The Department for Business, Energy & Industrial Strategy recently published a privacy notice covering their intention to gather data related to gas and electricity consumption. Data gathered includes the meter number and postcode of the house, plus the level of consumption.
This is, by any standard, a vast data grab, covering millions of households. Although the purpose of the scheme is the Energy Price guarantee, there are huge risks here. Energy consumption can tell you an enormous amount about how a household behaves.
I made an #FOI request to DBEIS to dig into the background. In particular, I wanted to see the #DPIA that DBEIS must have carried out to get as far as publishing a privacy notice about the scheme and whether they’d discussed the project with @ICOnews.
There is no DPIA and though DBEIS claim to have discussed the project with the ICO, the fact that they have no recorded information makes me suspect that this is not true. If you’re interested in the full response, rather than pick it apart here, I’ve linked to it below.
The crucial point I wanted to make was about the role of the DPIA – the DPIA is not a late-stage process. It’s not part of the sign-off. For legal but more importantly practical reasons, it should happen as early as possible in the lifecycle of a project.
If you identify a risk / possible improvement, you want to do that before money and resources have been committed. DBEIS say: “The scope of the data required for the Energy Price Guarantee scheme and how regularly it is collected is still being defined.”
The privacy notice hedges its bets about whether names, dates of birth and email addresses will be needed. It’s definitely the wrong time to publish a privacy notice (because they don’t know exactly what they’re doing) and the right time to do a DPIA (for the same reason).
Whether or not DPIAs survive the government's DP reforms as an obligation is an open question; the merit of an enforced impact assessment has always been lost on me because if you’re only doing one because you have to, it probably won’t be very good.
But if you’re proposing to monitor every household in the country and you’re not keen to think about risks and alternatives early and often, the chances of you screwing it up just increased significantly
This is the notice: gov.uk/government/pub…
Click here for the full DBEIS response: 2040training.co.uk/dpo-daily-down…
• • •
Missing some Tweet in this thread? You can try to
force a refresh
