The electricity supplier Direct Energie is put in residence by the president of the Cnil, Isabelle Falque-Pierrotin, for lack of collection of consent concerning the data coming from its communicating meter “Linky”.
A few weeks before the entry into force of the general regulation on the protection of personal data (RGPD), May 25, 2018, the CNIL takes the lead: the National Commission for Informatics and Freedoms puts in residence, by the voice from its president Isabelle Falque-Pierrotin, the electricity supplier Direct Energie for a lack of consent collection concerning consumption data from its Linky communicating meter. The brand has three months to comply with the law “Informatique et Libertés”. Several thousand customers would be concerned, hence a “public” decision of the Council to “educate people about their rights and ability to control their energy consumption data.” This data is indicative of personal information about consumers, such as the hours of waking and sleeping, the periods of absence from their home, or the number of occupants of the dwelling.
What’s the problem? On the occasion of the installation of the communicating counter Linky, explains the CNIL in a statement, Direct Energie asked the distribution network manager, the company Mendis, to transmit the data of its customers corresponding to their daily consumption of electricity as well as consumption data at half an hour, in order to establish monthly billing for the service provided. However, these data can only be collected after having obtained the consent of the persons concerned.
From October 2016 to February 2018, several checks were conducted by CNIL to ensure compliance of the collection with Article 7 of the 1978 law. However, for the supervisory authority, the consent is not, in the case of Direct Energie and Linky, neither “free” nor “enlightened” nor “specific”
When the meter is installed, Direct Energie asks its customers to agree simultaneously on the commissioning of the Linky meter and on the collection of hourly consumption data. This collection is presented as the corollary of the activation of the meter and as allowing the customer to benefit from a billing as fair. However, slice the Cnil, “the installation of a Linky meter is mandatory, and its commissioning does not depend on the company Direct Energie: the customer has the impression, erroneous, he chooses to activate the meter when it only consents to the collection of its consumption data.
The law requires brands, when collecting consent, to collect consent in an individualized manner, as indicated by CNIL, which continues: “Moreover, contrary to the presentation made, this collection is in no way the This is a necessary consequence of the activation of the meter. In addition, the purpose of “billing at the fair”, displayed during the collection of consent, is not accurate since Direct Energie does not offer offers based on hourly consumption. , the precise rate of the return of consumption data, per half-hour, is not indicated to the customer. ”
The controls conducted by the CNIL also led to the finding of a breach concerning the consent to the collection of daily consumption data. Indeed, if the company informs its customers of the collection of these data from the distribution network operator (Mendis) it does not ask them their prior consent.
The Commission recalls that this formal notice is not a sanction and that no follow-up will be given to this procedure if the company complies with the law within the time limit. In this case, the closure of the procedure will also be the subject of a communication.