Hungary’s Data Protection Authority (NAIH) released a statement on the data protection aspects of the operation of smart meters.
In its statement, NAIH declared that certain smart meter data are personal data since the identification number is inseparably attached to the subscriber, and the company can link the information to the energy profile of the customer.
NAIH also established that the legal basis for data processing concerning smart meters may vary with regard to the service provided and the circumstances of such services. Generally, the data controller may not refer to compliance with legal obligations due to the fact that such a service is not prescribed by law. Consent may serve as a valid legal basis in case of the provision of enhanced level services (e.g. tariffs levied based on the usage time), as well as the performance of a contract to which the subscriber is a party, in case of billing, since the service may not be provided without issuing an invoice. The legitimate interest of the data controller may also apply, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject, which require protection of personal data.
In this particular case, the utility company was processing data collected through smart meters to prevent the breach of contract by the subscribers, if the breach occurs not for the first time, or if it can cause, or caused significant damages to the company. The company verified the status of the smart meter in each within 15 minutes. NAIH emphasised the data minimisation principle and noted that the company did not provide proper reasoning how it determined the frequency of the verification. For example, why is it not sufficient to read verify the smart meter hourly? In addition, NAIH found that the company did not provide adequate data protection information on the operation of the smart meters in advance.
Companies involved in the operation of smart meters should revise their data processing operations in accordance with NAIH’s statement.