1. As used in this section, the following terms shall have the following meanings:

1. (a) "Customer" means a residential recipient of retail electric or gas service from an electric corporation, gas corporation, or combination gas and electric corporation.
2. (b) "Smart thermostat" means an electronic device that has the capability to be accessed and controlled remotely and also directly regulates heating and/or cooling appliances located within a dwelling to maintain a thermostatic range.
3. (c) "Utility" means an electric corporation, a gas corporation, or combination electric and gas corporation as such terms are defined in section two of this chapter and shall not include municipalities.
4. (d) "Program" means the Excelsior power program designed to reduce peak energy demand established by this section.
5. (e) "Customer information" means the personal information and data of customers.

2.

1. (a) The commission shall establish a program, developed and administered by the department, to reduce peak energy demand through the remote operation of voluntarily customer enrolled smart thermostats or other smart devices that reduce peak energy demand.
2. (b) Following the establishment of the program, the department shall, subject to appropriation, disburse available funds to utilities participating in the program for the purpose of providing bill credits to customers that have enrolled in the program.
3. (c) One year after the establishment of the program and annually thereafter, for as long as the program remains active, the department shall prepare a public report on the functioning, efficiency and usefulness of the program in reducing peak energy demand, which shall include enrollment information, information on curtailment events, and potential recommendations to improve the program.

4. (d) The department shall require that the program include:

   1. (i) a mechanism for customers to override the smart thermostat during extreme heat or cold events. No assessment of a fee, charge, or penalty to a customer or their account may be levied for overriding the smart thermostat during these or other demand response events, except that, any bill credits that are associated with a customer's involvement in the program, may be discounted in a manner to be determined by the commission that reflects the customer's limited involvement in the program; and
   2. (ii) criteria pertaining to the length of temperature adjustments, including taking account of the limited nature of demand response events.
5. (e) The utility or the commission may authorize a review, analysis, or audit of a utility's implementation of the program.

3.

1. (a) Customer participation in the program shall be voluntary. Customer enrollment in the program shall occur through the utility from which the customer receives service.
2. (b) No utility shall enroll a customer in the program without the customer's affirmative consent, which shall be confirmed via written consent that shall be maintained by the utility for seven years following the customer's disenrollment in the program. Customer enrollment shall occur only via an opt-in process, and the utility shall inform customers of their rights and protections under the program.
3. (c) A customer may disenroll from the program in a manner prescribed by the commission, provided that customers shall be offered a method of disenrollment no less convenient than the method of enrollment. No assessment of a fee, charge, or penalty to the customer or their account may be levied for disenrollment, except that, upon such disenrollment, any potential bill credits that may have been associated with a customer's enrollment in the program, shall cease, provided that any credits earned but not yet applied to the customer's bill as of the date of disenrollment shall be applied to the customer's next bill.

4.

1. (a) Customer information related to the program shall be treated as confidential information.
2. (b) Utilities shall only collect customer information to the extent necessary to effectively administer the program. Utilities shall take all reasonable steps to maintain the confidentiality of customer information related to the program. Utilities shall not sell, lend, lease, share, exchange or provide such customer information to third parties, except pursuant to a lawful subpoena or warrant or as otherwise required by law. Utilities shall safely store and safely encrypt customer information related to the program to protect against unauthorized use or access. Utilities shall also dispose of, destroy, or delete customer information at the end of the provision of services and upon disenrollment, except as necessary to comply with this section, any applicable New York state or federal law or rule or regulation.
3. (c) Utilities shall take all reasonable steps to protect against unauthorized use or access of customers' smart thermostats or other malicious acts by third parties.
4. (d) The department shall consider additional cybersecurity protections, and shall establish such protections if the department deems them necessary or appropriate to safeguard customer information and customer smart thermostats.
5. (e) Utilities shall make available customer information to the department upon request, provided such customer information continues to be treated as confidential information in a manner no less protective than as required by this subdivision, and such customer information is only requested and used for purposes of implementing and enforcing the program.

5. In the development of the program, the commission shall require inclusion of:

1. (a) customer education requirements, such as examples of when a utility may modify the settings of an enrolled smart thermostat, the minimum and maximum range of temperature adjustments, and the availability of other energy efficiency and affordability programs; and
2. (b) residential customer outreach efforts, methods to provide advance notice to enrolled customers of potential curtailment events such as forecasted high energy demand events or extreme weather events, identification of smart thermostats eligible to participate in the program, and actions to engage non-residential, commercial, or industrial customers in energy demand reduction efforts before adjusting participating residential customers' energy load.