Notice

Use of electricity meter data collected through the Energy Bills Support Scheme and Alternative Fuel Payment in Northern Ireland: privacy notice

Updated 17 August 2023

This notice is provided to meet the requirements of the UK General Data Protection Regulation (GDPR) and Data Protection Act 2018 (DPA) to provide transparency in how we process and use personal data collected from energy suppliers in Northern Ireland, for the Energy Bills Support Scheme (EBSS) and Alternative Fuel Payment (AFP) for Northern Ireland, and your rights. It is made under Articles 13 and 14 GDPR.

Scope

We will collect and process the following personal data*, related to each electricity meter eligible for EBSS and AFP in Northern Ireland:

• electricity supplier
• Meter Point Reference Number (MPRN)
• whether the EBSS and AFP payment has been provided
• whether the EBSS and AFP payment has been delivered
• electricity billing cycle
• electricity payment type
• whether their electricity account is in arrears
• customer address
• customer postcode

*Personal data is information that relates to an identified or identifiable individual and only includes information relating to natural persons who:

• can be identified or who are identifiable, directly from the information in question; or
• who can be indirectly identified from that information in combination with other information

Purpose

We are processing these data:

1. To enable us to monitor the progress and operational delivery of the EBSS and AFP for Northern Ireland. This includes monitoring the reach of the scheme across regions and vulnerable groups.

2. To conduct financial checks on EBSS and AFP payments including for assurance and the prevention, investigation, detection, or prosecution of criminal offences including fraud.

3. To allow us to evaluate the scheme to understand its impact and to inform future government policy.

4. To be used as part of application or post-payment checks to the Alternative Fund and other wider energy support schemes operated by us. The Alternative Fund is designed to support households that have not already received an EBSS and AFP payment, and the data will be used to sift for eligible customers.

Your data may be linked to other datasets in which your data is stored for the above purposes (see Sources).

Legal basis of processing

The legal basis for processing these personal data is public task.

Processing is necessary for the performance of a task carried out in the public interest, under Article 6(1)(e)) of the UK GDPR and in the exercise of official authority vested in the Secretary of State. The specific public task is to allow for monitoring, assurance, fraud prevention and evaluation purposes of the EBSS and AFP.

Sources

We are collecting these personal data from electricity suppliers. We will use existing government datasets and other datasets to support these data, as is necessary to meet the purpose. These datasets may include:

• supplier and meter-point data from Northern Ireland Electricity Networks
• data supplied by the Retail Energy Code Company
• energy consumption data from electricity data aggregators and Xoserve
• national postcode lookup data from the Office for National Statistics
• living cost and food survey data from the Office for National Statistics
• data from the Smart Energy Research Lab supplied by University College London

We may identify additional data sources as the scheme progresses.

Recipients

These data are being used by us and will be shared with our contractors (and if applicable their sub-contractors) where required for the delivery of the EBSS and AFP work that we have contracted out.

These personal data will be shared with our data processors Microsoft and Amazon Web Services.

We do not allow third parties to use this data.

We will not:

• sell or rent these data to third parties
• share these data with third parties for marketing purposes

We may share these data if we are required to do so by law, for example by court order or to prevent fraud or other crime.

Retention

We will only keep these data for as long as required to support the evaluation and scrutiny of the EBSS and AFP, as is in the public interest. These data will be securely deleted no later than 7 years after collection in line with our department policy. We recognise that this maximum retention period may be longer than energy suppliers will hold this data, which reflects the additional purposes for which we are collecting and processing this data, listed under Purpose.

Automated decision making

These personal data will not be subject to automated decision making.

Security

We are committed to doing all that we can to keep these data secure. We will protect this personal information against unauthorised access, unlawful use, accidental loss, corruption, or destruction.

We use technical measures such as firewalls and password protection to protect these data and the systems they are held in.

We limit access to this information to employees, agents, contractors and other third parties with a business need to know. They will only process this personal information in accordance with our instructions and are subject to a duty of confidentiality.

We have procedures in place to deal with any suspected data breach and will notify you and the Information Commissioner’s Office as required.

International transfers

These personal data will be processed in the UK. Your personal data will not be processed outside the UK and European Economic Area (EEA), or by an international organisation. Where your personal data is processed in the EEA or outside UK, the following safeguards will be in place: reliance on Model Contract Clauses.

As these personal data are stored on our IT infrastructure and shared with our data processors Microsoft and Amazon Web Services, they may be transferred and stored securely in the UK and European Economic Area. Where this personal data is stored outside the UK and EEA, it will be subject to equivalent legal protection using Model Contract Clauses.

Your rights

You have the right to request:

• information about how these personal data are processed, and to request a copy of that personal data
• that anything inaccurate in these personal data is corrected
• that any incomplete personal data are completed
• that these personal data are erased if there is no longer a justification for them to be processed

You can also:

• in certain circumstances (for example, where accuracy is contested) request that the processing of these personal data is restricted
• object to the processing of these personal data

You have an absolute right to object to the processing of your personal data where it is processed for direct marketing purposes.

To exercise any of your rights contact the Data Protection Officer at dataprotection@energysecurity.gov.uk.

Complaints

If you consider that your personal data has been misused or mishandled, you may make a complaint to the Information Commissioner, who is an independent regulator. The Information Commissioner can be contacted at:

Information Commissioner’s Office
Email icocasework@ico.org.uk
Contact form

Telephone 0303 123 1113
Textphone 01625 545 860

Any complaint to the Information Commissioner is without prejudice to your right to seek redress through the courts.

Contact details

The data controller for your personal data is the Department for Energy Security and Net Zero (DESNZ).

Contact the DESNZ DPO:

DESNZ Data Protection Officer
Department for Energy Security and Net Zero
3-8 Whitehall Place
London
SW1A 2EG

Email dataprotection@energysecurity.gov.uk

Updates to this notice

If this privacy notice changes in any way, we will place an updated version on this page. Regularly reviewing this page ensures you are always aware of what information we collect, how we use it, and under what circumstances we will share it with other parties. The ‘last updated’ date at the bottom of this page will also change and the revision to the Privacy Notice will be recorded alongside the date of change.

If these changes affect how your personal data is processed, we will take reasonable steps to let you know.