The Sacramento Municipal Utility District (SMUD) searches entire zip codes’ worth of people’s private data and discloses it to police without a warrant or any suspicion of wrongdoing, according to a privacy lawsuit filed Wednesday in Sacramento County Superior Court.
SMUD’s bulk disclosure of customer utility data turns its entire customer base into potential leads for police to chase and has particularly targeted Asian homeowners, says the lawsuit filed by the Electronic Frontier Foundation (EFF) and law firm Vallejo, Antolin, Agarwal, and Kanter LLP on behalf of plaintiffs the Asian American Liberation Network, a Sacramento-based nonprofit, and Khurshid Khoja, an Asian American Sacramento resident, SMUD customer, cannabis industry attorney, and cannabis rights advocate.
“SMUD’s policies claim that ‘privacy is fundamental’ and that it ‘strictly enforces privacy safeguards,’ but in reality, its standard practice has been to hand over its extensive trove of customer data whenever police request it,” said EFF Staff Attorney Saira Hussain. “Doing so violates utility customers’ privacy rights under state law and the California Constitution while disproportionately subjecting Asian and Asian American communities to police scrutiny.”
Utility data has historically provided a detailed picture of what occurs within a home. The advent of smart utility meters has only enhanced that image. Smart meters provide usage information in increments of 15 minutes or less; this granular information is beamed wirelessly to the utility several times each day and can be stored in the utility’s databases for years. As that data accumulates over time, it can provide inferences about private daily routines such as what devices are being used, when they are in use, and how this changes over time.
The California Public Utilities Code says public utilities generally “shall not share, disclose, or otherwise make accessible to any third party a customer’s electrical consumption data ….” except “as required under federal or state law.” The California Public Records Act prohibits public utilities from disclosing consumer data, except “[u]pon court order or the request of a law enforcement agency relative to an ongoing investigation.”
Read More: Utility Pumps Customers’ Smart Meter Data To Police Without Warrant