4 Colo. Code Regs. § 723-3-3030
Current through Register Vol. 47, No. 22, November 25, 2024
Section 4 CCR 723-3-3030 - Access to Customer Data for the Provision of Regulated Utility Service(a) A utility may disclose customer data to a contracted agent, provided that the contract requires the agent to: (I) implement and maintain data security procedures and practices to protect the customer data from unauthorized access, destruction, use, modification, or disclosure that are equal to or greater than the data privacy and security policies and procedures used by the utility internally to protect customer data;(II) use customer data solely for the purpose of the contract and prohibit the use of customer data for a secondary commercial purpose not related to the purpose of the contract without first obtaining the customer's consent as provided for in these rules;(III) return to the utility or destroy any customer data that is no longer necessary for the purpose for which it was transferred; and(IV) execute a non-disclosure agreement with the utility.(b) The utility shall maintain records of the disclosure of customer data to contracted agents for a minimum of three years. Such records shall include all contracts with the contracted agent and executed non-disclosure agreements.38 CR 17, September 10, 2015, effective 9/30/201539 CR 06, March 25, 2016, effective 4/14/201639 CR 08, April 25, 2016, effective 5/15/201640 CR 22, November 25, 2017, effective 12/15/201742 CR 03, February 10, 2019, effective 3/2/201942 CR 07, April 10, 2019, effective 4/30/201942 CR 09, May 10, 2019, effective 5/30/201943 CR 08, April 25, 2020, effective 5/15/202043 CR 12, June 25, 2020, effective 7/15/202043 CR 20, October 25, 2020, effective 11/14/202044 CR 13, July 10, 2021, effective 7/30/202144 CR 24, December 25, 2021, effective 1/14/202245 CR 18, September 25, 2022, effective 10/15/202246 CR 02, January 25, 2023, effective 2/14/2023