Washington Administrative Code › Title 480 - Utilities and Transportation Commission › Chapter 480-90 - Gas companies-Operations › Part II - CONSUMER RULES › Section 480-90-153 - Protection and disclosure of customer information

Current through Register Vol. 24-14, July 15, 2024
(1) A utility must use reasonable security
				practices and procedures to safeguard all customer information within the
				utility's possession or control from unauthorized access or
				disclosure.
(2) A utility may only
				collect and retain customer information that is reasonably necessary for the
				utility to perform duties directly related to the utility's primary purpose
				unless the utility has first obtained the customer's written consent to collect
				and retain customer information for another purpose.
(3) A utility may disclose customer
				information without written customer consent to an affiliate, subsidiary, or
				parent organization only to the extent necessary for the utility to perform
				duties directly related to the utility's primary purpose. The utility must
				obtain the customer's written consent to disclose customer information to an
				affiliate, subsidiary, or parent organization for any other purpose.
(4) A utility may disclose customer
				information to third parties only to the extent necessary for the utility to
				perform duties directly related to the utility's primary purpose unless the
				utility has first obtained the customer's written consent to disclose customer
				information to third parties for other specified purposes. The utility must
				require all third parties to which it provides access to customer information
				to have policies, procedures, and technological safeguards in place to protect
				customer information that are no less stringent than the utility's own
				standards.
(5) A utility is
				ultimately responsible for safeguarding customer information. The utility must
				ensure that it has and enforces contractual obligations with third parties,
				affiliates, subsidiaries, and parent organizations that require such entities
				to have and comply with policies, procedures, and technological safeguards
				sufficient to prevent the misuse or improper or unauthorized disclosure of
				customer information.
(6) A utility
				may not sell customer information . A utility may not otherwise disclose
				customer information except as provided in this rule. A utility may not
				disclose customer information to its affiliates, subsidiaries, parent
				organization, or any other third party for the purposes of marketing services
				or product offerings to a customer who does not already subscribe to that
				service or product, unless the utility has first obtained the customer's
				written consent. The utility must maintain a record of each customer's written
				consent as required in subsection (9) of this section.
(7) Nothing in this rule may be construed to
				preclude the utility from complying with demands for customer information as
				required by law, such as through a warrant or subpoena.
(8) If a customer discloses or directs the
				utility to disclose customer information to a third party other than in
				response to a request or requirement of the utility, the utility will not be
				responsible for the security of that information or its use or misuse by that
				third party.
(9) The utility must
				retain the following information for each written consent a customer gives to
				the utility for disclosure of customer information :
(a) The date and customer confirmation of
				consent to disclose customer information;
(b) A list of the affiliates, subsidiaries,
				parent organization, or third parties to which the customer has authorized the
				utility to disclose customer information;
(c) Information provided to the customer
				about how the customer can revoke consent; and
(d) Verification that the name, service
				address, and account number match the utility record for such
				account.