PURPOSE: This rule is intended to prevent the misuse of personally identifiable customer information.

1. (1) Definitions.

   1. (A) Aggregated customer information means information derived from combining the data of multiple customers in such a manner that no single customer can be individually identified. For purposes of this definition, such aggregated customer information shall contain the information of either at least four (4) residential customers with no individual customer’s load exceeding fifty percent (50%) of the data included in the aggregate or at least four (4) nonresidential customers with no individual customer’s load exceeding eighty percent (80%) of the data included in the aggregate.
   2. (B) Consent means either written or electronic permission (“opt-in”) provided by a customer on a commission-approved form or verbal permission memorialized in a voice recording that the customer provides in response to a request to share the individual customer’s information. For purposes of this rule, customer consent shall only be deemed to have been offered for discrete requests or transactions, and shall not be inferred for ongoing or successive transactions. When ongoing or successive transactions are explicitly agreed to by a customer, consent shall be valid until rescinded by the customer. Such consent shall be freely revocable by the customer at any time. The utility must retain records memorializing a customer’s consent, unless and until the customer revokes said consent.
   3. (C) Information means any data obtained by a utility that is not obtainable by nonaffiliated entities or can only be obtained at a competitively prohibitive cost in either time or resources.
   4. (D) Utility means, for purposes of this rule, an electrical corporation, gas corporation, heating company, water corporation, or sewer corporation as defined in section 386.020, RSMo, and subject to commission regulation pursuant to Chapters 386 and 393, RSMo.
   5. (E) Utility related services means those services provided by a utility in furtherance of the provision of regulated utility service pursuant to Chapters 386 and 393, RSMo, as well as actions taken by the utility to support customer use of those services, and pursuant to a utility’s commission-approved tariff.

2. (2) Standards.

   1. (A) Specific customer information shall be made available to affiliated or unaffiliated entities only upon consent of the customer or as otherwise provided by law or commission rules or orders.
   2. (B) Aggregated customer information shall be made available to affiliated or unaffiliated entities upon request and under the same terms and conditions applicable to all entities receiving such information, unless otherwise ordered by the commission.
   3. (C) The utility may set reasonable charges for costs incurred in producing customer information.
   4. (D) Customer information includes information provided to the regulated utility by affiliated or unaffiliated entities.
   5. (E) A utility customer’s information remains the sole property of the customer at all times, subject to its use and disclosure as otherwise provided for by this rule.

   6. (F) Utility Related Services.

      1. 1. When any utility contracts with an affiliate or a third-

party nonaffiliate to perform a utility-related service on behalf of the utility, and personally identifiable customer information to perform the utility-related service is required, the utility may provide the affiliate or third-party nonaffiliate with the necessary personally identifiable customer information without customer consent, provided that the utility shall make reasonable efforts to impose contractual obligations on the recipient, the substance of which are designed so that the recipient acknowledges that the personally identifiable customer information remains the property of the customer and limits the use of the personally identifiable customer information to performance of the contracted service.

1. (3) Other Notification Required Respecting Personal Customer Information.

   1. (A) A utility shall notify, without unreasonable delay, staff counsel’s office and the Office of the Public Counsel if there is an incident that warrants reporting to the attorney general of a “breach of security” or “breach” as defined by subsection 407.1500.1, RSMo, and the utility shall provide a copy of the notice provided to customers and a copy of all reports detailing the investigation(s) to the staff counsel’s office and the Office of the Public Counsel. Notices provided to customers shall be provided at the same time that they are sent to customers, and reports shall be provided immediately upon completion.
   2. (B) Each utility shall retain draft work-in-progress reports consistent with its data retention policies.

2. (4) Customer Data Privacy Policy.

   1. (A) Each covered utility shall maintain and submit to the commission the utility’s current customer data privacy policy, and revisions thereto. A utility’s customer data privacy policy shall be submitted in the commission’s Electronic Filing and Information System (EFIS) as a Non-Case Related Submission.
   2. (B) The utility must also include the privacy policy on its website. The privacy policy shall answer what safeguards the utility is utilizing to protect customer information from inadvertent disclosure while contracting with an affiliate or nonaffiliated third-party providing services to the utility in furtherance of the utility related services the utility provides.

AUTHORITY: sections 386.250 and 393.140, RSMo 2016.* Original rule filed Sept. 25, 2024, effective May 30, 2025. *Original authority: 386.250, RSMo 1939, amended 1963, 1967, 1977, 1980, 1987, 1988, 1991, 1993, 1995, 1996, and 393.140, RSMo 1939, amended 1949, 1967.