Privacy obligations of energy and water providers

Privacy in the energy and water industries

To supply energy and water services to residents and businesses in NSW, providers need to collect and use personal information.

When gathering data, all entities (including EWON) are subject to the Privacy Act. The Privacy Act regulates the way customer information is handled by government agencies and organisations with annual turnover of more than $3 million. The Act also sets out:

• The Australian Privacy Principles (APPs)
• the powers and responsibilities of the Officer of Australian Information Commissioner (OAIC) to investigate complaints about breaches of the Privacy Act and to publish the Australian Privacy Principles Guidelines (APP Guidelines), which provide additional context and clarity to entities with obligations under the APPs.

The APPs are legally binding principles which are the cornerstone of the privacy protection framework in the Privacy Act.¹

The Privacy Act sets out 13 APPs covering the following broad areas:

• consideration of personal information privacy (APPs 1 and 2)
• collection of personal information (APPs 3, 4 and 5)
• dealing with personal information (APPs 6, 7, 8 and 9)
• integrity of personal information (APPs 10 and 11)
• access to, and correction of, personal information (APPs 12 and 13)²

The OAIC has formally recognised EWON under the Privacy Act as an external dispute resolution scheme with jurisdiction to accept privacy complaints about our members. This means that an energy or water customer can complain to EWON about a provider’s collection, handling, use of or access to their personal information.

 

Privacy complaints to EWON

Customers complaining to EWON about privacy matters have concerns about a number of issues, including:

• the amount and necessity of information providers collect to create an energy or water account
• the amount and necessity of information requested to confirm identification during phone, email or online chat interactions
• customer access to personal information held by providers
• providers sharing information with credit reporting bodies, typically for credit checks and default listings
• providers sharing information with third-party service providers (such as meter service providers or corporate partners) or distributors
• distributors or their contractors impacting privacy while completing asset and vegetation inspections on, or adjacent to, the customer’s premises
• the security of remotely transmitted smart meter data
• the sharing of personal information with third party service providers based overseas.

While EWON acknowledges that energy and water providers need to collect, use and store customers’ personal information, it is critical that providers have robust systems and processes in place to effectively manage the risks associated with handling personal information, and protect the privacy of customers’.

 

Case studies

Case study one

---

 Customer concerned about the security camera installation

Leslie lived in a regional area where works were being undertaken on large scale renewable energy and transmission projects. As part of the works, security cameras were installed adjacent to a public access road. Leslie also noted a vehicle stationed at the roadside, with people inside recording the details of passing vehicles using the roadway. Leslie was concerned that these activities might amount to a breach of privacy.

Leslie contacted EWON to raise these concerns and asked EWON to clarify what information was being gathered by the cameras and personnel, the purpose of its collection and whether notification to local residents was required.

EWON contacted the member who was installing the infrastructure, raised Leslie’s concerns and sought clarification regarding the issues raised. The member advised that:

• two security cameras and a vehicle with personnel were in use on the road
• their purpose was to monitor site traffic and ensure project-related vehicle movements complies with the project’s planning approval
• the information collected was not sufficient to identify members of the public and all footage was kept securely
• the cameras were accompanied by signs
• a notification regarding the commencement of the works was circulated to adjacent landowners prior to any work being undertaken.

Based on that information, EWON advised Leslie that:

• Because the information collected was not sufficient to identify individual people, for the purpose of the Privacy Act, no personal information was being collected
• As no personal information was being collected, there was no legal requirement for local landowners to be notified of the cameras or vehicle or have their consent sought.
   

Case study two

---

 Customer sought assistance to update account information after a privacy breach

Ritu experienced a privacy breach via an unrelated third party, where the personal details she had previously used to create an energy account were compromised. As a result, she cancelled some of her cards and changed her mobile phone number and email address.

Ritu contacted her energy retailer and requested they update her contact number and email address. Her provider requested a copy of her photo identification, which she was reluctant to send via email due to the previous data breach experience. The provider advised that, without photo identification, it could not update the details as requested.

Ritu contacted EWON to raise her concerns and asked EWON to assist her to have the account details updated.

EWON contacted the provider who confirmed its procedure for updating the account information. EWON communicated the requirements to Ritu, who agreed to provide the required identification document. The contact details on the account were updated and Ritu was once again able to access her account. The provider confirmed to EWON that the photo identification provided during the process was subsequently removed from its systems to ensure compliance with privacy obligations. When EWON conveyed this information to Ritu she was satisfied and we closed the complaint.