Third Party Access to Customer Data from a Utility

(a) Except as provided in this rule, paragraph 4027(b), rule 4030, and rule 4031, a utility shall not disclose customer data to any third party unless the customer or a third party acting on behalf of a customer submits a paper or electronic signed consent to disclose customer data form that has been executed by the customer of record. (b) Incomplete or non-compliant consent to disclose customer data forms are not valid and shall be rejected by the utility. (c) The utility shall maintain records of all of the disclosures of customer data to third party requestors. Such records shall include a copy of the customer’s signed consent to disclose customer data form, all identifying documentation produced by the third party requestor, the customer's agreed upon terms of use, the date(s) and frequency of disclosure, and a description of the customer data disclosed. (d) The utility shall maintain records of customer data disclosures for a minimum of three years and shall make the records of the disclosure of a customer’s customer data available for review by the customer within five business days of receiving a paper or electronic request from the customer, or at such greater time as is mutually agreed between the utility and the customer.