Privacy Policy

This policy describes the fair information practices that govern the collection, maintenance, use, and disclosure of information on websites owned and operated by the copyright holder of this website hereinafter referred to as the site operator. Unless otherwise provided, all information provided on the website is made available subject to this Privacy Policy. By accessing this site website, you agree, without limitation or qualification, to be bound by this Privacy Policy.

  • Information Collected & Stored Automatically
    The site operator may automatically collect and store anonymous information about site visitors to enable us to make the website more useful and improve the overall quality of the visitor’s online experience. Anonymous information refers to data that cannot be tied back to a specific individual. We may collect the following anonymous information from you every time you access the website:

    1. Internet domain from which you access our website (e.g. google.com, your-company.com, bing.com)
    2. IP Address: An IP address is automatically assigned to your computer or mobile device when you surf the web. In some cases, these addresses may be individually or regionally identifiable. However, even when an IP address is identifiable, it usually takes additional effort to link a particular IP address to a specific individual. For many users, an IP address cannot be linked to a specific individual.
    3. Type of browser and operating system used to access our website
    4. Date and time of access
    5. Pages visited
    6. Address of the website (if any) from which you linked to the website

    Weblogs may also be automatically created and used to identify visitors who seek to damage the website, use the website in unauthorized ways, or interfere with operations.  Information about users who try to engage in any unapproved activities may be shared with law enforcement agencies. We do not collect any personal information about a routine visitor unless the visitor provides information to us.

  • Personal Information Collection & Use 
    You do not have to provide any personally identifiable information to visit this website; however, if you use the website to send us an email, subscribe to a newsletter or email alert, ask for information, or if you provide personally identifiable information through the website in any other way, we may collect and may maintain the information that you provide. Personally identifiable information refers to data that tells us specifically who you are (e.g. your name, address, email, electric service characteristics, dispute). In the situations described above, your personally identifiable information may be shared among our staff, members, and support services (including third party vendors) as we deem necessary. Once information reaches the correct office, it will be used in the same manner as comparable information collected in other ways. In no event will we sell, rent, or lease your personally identifiable information to any third parties.
  • Linking to Other Sites  
    From time to time, the website may provide links to other websites, not owned or controlled by us, that we think might be useful or of interest to you. We cannot, however, be responsible for the privacy practices used by other website owners or the content or accuracy of those other websites. Links to various websites do not constitute or imply endorsement of these websites, any products or services described on these sites, or of any other material contained in them.
  • Security & Data Quality
    1. The site operator maintains its website and its information with technical, administrative, and physical safeguards to protect against loss, unauthorized access, destruction, misuse, modification, and improper disclosure. We are committed to maintaining accurate, timely, relevant, and appropriate information about our users. No computer or mobile operating system can ever be fully protected against every possible hazard. We provide reasonable and appropriate security to protect against foreseeable hazards.
    2. We require that employees who have access to personally identifiable information from the website acknowledge in writing that they have read this privacy policy and that they are expected to follow it. Any employee who fails to comply with these rules may be subject to disciplinary action up to and including dismissal.
    3. Please note that your email, like most, if not all, non-encrypted Internet email communications, may be accessed and viewed by other internet users, without your knowledge or permission, while in transit to us. For that reason, to protect your privacy, please do not use email to communicate information to us that you consider confidential.
    4. “Phishing” is a scam designed to steal your personal information. If you receive an email that looks like it is from us asking you for your personal information, do not respond.  We will never request your passwords, user names, credit card information, or other personally identifiable information through email.
  • Cookie Policy
    A “cookie” is an element of data that a website can send to your browser and store your preferences when you link to that website. It is not a computer program and has no ability to read data residing on your device or instruct your device to perform any step or function. By assigning a unique data element to each visitor, the website is able to recognize repeat users, track usage patterns, and better serve you when you return to our site. The cookie does not extract personally identifiable information about you. In order to better understand how we use cookies, the following descriptions below account for the different types of cookies which may be utilized on our website. First party cookies are cookies set by the website you are visiting. Persistent cookies are cookies that remain on your device for the period of time specified in the cookie. Persistent cookies are activated each time that you visit the website that created that particular cookie. To help serve you better, we use persistent, first-party cookies to receive and store certain types of information whenever you interact with our website through your computer or mobile device. This information helps us identify return visitors to enhance your user experience, to tailor the website to your preferences, and track usage to understand what content is most useful to website visitors. You may update your “cookie” settings on your device at any time. The help function of your browser should contain instructions to allow you to set your device to accept all cookies, to notify you when a cookie is issued, or to not receive cookies at all.

If you use Microsoft Internet Explorer or Microsoft Edge, visit Microsoft Support to obtain information on how to set your cookie preferences.

If you use Google Chrome, visit Google Support to obtain information on how to set your cookie preferences.

If you use Firefox, visit Mozilla Support to obtain information on how to set your cookie preferences.

If you use Apple Safari, visit Apple Support to obtain information on how to set your cookie preferences.

Note that if you set your preferences so your device does not receive cookies, certain features of the website cannot be provided to you, and you may not be able to take full advantage of all the website content.

  • Uses & Disclosures
    1. The site operator uses its website to provide services and information to its members, employees, and members of the general public.
    2. General
      We may share information we collect on our website with companies that provide support services to us (such as auditors, web hosting providers, or call center service providers). These companies may need this information in order to perform their functions. We generally direct recipients to agree to safeguard personal information, to use it only as authorized by us, and to return it or destroy it when no longer required.
    3. Legal Process
      We could be required to disclose personal information in response to valid legal processes, such as a search warrant, subpoena, or court order. Any record keeper faces this possibility. Disclosures may also be appropriate to protect our legal rights or during emergencies if physical safety is believed to be at risk. We believe that these events are unlikely, but they are possible. We will take reasonable steps to limit the scope and consequences of any of these disclosures.
    4. Recruiting Services
      Web users can search and apply online for employment opportunities with the site operator and its affiliated companies. If you complete a job application online, provide a resume, or disclose other personal information for a recruitment activity, we may use your information in the same manner as if you applied by regular mail or in person. The information will only be used for recruiting and employment purposes. It is possible that information about you or about your application will be shared externally to verify the information, to obtain references, or for other employment-related purposes. When appropriate, application information will be shared with a member cooperative that advertised a vacancy. Each member cooperative has independent policies and practices for the use and disclosure of employment applications.
  • Subscriptions
    You may voluntarily sign up to receive various newsletters, updates or alerts, and other such communications, directly or indirectly, from our staff or affiliates. By electing to receive any communication, you understand that your information will be retained by us and may be added to our contact database. Based upon your election, we may contact you directly concerning other publications or events that may be useful to you. Note that as a recipient of any generated communications, you may unsubscribe from future messages via a link at the bottom of each email message to be removed from our contact list. We do not sell, rent, or otherwise share lists of subscribers to publications, online newsstand services, or list servers.
  • Changes to This Policy
    We may change this statement from time to time. We encourage you to periodically reread this policy to see if there have been any changes that may affect you. This statement is not intended to and does not create any contractual or other legal rights in or on behalf of any party.
  • Children & Privacy
    We are committed to protecting the privacy needs of children and encourages parents and guardians to take an active role in their children’s online activities. Our website does not target and is not intended to attract children under the age of 13. We do not knowingly solicit personal information from children under the age of 13 nor send them requests for personal information.

Consumer Personal Information & Data Privacy

Purpose

The purpose of this policy is to implement and carry out the provisions of Chapter 19.29A.RCW (Chapter 21, Laws of 2015 Electric Utilities-Customer Information-Privacy Policy).

In accordance with RCW 19.29A.100 it is the policy of Public Utility District No. 1 of Grays Harbor County to protect customer personal and proprietary information from unauthorized disclosure or breach of security throughout the lifecycle of the data. We understand the importance of protecting the personal and proprietary information we collect from the public and this policy is intended to help Public Utility District No. 1 of Grays Harbor County implement its commitment. The District is committed to protecting the security and privacy of all customer data, and will conform to applicable laws and regulations, as well as internal standards and policies which are intended to keep this information private and secure.

The District may be required to release various types of customer information in response to a public records request, court order, search warrant, or discovery request. When one of these events occur, efforts will be made as allowed by law to notify customers of such requests before the information is disclosed.

This policy shall be available at the District’s Main Office and posted on the District’s Website.

Requirements

A. Definitions

  • Aggregated Information: See Subsection G, below.
  • District: means Public Utility District No. 1 of Grays Harbor County.
  • Main Office: The District’s Main Office is located at:
    2720 Sumner Avenue
    Aberdeen, WA 98520
    The District’s hours are 8 a.m. to 5 p.m., Monday through Friday, except designated legal holidays.
  • Policy: means this Consumer Personal Information and Data Privacy Policy.
  • Electric Meters in Service: means those meters that record in at least nine of twelve calendar months in any calendar year, not less than two hundred fifty kilowatt-hours per month.
  • Electricity: means electric energy measured in kilowatt-hours, or electric capacity measured in kilowatts, or both.
  • Employee(s): This policy applies to all District employees, commissioners, and contract personnel with access to the District’s systems and data, hereinafter referred to within this policy as “employees.”
  • Governing Body: means the Board of Commissioners of the Public Utility District No. 1 of Grays Harbor County.
  • Private Customer Information: includes a retail electric customer’s name, address, telephone number and other personally identifying information (“PII” as defined in Section B below).
  • Proprietary Customer Information: means (a) information that relates to the sources, technical configuration, destination, and amount of electricity used by a retail electric customer, a retail electric customer’s payment history, and household data that is made available by the customer solely by virtue of the utility-customer relationship; and (b) information contained in a retail electric customer’s bill.
  • Retail Electric Customer: means a person or entity that purchases electricity for ultimate consumption and not for resale.
  • State: means the State of Washington.

B. Personally Identifiable Information (PII)

Customer data defined at "PII" in this Policy is limited to:

  • Names
  • Street (Service) addresses
  • Telephone numbers
  • Email addresses
  • Social Security or Unified Business Identifier (UBI) numbers
  • Account numbers (Named Utility account numbers, credit card numbers, bank account numbers)
  • Account balances
  • Any information received to identity the customer, such as driver’s license, passport, or information collected to establish the customer’s credit worthiness
  • Meter identifier and meter interval/electricity use data that is released in combination with any information included with the previous items.

C. Consumer Consent to Release Data

In accordance with RCW 19.29A.100, the District may not sell private or proprietary customer information for the purposes of marketing services or product offerings the customer does not already subscribe to. In order to disclose information to a third party for this purpose, the District must first obtain a customer’s permission prior to releasing the information.

Customer consent is not required when the utility is performing an essential business function. When customer data is released to a contractor/subcontractor or third party, the purpose of the release of the data will be defined as being for either a “Primary” or “Secondary” purpose, as follows:

Primary Purpose - data released for essential business functions, such as billing or bill presentment, energy efficiency program validation or administration (such as BPA), and customer surveys. When data is released to a vendor to provide services that are of a primary purpose, the vendor is further prohibited from disclosing the customer information to a party that is not under contract with the District or its contracted affiliates. Further, all vendors and contractors will be required to sign a Confidentiality and Non-Disclosure Agreement.

Secondary Purpose - data released for marketing services or product offerings the customer does not already subscribe to. Requests for customer data used for secondary purposes might come from a customer asking for their data to be shared directly to a third party vendor, from a vendor asking for customer information for marketing purposes, or from utility staff working with a third party to market a new product or service.

D. Obtaining Affirmative Customer Consent – Release of Data for a Secondary Purpose

When releasing customer data for a secondary purpose, affirmative (advance) customer consent must be obtained for each instance of release of data unless the customer has previously provided advance consent.

The following is necessary to meet the requirements of affirmative consent, which can be provided electronically or via hard copy on the District’s Customer Authorization to Release Information form:

  • The consent must include the date or date period for which the consent is granted.
  • The consent must specify the party or parties the customer has authorized the release of their data to, including any affiliates and third parties.
  • The District must validate that the individual providing the consent matches the name, service address, and account number of the customer of record in the District’s customer information system.
  • A record for each instance the customer has given written or electronic consent must be maintained, following applicable records retention guidelines.

Customers who have given affirmative consent have the right to retract that consent at any time.

It is the responsibility of District employees to be aware of their obligations as it relates to the protection of customer data and it’s release to a third party and to coordinate the release of customer personal information and/or data with the District’s Public Records Officer.

E. Resolution of Customer Complaints – Disclosure of Data

A customer has the right to request the District investigate the potential release of their information and/or appeal the release of their information.

A Customer shall utilize the following steps to initiate the investigation/appeal process:

  1. The District must receive a customer’s written request by personal delivery or mail, addressed to the Public Records Officer. The Public Records Officer may be contacted via first class mail addressed to the Public Records Officer at the Main Office, via email at pra2016(or, current year)@ghpud.org.
  2. The request must contain a short, plain statement of potential PII or data released, the action requested by the customer and the appropriate customer contact information for purposes of communications for the appeals process.
  3. Upon receipt of the request, the customer will be contacted by the District’s Public Records Officer within 5 business days and an informal conference will be scheduled.
  4. The District’s Public Records Officer will investigate and inform the customer of their findings.
  5. If the investigation is resolved to the satisfaction of the customer, the process is concluded.
  6. If the situation remains unresolved, the customer may appeal the results of the investigation to the Board of Commissioners or the District’s General Manager. The Board of Commissioners or the District’s General Manager shall promptly consider the matter and affirm or reverse the decision within 14 business days following receipt of the appeal.

G. Aggregated Data

In accordance with RCW 19.29A.100(8), aggregate information is information that is considered sufficiently consolidated so that any individual customer cannot reasonably be identified. The District will generally follow a 15/15 rule, which means that aggregated information must include the data of at least 15 customers, and no single customer included in the aggregated data is to comprise more than 15% of the total. Any personal identifying information must be removed from the aggregated data before release.

Customer consent is not required when releasing aggregated data that meets this definition.

H. Disclosure/Transmittal of PII

    1. Disclosure of PII to Contractors/Subcontractors

      The District may engage a vendor/contractor to provide services in support of primary and secondary business functions. A Confidentiality and Non-Disclosure Agreement (CNDA) will be included as part of the standard contract language and approved as part of the standard contract approval process. Further, the District’s contractors may engage a subcontractor or third party to provide services in support of their contract with the District. A CNDA must be signed by a subcontractor or third party and be routed through the normal contract approval process.

    2. Transmittal of PII to Contractor/Subcontractor

      All files and forms of data provided to a vendor to conduct business of the District should be sent via secure FTP or be encrypted. Email or hard copies should be avoided in sharing PII with a vendor/contractor.

    3. Disclosure of PII During Customer Transactions

      The District considers security of PII a top priority, and will only share PII when requested with the customer(s) of record or an individual designated by the customer(s) of record to receive such information. Before releasing PII, measures will be taken to verify the identity of the person requesting the information. This may include asking for the UBI number of a commercial business, some combination of a social security number (first three digits, last four digits), or verification by driver’s license number.

    4. Disclosure of PII to Law Enforcement

      The District will comply with RCW 42.56.235, which gives law enforcement authorities a mechanism to obtain records of individuals who are suspected of committing a crime. The law enforcement officer must complete a “Request for Inspection, Copying or Obtaining of Public Records by Law Enforcement Agencies” form before certain PII will be released to the requesting officer.

      Customer information that is strictly protected from disclosure by law will not be released to law enforcement under the above process. In order for law enforcement to obtain this type of exemptible data, a subpoena, search warrant, or other form of court order must be obtained by the requesting agency.

      All requests for PII by law enforcement should be processed through the District’s Customer Service Manager or Public Records Officer.

I. Breach of Notice Practice

The District will implement administrative, technical, and physical safeguards to protect PII from unauthorized access, destruction, use, modification, or disclosure.

Pursuant to RCW 42.56.590, if the District discovers or is informed of a breach, it will undertake all reasonable efforts to secure the breached data and will notify all affected customers unless the breach of security is not reasonably likely to subject the customer to a risk of harm.

Resolution Number 4916

A Resolution Adopting a Consumer Personal Information & Data Privacy Policy

Whereas, electric utility customers are being offered an ever-increasing number of innovative technology choices for energy management on the customer's side of the meter such as solar energy, smart thermostats, and hot water heaters, smart metering, 2-way power flow capability from electric vehicle charging and discharging into the grid, and aggregated home and business energy management services; and

Whereas, protecting our customer's privacy and their personal data, known as their personally identifying information, is a top priority for Grays Harbor PUD; and

Whereas, Grays Harbor PUD is subject to various state laws addressing the treatment of customer data by the PUD and disclosure to third parties including RCW 19.29A.100 (Data Privacy); RCW 42.56.330(2) (Exemption from Public Disclosure of certain customer data); RCW 42.56.590 (Notification of Data Breach); and RCW 42.56.335 (Law Enforcement); and

Whereas, the attached Consumer Personal Information and Data Privacy Policy addresses provisions of the PUD's policy and state laws that protect customers' data privacy and provides remedies for both the PUD and the customer in the event of an unauthorized data disclosure or breach;

Now, therefore, the board of commissioners of Public Utility District Number 1 of Grays Harbor County hereby adopts the attached Consumer Personal Information and Data Privacy Policy to protect our customers' data and provide an avenue for our customers to work with the PUD to be notified of, investigate, identify and seek to resolve, any disclosure or breach of their personally identifying information.

This Resolution shall be in force and take effect upon approval.

Passed and Approved this 10th day of October 2016