Recommendation 2012/148 - 2012/148/EU: Commission Recommendation of 9 March 2012 on preparations for the roll-out of smart metering systems - Main contents

EN

Official Journal of the European Union

L 73/9

Smart grids mark a new development on the path towards greater consumer empowerment, greater integration of renewable energy sources into the grid and higher energy efficiency and make a considerable contribution to reducing greenhouse gas emissions and to job creation and technological development in the Union.

In accordance with Directive 2009/72/EC of the European Parliament and of the Council of 13 July 2009 concerning common rules for the internal market in electricity and repealing Directive 2003/54/EC (1) and Directive 2009/73/EC of the European Parliament and of the Council of 13 July 2009 concerning common rules for the internal market in natural gas and repealing Directive 2003/55/EC (2), Member States are required to ensure the implementation of smart metering systems that assist the active participation of consumers in the electricity supply and gas supply markets and implementation of those metering systems may be subject to an economic assessment of all the long-term costs and benefits to the market and the individual consumer or which form of smart metering is economically reasonable and cost-effective and which timeframe is feasible for their deployment.

The Communication from the Commission to the European Parliament, the Council, the European Economic and Social Committee and the Committee of the Regions of 12 April 2011 on ‘Smart grids: from innovation to deployment’ (3) announces a number of measures, including monitoring Member States’ progress, establishing guidelines on key performance indicators and guidelines to define a methodology for the Member States’ plans for implementation of smart metering systems, along with cost-benefit analyses.

The Digital Agenda for Europe lists a set of appropriate measures, in particular on data protection in the Union, on network and information security, on cyber attacks and on functionalities for smart grids and metering. Member States, in collaboration with industry, the Commission and other stakeholders, should take appropriate measures to ensure a coherent approach.

One of the key tasks and preconditions for using smart metering systems is to find appropriate technical and legal solutions which safeguard protection of personal data as a fundamental right under Article 8 of the Charter of Fundamental Rights of the European Union and Article 16 of the Treaty on the Functioning of the European Union. Member States and stakeholders should ensure, especially in the initial phase of the roll-out of smart meters, that smart metering system applications are monitored and that fundamental rights and freedoms of individuals are respected.

Smart metering systems allow processing of data, including predominantly personal data. Moreover, the deployment of smart grids and smart metering systems should allow suppliers and network operators to evolve from a broad view of energy behaviour to detailed information on the energy behaviour of individual end-consumers.

The rights and obligations provided for by Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (4) and by Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications) (5) are fully applicable to smart metering which processes personal data, in particular in the use of publicly available electronic communications services for contractual and commercial relations with customers.

The opinions of the Working Party on the protection of individuals with regard to the processing of personal data set up in accordance Article 29 of Directive 95/46/EC provide guidance for identifying and developing ‘best available techniques’ to safeguard personal data and guarantee data security when data are processed in smart metering systems and smart grids.

In the light of the potential for deployment of smart grids, particular attention should be paid to security and protection of the personal data processed by smart metering systems. In this respect, data protection impact assessments should make it possible to identify from the start data protection risks in smart grid developments.

Data protection and information security features should be built into smart metering systems before they are rolled out and used extensively. Such features can effectively improve consumers’ control over the processing of personal data.

Member States should cooperate with industry and civil society stakeholders, in particular with national data protection authorities, to stimulate and support introduction of the ‘security and data protection by design’ principle at an early stage in the development of smart grids, particularly for the roll-out of smart metering systems.

Any party processing personal data in the context of smart metering systems should take all reasonable steps to ensure that data cannot be traced to an identified or identifiable person by any means likely to be used by either the network operator or any other third party, unless the data are processed in compliance with the applicable principles and legal rules on data protection.

The Commission Communication of 2 May 2007 on ‘Promoting data protection by privacy enhancing technologies (PETs)’ (6) sets out clear measures to achieve the goals of minimising the processing of personal data and using anonymous or pseudonymous data wherever possible by supporting the development of PETs and use thereof by data controllers and individuals.

A template developed at Union level for conducting data protection impact assessments will ensure that the provisions of this Recommendation are followed coherently across Member States.

An assessment of the data protection impact carried out by the operator and stakeholders prior to the roll-out of smart metering systems will provide the information necessary in order to take appropriate protective measures. Such measures should be monitored and reviewed throughout the lifetime of the smart meter.

In accordance with Directive 2009/72/EC, Member States are expected to complete, by 3 September 2012, a cost-benefit assessment of the roll-out of smart metering systems. Pursuant to the Communication from the Commission of 12 April 2011, the Commission considers it important to lay down criteria, a template and more general guidelines that would improve the depth and comparability of analyses. As suggested by the Smart Grid Task Force (7), the criteria should use quantifiable indicators.

Member States, in collaboration with industry, the Commission and other stakeholders, should take appropriate measures to disseminate information about and raise awareness of the potential benefits and risks associated with use of smart metering technology.

In this respect, Member States, in collaboration with industry, civil society associations and other stakeholders, should identify and disseminate examples of good practice in smart metering applications and take appropriate measures — such as large-scale pilot projects — to increase public awareness, as a prerequisite for wider take-up of this technology.

Establishment of a set of recommended functional requirements would enable Member States to achieve an optimum level of cost-efficiency in their roll-out plans more easily and simultaneously. Setting the same requirements would also provide regulators, the metering industry, network operators and suppliers with some indication of the approaches most likely to be taken in this sector.

Based on the guidelines of good practice defined by the European Regulators’ Group for Electricity and Gas (hereinafter referred to as the ‘ERGEG’) (8) and on the analysis of the first cost-benefit assessments communicated by Member States, the Commission sees benefit in recommending to Member States and regulators a set of common minimum functionalities for smart meters.

After consulting the European Data Protection Supervisor,

This section provides guidance to Member States on the design and operation of smart grids and smart metering systems ensuring the fundamental right to protection of personal data.

This section also provides guidance on measures to be taken for the deployment of smart metering applications in order to ensure that national legislation implementing Directive 95/46/EC is, where applicable, respected when such technologies are deployed.

Member States are invited to take note of the following definitions:

The data protection impact assessment should describe the envisaged processing operations, an assessment of the risks to the rights and freedoms of data subjects, the measures envisaged to address the risks, safeguards, security measures and mechanisms to ensure the protection of personal data and to demonstrate compliance with Directive 95/46/EC, taking into account the rights and legitimate interests of data subjects and persons concerned.

In order to guarantee protection of personal data throughout the Union, Member States should adopt and apply the data protection impact assessment template to be developed by the Commission and submitted to the Working Party on the protection of individuals with regard to the processing of personal data for its opinion within 12 months of publication of this Recommendation in the Official Journal of the European Union.

When implementing this template, Member States should take into account the advice of the Working Party on the protection of individuals with regard to the processing of personal data.

Member States should ensure that network operators and operators of smart metering systems, in line with their other obligations under Directive 95/46/EC, take the appropriate technical and organisational measures to ensure protection of personal data.

Member States should ensure that the entity processing personal data consults the Data Protection Supervisory Authority referred to in Article 28 of Directive 95/46/EC on the data protection impact assessment, prior to processing. This should allow the Authority to assess the compliance of the processing and, in particular, the risks for the protection of personal data of the data subject and the related safeguards.

Member States should make sure that once the template for data protection impact assessments, as provided for in point 5, has been adopted, network operators implement the points 7 and 8 in accordance with it.

Member States should strongly encourage network operators to incorporate data protection by design and data protection by default settings in deployment of smart grids and smart metering.

Data protection by design and data protection by default settings should be incorporated in the methodologies of parties involved in development of smart grids when personal data are processed.

Data protection by design should be implemented at legislative level (through legislation that has to be compliant with data protection laws) at technical level (by setting appropriate requirements in smart grid standards to ensure that infrastructure is fully consistent with the data protection laws) and organisational level (relating to processing).

Data protection by default should be implemented so that the most data protection friendly option is provided to the customer as a default configuration.

Member States should encourage European standardisation organisations to give preference to smart grid reference architectures based on data protection by design and on data protection by default.

For the purposes of optimising transparency and the individual’s trust, Member States should encourage use of appropriate privacy certification mechanisms and data protection seals and marks, provided by independent parties.

Article 8 of the Charter of Fundamental Rights of the European Union and Article 8(2) of the European Convention on Human Rights require justifying any interference with the right to the protection of personal data. The legitimacy of interference must be assessed on a case-by-case basis in the light of the cumulative criteria of legality, necessity, legitimacy and proportionality. Any processing of personal data which interferes with the fundamental right to the protection of personal data within the smart grid and smart metering system therefore has to be necessary and proportional for it to be considered fully in compliance with the Charter.

In order to mitigate the risks on personal data and security, Member States, in collaboration with industry, the Commission and other stakeholders, should support the determination of best available techniques for each common minimum functional requirement listed in point 42 of the Recommendation.

When deciding the range of information allowed for processing within smart grids, Member States should take all necessary measures to impose, as much as possible, use of data rendered anonymous in such a way that the individual is no longer identifiable. In cases where personal data are to be collected, processed and stored, Member States should ensure that the data are appropriate and relevant. Data collection should be limited to the minimum necessary for the purposes for which data are processed and data should be kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed.

Processing of personal data by or within a smart metering system should be legitimate in accordance with one or more of the grounds listed in Article 7 of Directive 95/46/EC. The opinion of the Working Party on the protection of individuals with regard to the processing of personal data on smart metering (11) should be taken into account.

The processing of personal data by third parties offering value-added energy services should also be lawful and based on one or more of the six grounds for legitimate processing listed in Article 7 of Directive 95/46/EC. Where consent is chosen as the ground for processing, the consent of the data subject should be freely given, specific, informed and explicit and be given separately for each value-added service. The data subject should have the right to withdraw his or her consent at any time. The withdrawal of consent should not affect the lawfulness of the processing based on consent before the withdrawal.

Member States should clearly determine the roles and responsibilities of data controllers and data processors. They should be compatible with their respective obligations set out in Directive 95/46/EC.

Member States should perform an analysis prior to launching processing operations, in order to determine to which extent suppliers and network operators need to store personal data for the purposes of maintaining and operating the smart grid and for billing. This analysis should allow Member States to determine, inter alia, if the periods for the storage of personal data currently set in national law are no longer than necessary for the purposes of operating smart grids. This must include mechanisms to ensure that the time limits set for the erasure of personal data and for a periodic review of the need to store personal data are observed.

For the purpose of this analysis, each Member State should particularly take into account the following principles: the principle of data minimisation, the principle of transparency — by ensuring that the end consumer is informed in a user-friendly and intelligible form using clear and plain language, of the purposes, timing, circumstances, collection, storage and all other processing of personal data, and the principle of empowerment of the individual — by ensuring that the measures taken safeguard the individual’s rights.

Member States should ensure that personal data security is designed in at an early stage as part of the architecture of the network, within a data protection by design process. This should encompass measures to protect personal data against accidental or unlawful destruction or accidental loss and to prevent any unlawful forms of processing, in particular any unauthorised disclosure, dissemination, access to or alteration of personal data.

The use of encrypted channels is recommended as it is one of the most effective technical means against misuse.

Member States should take into account that all present and future components of smart grids ensure compliance with all the ‘security-relevant’ standards developed by European standardisation organisations, including the smart grid information security essential requirements in the Commission’s standardisation mandate M/490. The international security standards should also be taken into account, in particular the ISO/IEC 27000 series (‘ISMS family of standards’).

Member States should ensure that network operators identify security risks and the appropriate security measures to guarantee the adequate level of security and resilience of the smart metering systems. In this regard, network operators, in cooperation with national competent authorities and civil society organisations, should apply existing standards, guidelines and schemes and where not available develop a new one. Relevant guidelines published by the European Network Information and Security Agency (ENISA) should also be taken into account.

Member States should ensure that in accordance with Article 4 of Directive 2002/58/EC, in the event of a personal data breach, the controller notifies without undue delay (preferably not later than 24 hours after the breach has been established) the supervisory authority and the data subject, if the breach is likely to have an adverse effect on protection of his or her personal data.

Without prejudice to the obligations of data controllers, in accordance with Directive 95/46/EC Member States should require that network operators develop and publish an accurate and clear information policy for each of their applications. The policy should include at least the items mentioned in Articles 10 and 11 of Directive 95/46/EC.

Where personal data relating to a data subject are collected, the controller should also provide the data subject with at least the following information:

This section provides guidance to Member States along with a framework for cost-benefit analysis as a foundation for conducting a consistent, credible and transparent economic assessment of the long-term costs and benefits of the roll-out of smart metering.

The economic assessment should follow the guidelines set out in the Annex and should always include the following four steps:

When carrying out the economic assessment of the roll-out of smart metering, Member States or any competent authority that they designate should examine and take into consideration, where available, appropriate pilot programmes that have already implemented smart metering systems. They should also consult, where possible, actual field performance data and pertinent ‘real-life’ experience, in order to fine-tune their assumptions on technology choices and to optimise the associated costs and benefits and consumer engagement, both in terms of public awareness and use of smart metering systems.

In order to perform the cost-benefit analysis, Member States or any competent authority they designate should ensure that a minimum of two forecast scenarios are considered, one of them being ‘business as usual’ (‘do nothing and nothing happens’). In the case of electricity, the second scenario should be in line with the obligation imposed in Directive 2009/72/EC of an 80 % roll-out of smart metering by 2020 and should consider the set of common minimum functionalities laid down in Section III of this Recommendation. It is recommended to explore additional alternative scenarios. Such scenarios should also take into account synergies between existing and future energy-saving measures along with other forms of feedback and advice to consumers, especially the introduction of frequent billing or cost statements based on actual consumption rather than flat rates or estimated consumption. Member States should consider in their alternative scenarios the positive role that clear consumer information and price transparency, as well as competition on the manufacturers’ and providers’ side may have in the roll-out of smart metering.

When setting the conditions and deciding on the hypotheses for running the different scenarios, the Member States or any competent authority they designate should ensure that they conduct timely consultations on this subject with the national regulatory authorities and with promoters and enforcers of the roll-out of smart metering — which in most Member States are the distribution system operators — and with the owners of relevant pilot projects, where available.

As regards, and during, the process of setting the framework conditions, Member States or any competent authority they designate should ensure that all the appropriate communication infrastructure technologies, architectures and measures needed to guarantee interoperability and compliance with the available Union’s or international standards and best practices are taken into consideration. Furthermore, Member States or any competent authority that they designate should ensure that the assumptions underpinning the analysis are adapted to local circumstances, bearing in mind parameters such as geographical coverage, electricity demand, peak load and micro- and macroeconomic conditions. Section 2 of the Annex to this Recommendation contains a list of the parameters which the Member States should ensure are used in this operation.

The Member States or any competent authority they designate should ensure that the CBA follows the supporting guidelines and the step-by-step methodological framework (the ‘seven CBA steps’) laid down in the Annex to this Recommendation. Furthermore, Member States or any competent authority they designate should ensure a reasonable, transparent and well-documented calculation of all the expected costs and benefits in accordance with the logical sequential process proposed for estimating them. Costs that might potentially be incurred by the consumer through the roll-out of smart metering systems should be explicitly indicated in the CBA and set into comparison with long-term potential benefits for the consumers. In Annex I, tables 4 and 5 propose a non-exhaustive list of elements to be included in the CBA.

The Member States or any competent authority they designate should identify critical variables for the sensitivity analysis and report the magnitude of the variable range (minimum and maximum values of the critical variables identified) for the positive roll-out conditions where benefits exceed costs, as obtained from the sensitivity analyses they have performed. In addition, their analysis might also include the volatility responsiveness and possible control measures to keep the value of the variable within the desired range.

When assessing the merits of deployment, externalities (such as on environment or health), the impact of public policy measures and social benefits expected from the roll-out of smart metering, the Member States or any competent authority they designate should ensure that appropriate weighting factors, complementing the quantitative results of the previous steps of the CBA, are taken into account.

The Annex to this Recommendation provides a list of references for other related benefits.

This section is based on best practice from early CBAs for smart metering of electricity carried out in 11 Member States. It provides guidance on measures to be taken to ensure that Member States make due use of appropriate interoperability and standards for smart metering systems currently being developed under Mandates M/441, M/468 and M/490 and of best practice.

Member States are provided with guidance on a set of common minimum functional requirements for smart metering of electricity that would enable them to identify common means of achieving cost-efficiencies in their roll-out plans. This could in turn serve Member States, metering suppliers and network operators as a common basis for their own cost-benefit analyses and investments to facilitate the procurement associated with roll-out and provide regulators with European reference definitions.

This section also provides guidance on provisions to secure consumer benefits and contribute to increases in energy efficiency. It should facilitate the linking of smart metering systems with standardised interfaces equipped with consumer oriented tools that combine consumption data and cost information, encouraging consumer interest in energy saving actions and response to demand. This approach should be fully taken into account when analysing the costs and benefits of the roll-out of smart metering of electricity in line with Union legislation.

Every smart metering system for electricity should offer at least all the functionalities listed below.

Member States should take all necessary measures to follow this Recommendation and to draw it to the attention of all stakeholders involved in designing and operating smart grid applications within the Union.

Member States should report to the Commission by 3 September 2012 on the results of their cost-benefit analysis regarding the roll-out of smart metering systems and on the measures and plans they have adopted in relation to this Recommendation.

The Commission intends to assess, in the light of this Recommendation, the economic appraisals reported on the roll-out of smart metering.

This Recommendation is addressed to the Member States and to any competent authority they designate to be involved in the economic assessment of smart metering systems.

European Commission — Joint Research Centre Institute for Energy and Transport (2012). ‘Guidelines for conducting a cost-benefit analysis of smart grid projects’, available at: http://ses.jrc.ec.europa.eu/

European Commission — Joint Research Centre Institute for Energy and Transport (2012). ‘Guidelines for cost-benefit analysis of smart metering deployment’, available at: http://ses.jrc.ec.europa.eu/

European Regulators’ Group for Electricity and Gas. ‘Final Guidelines of Good Practice on Regulatory Aspects of Smart Metering for Electricity and Gas’, February 2011, Ref.: E10-RMF-29-05 http://www.smartgridscre.fr/media/documents/ERGEG_Guidelines_of_good_practice.pdf

European Commission Task Force for Smart Grids (2010), Expert Group 3: Roles and responsibilities of actors involved in smart grids deployment, ‘Merit deployment matrix’ available at: http://ec.europa.eu/energy/gas_electricity/smartgrids/doc/expert_group3_annex.xls

Proposal for a Directive on energy efficiency and repealing Directives 2004/8/EC and 2006/32/EC [COM(2011) 370 final, 22 June 2011]

SEC(2011) 288 final — Commission Staff Working Document ‘Impact Assessment’ accompanying the Communication from the Commission to the European Parliament, the Council, the European Economic and Social Committee and the Committee of the Regions, ‘A roadmap for moving to a competitive low-carbon economy in 2050’ (COM(2011) 112 final) (SEC(2011) 289 final)