4 Colo. Code Regs. § 723-3-3028
Current through Register Vol. 47, No. 22, November 25, 2024
Section 4 CCR 723-3-3028 - Customer Notice(a) A utility shall provide each year to its customers a written notice complying with this rule. The utility shall conspicuously post on its website notice of its privacy and security policies governing access to and disclosure of customer data and aggregated data to third parties. This notice shall: (I) explain what is available to customers, as standard and/or non-standard customer data (e.g., 15 minute versus hourly data);(II) describe the frequency that the utility can provide customer data based on a request for standard data (e.g., on a weekly or monthly basis);(III) advise customers that their customer data may provide insight into their activities within the premises receiving service;(IV) inform customers that the privacy and security of their customer data will be protected by the utility while in its possession;(V) explain that customers can access their standard customer data, as identified by the utility's tariff, without additional charge;(VI) advise customers that their customer data will not be disclosed to third parties, except: (A) as necessary to provide regulated utility services to the customers;(B) as otherwise permitted or required by law or Commission rule; or(C) pursuant to the authorization given by the customer in accordance with these rules.(VII) describe the utility's policies regarding how a customer can authorize access and disclosure of his or her customer data to third parties. With regard to such third party data disclosure, the notice shall: (A) inform customers that declining a request for disclosure of customer data to a third party will not affect the provision of utility service that the customer receives from the utility; and(B) explain that any customer consent for access to, disclosure of, or use of a customer's customer data by a third party may be terminated or limited by the customer of record at any time and inform the customers of the process for doing so.(VIII) explain that aggregated data does not contain customer identifying information and inform customers that customer data may be used to create aggregated data that will not contain customer identifying information;(IX) explain that the utility may provide aggregated data to third parties, subject to its obligation under paragraph 3033(a);(X) be viewable on-line and printed in ten point or larger font;(XI) be sent either separately or included as an insert in a regular monthly bill, or, for those customers who have consented to receive e-bills, such notice may be sent electronically separately from an e-bill, conspicuously marked and stating clearly that important information on the utility's privacy practices is contained therein;(XII) be available in English and Spanish. The customer notice may also be translated to a language other than English or Spanish by a third party or the utility. Forms translated to other languages in accordance with this rule must be accepted by utilities, and may be relied upon, after the English version of the form, the translated version of the form, and an affidavit attesting to the accurate and complete translation from the English version of the form, have been provided to the Commission and the utility possessing the data. Such affidavit must be executed by an interpreter on the active roster of interpreters maintained by the Office of Language Access of the Colorado Judicial Branch. If the utility incurs a cost for translation made at the request of a third party, it may charge the requestor for such cost and may include a reasonable administrative fee in addition to the translation cost; and(XIII) provide a customer service phone number and web address where customers can direct additional questions or obtain additional information regarding their customer data, the disclosure of customer data or aggregated data, or the utility's privacy policies and procedures with respect to customer data or aggregated data.38 CR 17, September 10, 2015, effective 9/30/201539 CR 06, March 25, 2016, effective 4/14/201639 CR 08, April 25, 2016, effective 5/15/201640 CR 22, November 25, 2017, effective 12/15/201742 CR 03, February 10, 2019, effective 3/2/201942 CR 07, April 10, 2019, effective 4/30/201942 CR 09, May 10, 2019, effective 5/30/201943 CR 08, April 25, 2020, effective 5/15/202043 CR 12, June 25, 2020, effective 7/15/202043 CR 20, October 25, 2020, effective 11/14/202044 CR 13, July 10, 2021, effective 7/30/202144 CR 24, December 25, 2021, effective 1/14/202245 CR 18, September 25, 2022, effective 10/15/202246 CR 02, January 25, 2023, effective 2/14/2023