Ill. Admin. Code tit. 83, § 470.110 – Protection of Customer Information

a) To protect the customer-specific information described in Section 470.100 and to ensure compliance with Section 1-92 of the IPA Act, the Aggregation Supplier shall establish and follow appropriate protocols to preserve the confidentiality of customer-specific information and limit the use of customer-specific information strictly and only to effectuate the provisions of Section 1-92 of the IPA Act. The Aggregation Supplier shall ensure that these protocols:
1. 1) provide that the Aggregation Supplier shall not disclose, use, sell or provide customer-specific information to any person, firm or entity for any purpose outside of the Aggregation Program;
2. 2) provide that the Aggregation Supplier shall not use the customer-specific information to market products other than the service the Aggregation Supplier has contracted to provide the Governmental Aggregator under the applicable Aggregation Program consistent with Section 1-92 of the IPA Act;
3. 3) provide that if the Aggregation Supplier receives the account numbers of customers receiving or pending to receive RES service who have not opted into the Aggregation Program, the Aggregation Supplier shall destroy the customer numbers or return them to the Governmental Aggregator;
4. 4) except as otherwise required by record retention obligations imposed by applicable law, within 30 days following: a customer's opt-out of the Aggregation Program, a customer's exit from the Aggregation Program, or the end of the term during which the Aggregation Supplier is providing service to the Aggregation Program, the Aggregation Supplier must dispose of, delete, and/or destroy all customer-specific information in whatever format that is in its possession as a result of having been the Aggregation Supplier to an Aggregation Program. The Aggregation Supplier may not use customer-specific information retained due to record retention obligations to market to customers; and
5. 5) provide for the usage restrictions and additional records retention requirements set forth in Section 470.240.
b) Breaches of these confidentiality provisions by the Aggregation Supplier will be subject to the imposition of financial penalties by the Commission as described in Section 16-115B(b) of the PUA.