By:
Nader Farah President
ESTA International
Smart Grid and Privacy
An International View
6° FÓRUM LATINO-AMERICANO
DE SMART GRID
27 November 2013
Smart Grid and Privacy
An International View
6° FÓRUM LATINO-AMERICANO
DE SMART GRID
One US Consumer’s Reaction in Texas!
Source: SmartGridNews.com – July 20, 2012
ESTA International
Consultants Focused on the Smarter Grid
Areas of Expertise
Smart Grid Technologies (Smart Meters, AMI, PMU, Renewable Energy, Communication Technologies, Electric Vehicles impacts, Energy Storage, Testing Facilities) Smart Grid Regulation and Policy
Real-Time Automation (SCADA, EMS, Distribution Management Systems, Outage Management Systems, Substation Automation, IEC 61850 Object Modeling) Cybersecurity, IT and Telecomm for Electric Utilities Power Systems Planning, Analysis, and Studies Asset and Maintenance Management, Failure Analysis Revenue Assurance
Operational Support
Distributed Energy Resource Integration of Renewable Energy Wholesale electricity market operations
Demand Response Programs & Energy Efficiency
Smart Grid Regulatory Framework/ Roadmap Smart Grid Transmission Feasibility Study
Smart Grid Distribution Feasibility Study
Int’l Smart Grid Survey/ Study ISGAN Support
Smart Meter Lab Design Sensor Technology Study
PMU Standards Harmonization Int’l Coordination Support
Smart Grid PLC Testbed For HAN and EV/EVSE
SG Technology Roadmap Guide Draft Roadmap for Saudi Arabia
Many Countries Have Consumer Protection Laws
Example - Mexico
o
Article 1.- This Law is of public interest and of general enforcement throughout the entire
Republic (Mexico) and has as its purpose the protection of personal information possessed
by private parties, with the goal of regulating its legitimate use, monitored and informed,
in order to guarantee privacy and the people’s right to informed self-determination.
Source: Ley Federal de Protección de Datos Personales en Posesión de los Particulares (LFPDPPP).
o
Article 6, sections II and III, of the Political Constitution of the United Mexican States
(CPEUM) establishes the principles and foundations for exercising human rights to
information and privacy in the following manner:
II. Information regarding private life and personal information will be protected under the terms and with exceptions determined by law.
III. Every person, without need for proving any interest or justifying its use, will have free access to public information, to his/her personal information, or to correction of such.
Source: Constitución Política de los Estados Unidos Mexicanos (CPEUM)
While Smart Grid privacy concerns may not be expressly addressed in existing laws
and regulations, they may still be applicable!
Customer Energy Data
o
Foundational to:
o
Customer Engagement
o
Energy Efficiency
o
Demand Response
o
Enhanced Outage Management
o
Improved Grid Operation
Four Dimensions of Privacy
1.
Personal information—any information relating to an individual,
who can be identified, directly or indirectly, by that information
and in particular by reference to an identification number or to
one or more factors specific to his or her physical, physiological,
mental, economic, cultural, locational or social identity
2.
Personal privacy—the right to control the integrity of one’s own
body
3.
Behavioral privacy—the right of individuals to make their own
choices about what they do and to keep certain personal
behaviors from being shared with others
4.
Personal communications privacy—the right to communicate
without undue surveillance, monitoring, or censorship
6
Generally Suggested Issues for Smart Grid Entities
o Conduct pre-installation processes and activities for using Smart Grid technologies with
utmost transparency.
o Conduct an initial privacy impact assessment before making the decision to deploy
and/or participate in the Smart Grid.
o Provide regular privacy training and ongoing awareness communications and
activities to all workers who have access to personal information within the Smart Grid
o Develop privacy Use Cases that track data flows containing personal information to
address and mitigate common privacy risks that exist for business processes within the Smart Grid
o Educate consumers and other individuals about the privacy risks within the Smart Grid
and what they can do to mitigate them
o Share information with other Smart Grid market participants concerning solutions to
common privacy-related risks
o Manufacturers and vendors of smart meters, smart appliances, and other types of
smart devices, should engineer these devices to collect only the data necessary for the purposes of the smart device operations
Smart Grid Privacy
o
European Union
o
United States DOE
o
Unites States, California
o
Canada, Ontario
o
United Kingdom
European Union
EU Commission SG Task Force Recommendations
o Adequate measures must be deployed to physically protect the contents and nature
of data related to the consumer in order to protect that consumer
o The EU should perform a form of privacy impact assessment related to SG
development to determine upfront if a development causes a privacy impact to the public
o Minimizing the amount of data to the only necessary ones
o Determine deadlines and timeframes for storage of the data and different types of
data usage
o Develop procedures for removing / deleting the data
o Anonymous data approach
o Transparency in all processes and work
o Usage of privacy certifications systems by regulatory bodies over any actor that will
have access to the data
10
- EU Commission SG Task Force Recommendations -, Essential Regulatory Requirements and Recommendations for Data Handling, Data Safety, and Consumer Protection, pg. 4.
DOE Task Force Recommendations
USA - California
o
California became the first US State to adopt privacy rules for customer data.
Senate Bill-1467
o
At core are concepts from Fair Information Practice (FIP) principals adopted
by the Department of Homeland Security (DHS)
o
Rules apply to electrical corporations, electrical corporations’ third-party
contractors, and any other third-parties that access customer data directly
from the electrical corporation
o
Rules require:
o Electrical corporations provide customers with a privacy notice
o That upon a security breach affecting more than 1,000 customers, the electrical
corporation notify customers within two weeks of such a breach
o Electrical corporations file with the CPUC annually a report on
o All security breaches of customer information
o The number of third-parties accessing customer data
o The number of times the utility or third-party was not in compliance with the rules
USA -California
o Disclosure - Utilities that collect meter data may not share customers’ energy
information with any third party without the customer’s consent
o only exception is if data is part of an energy efficiency or demand response program in which
the customer participates. In that case, the third party must sign a contract agreeing to implement data protection measures
o Data security/protection - Utilities and energy service providers must
o provide security “to protect the personal information from unauthorized access, destruction, use,
modification, or disclosure.”
o “prohibit the use of the data for a secondary commercial purpose not related to the primary
purpose of the contract without the customer’s consent.”
o Liability - Utilities that release data to a third party with customer consent “shall not be
responsible for the security of that data, or its use or misuse” unless the utility has a business relationship with the third party.
o Removes a major liability concern for utilities
o Continued use - Utilities are explicitly granted permission to continue using customer
Canada, Ontario
o
Privacy issues in Ontario are reviewed by the Office of the Information
and Privacy Commissioner of Ontario (IPC)
o
IPC has advocated that local utilities adhere to Privacy by Design
principles (PbD) to ensure that privacy is part of the core functionality of
the Smart grid
o
Goal of PbD is “the protection of privacy through the use of privacy
enhancing technologies
o embedding them into the design specifications of information technology,
business practices, physical environments and infrastructure
o making privacy the default”
o
Ultimate goal in Ontario is to have PbD incorporated into the design and
infrastructure of Smart Grid systems as a means of protecting Personal
Identifiable Information (PII)
Cavoukian, Polonetsky, & Wolf, Smart Privacy for the Smart Grid: embedding privacy into the design of electricity conservation, 2010, p. 276
United Kingdom
o
The UK Smart Grid Program has taken a rigorous and systematic
approach to assessing and managing the issue of data privacy
o
It is intended to build on safeguards already in place, notably the
Data Protection Act 1998, to develop a privacy policy for smart
metering data
o
The UK plans to utilize the Privacy by Design (PbD) approach toward
developing these policies
16
Overall principle: Consumers should be able to choose how their
consumption data is used and by whom, except where data is
required to fulfill regulated duties
United Kingdom
The UK approach to privacy is being delivered through:
o
The development of a Privacy Impact Assessment
o
The development of a privacy policy framework which will protect the
interests of consumers and provide them with assurance
o
A Privacy Charter to be developed by suppliers to provide
transparency about the new arrangements
o
Implementing the framework, for example through changes to
United Kingdom – Smart Grid Privacy Policy Proposals
o
From a privacy perspective consumers have a right to expect that
any personal data they might have processed about them is kept
secure and cannot be accessed inappropriately
o
There should be a functional requirement for thirteen months of
consumption data to be stored within the meter
o
For the majority of smart metering data, it is only when the
consumption data is accessed and can be combined with other
information relating to an individual that it becomes personal data
o
Explore opportunities for ways of accessing this data without
combining it in such a way that it becomes personal data
(“anonymising”)
o
Introduction of a privacy charter to address privacy concerns
associated with the rollout of smart metering and in line with best
practice as identified by the Information Commissioner’s Office (ICO)
US DOE - Voluntary Code of Conduct
1.
Rights of the Consumers – Elements that relate to the rights that the
consumers have according with laws and regulations.
2.
Obligations of the third parties and vendors – Elements that relate to the
rights that the consumers have according with laws and regulations.
3.
Management And Accountability – Elements that relate to the credibility
of the utility and/or third party’s privacy function.
4.
Notice And Purpose – Elements that relate to communicating
applicable policies, and related choices, to consumers.
5.
Choice And Consent – Elements that relate to the consumer’s granting
of authorization for the release/sharing of his or her data.
6.
Collection And Scope – Elements that relate to the scope of consumer
US DOE - Voluntary Code of Conduct
7.
Use And Retention – Elements that relate to how long consumer data
should be kept, and when it should be destroyed.
8.
Individual Access – Elements that relate to the consumer accessing his
or her own data.
9.
Disclosure And Limiting Use – Elements that relate to how consumer
data is shared with third parties
10.
Security And Safeguards – Elements that relate to how consumer data
should be protected from un-authorized disclosure.
11.
Accuracy And Quality – Elements that relate to the maintenance of
accurate and complete consumer data.
12.
Openness, Monitoring, And Challenging Compliance – Elements that
relate to consumer education and complaints.
US DOE - Voluntary Code of Conduct
o
Mission Statement Work Group
o
Notice and Awareness Work Group
o
Self Enforcement Management and Redress Work Group
o
Choice and Consent Work Group
o
Integrity and Security Work Group
o
Access and Participation Work Group
Two Public Meetings in Washington D.C. - Open to all participants in
person or via web-conferencing (Feb 26, 2013 and Nov 22, 2013)
Conclusion
o
Countries are at different levels of policy development
o
Common trends for countries reviewed:
o
Consumer is the owner of the data
o
Use of consumer data should require an opt-in action (the consumer
approving access to their information) in order to use that data.
o
Other trends not fully developed
o
Lifespan of data retention should be limited, but there is not yet
consensus on how long lifespan should be
o
What data to include as a set in order to determine the level of
personal identification that set gives, and
o
What level of transparency the process of managing this data will have
Contact at ESTA
Nader Farah President
ESTA International, LLC
2214 Rock Hill Road, Suite 180 Herndon, VA 20170
USA
Office Phone: +1 703 831 4567 Mobile Phone: +1 703 200 7381
