# Privacy, Access, and Disclosure

- **operation:** document
- **citation:** 4 CCR 723-4 Rule 4027
- **title:** Privacy, Access, and Disclosure
- **source type:** regulation
- **agency:** Colorado Public Utilities Commission
- **status:** current
- **official:** true
- **published on:** Not available
- **effective on:** Not available
- **summary:** (a) A utility shall protect customer data in the utility's possession or control to maintain the privacy of customers, while providing reasonable access to that data. A utility is only authorized to use customer data to provide regulated utility service in the ordinary course of business. (b) A util
- **machine formats:** - **json:** https://regulus.evalyn.ai/document/co-ccr-4-723-4-4027.json
- **markdown:** https://regulus.evalyn.ai/document/co-ccr-4-723-4-4027.md
- **app url:** https://regulus.evalyn.ai/document/co-ccr-4-723-4-4027
- **source url:** https://www.sos.state.co.us/CCR/DisplayRule.do?action=ruleinfo&ruleId=2260&deptID=18&agencyID=96&deptName=Department%20of%20Regulatory%20Agencies&agencyName=Public%20Utilities%20Commission&seriesNum=4%20CCR%20723-4
**body:**

(a) A utility shall protect customer data in the utility’s possession or control to
maintain the privacy of customers, while providing reasonable access to that
data. A utility is only authorized to use customer data to provide regulated utility
service in the ordinary course of business.
(b) A utility shall not disclose customer data unless such disclosure conforms to
these rules, except as required by law or to comply with Commission rule.
Illustratively, this includes responses to requests of the Commission, warrants,
subpoenas, court orders, or as authorized by § 16-15.5-102, C.R.S.
(c) A utility shall include in its tariffs a description of customer data that the utility is
able to provide to the customer or to any third party recipient to whom the
customer has authorized disclosure of the customer’s data within the utility’s
technological and data capabilities. At a minimum, the utility’s tariff must provide
the following:
(I) a description of standard customer data and non-standard customer data
and the frequency of customer data updates that will be available (annual,
monthly, daily, etc.);
(II) the method and frequency of customer data transmittal and access
available (electronic, paper, etc.) as well as the security protections or
requirements for such transmittal;
(III) a timeframe for processing requests;
(IV) any rate associated with processing a request for non-standard customer
data; and
(V) any charges associated with obtaining non-standard customer data.
(d) As part of basic utility service, a utility shall provide access to the customer’s
standard customer data in electronic machine-readable form, without additional
charge, to the customer or to any third party recipient to whom the customer has
authorized disclosure of the customer’s customer data. Such access shall
conform to nationally recognized open standards and best practices. The utility
shall provide access in a manner that ensures adequate protections for the
utility’s system security and the continued privacy of the customer data during
transmission.

(e) Nothing in these rules shall limit a customer’s right to provide his or her customer
data to anyone.
(f) A utility and each of its directors, officers and employees that discloses customer
data pursuant to a customer’s authorization in accordance with these data
privacy rules shall not be liable or responsible for any claims for loss or damages
resulting from the utility’s disclosure of customer data.
- **truncated:** false
- **body characters:** 2474