Policy 29: Customer Data Management

Policy Objective:

Rochester Public Utilities (RPU) understands that privacy is important to its customers, and respects customer's privacy concerns. The intent of this policy is to ensure RPU’s customers’ personal information is safeguarded and the due care is maintained in how the data is collected and protected. While RPU is subject to the Minnesota Government Data Practices Act (MGDPA) which can be found in Minnesota Statutes, Chapter 13 (2021), this policy sets forth the manner in which RPU collects, creates, receives, maintains, or disseminates customer data. This policy describes what kind of customer data is collected, how the collected data is used, and how the collected data is securely maintained by RPU.

Policy Statement:

1. Customer data RPU may collect:
   1. Contact information (such as name, postal address, email address, phone number, employer(s), and authorized third party representatives);
   2. Personal identification information (such as local, state or federal government identification documents);
   3. Demographic data (such as dwelling size and type, business size and type, owner/tenant, and household income);
   4. Service address and dates of service;
   5. Information about customers participating in RPU’s various conservation programs (such as renewables, energy conservation, or Service Assured®);
   6. Account history (such as collection notices issued, disconnection and reconnection dates, and payment arrangements);
   7. Account notes detailing contacts made or interactions with customers via in person, letter, phone, email, fax, chat, text, meeting space (such as Zoom), or social media;
   8. Energy and water usage data specific to an account;
   9. Customer billing details (such as amounts due, payment history, payment amounts and dates, financial account number, routing number, and billing address); and
2. How RPU Uses collected customer data:
   1. To assist customers in establishing an account with RPU;
   2. Provide, bill, and collect for RPU products and services or services that RPU bills for or manages (e.g., city stormwater or miscellaneous billings);
   3. Communicate with customers, respond to customer questions and comments, and provide customer support (such as making outreach calls or connecting customers to various agencies that provide assistance);
   4. Administer customer participation in events, programs, rebates, surveys, and other offers and promotions;
   5. Operate, evaluate, and improve our business, products and services (including developing new products, analyzing our products and services, optimizing our customer experience, managing our distribution system, reducing costs, improving accuracy and reliability, performing accounting, auditing, and other internal transactions);
   6. Protect against fraud, unauthorized transactions, claims, and other liabilities; and
   7. Connect customers to assistance through federal, state, county, city or other non-profit administered welfare or assistance programs in order to ensure customers can access services that RPU bills for or manages on behalf of the city.
3. Information Disclosures
   1. A law enforcement agency that requests access to the data in connection with an investigation;
   2. A school for the purposes of compiling pupil census data;
   3. The Metropolitan Council for use in or analysis required by law;
   4. A public child support authority for purposes of establishing or enforcing child support; or
   5. A person where use of the data directly advances the general welfare, health, safety of the
      public as set forth in Minn. Stat. Sec. 216C.331 Subd.8 (1) Energy Benchmarking; 
   6. RPU will aggregate whole building data for purposes of benchmarking to a 4/50 standard. This standard means there must be at least four premises in the data set, and no one premise can comprise of 50 percent or more of the total energy consumption; and
   7. Customer energy use data sets containing three or fewer customers or with a single customer’s energy use greater than 50 percent of the total energy consumption will only be provided upon the customer’s written consent.
      
      RPU may disclose customer data for any of these purposes provided the City Attorney has reviewed the request and deemed it in compliance with the Minnesota Government Data Practices Act (MGDPA) or other applicable law. A customer may authorize the release of information by participating in programs or services (such as energy audits or other programs that require information to deliver the service).
      
      RPU and City officials and staff, as well as state agencies such as the Department of Commerce, Minnesota Housing or the Minnesota Department of Human Services, or other entities acting as an agent for federal or state programs engaging in eligibility determinations and therefore may reasonably require access to private or confidential data in the course of their work duties or responsibilities.
      
      RPU may also disclose information about customers to service providers who perform services on our behalf, such as companies that assist RPU in providing products and services to customers, billing customers, or processing credit card payments or managing software applications. RPU contractually requires these service providers to comply with the protections of the MGDPA, and limits the access and use of private information to that which is reasonably necessary to perform specific contracted services.
      
      RPU may disclose aggregated energy and water usage data (without reference to specific customers) to third parties as allowed under the MGDPA.
      
      
4. How RPU stores and protects collected customer data
   RPU will maintain administrative, technical, and physical safeguards designed to protect the security and privacy of the information that is maintained about customers. Administrative controls will consist of:
   1. Ensuring that all employees are provided with MGDPA compliance training upon hire or rehire and annually for existing employees. Maintaining a list of recipients of shared data to include the third party receiving the data, frequency, delivery method, and information shared. This list will be audited annually by the City Attorney for compliance with the MGDPA and provided to the RPU Board.
   2. Ensuring vendors that may have access to customer data will be assessed as part of the vendor risk assessment process.
   3. Following procedures to ensure that private or confidential data are only accessible to persons whose work duties reasonably require access to the data, and that such data is accessed for the purposes described in this policy.
   4. A public child support authority for purposes of establishing or enforcing child support; or
   5. A person where use of the data directly advances the general welfare, health, safety of the
      public as set forth in Minn. Stat. Sec. 216C.331 Subd.8 (1) Energy Benchmarking
   6. RPU will aggregate whole building data for purposes of benchmarking to a 4/50 standard. This standard means there must be at least four premises in the data set, and no one premise can comprise of 50 percent or more of the total energy consumption; and
   7. Customer energy use data sets containing three or fewer customers or with a single customer’s energy use greater than 50 percent of the total energy consumption will only be provided upon the customer’s written consent.

Policy Information

Effective Date of Policy: September 30, 20214
Last Reviewed: July 30, 2024
Last Approved: August 27, 2024
Signed By: Melissa Graner Johson, Board President