1 / 12

Privacy and the Smart Grid Elias L. Quinn April, 2009

Privacy and the Smart Grid Elias L. Quinn April, 2009. The Heart of the Matter. Existing Privacy Law. Privacy Concern. Privacy Concern. Balancing Risks. Existing Privacy Law. Policy Responses. Data Services. Balancing Risks. Existing Privacy Law. Policy Responses. Privacy Concern.

gaius
Download Presentation

Privacy and the Smart Grid Elias L. Quinn April, 2009

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Privacy and the Smart Grid Elias L. Quinn April, 2009

  2. The Heart of the Matter

  3. Existing Privacy Law

  4. Privacy Concern Privacy Concern Balancing Risks Existing Privacy Law Policy Responses Data Services Balancing Risks Existing Privacy Law Policy Responses

  5. Privacy Concern Balancing Risks Smart Grid Privacy Concerns Existing Privacy Law Policy Responses Individuated Patterns Real Time Surveillance Electronic Detritus Physical Invasion

  6. Privacy Concern Balancing Risks Competing Policy Concerns Existing Privacy Law Policy Responses Environmental Initiatives: High resolution information best facilitates DSM and conservation efforts. Utility Incentive Structures: Reduced consumption cuts into profits. Utility-control of information flows is a potential (partial) answer. Edge Services & Data Markets: Bottlenecks in information exchange could dampen innovation, bar market entry, or drive a black market. Privacy Implications: The fewer restrictions access to AMI, the greater the risk of privacy invasion. Technological decisions and standards are not policy-neutral. Unbundling the smart meter will alter the calculus.

  7. Privacy Concern Balancing Risks Colorado’s Privacy Regulations Existing Privacy Law Policy Responses Examination Diagnosis 4 C.C.R. § 723-1-1004(t): Defines protectable “personal information” broadly, excludes info “necessary for billing.” 4 C.C.R. § 723-1-1104: Requires consumer informed consent prior to information disclosure; prohibits umbrella opt-in mechanisms. C.R.S. § 6-1-716: Requires customer notice of security breach; references even narrower definition of “personal information.” Exception likely to swallow the rule. Unnecessarily inflexible in light of rapid changes and growth in edge services. Definitions generally do not contemplate information such smart-metered data.

  8. Privacy Concern Balancing Risks The Regulatory Tool Kit Existing Privacy Law Policy Responses [1] 2 3 • Disclosure Consent Regulations • Opt-in: Customers affirmatively allow their information to be shared. • Opt-out: Customers are provided with an opportunity to take their name off the list for information sharing. •  Case-by-case, or umbrella consent. • Combination, e.g., • Umbrella opt-out for joint venture or electricity service partners. • Umbrella opt-in for efficiency consultants and automation vendors • Case-by-case opt-in for entities unrelated to electricity provision (such as data brokers, insurance) Disclosure Consent Regulation Smart Grid Privacy

  9. Privacy Concern Balancing Risks The Regulatory Tool Kit Existing Privacy Law Policy Responses 1 [2] 3 • Protection Requirements • (Electric Utilities & 3rd Parties) • Confidentiality Agreement • Prohibited from sharing info. • Subject to PUC restrictions • Procedural Best Practices • processed fairly and lawfully, • sought/collected/analyzed only for specified purposes, • merely adequate and not excessive for the purposes motivating its collection, • kept accurate, and • Kept in a form allowing for identification for no longer than necessary • from EU Directive 95/46/EC Art. 6(1) Disclosure Consent Regulation Protection Requirements Smart Grid Privacy

  10. Privacy Concern Balancing Risks The Regulatory Tool Kit Existing Privacy Law Policy Responses 1 [2] 3 • Protection Requirements • (Electric Utilities & 3rd Parties) • Confidentiality Agreement • Prohibited from sharing info. • Subject to PUC restrictions • Procedural Best Practices • processed fairly and lawfully, • sought/collected/analyzed only for specified purposes, • merely adequate and not excessive for the purposes motivating its collection, • kept accurate, and • Kept in a form allowing for identification for no longer than necessary • from EU Directive 95/46/EC Art. 6(1) • Technological Protections • “Industry Standards” for Security • e.g., Texas Code § 25.130(j)(3) • Clean Air Act Method for Tech. Protections: • - BACT: Best Available Control Tech. • - BDT: Best Demonstrated Tech. • - RACT: Reasonably Available Control Tech. • CAA §§ 165(a)(4), 111(a)(1), 172(c)(1) • D. Audits , Reports, Self-Assessments. Disclosure Consent Regulation Protection Requirements Smart Grid Privacy

  11. Privacy Concern Balancing Risks The Regulatory Tool Kit Existing Privacy Law Policy Responses 1 2 [3] • Notice of Information Breach • Ensure smart grid information triggers notice obligations. • Notice to both the electricity customer and to the PUC. • Safe haven if security audits are clean. Disclosure Consent Regulation Protection Requirements Smart Grid Privacy Notice of Information Breach

  12. Privacy Concern Balancing Risks Questions? Existing Privacy Law Policy Responses Existing Privacy Law Elias L. Quinn University of Colorado Law School eliquinn@gmail.com

More Related