PUC §8381: (a) For purposes of this section, “electrical consumption data” means data about a customer’s electrical usage that is made available as part of an advanced metering infrastructure, and includes the n

(a) For purposes of this section, “electrical consumption data” means data about a customer’s electrical usage that is made available as part of an advanced metering infrastructure, and includes the name, account number, or residence of the customer. (b) (1) A local publicly owned electric utility shall not share, disclose, or otherwise make accessible to any third party a customer’s electrical consumption data, except as provided in subdivision (f) or upon the consent of the customer. (2) A local publicly owned electric utility shall not sell a customer’s electrical consumption data or any other personally identifiable information for any purpose. (3) A local publicly owned electric utility or its contractors shall not provide an incentive or discount to the customer for accessing the customer’s electrical consumption data without the prior consent of the customer. (4) A local publicly owned electric utility that utilizes an advanced metering infrastructure that allows a customer to access the customer’s electrical consumption data shall ensure that the customer has an option to access that data without being required to agree to the sharing of the customer’s personally identifiable information, including electrical consumption data, with a third party. (c) If a local publicly owned electric utility contracts with a third party for a service that allows a customer to monitor the customer’s electricity usage, and that third party uses the data for a secondary commercial purpose, the contract between the local publicly owned electric utility and the third party shall provide that the third party prominently discloses that secondary commercial purpose to the customer and secures the customer’s consent to the use of the customer’s data for that secondary commercial purpose prior to the use of the data. (d) A local publicly owned electric utility shall use reasonable security procedures and practices to protect a customer’s unencrypted electrical consumption data from unauthorized access, destruction, use, modification, or disclosure, and to prohibit the use of the data for a secondary commercial purpose not related to the primary purpose of the contract without the customer’s consent. (e) A local publicly owned electric utility shall not share, disclose, or otherwise make accessible to any immigration authority, as defined in Section 7284.4 of the Government Code, a customer’s electrical consumption data without a court-ordered subpoena or judicial warrant. (f) (1) This section shall not preclude a local publicly owned electric utility from using customer aggregate electrical consumption data for analysis, reporting, or program management if all information has been removed regarding the individual identity of a customer. (2) This section shall not preclude a local publicly owned electric utility from disclosing a customer’s electrical consumption data to a third party for system, grid, or operational needs, or the implementation of demand response, energy management, or energy efficiency programs, provided, for contracts entered into after January 1, 2011, that the utility has required by contract that the third party implement and maintain reasonable security procedures and practices appropriate to the nature of the information to protect the personal information from unauthorized access, destruction, use, modification, or disclosure, and prohibits the use of the data for a secondary commercial purpose not related to the primary purpose of the contract without the customer’s prior consent to that use. (3) Except as provided in subdivision (e), this section shall not preclude a local publicly owned electric utility from disclosing electrical consumption data as required under state or federal law. (g) If a customer chooses to disclose the customer’s electrical consumption data to a third party that is unaffiliated with, and has no other business relationship with, the local publicly owned electric utility, the utility shall not be responsible for the security of that data, or its use or misuse.