Background:

The Statewide Minimum Privacy Policy for Disclosure of Customer Energy Use Information.

Legislation enacted in the 2015 regular session established the Statewide Minimum Privacy Policy (Privacy Policy) for disclosure of utility customer energy use information.

Effective July 24, 2015:

an electric utility may not sell private or proprietary retail electric customer information;
except under limited circumstances, an electric utility may not disclose private or proprietary retail electric customer information with or to its affiliates, subsidiaries, or any other third party for the purposes of marketing services or product offerings to a retail electric customer who does not already subscribe to the service or product, unless the utility has first obtained the customer's written or electronic permission;
customer permission is not required when the utility has a contract with a third party that is directly related to the conduct of the utility's business, if the contract prohibits the third party from further disclosing any private or proprietary customer information to certain other third parties; and
a person other than an electric utility may not capture, obtain, or disclose private or proprietary customer information for commercial purposes except under limited circumstances.

"Person" means any individual, partnership, corporation, limited liability company, or other organization or commercial entity, other than an electric utility.

"Private consumer information" includes the customer's name, address, telephone number, and any other personally identifying information.

Enforcement of the Privacy Policy.

Violation of the Privacy Policy is declared an unfair and deceptive act in trade or commerce and an unfair method of competition for purposes of applying the Consumer Protection Act (CPA).

Consumer Protection Act.

The CPA prohibits unfair methods of competition and unfair or deceptive acts or practices in the conduct of trade or commerce directly or indirectly affecting the people of Washington. The CPA allows a person injured by a violation of the act to bring a private cause of action for damages. In addition, the CPA allows the Attorney General (AG) to bring a CPA action in the name of the state or on behalf of persons residing in the state. In an action brought by the AG, the prevailing party may, at the discretion of the court, recover the costs of the action and reasonable attorneys' fees.

The CPA does not apply to actions or transactions that are regulated by the Utilities and Transportation Commission (UTC). Therefore, the CPA does not apply to regulated actions of an investor-owned utility. In addition, the CPA has been construed to be inapplicable to actions of municipal corporations, including public utility districts, on the grounds that actions of such municipal corporations have not been deemed to be actions "in the conduct of trade or commerce."

Disclosure of Private Customer Energy Information by Investor-Owned Utilities.

The UTC prohibits investor-owned utilities from disclosing or selling private consumer information with or for a utility's affiliates, subsidiaries, or any other third party for the purposes of marketing services or product offerings to a customer who does not already subscribe to that service or product, unless the utility obtains the customer's written or electronic permission.

Consumer-Owned Utilities.

"Consumer-owned utility" (COU) means a municipal electric utility, a public utility district, an irrigation district, a cooperative, or a mutual corporation or association, that is engaged in the business of distributing electricity to more than one retail electric customer in the state. The UTC does not have authority to regulate COUs, which are instead primarily regulated by their own governing bodies. The State Auditor's Office has authority to examine the financial affairs of all local governments, including public utility districts and municipal electric utilities, and to audit the compliance of COUs with the Energy Independence Act.

Summary:

The Statewide Minimum Privacy Policy for Disclosure of Customer Energy Use Information.

An electric utility's authority to disclose private or proprietary customer information to a third party with which the utility has a contract is modified. In addition to prohibiting the third party from further disclosing the customer information, the contract must prohibit the third party from selling the information to a party that is not the utility and not a party to the contract with the utility.

Implementation by Consumer-Owned Utilities.

A consumer-owned utility (COU) must implement the Statewide Minimum Privacy Policy for disclosure of customer energy use information through a policy adopted by its governing board by October 9, 2016. The policy must include provisions ensuring compliance with the statewide minimum privacy policy and must include procedures, consistent with applicable law, for investigation and resolution of complaints by a retail electric customer whose private or proprietary information may have been sold by the COU or disclosed by the utility for the purposes of marketing services or product offerings without the customer's permission.

Consumer Protection Act.

Disclosure or sale of private or proprietary customer information by an electric utility is no longer declared an unfair or deceptive act in trade or commerce and enforceable under the Consumer Protection Act (CPA). Disclosure or sale of private or proprietary customer information by a third party remains enforceable as a CPA violation, if a contract with the utility prohibited the third party from further disclosure or sale of the customer information.

House	97	0
Senate	44	0