1.1 	A bill for an act
1.2 	relating to utilities; providing access rights to energy usage data maintained by 
1.3 	utilities;amending Minnesota Statutes 2018, section 13.685; proposing coding for 
1.4 	new law in Minnesota Statutes, chapter 216B.
1.5 	BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF MINNESOTA:

1.6 	Section 1. Minnesota Statutes 2018, section 13.685, is amended to read:
1.7 	13.685 MUNICIPAL UTILITY CUSTOMER DATA.
1.8 	Data on customers of municipal electric utilities are private data on individuals or 
1.9 	nonpublic data, but may be released to:
1.10 	(1) a law enforcement agency that requests access to the data in connection with an 
1.11 	investigation;
1.12 	(2) a school for purposes of compiling pupil census data;
1.13 	(3) the Metropolitan Council for use in studies or analyses required by law;
1.14 	(4) a public child support authority for purposes of establishing or enforcing child support; 
1.15 	or
1.16 	(5) a person authorized to receive the data under section 216B.078; or
1.17 	(5) (6) a person where use of the data directly advances the general welfare, health, or 
1.18 	safety of the public; the commissioner of administration may issue advisory opinions 
1.19 	construing this clause pursuant to section 13.072.

2.1 	Sec. 2. [216B.078] CUSTOMER ENERGY DATA.
2.2 		Subdivision 1.Definitions. (a) For purposes of this section, the following terms have 
2.3 	the meanings given.
2.4 	(b) "Customer" means a person contracting for or purchasing electric or natural gas 
2.5 	service from a utility.
2.6 	(c) "Customer data" means all data a utility collects, creates, receives, or maintains in 
2.7 	which a customer is identified or can be identified as the subject of the data. Customer data 
2.8 	includes energy usage data.
2.9 	(d) "Energy usage data" means a customer's account information and the data a utility 
2.10 	collects from the customer's meter that reflects the quantity, quality, or timing of the 
2.11 	customer's natural gas use, electricity use, or electricity production. Customer energy usage 
2.12 	data includes but is not limited to data regarding:
2.13 	(1) the amount and timing of energy use and production;
2.14 	(2) energy outages, frequency, intermittency, or shutoffs;
2.15 	(3) pricing and rate data applicable to the customer; and
2.16 	(4) any other energy usage data used to calculate the customer's bill.
2.17 	(e) "Summary energy usage data" means statistical records and reports derived from 
2.18 	energy usage data that do not contain a customer's personally identifiable information.
2.19 	(f) "Personally identifiable information" means any data in which a customer is identified 
2.20 	or can be identified as the subject of the data.
2.21 	(g) "Third party" means a person, other than a customer, who requests customer energy 
2.22 	usage data or summary energy data from the utility that maintains the data.
2.23 	(h) "Utility" means a public utility, retail municipal utility, or retail cooperative 
2.24 	association that provides electric or natural gas service to Minnesota customers.
2.25 		Subd. 2.Customer access to energy usage data. (a) A utility must provide a customer 
2.26 	with access to the customer's own energy usage data.
2.27 	(b) Access must be convenient for the typical customer. A utility's procedure to access 
2.28 	energy usage data must be user-friendly. The utility must present the energy usage data in 
2.29 	a format comprehensible to the typical customer.
2.30 	(c) A utility must provide access to energy usage data in as close to real-time as 
2.31 	practicable.
3.1 	(d) Access to energy usage data must be provided free of charge to the customer, except 
3.2 	that a utility may charge a fee if a customer requests access to energy usage data in a format 
3.3 	or standard that differs from the format or standard the utility generally offers to customers.
3.4 	(e) A utility must notify a customer if it substantially modifies the customer's energy 
3.5 	usage data. The notification must include a detailed explanation of the changes made to the 
3.6 	customer's energy usage data.
3.7 		Subd. 3.Third-party access to energy usage data. (a) If a customer provides 
3.8 	authorization, a utility must provide a third party with access to the customer's energy usage 
3.9 	data.
3.10 	(b) The procedure a utility uses to allow a customer to authorize third-party access to 
3.11 	energy usage data must be (1) convenient for the typical customer, and (2) available on the 
3.12 	utility's website and in physical form by mail.
3.13 	(c) The scope of the authorization may limit a third party's access to specific elements 
3.14 	of the customer's energy usage data.
3.15 	(d) An authorization to access energy usage data is valid for the period of time specified 
3.16 	in the written authorization. An authorization may include a period without a specified end 
3.17 	date.
3.18 	(e) A customer may revoke an authorization for third-party access at any time. The 
3.19 	utility's procedure to revoke authorization must be (1) convenient for the typical customer, 
3.20 	and (2) available on the utility's website and in physical form by mail.
3.21 	(f) Subject to the scope of the authorization, an authorized third party must have the 
3.22 	same level of access to the customer's energy usage data as the customer.
3.23 	(g) To the extent a third party with access to energy usage data under this subdivision 
3.24 	maintains the data independent of the utility providing access, the third party is subject to 
3.25 	the data security and privacy requirements under subdivision 6.
3.26 		Subd. 4.Public access to summary energy data. (a) A utility must prepare and make 
3.27 	available summary energy usage data upon the written request of any person. The procedure 
3.28 	a utility uses to allow a person to request summary energy data must be (1) convenient for 
3.29 	the typical customer, and (2) available on the utility's website. A utility may charge the 
3.30 	requester a fee to prepare and supply summary energy data.
3.31 	(b) Summary energy usage data provided under this subdivision may include aggregated 
3.32 	sets of customer energy usage data from no less than 15 customers. A single customer's 
3.33 	energy use must not constitute more than 15 percent of total energy consumption for the 
4.1 	requested data set. Summary energy usage data may be disaggregated on a per-customer 
4.2 	basis, provided that the customer's identity is not ascertainable.
4.3 	(c) Within ten days of the date a request for summary energy data is received, a utility 
4.4 	must respond by providing the requester with:
4.5 	(1) the summary energy data requested or a reference to responsive summary energy 
4.6 	data published under paragraph (d);
4.7 	(2) a written statement that describes any fee charged and a time schedule for preparing 
4.8 	the requested summary energy data, including reasons for any time delays; or
4.9 	(3) a written statement stating reasons why the utility has determined the requested 
4.10 	summary energy data cannot be prepared.
4.11 	(d) A utility may make summary energy data publicly available on its website.
4.12 		Subd. 5.Fees charged for data. A utility charging a data access fee authorized by this 
4.13 	section must:
4.14 	(1) base the fee amount on the actual costs incurred by the utility to create and deliver 
4.15 	the requested data;
4.16 	(2) consider the reasonable value of the data prepared to the utility and, if appropriate, 
4.17 	reduce the fee assessed to the requesting person;
4.18 	(3) provide the requesting person with an estimate and explanation of the fee; and
4.19 	(4) collect the fee before preparing or supplying the requested data.
4.20 		Subd. 6.Data security and privacy. (a) A utility must establish appropriate, 
4.21 	industry-standard safeguards to protect the security of energy usage data it maintains. A 
4.22 	utility is prohibited from selling, sharing, licensing, or disseminating energy usage data, 
4.23 	except as authorized under this section or by state or federal law.
4.24 	(b) Utilities must implement risk management practices to protect customer data. Risk 
4.25 	management practices must include but are not limited to practices that:
4.26 	(1) identify, analyze, and mitigate cybersecurity risks to customer data;
4.27 	(2) reasonably protect against loss and unauthorized use, access, or dissemination of 
4.28 	customer data;
4.29 	(3) implement employee training measures to preserve data integrity; and
4.30 	(4) maintain a comprehensive data breach response program to identify, mitigate, and 
4.31 	resolve an incident that causes or results in the unauthorized use, access, or dissemination 
5.1 	of customer data. The data breach response program must provide for complete, accurate, 
5.2 	and timely notice to customers whose customer data may have been compromised.
5.3 	(c) If a utility uses a third-party service to maintain or store customer data, the utility 
5.4 	must ensure that the third-party service implements risk management practices that meet 
5.5 	the requirements under paragraph (b).
5.6 		Subd. 7.Enforcement. The commissioner may enforce this section as provided under 
5.7 	section 45.027.