{"operation":"document","citation":"4 CCR 723-4 Rule 4030","title":"Access to Customer Data for the Provision of Regulated Utility Service","source_type":"regulation","agency":"Colorado Public Utilities Commission","status":"current","official":true,"published_on":null,"effective_on":null,"summary":"(a) A utility may disclose customer data to a contracted agent provided that the contract requires the agent to: (I) implement and maintain data security procedures and practices to protect the customer data from unauthorized access, destruction, use, modification, or disclosure that are equal to or","machine_formats":{"json":"https://regulus.evalyn.ai/document/co-ccr-4-723-4-4030.json","markdown":"https://regulus.evalyn.ai/document/co-ccr-4-723-4-4030.md"},"app_url":"https://regulus.evalyn.ai/document/co-ccr-4-723-4-4030","source_url":"https://www.sos.state.co.us/CCR/DisplayRule.do?action=ruleinfo&ruleId=2260&deptID=18&agencyID=96&deptName=Department%20of%20Regulatory%20Agencies&agencyName=Public%20Utilities%20Commission&seriesNum=4%20CCR%20723-4","body":"(a) A utility may disclose customer data to a contracted agent provided that the\ncontract requires the agent to:\n(I) implement and maintain data security procedures and practices to protect\nthe customer data from unauthorized access, destruction, use,\nmodification, or disclosure that are equal to or greater than the data\nprivacy and security policies and procedures used by the utility internally\nto protect customer data;\n(II) use customer data solely for the purpose of the contract and prohibits the\nuse of customer data for a secondary commercial purpose not related to\nthe purpose of the contract without first obtaining the customer’s consent\nas provided for in these rules;\n(III) return to the utility or destroy any customer data that is no longer\nnecessary for the purpose for which it was transferred; and\n(IV) execute a non-disclosure agreement with the utility.\n(b) The utility shall maintain records of the disclosure of customer data to contracted\nagents for a minimum of three years. Such records shall include all contracts with\nthe contracted agent and executed non-disclosure agreements.","truncated":false,"body_characters":1107}