A big change is coming for gas customers. It comes with risks

• The President of the Personal Data Protection Office presented comments on the proposed amendments to the Energy Law.
• The President of the UODO notes that the proposed solutions were not consulted with the supervisory authority at the government stage of work on this project.
• The head of the UODO also pointed out that it is important whether the processing of personal data from meters will be associated with the risk of automated processing of recipients’ data, including profiling.

The President of the Personal Data Protection Office, Mirosław Wróblewski, presented comments on the proposed changes to the Energy Law, which were included in the draft act on crude oil reserves. The amendment is at the stage of the parliamentary legislative process.

The President of the UODO notes that the proposed solutions were not consulted with the supervisory body at the government stage of work on this project, meanwhile - as he notes - the designed solutions are inextricably linked to the processing of personal data, as they concern the possibility of installing meters showing the actual consumption of gas fuels by the recipient and the actual time of gas use.

However, the project does not specify who would have access to data from the meter - only the recipient or also the distribution system operator or other entities.

In the latter case, the personal data of the final customer regarding the consumption and time of day at which a specific customer uses gas would be processed. Therefore, the law must clearly indicate who will have access to such information, for what specific purpose. As well as in what manner, for how long this data will be processed

- convinces Mirosław Wróblewski.

As the President of the UODO writes, the European Energy Efficiency Directive indicates that if Member States implement intelligent metering systems and distribute smart natural gas meters , they must, among other things, ensure the security of these meters and data transmission, as well as the privacy of end users.

The head of the UODO also pointed out that it is important whether the processing of personal data from gas meters will involve the risk of automated processing of recipients’ data, including profiling.

GDPR (in Article 22) gives the data subject the right not to be subject to a decision that is based solely on automated processing, including profiling. This is important because entities, together with information obtained from meters, will learn in what quantities and when the recipient uses devices using gas fuel

- explains Wróblewski.

As a good example of regulation concerning automated processing, he points to Article 105a paragraph 1a of the Banking Law, which establishes guarantees for the protection of the rights and freedoms of natural persons against whom a decision related to the assessment of creditworthiness is to be issued based solely on automated processing, including profiling.

As the President of the UODO reminds, this provision provides for the right to receive appropriate explanations as to the grounds for the decision taken, the right to obtain human intervention in order to make a new decision and the right to express one's own position.