Pipe up, by Andrew Hartshorn

Much heat has been generated following the announcement of the changes to the General Data Protection Regulation (GDPR), particularly with the steep increase in fines and onerous obligations for businesses. Yet the new regime gives an opportunity for energy suppliers to improve the public’s perception of how they gather and use personal data. If managed correctly, it could provide the energy industry with an opportunity to buy back consumer trust.

According to the latest PwC Annual Global CEO Survey, almost two-thirds of CEOs consider that the way they manage data will be a differentiating factor for the business and that treating customers and their data with integrity will be key to this.

The process needs to permeate all touch points between energy suppliers and their customers. From the first contact, the GDPR requires organisations to be completely transparent about how they collect, process, store and pass on customers’ personal data.

Understanding the basis of processing and ensuring that the most valuable of customer commodities, consent, is appropriately obtained and managed will be key to customer relationships going forward. Consent now needs to be specific, informed and given by a positive statement. Energy suppliers who are looking to use information from smart meters other than for basic contract fulfilment will need to consider carefully how they engage with consumers on this issue.

Managing the data sets that are collected from consumers will be key. The GDPR requires organisations to collect only the necessary personal data required for the processing to be carried out. While this is fundamentally no different from the position under existing legislation, enhanced consumer awareness of their rights under the new regime, together with the removal of the fee for subject access requests, means businesses should expect an increase in requests. Minimising information held about customers will make responding easier. Similarly, staff need to be trained to ensure they follow best practice. For example, referring to customers in a derogatory way in an email can now be used in evidence against them.

Carrying out Data Protection Impact Assessments will also support energy suppliers hoping to enhance consumer trust. By properly understanding the impact that the introduction of new processes will have on the use of customer data, suppliers will be able to explain the benefits of the processing to their customers – allowing consumers to engage with the supplier with greater trust.