Privacy, Access, and Disclosure

(a) A utility shall protect customer data in the utility’s possession or control to maintain the privacy of customers, while providing reasonable access to that data. A utility is only authorized to use customer data to provide regulated utility service in the ordinary course of business. (b) A utility shall not disclose customer data unless such disclosure conforms to these rules, except as required by law or to comply with Commission rule. Illustratively, this includes responses to requests of the Commission, warrants, subpoenas, court orders, or as authorized by § 16-15.5-102, C.R.S. (c) A utility shall include in its tariffs a description of customer data that the utility is able to provide to the customer or to any third party recipient to whom the customer has authorized disclosure of the customer’s data within the utility’s technological and data capabilities. At a minimum, the utility’s tariff must provide the following: (I) a description of standard customer data and non-standard customer data and the frequency of customer data updates that will be available (annual, monthly, daily, etc.); (II) the method and frequency of customer data transmittal and access available (electronic, paper, etc.) as well as the security protections or requirements for such transmittal; (III) a timeframe for processing requests; (IV) any rate associated with processing a request for non-standard customer data; and (V) any charges associated with obtaining non-standard customer data. (d) As part of basic utility service, a utility shall provide access to the customer’s standard customer data in electronic machine-readable form, without additional charge, to the customer or to any third party recipient to whom the customer has authorized disclosure of the customer’s customer data. Such access shall conform to nationally recognized open standards and best practices. The utility shall provide access in a manner that ensures adequate protections for the utility’s system security and the continued privacy of the customer data during transmission.

(e) Nothing in these rules shall limit a customer’s right to provide his or her customer data to anyone. (f) A utility and each of its directors, officers and employees that discloses customer data pursuant to a customer’s authorization in accordance with these data privacy rules shall not be liable or responsible for any claims for loss or damages resulting from the utility’s disclosure of customer data.