Facing a year-end target date for displaying sensitive energy usage data from smart meters to utility customers, the California Public Utilities Commission finds itself struggling to establish privacy safeguards. Lack of common ground among competing interests is slowing commission efforts. Many point out that the parameters are late anyway--coming after the figurative horse already has left the barn with mass installation of smart meters. Right now there is \u201cnothing\u201d to prevent companies from using energy usage data produced by smart meters for unintended purposes, such as marketing, according to Karin Hieta, Division of Ratepayer Advocates analyst. The analyst further acknowledged there would be little consequence for companies that carelessly lose the sensitive information--for instance, if one of their employees left a laptop computer full of customer energy records in a coffee shop. Meanwhile, the CPUC has slowed its effort to set privacy standards, acknowledges commissioner Nancy Ryan. \u201cWe delayed the decision on request of stakeholders who wanted to take a deeper dive,\u201d she said Dec. 2. Ryan\u2019s remark alludes to fundamental disagreements among consumer advocates, utilities, and a growing array of third party smart grid companies about what privacy standards--if any--are needed. The parties even disagree on whether the CPUC has legal authority to effectively police the privacy of energy usage records. The result is what some are concerned amounts to a privacy standard vacuum that continues as utilities increasingly turn to third party contracts to make energy usage data from smart meters available to their customers in a meaningful way, a first step toward capturing the energy and financial savings promised by the new meters. San Diego Gas & Electric, for instance, is working with Google. Google, so far, displays smart meter data to 7,000 San Diego customers through its online PowerMeter portal, said April Bolduc, utility spokesperson. Southern California Edison entered a pact with OPOWER to help display energy usage data to many of its customers as it rolls out smart meters. Other companies are offering energy information management systems to consumers independent of utilities. At the heart of the privacy debate is \u201cwhat the data itself reveals,\u201d notes Hieta, as well as \u201cwhat people do with the data.\u201d Smart meters show a wide range of sensitive information about behavior in the home, consumer advocates note, from whether you are home or not to which appliances and devices you are using. They even can show if your home alarm system is activated or deactivated. Most consumers don\u2019t realize this, said Dave Ashuckian, DRA deputy director. The lack of overt consent is why consumer advocates want privacy standards based on a model developed by a number of privacy advocates known as the Fair Information Practices Principles. Those principles go well beyond today\u2019s typical informed consent model by establishing an opt-in standard before data can be released, as well as other safeguards (see sidebar). To implement the principles, the CPUC should take an expansive view of its legal power and firmly regulate what third parties can do with customer data, according to DRA attorney Sarah Thomas. Otherwise, the commission will create what she called in a filing with the CPUC late last month \u201ca huge and unmanageable loophole\u201d that allows third parties to tap into \u201cenergy consumption and other personal data\u201d for their own ends. Under SB 1476--a law enacted this year calling for energy usage record privacy protection--the CPUC has clear authority to regulate third parties, Consumer Federation of California attorney Alexis Wodtke said. She admitted that others interpret the law differently. Consumer advocates fear that unless the CPUC uses that power to the full extent possible utility customers will remain protected by only a hodge-podge of state and federal laws that were not written with unique and sensitive energy usage information in mind. Others starkly disagreed in filings last month with the CPUC. California law confers \u201cno specific grant of authority for the commission to regulate non-utility third party entities that receive a consumer\u2019s energy usage,\u201d wrote Allen Trial, a San Diego Gas & Electric attorney. The attorney told the CPUC that the best the commission can do to protect customer privacy is to regulate how utilities can share smart meter data with third parties and hold those parties that violate the terms of the requirements in contempt. This would allow it to impose penalties of between $500 and $20,000 for violations by third parties. Third-party smart grid companies maintain they are beyond the CPUC\u2019s reach altogether. They maintain SB 1476 gives the CPUC no power over third parties, nor does it prevent utilities or customers from turning over energy use data to third parties as long there is proper disclosure. If lawmakers wanted to give the CPUC power over third parties, they would have explicitly specified the new authority in SB 1476, wrote attorney Sara Steck Meyers in a filing on behalf of the demand-response company EnerNoc, and other smart grid companies like Tendril Networks. EnerNoc is a growing player in California. It has demand-response program contracts with all the state\u2019s major investor-owned electric utilities. Disagreeing with SDG&E, Meyers maintained that the only party that could take action against a third-party company that violates commission-required contractual terms would be investor-owned utilities themselves. Utilities, she wrote, would have to take their contractors to court to act against violations of CPUC-dictated privacy standards. Verizon attorneys told the CPUC that the commission needs to make sure it does not stifle smart grid innovation with onerous privacy requirements. Since federal standards exist, they urged the CPUC to simply monitor the smart grid for privacy problems and act only as needed to fill cracks in existing standards as they become apparent. Verizon and other companies are concerned that strict privacy requirements could make it difficult for them to compete with utilities in providing home energy information and management services to consumers.