Privacy: customer electrical or natural gas usage data.

Existing law prohibits, except as specified, an electrical corporation or gas corporation, and a local publicly owned utility, from sharing, disclosing, or otherwise making accessible to a 3rd party a consumer's electric or gas usage that is made available as a part of an advanced metering infrastructure, including the name, account number, and residence of the customer (data) . Existing law requires the electrical corporation or gas corporation, and a local publicly owned utility, to use reasonable security procedures and practices to provide a consumer's unencrypted data from unauthorized access, destruction, use, modification, or disclosure. Existing law makes the willful obtaining of personal identifying information, as defined, and use of that information for any unlawful purpose, a felony or misdemeanor. Existing law authorizes a person that has been injured as a result of a violation of this prohibition to bring an action against a claimant, as defined, to establish that they are a victim of identity theft, in connection with the claimant's claim against that person and to bring a cross-complaint if the claimant has brought an action to recover on a claim against the person. A person who proves that he or she is a victim of identity theft by a preponderance of evidence is entitled to a judgment providing for actual damages, attorney's fees, and costs, and any equitable relief that the court deems appropriate. This bill would prohibit a business from sharing, disclosing, or otherwise making accessible to any 3rd party a customer's electrical or natural gas usage data without obtaining the express consent of the customer and conspicuously disclosing to whom the disclosure will be made and how the data will be used. The bill would require a business and a nonaffiliated 3rd party, pursuant to a contract, to implement and maintain reasonable security procedures and practices to protect the data from unauthorized disclosure. The bill would prohibit a business from providing an incentive or discount to the customer for accessing the data without the prior consent of the customer. The bill would require a business to take reasonable steps to dispose that customer data within its custody or control when the data is no longer to be retained by the business, as specified. The bill would authorize a customer to bring a civil action for actual damages not to exceed $500 for each willful violation of these provisions.