directive).
140 CPUC s 8380(b)(1-2).
141 CPUC s 8380(e)(1-3).
142 Obama’s Consumer Privacy Bill of Rights (n 45) 47–48.
6.7 Should consumers have the legal right to opt out of having a smart
meter or otherwise choose not to share smart meter data?

There are at least two different dimensions to this question. First, from a privacy and
data protection perspective, must energy suppliers provide an opportunity for con-
sumers to opt out of having a smart meter installed in their homes? Choosing not to
have a smart meter is the ultimate opt out from an information privacy perspective
because it provides maximum privacy and data protection for the consumer by pre-
venting data collection, processing and sharing of smart meter data at the household
level. Another option may be to require consumers to accept installation of a smart
meter in their homes, but give them the right to have their smart meter modified so
that it will limit data sharing, including programming to limit sharing of smart meter
data with their energy suppliers or other third parties. The latter option attempts to
balance the goals of protecting consumer privacy while also furthering the societal
interests that support participation in smart metering systems.
A second dimension to this privacy question relates to whether consumers can be
charged additional fees when they opt out of having a smart meter installed in their
homes or opt out of having their smart meters share data with their energy services
providers. Energy suppliers and industry regulators may argue that it is fair to charge
additional fees to consumers who opt out of smart meter installation or chose to
have their smart meters programmed to limit communication of their smart meter
data to their energy suppliers because such opt outs result in additional expenses for
energy suppliers and undermine potential societal benefits of smart metering
systems.143
In both Europe and the USA, some consumers have objected to having smart
meters installed in their homes for a variety of reasons that include concerns the priv-
acy intrusions and concerns that the technology may create health and safety risks
for consumers.144 In the USA, state public utility commissions that regulate energy
services suppliers and energy services suppliers have received complaints from con-
sumers who oppose having smart meters installed in their homes.145 Maine was one
143 See European Smart Metering Landscape Report 2012 (n 1) 59 (commenting that ‘the main beneficial
items (in order of positive contribution) are energy savings, savings on call centre costs, a lower cost
level as a result of the market mechanism (increased switching) and savings in meter reading costs’.
144 See, eg Angela Beniwal, ‘Utilities Are Getting Ahead Of Smart Meter Opt-Out Demands’ Renew Grid
(28 February 2012) (reporting on the California Public Utility Commission’s vote to create an opt-out
program and the resulting programs put in place by electrical and gas utilities in California) <http://
www.renew-grid.com/e107_plugins/content/content.php?content.8097> accessed 18 October 2013. In
the Netherlands, consumer privacy concerns led to a significant delay in the roll-out for smart meters
after the Dutch Senate, in April 2009, rejected a proposal for mandatory smart metering deployment.
European Smart Metering Landscape Report 2012, SmartRegions Deliverable 2.1, Vienna, p 58–60
(October 2012) (European Smart Metering Landscape Report 2012) <www.smartregions.net> ac-
cessed 18 October 2013.
145 Order Dismissing Complaint, State of Maine Public Utilities Commission, regarding Ed Friedman, and
others, Request for Commission Investigation into Smart Meters and Smart Meter Opt-Out, Docket No
2011-262 (31 August 2011) (providing background details regarding complaints filed by customers re-
garding smart meter installation and opt-out alternatives that lead to a previous Order by the State of
Maine’s Public Utility Commission directing a local utility to include opt out alternatives as part of its
smart meter initiative).
of the first states to pursue widespread implementation of smart meters. The Maine
Supreme Judicial Court issued the first reported court decision involving challenges

to smart metering implementation programmes in Friedman v PUC. The case was
brought by residential customers of Central Main Power Company (CMP) who ob-
jected to paying smart meter opt-out fees.146
Friedman v PUC examined CMP’s smart meter installation programme, which
had been approved by the Maine Public Utilities Commission (Maine PUC).147 The
programme gave customers two options to opt out: (i) have an analog meter
installed in the home instead of a smart meter, for an initial cost of $40 to have it
installed and additional fees of $12 per month as the consumer continued to opt
out, or (ii) keep the smart meter that has been installed in the home and have
the radio communications from the meter disabled, for a one-time fee of $20
and additional fees of $10.50 per month for as long as the opt out continues.148
In the case, consumers argued that CMP’s opt out programme was unlawful
because the opt out fees were so large as to be unreasonable, unjust and
discriminatory.149
The case was decided by the Supreme Judicial Court of Maine, the highest appel-
late court in the state, which agreed with the earlier decision of the Maine’s PUC
that CMC’s smart metering programme, with its two options for consumers to opt
out, did not violate consumers’ privacy rights.150 In so doing, the court accepted the
CMC’s argument that the opt out fees were justified due to the incremental cost to
suppliers that resulted from consumers opting out of smart meters.151 From a privacy
perspective, the court’s decision is disappointing because it does not discuss informa-
tion privacy concerns about the use or sharing of consumer data produced by smart
146 Friedman and others v Public Utilities Commission, 2012 ME 90, 2-3 (Maine Supreme Judicial Court, 12
July 2012) (Friedman v. PUC).
147 Order Approving Installation of AMI Technology, No. 2007-215(II), Order (Maine PUC, 25 February
2010); N Shah, ‘Maine Supreme Court Affirms Validity of Smart Meter Opt-Out Program’
InformationLawGroup (1 August 2012) (InformationLawGroup) <http://www.infolawgroup.com/
2012/08/articles/smart-grid-1/maine-supreme-court-affirms-validity-of-smart-meter-optout-program/>
accessed 18 October 2013.
148 Order (Part I), Nos 2010-345, 2010-389, 2010-398, 2010-400, 2011-085, Order (Maine PUC, 19 May
2011); Katherine Tweed, Court: Maine PUC Must Revisit Smart Meter Safety Issue,’ greentechgrid: (18
July 2012) <http://www.greentechmedia.com/articles/read/maine-puc-told-to-revisit-smart-meter-
safety-issue/> accessed 18 October 2013.
149 Friedman v. PUC, (fn 147) 4-5. They also asked the court to order the Maine PUC to reopen its investi-
gation to consider new evidence about the health and safety risks of radiation emitted by smart meters
that had been published since the PUC issued its Order imposing the opt out program.
150 Consumers had more success with their arguments about the health risks of smart meters. The Maine
Supreme Court found Maine’s PUC erred in dismissing consumers’ complaints raising concerns about
the health and safety of smart-meter technology associated with CMP’s smart metering project because
the PUC has a statutory duty to regulate public utilities in Maine to ‘ensure safe, reasonable, and ad-
equate service and to ensure that the rates of public utilities are just and reasonable to customers and
public utilities’. Friedman v PUC (n 147) 6.
151 The Maine PUC concluded incremental costs to the utility justified the fees to be charged by CMC for
the two options for consumers to opt out of its smart metering program. These incremental costs
included ‘1) longer repair times for power restoration after storms; and 2) continued inefficient energy
allocation to those customers using analog meters. InformationLawGroup (n 148) 1.
metering systems.152 Across the USA, consumers continue to challenge smart meter-
ing implementation programmes for a variety of privacy, health and other reasons,

including challenges to the reasonableness of opt out charges and in some states
(including Maine) legislation has been proposed to repeal or prohibit opt out
charges.153
Privacy concerns about mandatory smart meter installation programmes in
Europe have also lead to regulators giving consumers the ability to opt out of having
smart meters installed in their homes, as well as options to limit the data communi-
cated by smart meters.154 For example, Dutch consumers have the option to refuse a
smart meter and keep their traditional meter.155 At the EU level, the EDPS recom-
mends that consumers be given the choice of not switching to smart meters, or alter-
natively, be given the choice to have a smart meter installed but to have the meter’s
smart functionalities disabled.156
Allowing consumers to opt out of having smart meters or at least to opt out of
having smart meters that communicate granular energy use data is reasonable given
the policy reasons for implementing smart metering programmes. Energy suppliers
do not need data from each household to manage their businesses and the benefits
of the smart grid may be achieved without each household sharing granular energy
use data.157 However, at some point, if opt outs become prevalent, there may be in-
sufficient data to achieve the goals of the smart grid.158 A reasonable balance seems
to involve charging consumers reasonable fees to opt out. This is likely constitutional
in the USA where consumers do not have broad information privacy rights or funda-
mental human rights of privacy or data protection, at least not in the context of infor-
mation privacy and smart metering systems that do not involve governmental
surveillance.159 But is it lawful to charge opt out fees to EU consumers who do have
fundamental human rights of privacy and data protection that apply in all contexts
including smart metering systems? The answer will likely depend on finding a correct
balance between protecting fundamental human rights of privacy and data protection
152 Although Friedman v PUC (n 147) concluded that consumers’ privacy claims had been resolved by the
Maine PUC, the appellate court did not specifically discuss information privacy or data protection rights.
Instead, the appellate court’s discussion of privacy focuses on concerns about physical privacy intrusions
by utilities including the utilities access to customers’ property and premises for purposes of installation,
repair or replacement of its meters. Friedman v PUC (n 147) 12–14.
153 See, eg Walter Delacruz, ‘Smart Grid Technology: Privacy and Data Security Issues’ The Privacy Advisor,
p 1 (26 June 2012); Jeff Evans, ‘The Opt-Out Challenge’ Black & Veatch (published in the March/April
2012 issue of Electric Light & Power) <http://bv.com/docs/articles/the-opt-out-challenge.pdf> ac-
cessed 18 October 2013.
154 European Smart Metering Landscape Report 2012 (n 1) 59–60.
155 ibid 59. In the case of new construction and renovations, it is required that a smart meter be installed
and there is no obligation for the energy supplier to replace it with a traditional meter at the request of a
customer. ibid. However, the customer can have the smart meter treated like a traditional meter by regis-
tering it as ‘administrative off’. ibid.
156 EDPS Opinion on Smart Metering (n 2) 11.
157 Evans (n 154) 5–6.
158 ibid. (commenting that there is additional cost to the energy supplier that would result if too few cus-
tomers opt out; in this case the per-customer cost to opt out increases significantly and utilities would
need to recover non-covered opt out costs from the entire rate base, which would result in passing the
cost of opt outs onto all customers, not just those who choose to opt out).
159 See generally, CRID treatise (n 86).
in smart metering systems and promoting the societal goals of smart grids and smart
metering systems. If the fees imposed for opting out are too onerous, consumers

may rightly claim they are being unlawfully forced to give up their fundamental rights
of privacy and data protection. Recent research indicates that if there are little to no
price differences in services provided on homogeneous goods (likely including elec-
tricity service), privacy-friendly service providers can obtain a competitive advantage
over competitors that are less privacy friendly.160 However, it does not appear that
many consumers are willing to pay much more for enhanced information privacy.161
If smart meter opt out fees are imposed that are consistent with preserving con-
sumers’ fundamental human rights of privacy and data protection, these fees may still
be high enough to deter many privacy conscious people from opting out of participa-
tion in smart metering programmes.
6.8 Are there special concerns about consumer profiling and data sharing?
Profiling related to smart meters in the home will produce energy use profiles that
may be a source of detailed, behavioural information about the occupants of the
home. With a smart metering communication infrastructure, information about spe-
cific electric devices in a customer’s home will reveal not only the amount of electri-
city used, but rather, when and how long the device is used. Significant privacy
concerns arise when there is a possibility of revealing PII such as the personal life-
style habits and behaviours of customers, especially if this information is mishandled
or used for secondary purposes other than providing electricity.162
Consumer energy-use profiles differ from the data that are directly produced by
smart meters because they are consumer information that is derived or ‘mined’ from
consumer bases using automated profiling technologies.163 If consumer energy-use
profiles are produced and used by others, but are not known to the consumer, there
is informational asymmetry, meaning that the profiler knows information about the
consumer that the consumer does not know about themselves, so that the resulting
application of the profile to the consumer may induce the consumer to act in ways
he or she would not have chosen to do. Assume a profile is created by an energy sup-
plier based on smart meter data indicating that the consumer wastes energy as com-
pared to other households in her neighbourhood (‘energy hog’ profile). If that
160 Nicola Jentzsch and others, ‘Study on Monetising Privacy, An Economic Model for Pricing Personal
Information’ European Network and Information Security Agency, Deliverable 2012-02-27, (2012)
34–37, 39, 41 (ENISA Report).
161 ibid.
162 SDG&G’s Dynamic Pricing Project & Privacy by Design (n 87) (Forward).
163 See the work of Mireille Hildebrandt on profiling, arguing the focus of information privacy should be on
information rather than data because a consumer profile may be generated that has significant privacy
concerns, yet it is not based on PII. M Hildebrandt, ‘Profiling into the Future: An Assessment of
Profiling Technologies in the Context of Ambient Intelligence’ (2007) 1 FIDIS J Identity in the
Information Society 13 (Hildebrandt, FIDIS) <http://www.fidis.net/fileadmin/journal/issues/1-2007/
Profiling_into_the_future.pdf> accessed 2 March 2014. Automated profiling technologies use data min-
ing technologies build knowledge profiles and apply them, often without human intervention.
Hildebrandt, FIDIS, 5. One of the key privacy concerns related to profiling is information asymmetry,
wherein the data subject lacks access to information about themselves that is needed to exercise personal
autonomy. Hildebrandt, FIDIS, 9.
profile is shared with a network advertising company and used to select consumers
to receive special offers to buy autos, will that consumer receive special offers related

to energy-efficient cars? Probably not. But if the consumer knew about her energy-
use profile, she might choose to change her behaviour, perhaps by becoming more
environmentally aware and trying to help save the planet by conserving energy.
Purchasing an energy-efficient car rather than a gas guzzler would be a good step for
such a consumer, but she may not be aware that she fits the profile of an energy hog.
In other words, to exercise the important privacy right of personal autonomy, the
consumer needs access to important information about her energy usage including
energy use profiles that have been created using her smart meter data. Further, when
energy use profiles are not known by the consumer and they are shared with third-
parties including third parties the consumer is not aware of, such as online marketers,
this may result in further privacy harms such as unfair manipulation in commercial
contexts that are remote from the consumer/energy supplier relationship.
In sum, although it is increasingly possible to profile consumer’s online and other
behaviour without using PII or linking the profile to an identifiable natural person,
detailed energy use profiles for a residence should be considered personal data
related to smart metering systems.164 Privacy and data protection designed for smart
meter data should focus on consumer data that is reasonably identifiable to a house-
hold or any of its residents, as opposed to limiting personal data protection to trad-
itional notions of PII. If energy use data is enhanced with other consumer data in the
profiling process, this process should be transparent to consumers.165 Consumers
should be given access to their energy use profiles and have control over data sharing
of their energy use profiles with third parties. In most cases, affirmative express con-
sent mechanisms will be necessary to protect consumers’ privacy in data sharing con-
texts that involve energy use profiles.
6.9 Are there special concerns about data security and data sharing?
There are significant security concerns associated with smart grids and smart meter-
ing systems, such as preventing unauthorized data sharing with hackers and other un-
intended third parties. Researchers have demonstrated that it is possible to intercept
unencrypted smart meter data and to use it to discover details that invade users’ priv-
acy.166 Accordingly, the EU Commission advises that energy suppliers or network
operators that operate smart metering systems have security obligations to take ne-
cessary steps to protect personal data.167 Further, it is important to recognize that
encrypting smart meter data does not render data anonymous in order to make data
164 Costa and Poullet (n 55) 258–59.

165 FTC’s 2012 Report (n 45) 42–45 (discussing the need to provide increased transparency for data en-
hancement, a process whereby a company appends data obtained from third parties to data the company
has obtained directly from consumers). Data enhancement is already covered by the Data Protection
Directive, but in most situations data enhancement is not regulated in the USA.
166 ‘Smart meter technology is privacy intrusive, researchers claim’ Out-law.com (11 Jan 2012).
167 Commission’s Recommendation on Smart Metering Systems (n 2) para 7 (commenting that ‘Member
States should ensure that network operators and operators of smart metering systems, in line with their
other obligations under Directive 95/46/EC, take the appropriate technical and organizational measures
to ensure protection of personal data).
protection laws inapplicable because it is generally possible to decrypt the data and
re-identify the data subject.168 Even so encryption is important to discussions about

privacy and data sharing because it prevents access to energy use data without the
encryption key except in situations where the person acquiring the data has access to
the encryption code or breaks the encryption. In its guidance on privacy by design,
the Privacy Commissioner of Ontario recommends implementing a default rule that
all PII that is communicated from smart meters, whether transmitted wirelessly or
over wired networks, be encrypted.169 This is a sensible suggestion that should be ex-
tended to data sharing between the energy supplier or network operator and third
parties.
7. CONCLUSIONS
Consumer data sharing is a predominant feature of smart metering systems—indeed
at least some consumer data sharing may be essential in order for smart metering sys-
tems to live up to their potential to achieve energy conservation goals. Society bene-
fits from achieving energy conservation, but it should not come at the expense of
undue sacrifice of consumers’ privacy and data protection. In many cases, existing
laws in both the EU and the USA that regulate smart metering systems do not ad-
equately protect consumers’ data or privacy rights, including the right to be free of
unwarranted and intrusive surveillance in the home.
As demonstrated by this article, both the EU and US energy consumers have sig-
nificant privacy concerns about the implementation of smart metering systems and
sharing of their energy-use data. Further, finding solutions to address these privacy
concerns is challenging because it will require balancing individual and family privacy
interests with broader societal interests, including the need to better manage the en-
ergy supply. Although smart metering systems are being implemented on a global
basis and they raise similar privacy concerns for consumers around the world, they
are being addressed locally by regional, national or even state governments. Given
the large number of regulatory bodies involved in this effort (including 28 Member
States in the EU and over 50 state public utility commissions in the USA and thou-
sands of energy suppliers and industry associations), achieving consistent global data
protection and privacy protection for consumers is a daunting task. As this article ex-
plains, it is further complicated by the fact that there are several different approaches
that could be taken to ensure privacy in smart metering systems, including legisla-
tion, self-regulatory codes of conduct and technical design solutions.
Initially, the possibility of finding global solutions to protect consumers’ privacy
in smart metering systems appears brighter when approached from an industry
168 According to the FTC, fair information practices recommended for consumer data should be provided
for consumer data when it is reasonably linkable to a specific consumer, computer or device and this is
so even when the data is otherwise anonymous. However, the FTC limits the reach of its reasonably
linkable standard requiring recommended fair information practices: ‘As long as (1) a given data set is
not reasonably identifiable, (2) the company publicly commits not to re-identify it, and (3) the company
requires any downstream users of the data to keep it in de-identified form’ the data falls outside the
scope of the FTC’s recommended privacy protections and the data does not need to be given the rec-
ommended privacy protections. FTC’s 2012 Report (n 45) 22.
169 SDG&G’s Dynamic Pricing Project & Privacy by Design (n 87) 16.
self-regulation standpoint. Global privacy standards for smart metering systems could
be implemented by industry leaders who are designing, manufacturing and installing

smart meters in consumers’ homes as this type of industry self-regulation is not ne-
cessarily limited by national or regional borders. Yet, whether or not industry self-
regulation is a global effort, it often fails due to lack of a legal mandate to adequately
protect consumers’ privacy because trade-offs are made in the effort to cut costs and
maximize profits that unduly sacrifice consumer privacy. Given the revenue opportu-
nities smart metering systems create, the temptation to sacrifice consumer privacy in
order to facilitate data sharing and data mining for direct marketing purposes may
prove too much for the smart metering industry.
On the other hand, solutions involving the application of principles of privacy by
design to smart metering systems also seem promising, and there have been some
impressive efforts by energy suppliers to incorporate privacy by design into design of
smart metering systems.170 These efforts provide case studies that demonstrate best
practices in terms of applying principles of privacy by design to smart metering
systems.
Finally, new privacy and data protection laws are a viable solution to protect con-
sumers’ privacy in smart metering systems. This task should involve identifying the
significant privacy and data concerns related to data sharing in smart metering sys-
tems, which include the potential that consumers’ energy-use data may be transferred
beyond national borders. It should also involve finding solutions that comply with
globally recognized privacy and data protection principles and industry best practices
in order to adequately protect the information privacy of consumers in smart meter-
ing systems. Although different regulatory approaches have, and will likely continue
to be, adopted by EU and US regulators, the insights offered by this article’s com-
parative law analysis are aimed at providing a more global perspective for these legis-
lative efforts.
In sum, we urge government regulators and the smart metering industry not to
lose sight of the global nature of the smart metering industry and the common con-
sumer privacy concerns shared by the EU and US consumers. Although applicable
laws will likely continue to be adopted by local, national or regional governments
and industry-crafted solutions may also be diverse, consumers in both jurisdictions
should be able to expect that their privacy and personal data will be protected in
smart metering systems consistent with recognized privacy principles and best prac-
tices in the industry.
170 See, for example, application of foundational principles of privacy by design to smart grid systems (see
Privacy by Design, Ontario (n 87) 16–17, 28).

Smart Metering Systems and Data Sharing

Hochgeladen von

Dokumentinformationen

Originalbeschreibung:

Copyright

Verfügbare Formate

Dieses Dokument teilen

Dokument teilen oder einbetten

Freigabeoptionen

Stufen Sie dieses Dokument als nützlich ein?

Sind diese Inhalte unangemessen?

Copyright:

Verfügbare Formate

Smart Metering Systems and Data Sharing

Hochgeladen von

Copyright:

Verfügbare Formate

International Journal of Law and Information Technology, 2014, 22, 215–253

Downloaded from https://academic.oup.com/ijlit/article-abstract/22/3/215/755952 by Universidad Tecnológica de Pereira user on 04 November 2019

C The Author (2014). Published by Oxford University Press.

Downloaded from https://academic.oup.com/ijlit/article-abstract/22/3/215/755952 by Universidad Tecnológica de Pereira user on 04 November 2019

Downloaded from https://academic.oup.com/ijlit/article-abstract/22/3/215/755952 by Universidad Tecnológica de Pereira user on 04 November 2019

Downloaded from https://academic.oup.com/ijlit/article-abstract/22/3/215/755952 by Universidad Tecnológica de Pereira user on 04 November 2019

Downloaded from https://academic.oup.com/ijlit/article-abstract/22/3/215/755952 by Universidad Tecnológica de Pereira user on 04 November 2019

Installation of smart metering systems is important to achieving the goals of smart

Downloaded from https://academic.oup.com/ijlit/article-abstract/22/3/215/755952 by Universidad Tecnológica de Pereira user on 04 November 2019

Downloaded from https://academic.oup.com/ijlit/article-abstract/22/3/215/755952 by Universidad Tecnológica de Pereira user on 04 November 2019

Downloaded from https://academic.oup.com/ijlit/article-abstract/22/3/215/755952 by Universidad Tecnológica de Pereira user on 04 November 2019

Downloaded from https://academic.oup.com/ijlit/article-abstract/22/3/215/755952 by Universidad Tecnológica de Pereira user on 04 November 2019

Downloaded from https://academic.oup.com/ijlit/article-abstract/22/3/215/755952 by Universidad Tecnológica de Pereira user on 04 November 2019

transmission or unauthorized persons access electronically stored energy use data, as

Downloaded from https://academic.oup.com/ijlit/article-abstract/22/3/215/755952 by Universidad Tecnológica de Pereira user on 04 November 2019

Downloaded from https://academic.oup.com/ijlit/article-abstract/22/3/215/755952 by Universidad Tecnológica de Pereira user on 04 November 2019

4.1 Consumer data directly produced by smart metering systems

‘Unique smart meter ID and/or unique property reference number (even in

49 DOE Data Access and Privacy Report (n 5) 9.

A description of the message being transmitted, for example whether it is a

Downloaded from https://academic.oup.com/ijlit/article-abstract/22/3/215/755952 by Universidad Tecnológica de Pereira user on 04 November 2019

4.2 Indirect consumer data produced by smart metering

Downloaded from https://academic.oup.com/ijlit/article-abstract/22/3/215/755952 by Universidad Tecnológica de Pereira user on 04 November 2019

5. PARTIES AND PURPOSES AND DATA SHARING

Downloaded from https://academic.oup.com/ijlit/article-abstract/22/3/215/755952 by Universidad Tecnológica de Pereira user on 04 November 2019

5.1 Third parties involved in data sharing

Downloaded from https://academic.oup.com/ijlit/article-abstract/22/3/215/755952 by Universidad Tecnológica de Pereira user on 04 November 2019

5.2 Primary and secondary purposes for acquiring

Downloaded from https://academic.oup.com/ijlit/article-abstract/22/3/215/755952 by Universidad Tecnológica de Pereira user on 04 November 2019

Downloaded from https://academic.oup.com/ijlit/article-abstract/22/3/215/755952 by Universidad Tecnológica de Pereira user on 04 November 2019

6. KEY PRIVACY CONCERNS AND WAYS

77 EDPS Opinion on Smart Metering Systems (n 2) 5–6.

Downloaded from https://academic.oup.com/ijlit/article-abstract/22/3/215/755952 by Universidad Tecnológica de Pereira user on 04 November 2019

Downloaded from https://academic.oup.com/ijlit/article-abstract/22/3/215/755952 by Universidad Tecnológica de Pereira user on 04 November 2019

Downloaded from https://academic.oup.com/ijlit/article-abstract/22/3/215/755952 by Universidad Tecnológica de Pereira user on 04 November 2019

6.2 What data related to smart metering systems should be protected?

Downloaded from https://academic.oup.com/ijlit/article-abstract/22/3/215/755952 by Universidad Tecnológica de Pereira user on 04 November 2019

reasonably linkable to a specific consumer, smart meter, computer, or household.’98

Downloaded from https://academic.oup.com/ijlit/article-abstract/22/3/215/755952 by Universidad Tecnológica de Pereira user on 04 November 2019

Downloaded from https://academic.oup.com/ijlit/article-abstract/22/3/215/755952 by Universidad Tecnológica de Pereira user on 04 November 2019

6.3 What data are particularly sensitive in the

Downloaded from https://academic.oup.com/ijlit/article-abstract/22/3/215/755952 by Universidad Tecnológica de Pereira user on 04 November 2019

106 ibid. art. 8.

Downloaded from https://academic.oup.com/ijlit/article-abstract/22/3/215/755952 by Universidad Tecnológica de Pereira user on 04 November 2019

113 ibid 60.

Downloaded from https://academic.oup.com/ijlit/article-abstract/22/3/215/755952 by Universidad Tecnológica de Pereira user on 04 November 2019

6.4 What are the implications of the increasing

117 EDPS Opinion on Smart Metering Systems (n 2) 12.

Downloaded from https://academic.oup.com/ijlit/article-abstract/22/3/215/755952 by Universidad Tecnológica de Pereira user on 04 November 2019

Downloaded from https://academic.oup.com/ijlit/article-abstract/22/3/215/755952 by Universidad Tecnológica de Pereira user on 04 November 2019

6.5 Are consumers able to adequately access and

Downloaded from https://academic.oup.com/ijlit/article-abstract/22/3/215/755952 by Universidad Tecnológica de Pereira user on 04 November 2019

Downloaded from https://academic.oup.com/ijlit/article-abstract/22/3/215/755952 by Universidad Tecnológica de Pereira user on 04 November 2019

134 DOE Data Access and Privacy Report (n 5) 12.

Downloaded from https://academic.oup.com/ijlit/article-abstract/22/3/215/755952 by Universidad Tecnológica de Pereira user on 04 November 2019

Downloaded from https://academic.oup.com/ijlit/article-abstract/22/3/215/755952 by Universidad Tecnológica de Pereira user on 04 November 2019

Downloaded from https://academic.oup.com/ijlit/article-abstract/22/3/215/755952 by Universidad Tecnológica de Pereira user on 04 November 2019

Downloaded from https://academic.oup.com/ijlit/article-abstract/22/3/215/755952 by Universidad Tecnológica de Pereira user on 04 November 2019

Downloaded from https://academic.oup.com/ijlit/article-abstract/22/3/215/755952 by Universidad Tecnológica de Pereira user on 04 November 2019

Downloaded from https://academic.oup.com/ijlit/article-abstract/22/3/215/755952 by Universidad Tecnológica de Pereira user on 04 November 2019

164 Costa and Poullet (n 55) 258–59.

Downloaded from https://academic.oup.com/ijlit/article-abstract/22/3/215/755952 by Universidad Tecnológica de Pereira user on 04 November 2019

Downloaded from https://academic.oup.com/ijlit/article-abstract/22/3/215/755952 by Universidad Tecnológica de Pereira user on 04 November 2019