65- 407 C.M.R. ch. 660, § 4
A utility shall not disclose, sell or transfer (other than for debt collection, credit reporting, or usage reporting pursuant to state and federal law or to law enforcement agencies pursuant to lawful process, or as otherwise authorized by law, Commission Rule or Order), individual customer information, including, but not limited to, a customer's name, address, telephone number, water usage, or payment history, to a third party without the consent of a customer. Utilities may accept oral certification from a social service agency that they have received authorization from the customer to discuss that customer's account information. A utility may also share customer information with State, County, tribal and local emergency management agency personnel when the customer information is requested as part of that agency's response to an emergency situation. In addition, a utility may also share customer information with sewer and sanitary departments or districts to the extent necessary to allow these entities to bill customers for services rendered.
65- 407 C.M.R. ch. 660, § 4