H.R. 10284: Smart Meter Data Privacy Protection Act

This bill would limit how certain electric utilities can use data collected by smart meters. It applies to state-regulated electric utilities that are not wholly owned by U.S. persons, and it focuses on data that shows how much electricity a customer uses in near real time.

What data is covered

The bill defines covered data as “personal consumption data”, meaning data collected by a smart meter. A smart meter is a digital device that records a customer’s electricity use in near real time and automatically sends that information to the utility.

Main restriction on use of the data

A covered utility would be prohibited from using this personal consumption data for any purpose other than an authorized operational purpose. The bill says authorized operational purposes include:

• billing,
• outage management,
• electric grid reliability,
• regulatory compliance, and
• customer-authorized demand response programs.

The bill also says utilities could not license, sell, monetize, or otherwise use this data for commercial purposes unless the use is for one of those allowed operational purposes.

Reporting requirements

Each covered utility would have to file an annual report with the Federal Trade Commission (FTC), no later than one month after the end of its fiscal year. The report would need to describe:

• what kinds of personal consumption data the utility collected during the year,
• how the utility used that data, and
• who the utility shared that data with.

Penalties for misuse

If the FTC finds that a utility used the data in violation of the bill, the utility would have to credit the affected customer’s bill by three times the revenue generated by that improper use. The utility would not be allowed to pass that cost on to customers through higher bills.

Enforcement

The FTC would enforce these rules as if violations were unfair or deceptive acts or practices under the FTC Act. States would also be able to bring lawsuits if they believe residents were harmed, seeking to stop violations, enforce compliance, obtain damages or restitution, or get other appropriate relief. The FTC would have the option to intervene in those state cases.

Data security and retention

The FTC would be required to set reasonable security and retention standards for any personal consumption data that is used for an allowed operational purpose.

Effect on state laws

The bill would create a federal minimum standard, but it would not override state laws that provide stronger privacy protections for smart meter data.

Relevant Companies

None found