(a) The data collection system managed pursuant to Section 25320 shall include the following requirements regarding the confidentiality of the information collected by the commission:

1. (1) Any person required to present information to the commission pursuant to this section may request that specific information be held in confidence. The commission shall grant the request in any of the following circumstances:

   1. (A) The information is exempt from disclosure under the California Public Records Act, Division 10 (commencing with Section 7920.000) of Title 1 of the Government Code.
   2. (B) The information satisfies the confidentiality requirements of Article 2 (commencing with Section 2501) of Chapter 7 of Division 2 of Title 20 of the California Code of Regulations, as those regulations existed on January 1, 2002.
   3. (C) On the facts of the particular case, the public interest served by not disclosing the information clearly outweighs the public interest served by disclosure of the information.
2. (2) The commission may, by regulation, designate certain categories of information as confidential, which removes the obligation to request confidentiality for that information.
3. (3) Any confidential information pertinent to the responsibilities of the commission specified in this chapter that is obtained by another state agency, or the California Independent System Operator or its successor, shall be available to the commission and shall be treated in a confidential manner.
4. (4) Information presented to or developed by the commission and deemed confidential pursuant to this section shall be held in confidence by the commission. Confidential information shall be aggregated or masked to the extent necessary to ensure confidentiality if public disclosure of the specific information would result in an unfair competitive disadvantage to the person supplying the information.

(b) Requests for records of information shall be handled as follows:

1. (1) If the commission receives a written request to publicly disclose information that is being held in confidence pursuant to paragraph (1) or (2) of subdivision (a), the commission shall provide the person making the request with written justification for the confidential designation and a description of the process to seek disclosure.
2. (2) If the commission receives a written request to publicly disclose a disaggregated or unmasked record of information designated as confidential under paragraph (1) or (2) of subdivision (a), notice of the request shall be provided to the person that submitted the record. Upon receipt of the notice, the person that submitted the record may, within five working days of receipt of the notice, provide a written justification of the claim of confidentiality.
3. (3) The commission or its designee shall rule on a request made pursuant to paragraph (2) on or before 20 working days after its receipt. The commission shall deny the request if the disclosure will result in an unfair competitive disadvantage to the person that submitted the information.
4. (4) If the commission grants the request pursuant to paragraph (3), it shall withhold disclosure for a reasonable amount of time, not to exceed 14 working days, to allow the submitter of the information to seek judicial review.

(d) The commission shall establish, maintain, and use appropriate security practices and procedures to ensure that the information it has designated as confidential, or received with a confidential designation from another government agency, is protected against disclosure other than that authorized using the procedures in subdivision (b). The commission shall incorporate the following elements into its security practices and procedures:

1. (1) Commission employees shall sign a confidential data disclosure agreement providing for various remedies, including, but not limited to, fines and termination for wrongful disclosure of confidential information.
2. (2) Commission employees, or contract employees of the commission, shall only have access to confidential information when it is appropriate to their job assignments and if they have signed a nondisclosure agreement.
3. (3) Computer data systems that hold confidential information shall include sufficient security measures to protect the data from inadvertent or wrongful access by unauthorized commission employees and the public.