In February 2020, the National Commission for Informatics and Liberties (CNIL) noted shortcomings in the way in which suppliers, Engie and Electricité de France (EDF), obtained consumers’ consent to the collection of their consumption data by Linky smart meters. , as well as a “Excessive shelf life” of this data.
After an identical decision concerning EDF in February, the French data protection gendarme announced Thursday, May 6 to close the formal notice procedure against Engie, ruling that the breaches “Have ceased”.
The data read by the meters can give information on the private life of the occupants of the dwelling, such as the times of getting up and going to bed, the periods of absence or the number of people present. “By decision of May 4, 2021, the president of the CNIL decided to close the formal notice” targeting Engie, according to a press release from the commission, considering that “The elements of response provided by the company made it possible to demonstrate that the deficiencies noted during the control have since ceased”.
“New consent path”
“The company has put a new consent process online” during which “The customer can consent to the monitoring of his daily consumption without also having to consent to the monitoring of his consumption by half an hour”, specified the CNIL. And “The company has implemented a new policy for the conservation of consumption data: the retention periods are now proportionate to the purposes for which they are processed”, continues the CNIL.
The CNIL closed the formal notice against EDF on February 15, for the same reasons, the new consent process set up by the company and its connection data retention policy now complying with the general data protection regulation.
The commission originally gave companies three months to become compliant, but this timeframe “Has been extended due to the health crisis linked to Covid-19”, specified the CNIL.