Privacy and security concerns surrounding smart meter technology arise from the meters' essential functions, which include (1) recording near-real time data on consumer electricity usage; (2) transmitting this data to the smart grid using a variety of communications technologies; and (3) receiving communications from the smart grid, such as real-time energy prices or remote commands that can alter a consumer's electricity usage to facilitate demand response. The data must also be transmitted to electric utilities—and possibly to third parties outside of the smart grid—subjecting it to potential interception or theft as it travels over communications networks and is stored in a variety of physical locations. These characteristics of smart meter data present privacy and security concerns that are likely to become more prevalent as government-backed initiatives expand deployment of the meters to millions of homes across the country. In the American Recovery and Reinvestment Act of 2009 (ARRA), Congress appropriated funds for the implementation of the Smart Grid Investment Grant (SGIG) program administered by the Department of Energy. Installation of smart meters and the communications technologies that accompany them may have unforeseen legal consequences for those who generate, seek, or use the data recorded by the meters. This report examines federal privacy and cybersecurity laws that may apply to consumer data collected by residential smart meters. General federal privacy safeguards provided under the Federal Privacy Act of 1974 (FPA) protect smart meter data maintained by federal agencies, including data held by federally owned electric utilities. Section 5 of the Federal Trade Commission Act (FTC Act) allows the Federal Trade Commission (FTC) to bring enforcement proceedings against electric utilities that violate their privacy policies or fail to protect meter data from unauthorized access, provided that the FTC has statutory jurisdiction over the utilities. However, depending upon the manner in which smart meter services are presented to consumers, smart meter data may be protected from unauthorized disclosure or unauthorized access under the Stored Communications Act (SCA), the Computer Fraud and Abuse Act (CFAA), and the Electronic Communications Privacy Act (ECPA). If smart meter data is protected by these statutes, law enforcement would still appear to have the ability to access it for investigative purposes under procedures provided in the SCA, ECPA, and the Foreign Intelligence Surveillance Act (FISA). Then it will discuss whether there are sufficient differences between the use of smart meters and traditional third-party cases to counsel against its application. Third-Party Doctrine

Traditionally, there has been no Fourth Amendment protection for information a consumer gives to business as part of their business dealings. Traditionally, utility records have been handled similarly to bank records and telephone records. To withdraw protection of this minimum expectation would be to permit police technology to erode the privacy guaranteed by the Fourth Amendment. This depth of intrusion suggests that customers may have a reasonable expectation of privacy in smart meter data. Additionally, the dragnet theory may apply to collection of energy usage data. A court could, among other options: (1) find that the meaning of "persons" in Section 5 is ambiguous, and thus defer to the FTC's broad interpretation of its own jurisdiction because of the Chevron doctrine; (2) find that the statute is ambiguous, but that principles of federalism outweigh the court's usual Chevron deference to the Commission's interpretation of its own jurisdiction—a determination that may require a court to find that the state is acting in its sovereign capacity when the state (or one of its subdivisions) operates an electric utility; or (3) find that Congress clearly intended "persons" to include government entities because Section 5 should be read together with the other antitrust laws, under which the term "person" includes state and local government entities—a determination that may require a court to find that the state is performing a proprietary function when the state (or one of its subdivisions) operates a utility.
Fueled by stimulus funding in the American Recovery and Reinvestment Act of 2009 (ARRA), electric utilities have accelerated their deployment of smart meters to millions of homes across the United States with help from the Department of Energy's Smart Grid Investment Grant program. As the meters multiply, so do issues concerning the privacy and security of the data collected by the new technology. This Advanced Metering Infrastructure (AMI) promises to increase energy efficiency, bolster electric power grid reliability, and facilitate demand response, among other benefits. However, to fulfill these ends, smart meters must record near-real time data on consumer electricity usage and transmit the data to utilities over great distances via communications networks that serve the smart grid. Detailed electricity usage data offers a window into the lives of people inside of a home by revealing what individual appliances they are using, and the transmission of the data potentially subjects this information to interception or theft by unauthorized third parties or hackers.
Unforeseen consequences under federal law may result from the installation of smart meters and the communications technologies that accompany them. This report examines federal privacy and cybersecurity laws that may apply to consumer data collected by residential smart meters. It begins with an examination of the constitutional provisions in the Fourth Amendment that may apply to the data. As we progress into the 21st century, access to personal data, including information generated from smart meters, is a new frontier for police investigations. The Fourth Amendment generally requires police to have probable cause to search an area in which a person has a reasonable expectation of privacy. However, courts have used the third-party doctrine to deny protection to information a customer gives to a business as part of their commercial relationship. This rule is used by police to access bank records, telephone records, and traditional utility records. Nevertheless, there are several core differences between smart meters and the general third-party cases that may cause concerns about its application. These include concerns expressed by the courts and Congress about the ability of technology to potentially erode individuals' privacy.
If smart meter data and transmissions fall outside of the protection of the Fourth Amendment, they may still be protected from unauthorized disclosure or access under the Stored Communications Act (SCA), the Computer Fraud and Abuse Act (CFAA), and the Electronic Communications Privacy Act (ECPA). These statutes, however, would appear to permit law enforcement to access smart meter data for investigative purposes under procedures provided in the SCA, ECPA, and the Foreign Intelligence Surveillance Act (FISA), subject to certain conditions. Additionally, an electric utility's privacy and security practices with regard to consumer data may be subject to Section 5 of the Federal Trade Commission Act (FTC Act). The Federal Trade Commission (FTC) has recently focused its consumer protection enforcement on entities that violate their privacy policies or fail to protect data from unauthorized access. This authority could apply to electric utilities in possession of smart meter data, provided that the FTC has statutory jurisdiction over them. General federal privacy safeguards provided under the Federal Privacy Act of 1974 (FPA) protect smart meter data maintained by federal agencies, including data held by federally owned electric utilities.
A companion report from CRS focusing on policy issues associated with smart grid cybersecurity, CRS Report R41886, The Smart Grid and Cybersecurity—Regulatory Policy and Issues, by [author name scrubbed], is also available.