The EDPS is concerned for the treatment of personal data on smart metering systems

Member States are preparing for the roll-out of the smart metering systems, and therefore, the Commission has presented a Recommendation to them on preparations for the roll-out of smart metering systems. The European Data Protection Supervisor (EDPS) welcomed such recommendation but regrets that the Commission has not provided more specific, more comprehensive and practical guidance in the Recommendation itself.

The European Data Protection Supervisor (EDPS) opinion on the Commission Recommendation on preparations for the roll-out of smart metering systems welcomes the efforts by the Commission to provide guidance to Member States. In particular, the EDPS supports the plan to prepare a template for a data protection impact assessment and submit it to the Article 29 Data Protection Working Party for advice. The Europe-wide rollout of smart metering systems may bring significant benefits, but it will also enable massive collection of personal data which can track what members of a household do within the privacy of their own homes. A recent published survey showed that EU citizens want mandatory energy savings.

In light of these risks, the EDPS welcomes the efforts by the Commission to provide guidance to Member States but regrets that the Commission has not provided more specific, more comprehensive and practical guidance in the Recommendation itself. In addition, he considers that some guidance can still be given in the data protection impact assessment template. In addition, further legislative action should also be considered.

Therefore, the EDPS recommends, among other things more guidance on the legal basis of the processing and the choices available to data subjects, including on frequency of meter readings; mandatory application of privacy-enhancing technologies ('PET's) and other ‘best available techniques’ for data minimisation; more guidance on retention periods; and direct access to consumers to their energy usage data, as well as disclosure to them of their individual profiles and the logic of any algorithms used for data mining and information on remote on/off functionality.