Contributed by Matt Chambers and Michael Juchno, Ernst & Young LLP
Data security continues to be a top-of-mind issue for consumers and utilities alike and must be part of a utility’s data governance plan. The recent EY Power and Utilities Data Governance Survey revealed that data security and privacy were among the most developed areas of utility data strategy, with 69% of respondents stating that their organizations were established, advanced or leading.
Yet, as the sector continues to branch out and diversify, consumers and regulators have raised concerns about how consumer data is being protected and utilized. Concerns range from the sale of personal information to outside groups to the threat of a cyber attack.
While consumers support leveraging technology to advance the energy transition, they are also protective of their data. They want to understand both how it’s being used to feed new technologies like generative AI (GenAI) and what is being done to keep this information out of harm’s way.
Utilities have made deep investments to keep sensitive data away from those looking to infiltrate the grid, driven largely by regulations from the North American Electric Reliability Corp. But it’s not just hackers that consumers are concerned about. The California Consumer Privacy Act of 2018 was designed to give consumers more control over the personal information that businesses collect about them.
Other states have either passed similar consumer privacy legislation or are considering it. It’s another variable in the effort to secure data, whether it’s consumers worried about their privacy being violated by utilities or utilities trying to keep privileged assets away from bad actors.
What to do about data
One of the challenges in the data protection effort across the utilities sector is the massive amount of data that is out there. The World Economic Forum calculated the total amount of data in the world to be 33 zettabytes (ZBs) – the equivalent of 33 trillion gigabytes. This figure grew to 59 ZBs in 2020 and is projected to reach 175 ZBs by 2025. As utilities deploy advanced smart meter platforms, synchrophasor systems and new outage management tools, the volume of data generated in the utilities sector will also grow even larger. Questions are being asked about how utilities use data, how they protect it and even whether they own the data that they are collecting.
To this point, there are utilities that can track energy usage patterns of consumers in 15-minute increments. While a utility might argue that this allows for the study of patterns to identify trends and develop strategies to provide better and more comprehensive service, there are consumers who would say that utilities don’t need, and shouldn’t have, that type of insight.
To a large extent, utilities have stopped collecting data where it’s not clear who has custody or ownership, or who should be granted access to the data. If a use case can’t be easily identified, it’s perceived as a liability, and utilities have chosen to avoid the issue altogether. This may be a shortsighted approach.
A free flow of information across the sector will be necessary for utilities to meet consumer expectations and to effectively embrace the future of the sector – such as when renewable energy (wind, hydro, solar) is purchased from customers or there is increased adoption of electric vehicles. With access to accurate data systems, utilities can develop self-service analytics capabilities to explore new ways to address operational and energy supply challenges.
Some early adopters of technology have begun to stand up innovation centers to determine where the best use cases for GenAI are. One key challenge that many utilities will face if they want to push GenAI privately is creating stronger data governance programs that provide confidence that the data sets being used are verifiable and protected from being exfiltrated and placed in the public domain.
For now, utilities are focused on securing data that has been identified as being more valuable to adversaries looking to launch a cyber attack. IP addresses, data about assets within a system or protocols for communication between assets are priorities. Next is personally identifiable information and Health Insurance Portability and Accountability Act data, such as medical records, and then data that is used by the payment card industry. Most utilities don’t keep credit card information due to compliance difficulties, so that is believed to be less of a priority.
Act with urgency, transparency
Here are four steps that utilities should consider to build consumer trust around data protection:
- Increase data visibility: Utilities need to classify existing data, determine what new data is being produced and identify owners of each data group. The volume of data is only going to increase. Utilities need to know more about their data, what it means and where they can access it when they need it.
- Take a broader view of data governance: Utilities need to better define use cases and make sure that everyone in the operating model, including third and fourth parties, are protecting data with the same diligence as the utility, and then disposing of it in a secure manner in accordance with contractual obligations. The more utilities know about all of the different aspects of how data supports their work and who has access, the better positioned they’ll be to make sure that it’s protected.
- Continue investing in emerging technology: Sector leaders need to continue identifying tools that can strengthen performance for consumers and boost grid resiliency. This is needed both on the operational command and control side of utilities, and through managing customer relationships and business data.
- Develop an opt-in strategy: There needs to be a high degree of transparency with end users as to the benefits they get from allowing their data to be collected and used. The best approach is likely an opt-in strategy for sharing data. So, by default, data would not be used beyond traditional processes, placing responsibility on the utility to demonstrate to consumers that there is value to opting in and sharing their data.
Utilities don’t have data problems; they have business problems that data and analytics can address. Their ability to demonstrate this value to consumers, and to earn their trust in their approach to data management, is crucial to the success of the energy transition.
This article is the second in a three-part series written by professionals in the EY Americas Power and Utilities sector. The first article focused on establishing a data governance plan, and the third article in the series will focus on operationalizing data in the face of disruptive technology.
About the authors
Michael Juchno is a principal at Ernst & Young LLP and leads EY Americas teams in deploying AI and data projects in the Power and Utilities sector. Mike has more than 25 years of experience advising utility companies in the full data lifecycle, from data strategy, quality and governance, and execution of use cases, to increasing the consumption of data analytics across the utility value chain. He has presented to Edison Electric Institute, Utility Analytics Institute and DISTRIBUTECH International conferences.
Matt A. Chambers is a principal at Ernst & Young LLP and serves as the EY Americas Power and Utilities Cybersecurity Leader. In this role, Matt works with EY utility clients to improve the effectiveness and efficiency of the operating model used to identify, assess and respond to the most significant risks impacting success.
The views reflected in this article are the views of the author(s) and do not necessarily reflect the views of Ernst & Young LLP or other members of the global EY organization.
