{"operation":"document","citation":"4 CCR 723-4 Rule 4027","title":"Privacy, Access, and Disclosure","source_type":"regulation","agency":"Colorado Public Utilities Commission","status":"current","official":true,"published_on":null,"effective_on":null,"summary":"(a) A utility shall protect customer data in the utility's possession or control to maintain the privacy of customers, while providing reasonable access to that data. A utility is only authorized to use customer data to provide regulated utility service in the ordinary course of business. (b) A util","machine_formats":{"json":"https://regulus.evalyn.ai/document/co-ccr-4-723-4-4027.json","markdown":"https://regulus.evalyn.ai/document/co-ccr-4-723-4-4027.md"},"app_url":"https://regulus.evalyn.ai/document/co-ccr-4-723-4-4027","source_url":"https://www.sos.state.co.us/CCR/DisplayRule.do?action=ruleinfo&ruleId=2260&deptID=18&agencyID=96&deptName=Department%20of%20Regulatory%20Agencies&agencyName=Public%20Utilities%20Commission&seriesNum=4%20CCR%20723-4","body":"(a) A utility shall protect customer data in the utility’s possession or control to\nmaintain the privacy of customers, while providing reasonable access to that\ndata. A utility is only authorized to use customer data to provide regulated utility\nservice in the ordinary course of business.\n(b) A utility shall not disclose customer data unless such disclosure conforms to\nthese rules, except as required by law or to comply with Commission rule.\nIllustratively, this includes responses to requests of the Commission, warrants,\nsubpoenas, court orders, or as authorized by § 16-15.5-102, C.R.S.\n(c) A utility shall include in its tariffs a description of customer data that the utility is\nable to provide to the customer or to any third party recipient to whom the\ncustomer has authorized disclosure of the customer’s data within the utility’s\ntechnological and data capabilities. At a minimum, the utility’s tariff must provide\nthe following:\n(I) a description of standard customer data and non-standard customer data\nand the frequency of customer data updates that will be available (annual,\nmonthly, daily, etc.);\n(II) the method and frequency of customer data transmittal and access\navailable (electronic, paper, etc.) as well as the security protections or\nrequirements for such transmittal;\n(III) a timeframe for processing requests;\n(IV) any rate associated with processing a request for non-standard customer\ndata; and\n(V) any charges associated with obtaining non-standard customer data.\n(d) As part of basic utility service, a utility shall provide access to the customer’s\nstandard customer data in electronic machine-readable form, without additional\ncharge, to the customer or to any third party recipient to whom the customer has\nauthorized disclosure of the customer’s customer data. Such access shall\nconform to nationally recognized open standards and best practices. The utility\nshall provide access in a manner that ensures adequate protections for the\nutility’s system security and the continued privacy of the customer data during\ntransmission.\n\n(e) Nothing in these rules shall limit a customer’s right to provide his or her customer\ndata to anyone.\n(f) A utility and each of its directors, officers and employees that discloses customer\ndata pursuant to a customer’s authorization in accordance with these data\nprivacy rules shall not be liable or responsible for any claims for loss or damages\nresulting from the utility’s disclosure of customer data.","truncated":false,"body_characters":2474}