4 Colo. Code Regs. § 723-4-4027
Current through Register Vol. 47, No. 20, October 25, 2024
Section 4 CCR 723-4-4027 - Privacy, Access, and Disclosure(a) A utility shall protect customer data in the utility's possession or control to maintain the privacy of customers, while providing reasonable access to that data. A utility is only authorized to use customer data to provide regulated utility service in the ordinary course of business.(b) A utility shall not disclose customer data unless such disclosure conforms to these rules, except as required by law or to comply with Commission rule. Illustratively, this includes responses to requests of the Commission, warrants, subpoenas, court orders, or as authorized by § 16-15.5-102, C.R.S.(c) A utility shall include in its tariffs a description of customer data that the utility is able to provide to the customer or to any third party recipient to whom the customer has authorized disclosure of the customer's data within the utility's technological and data capabilities. At a minimum, the utility's tariff must provide the following: (I) a description of standard customer data and non-standard customer data and the frequency of customer data updates that will be available (annual, monthly, daily, etc.);(II) the method and frequency of customer data transmittal and access available (electronic, paper, etc.) as well as the security protections or requirements for such transmittal;(III) a timeframe for processing requests;(IV) any rate associated with processing a request for non-standard customer data; and(V) any charges associated with obtaining non-standard customer data.(d) As part of basic utility service, a utility shall provide access to the customer's standard customer data in electronic machine-readable form, without additional charge, to the customer or to any third party recipient to whom the customer has authorized disclosure of the customer's customer data. Such access shall conform to nationally recognized open standards and best practices. The utility shall provide access in a manner that ensures adequate protections for the utility's system security and the continued privacy of the customer data during transmission.(e) Nothing in these rules shall limit a customer's right to provide his or her customer data to anyone.(f) A utility and each of its directors, officers and employees that discloses customer data pursuant to a customer's authorization in accordance with these data privacy rules shall not be liable or responsible for any claims for loss or damages resulting from the utility's disclosure of customer data.38 CR 17, September 10, 2015, effective 9/30/201540 CR 01, January 10, 2017, effective 1/30/201741 CR 11, June 10, 2018, effective 6/30/201842 CR 07, April 10, 2019, effective 4/30/201943 CR 08, April 25, 2020, effective 5/15/202044 CR 04, February 25, 2021, effective 3/17/202144 CR 24, December 25, 2021, effective 1/14/202245 CR 18, September 25, 2022, effective 10/15/202246 CR 06, March 25, 2023, effective 1/25/202346 CR 08, April 25, 2023, effective 5/15/2023