They have three months to comply with the way they manage the collection of personal information from consumers by Linky smart meters. The National Commission for Data Protection (CNIL), an independent administrative authority responsible in particular for data protection, announced on Tuesday 11 February that it had given notice to the energy groups EDF and Engie.
The two groups are put on notice,
“Due to non-compliance with certain requirements relating to the collection of consent to the collection of consumption data from Linky smart meters, as well as for an excessive retention period for consumption data”.
EDF and Engie “Actually collect consent from their users”, but he “Is neither specific nor sufficiently enlightened”, says the French personal data gendarme, who conducted a series of checks on these companies to ensure the conformity of their practices.
Information on the privacy of the occupants of the accommodation
If the two French groups “Have generally defined retention periods” data, the audits revealed that they are “Sometimes too long with regard to the purposes” for which the data are kept, also reports the CNIL.
EDF and Engie are however in “A global trajectory of compliance”, estimates the gendarme of personal data, who gave them three months to rectify the two breaches.
The consumption data collected by Linky smart meters can provide information on the privacy of the occupants of the accommodation, such as getting up and going to bed, periods of absence or the number of people present. “It is therefore essential that customers can keep control of their data”, underlines the CNIL.
This data can only be collected after obtaining the consent of the data subjects. This consent must be “Free, specific, enlightened and unequivocal”, in accordance with the General Data Protection Regulation (GDPR), which entered into force in May 2018.
Our “Linky in questions” series
–
