Energy & environment — GDPR: protecting consumption data

What does GDPR cover?

GDPR applies to consumption data that can be linked to an individual or household. Fine-grained readings make it possible to infer presence, lifestyle patterns and appliances, hence their particular sensitivity.

The data minimisation principle calls for collecting the least intrusive measurement interval possible for the purpose.

Is the "Energy & environment" sector concerned?

Suppliers, network operators, and processors handling consumption data are data controllers. Third-party services (via the Data Act) are controllers for their own processing activities.

The purpose (billing, erasure, performance service) determines the legal basis and the justified measurement granularity.

Detailed obligations

Sanctions & risks

Fines of up to €20M or 4% of global turnover. The granularity of consumption data attracts regulatory scrutiny.

Common mistakes in the sector

• 1No excessive measure. Collecting detailed statements without justification.
• 2Insufficient information. Failing to communicate clearly on data usage.
• 3Unregulated profiling. Profiling consumption without a governance framework.
• 4Excessive retention. Retain data beyond what is necessary.

Practical case

A supplier was collecting minute-by-minute readings for all its customers by default. Following analysis, it aligns the measurement interval with the actual purpose (billing, erasure), informs customers, and offers explicit consent for more granular uses.

Compliance roadmap

1. 1

   Map. Map consumption processing activities.

2. 2

   Qualify. Verify legal basis and no profiling measure.

3. 3

   Minimise. Reduce intrusion to what is necessary.

4. 4

   Secure. Strengthen security and retention periods.

5. 5

   Inform. Clarify information provided to users.

Frequently asked questions