This policy discloses the privacy practices of Village of Hyde Park Electric Department (hereinafter “Utility”) with respect to Customer Specific Information (“CSI”), which is defined as a customer’s personal information (such as name, address, social security number, phone number, email address, etc.) or any usage information that can reasonably be identified or re- identified with an individual, family, household, residence, or customer. This policy is adopted in furtherance of the Public Utility Commission’s Final Order Approving a Statement of Principles Relative to Privacy in Docket No. 7307 dated February 25, 2019. Utility will treat CSI as confidential, to the extent permitted by state and federal law, including Vermont’s Public Records Act, 1 V.S.A. § 315 et seq. Unless specifically required by state or federal law, or the express consent of the affected customer(s), Utility shall not disclose CSI by giving, selling, or otherwise distributing to a third party unless required to do so by

​

(1) judicial order (including a subpoena sent by a judge);

(2) a warrant naming with specificity the customer(s) whose information is sought and issued pursuant to the Vermont or Federal Rules of Criminal Procedure upon a finding of probable cause or;

(3) as otherwise authorized in this policy.

 

This policy does not restrict Utility from the sale, transfer, or other distribution of aggregated data that cannot identify any single Utility customer. Aggregation of customer information shall be done such that individual customers cannot be identified from that data. Unless otherwise prohibited by law, Utility shall provide customers with notice to their last known mailing address (or via email if customer has previously provided to Utility) no less than ten (10) days prior to responding to a duly authorized subpoena requesting disclosure of CSI. Utility has undertaken internal measures and put in place sufficient controls to protect CSI from independent disclosure and/or accessibility to unauthorized third parties. Only authorized Utility personnel and contractors approved by the Utility’s manager may have access to CSI, which will be provided only where a legitimate business reason requires it. Utility shall adhere to any confidentiality arrangement governing the provision of CSI to any entity appointed as an energy efficiency utility pursuant to 30 V.S.A. § 209(d)(2). Except to the extent disclosure may be required by law, CSI shall not be sold, given, or in any fashion conveyed to third persons for any commercial purpose without the written express consent of customer. Notwithstanding the foregoing Utility may disclose CSI to third party vendors or consultants with whom it works as necessary, provided such third party is bound to maintain the confidentiality of CSI. Nothing herein restricts a customer from choosing to provide CSI directly to a third-party. This policy shall be posted permanently at Utility’s offices, posted on its website (if any), and made available to customers, and presented to third-party vendors when appropriate to ensure protection of CSI. Utility will not provide real time access to information unless pursuant to a judicial order issued under state or federal wiretap law. Any interactive connections with a customer shall require a secure method of user authentication on the part of the customer.

Adopted by the Board of Trustees at the duly warned regular meeting held on October 9, 2019.