Peter Hustinx, the European Data Protection Supervisor (EDPS), released - on 8 June 2012 - his opinion on the European Commission's Recommendation on the deployment of smart metering systems. The Recommendation, issued on 9 March 2012, provides guidance to EU Member States to prepare for the roll-out of smart metering systems that is foreseen by 2020, subject to an economic assessment of costs and benefits.

Welcoming the efforts of the Commission, the EDPS stated that he supported the plan to prepare a Template for a data protection impact assessment and submit it to the Article 29 Data Protection Working Party for discussion. However, the EDPS 'regrets' that the Commission did not provided more specific, more comprehensive and practical guidance in the Recommendation itself. The EDPS called upon the Commission to assess whether, beyond the adoption of the Recommendation and the Template for privacy impact assessment, further legislative action is necessary at EU level.

Smart metering would allow consumers to access the information they need to understand and manage their energy use and reduce carbon emissions. It is also hoped that energy consumption data would enable the industry to operate more efficiently and support the provision of new energy services.

'Smart metering will enable massive collection of personal data which can track what members of a household do within the privacy of their own homes, whether they are away on holiday or at work, if someone uses a specific medical device or a baby-monitor, how they like to spend their free time and so on', read a statement by the EDPS. 'These patterns can be useful for analysing our energy use for energy conservation but together with data from other sources, the potential for extensive data mining is very significant. Patterns and profiles can be used for many other purposes, including marketing, advertising and price discrimination by third parties.'

The EDPS recommended, among other things, that further guidance be issued on the legal basis of the processing and the choices available to data subjects, including on the frequency of meter readings. The EDPS also said that there should be mandatory application of privacy-enhancing technologies and other 'best available techniques' for data minimisation. Further guidance on retention periods, direct consumer access to energy usage data, as well as disclosure to consumers of their individual profiles, are also recommended.

''The EDPS calls on the Commission to assess whether further legislative action is necessary at EU level to ensure adequate protection of personal data for the roll-out of smart metering systems and - in his Opinion - provides pragmatic recommendations for such legislative action'', said Giovanni Buttarelli, the Assistant EDPS. ''Some of these recommendations can already be implemented via an amendment to the Energy Efficiency Directive, which is currently before the Council and Parliament. These should at least include a mandatory requirement for controllers to conduct a data protection impact assessment and an obligation to notify personal data breaches.''

EU: BCR Webinar: Top 5 takeaways

EU: Soundbites from the EU Parliament seminar on the data reform

EU: WP29 clarifies DPAs' expectations of BSPRs

EU: 'Three possible dates' put forward for the LIBE vote on data proposals

USA: Data brokers urged to review privacy practices after FTC warnings

USA: NLRB: blanket confidentiality rule during employee investigations 'invalid'

China: MIIT draft rules expand telecoms & IISP obligations

Singapore: Personal Data Protection Commission to launch May 2013

Australia, OAIC: Data security 'critical' to meet upcoming requirements

USA: Commerce Committee criticises industry failure to adopt DNT

USA: SEC and CFTC issue Red Flag Rules for financial institutions and creditors