NAESB REQ Data Privacy Task Force

Document:	(1) Freedom of Information and Protection of Privacy Act, R.S.O. 1990, C. F.31 (FIPPA) http://www.e-laws.gov.on.ca/html/statutes/english/elaws_statutes_90f31_e.htm

R.R.O. 1990, REGULATION 460 - General Regulation (FIPPA Gen. Reg.)
http://www.e-laws.gov.on.ca/html/regs/english/elaws_regs_900460_e.htm

(2) Municipal Freedom of Information and Protection of Privacy Act, R.S.O. 1990, C. M.56 (MFIPPA) http://www.e-laws.gov.on.ca/html/statutes/english/elaws_statutes_90m56_e.htm

R.R.O. 1990, REGULATION 823 - General Regulation (MFIPPA Gen. Reg.)
http://www.e-laws.gov.on.ca/html/regs/english/elaws_regs_900823_e.htm
ONTARIO REGULATION 372/91 – Institutions (MFIPPA Inst. Reg.)
http://www.e-laws.gov.on.ca/html/regs/english/elaws_regs_910372_e.htm

(3) Electricity Act, 1998, S.O. 1998, C.15, Schedule A (Electricity Act)
http://www.e-laws.gov.on.ca/html/statutes/english/elaws_statutes_98e15_e.htm

ONTARIO REGULATION 393/07 - Designation of Smart Metering Entity (SME) http://www.e-laws.gov.on.ca/html/source/regs/english/2007/elaws_src_regs_r07393_e.htm 
ONTARIO REGULATION 233/08 - Amending O. Reg. 393/07
http://www.e-laws.gov.on.ca/html/source/regs/english/2008/elaws_src_regs_r08233_e.htm
(Electricity Act SME Regulations)

(4) Ontario Energy Board Act, 1998, S.O. 1998, C. 15, Schedule B (Ontario Energy Board Act) http://www.e-laws.gov.on.ca/html/statutes/english/elaws_statutes_98o15_e.htm

Ontario Energy Board (OEB) Affiliate relationships code for gas utilities (11/25/2010) http://www.oeb.gov.on.ca/OEB/_Documents/Regulatory/Affiliate%20Relationships%20Code%20for%20Gas%20Utilities%20ARC.pdf
OEB Affiliate relationships code for electricity distributors & transmitters (03/15/2010) 
http://www.oeb.gov.on.ca/OEB/_Documents/Regulatory/Affiliate_Relationships_Code_ARC_Electricity.pdf
(OEB Electricity and Gas Utilities Affiliate Relationship Codes)

Nov. 23, 2010, directive of the Minister of Energy requiring the OEB to provide guidance to licensed distributors and other regulated entities regarding the OEB’s expectations in relation to activities in support of the establishment and implementation of a smart grid.  (Issued under section 28.5 of the OEB Act.) (November 23, 2010 Ministerial Directive) http://www.oeb.gov.on.ca/OEB/_Documents/Documents/Minister_directive_smart_grid_20101123.pdf

Also see the Green Energy Act, 2009, S.O. 2009, C. 12, Schedule A http://www.e-laws.gov.on.ca/html/statutes/english/elaws_statutes_09g12_e.htm

(5) Personal Information Protection and Electronic Documents Act, S.C. 2000, c. 5 (PIPEDA)
http://laws.justice.gc.ca/en/ShowDoc/cs/P-8.6//20090818/en?page=1

Summary:	Across Ontario, provincial public sector and federal private sector privacy legislation provides that information about an identifiable individual in the custody or control of a public institution (such as a public utility or regulator) or handled in the course of an organization’s commercial activities (such as those that may be related to the generation, distribution or sale of energy) is subject to a comprehensive set of privacy protective rules that regulate the collection, retention, secure handling, use and disclosure of personal information.

Privacy rules established under these statutes also provide that individuals have a right of access and correction with respect to their own personal information and may exercise a degree of control over the collection, use and disclosure of their own personal information. 

Under this overarching framework of privacy rules (including as further provided for under provincial energy legislation), a utility must, as a general rule, provide individuals with notice of an intention to use or disclose personal information for a purpose secondary to that for which it was originally collected and obtain their consent before using or disclosing it for such a secondary purpose.  The only exceptions to this general rule are those provided for under the applicable statutory privacy provisions.

State/Province	Category	Text/Description	
Ontario	Statute and regulation	(1) FIPPA, Part III (Protection of Personal Privacy) and FIPPA Gen. Reg. provide comprehensive rules governing the collection, retention, secure handling, use, and disclosure of “personal information” by or on behalf of provincial “institutions” including Hydro One, the Independent Electricity System Operator (IESO), and the OEB, as well as for the individual’s right of access and correction to his or her own “personal information” in the custody or control of an “institution” (and see section 2 (“definitions”, e.g. “institution” and “personal information”)).	
Ontario	Statute and regulations	(2) MFIPPA, Part II (Protection of Personal Privacy), MFIPPA Gen. Reg. and MFIPPA Inst. Reg. provide comprehensive rules governing the collection, retention, secure handling, use, and disclosure of “personal information” by or on behalf of municipal “institutions”(including “every corporation incorporated under section 142 of the Electricity Act, 1998”), as well as for the individual’s right of access and correction to his or her own “personal information” in the custody or control of an “institution” (and see section 2 (“definitions”, e.g. “institution” and “personal information”)).	
Ontario	Statute and regulations	(3) Electricity Act, Parts II and1V.2 (and see section 2 (“definitions”, e.g. “affiliate”, “smart grid”, “smart metering data”)) and the Electricity Act SME Regulations establish and regulate the IESO as the Smart Metering Entity (SME) whose statutory objects include collecting, storing, and managing information and data related to the metering of consumers’ consumption or use of electricity in Ontario.	
Ontario	Statute, codes of conduct, and ministerial directive
	(4) Ontario Energy Board Act continues and regulates the OEB and provides a framework for its issuance of enforceable codes of conduct directed at utilities and their relationships with “affiliates” including with respect to the handling of “confidential information” such as information relating to a specific consumer (and see section 3 of the Ontario Energy Board Act (“definitions”, e.g. “affiliate”, “enforceable provision”, “smart grid”, “smart metering data”)) as well as the OEB electricity and gas utilities affiliate relationship codes).  Also see the November 23, 2010 Ministerial Directive which requires that the OEB shall be guided by government policy objectives including, inter alia:  “Privacy: Respect and protect the privacy of customers.  Integrate privacy - into smart grid planning and design from an early stage, including the completion of privacy impact assessments.”	
Canada	Statute	(5) PIPEDA, Division 1 and Schedule 1 provide comprehensive rules governing the collection, retention, secure handling, use, and disclosure of “personal information” of an identifiable individual in the course of an “organization’s” “commercial activities”, as well as for the individual’s right of access and correction to his or her own “personal information” held by an “organization” (and see section 2 (“definitions”, e.g. “commercial activity”, “organization”, “personal information”)).