1. Smart Grid, Data and Behaviour – Privacy and Security Issues - Potential for Secure Computation Lexpert Seminar December 9, 2013David Young, Partner

2. Smart Grid Data – Personal Information?  “Personal Information” is information about an identifiable individual (FIPPA; PIPEDA)  Energy consumption data that relates to an individual (e.g., a homeowner) is personal information  If that energy consumption data can be made appliance-specific then that would be personal information 2

3. Granularity of Energy Use Data Pointing to Lifestyle, Habits, Activities  Energy use data may be either aggregate or (potentially) specific to appliances  May reveal behaviour patterns, activities within a home – including sensitive aspects e.g., sleeping/waking, health, affluence 3

4. Smart Grid Data – Big Data?  Energy-usage data when combined with other non-identifiable data (e.g., consumer profile data generated through internet tracking) may render the resulting dataset personal information  Granular energy use data when combined data from other sources indicating a customer’s profile may enable monitoring of usage patterns and appliance use 4

5. Smart Grid Data – What Uses?  Energy System Planning  Conservation initiatives o demand management/centralized control instructions o Smart Meter/time of use data o social benchmarking o behavioural change  Secondary uses (e.g., targeted marketing) 5

6. Smart Grid Data – What Collectors, Users?  Utilities (LDCs)  Public sector market stakeholders (e.g., IESO, Smart Metering Entity, OEB, OPA, Government)  Customers  Private sector energy management providers  Electricity market parties that collect or hold PI have an obligation to ensure its security even when disclosed to third party service providers 6

7. De-identification of Smart Grid Data  Personal information that has been anonymized or aggregated so that it is not, and cannot be made, identifiable is no longer personal information  Smart Grid data that is de-identified may be analyzed or disclosed to third parties in a secure manner  Potential for secure analysis by a market participant(e.g. IESO/LDC) and use of that data without re-identifying it 7