Report of EC Smart Grid Task Force Expert Group 2 activities Regulatory Recommendations for Data Safety, Data Handling and Data Protection François Ennesser ETSI EG2 Representative © ETSI 2010. All rights reserved 14 June 2010

Expert Group 2 Scope Within the general Task Force mandate: TASK 1. Produce a common vision in conjunction with institutional actors and key stakeholders for the implementation of Smart Grids TASK 2. Identify the strategic decisions and regulatory recommendations for the EU-wide implementation of Smart Grids TASK 3. Produce a strategic roadmap for the implementation of Smart Grids and Smart Meters into the European internal market Expert Group 2 mandate: "The key deliverable is to identify the appropriate regulatory scenario and recommendations for data handling, safety and consumer protection” ETSI/B72(09)XX

EG 2 Represented organizations ESMIG 5 Metering Industry DigitalEurope 3 IT Industry EECA - ESIA 4 Semiconductor Industry DSO Club Energy Distribution CEN/CENELEC Standards Development Organization EU TC Utilities Telecom Council EU TREN 2 European Commission ANEC - BEUC Consumers ERGEG 1 Energy regulation EURELECTRIC Electricity Industry T&D Europe Energy Transmission and distribution GEODE ConsumentenBond CEDEC Energy companies ETSI 3 3

EG2 intentions Identify benefits and concerns of customers to become active actors Overview of European legislation on data protection Identify: possible risks in data handling, safety and protection data exchange issues ownership of data and access rights responsible parties for data protection Analyse how to handle these issues along the value chain Develop a framework for using data Recommendations for Information and Communication of Smart Grid benefits to consumers and politicians 4 4

EG2 Organization The group organized 7 subtasks, to produce input documents for final contribution: Definitions EU Countries Inventory Benchmark of other industries (Telecom, Banking…) and countries Recommendation for Open Standards Recommended data safety, data protection and data handling framework Recommendation on Smart Grid Benefits/Risks Business case Smart Grid / Smart Meter 5 5

The situation in Europe today Efforts towards the implementation of Smart Grid reached sophisticated but not coordinated level Example initiatives: Dutch Smart Metering Standard (DSMR) German Open Metering System Specification (OMS) German FNN MUC Specification Recommendations for data security exist (including smart grid data security) but… EU-wide guideline for end-to-end security in Smart Grid is missing Critical infrastructures such as power grids are targets for cyber attacks and therefore, need strong protection Actual happenings in other fields (banking, healthcare) show that high attention of consumer data safety is critical 6 6

The Dutch experience 2009: Dutch law mandating smart meters voted down due to privacy concerns Same as another Dutch law, for Road Pricing (also M2M) Problem: Frequent monitoring of energy consumption gives insights on people’s privacy Energy distributors in the Netherlands became sensitive to Security & Privacy issues and addressed the issue Extensive studies initiated, encompassing all aspects According to EC Directives (subject to national interpretation): Unless user chooses to enroll, there shall be no interference to privacy right, except as allowed by law in the interest of democratic society When do privacy violations counterbalance benefits to society? Level of trust to be raised by appropriate public communication 80% smart meter coverage intended and needed to break even ETSI/B72(09)XX

EG2 Report presentation EC expectations: Reports to be about 20 pages long Each EG report will be maintained as an independent document EGs will be tasked with further investigations as a next step EG2 Report outline with recommendations are listed in the following slides ETSI/B72(09)XX

1- Presentation of European Privacy Framework Recommendation 1: Investigate how EC Privacy and Data Protection framework cover Smart Metering and Smart Grids Determine any additional legal framework needed for regulation Propose particular privacy requirements for the stakeholders ETSI/B72(09)XX

2- Other industries and international experience Banking, Telecom, Automated Fare collection, Road Pricing: Recommendation 2: Address Security & Privacy at the design stage Consider security features developed out of identified threats in Telecom Data aggregation and anonymization will be essential for Smart Grids Dutch Experience: Apply below Framework for developing Security & privacy requirements U.S.: More focused on malevolent attacks and less on privacy ETSI/B72(09)XX

3- Data Security Pending issue about ETSI’s involvement in this picture… First assessment of security risks on the involved interfaces Recommendation 3: CEN/CLC/ETSI Joint Working Group to update, extend or develop standards covering Smart Grid security ETSI/B72(09)XX

4- Data Handling Recommendation 4: Develop pilot projects in consultation with banking and payment card industry, to propose list of high level data handling principles for smartgrid operators to design their systems and processes Produce and present paper to CEN, CENELEC Joint WG highlighting additional detailed standardization required in Data Handling Define the Security levels from minimum to advanced and estimate their cost. ETSI/B72(09)XX

5- Data Privacy Recommendation 5: Detail and distinguish the different data elements between: Consumers data: Specific data that can be traced back to the individual consumer Technical data: Aggregated and anonymous data that does not contain explicit reference to persons Define roles and responsibilities regarding ownership, possession and access to data, read and change rights, etc. ETSI/B72(09)XX

Next Steps EG 2 Report Version 1.0 open for comments until Close of Business Tuesday, June 15 Possible 1 to 1 Teleconf on Wednesday June 16 to resolve major areas of conflicts Presentation to Task Force Steering Committee by June 22 Expectation that EG2 will be tasked with further investigations in the next phase ETSI/B72(09)XX