Correspondence

Alternative Fuel Payment: data sharing - ministerial direction

Published 23 December 2022

Applies to England, Scotland and Wales

Direction made by the Secretary of State for Business, Energy and Industrial Strategy under sections 7(3)(a) and 107 of the Electricity Act 1989 and pursuant to condition 59 of the standard conditions of electricity supply licence

This direction is made by the Secretary of State under sections 7(3)(a) and 107 of the Electricity Act 1989 and pursuant to condition 59 of the standard conditions of electricity supply licence.

Context and purpose

1. 1.—(1) The Secretary of State anticipates issuing subsequent directions which establish schemes to provide financial support in relation to domestic and non-domestic premises which are heated by alternative fuels other than mains gas.
   1. (2) The Secretary of State expects that under the schemes the government will provide funding to electricity suppliers for them to make payments to each of their customers who are identified by the Secretary of State as being entitled to benefit.
   2. (3) To assist suppliers in undertaking necessary preparations for the schemes the Secretary of State anticipates providing suppliers with data which is likely to constitute or include personal data (as defined under the Data Protection Act 2018). To give suppliers sufficient time to prepare, it is expected that it will be necessary to provide the data before the directions establishing the schemes have been made.
   3. (4) It is anticipated that the Secretary of State and suppliers will process the data as independent controllers. Notwithstanding this, the Secretary of State is making this direction to suppliers to ensure appropriate protections are provided for their processing of the data.

Title, commencement and cessation

1. 2.—(1) This direction may be referred to as the Alternative Fuel Payment Data Sharing Direction.
   1. (2) This direction has effect from 12:01am on 4 January 2023.
   2. (3) This direction ceases to have effect at 11:59pm on 3 July 2023.

Interpretation

1. 3.—(1) In this direction—
   1. ‘anticipated scheme’ means a scheme to provide financial support in relation to domestic or non-domestic premises which are heated by alternative fuels other than mains gas, and which the Secretary of State anticipates establishing by making a direction;
   2. ‘anticipated scheme beneficiary data’ means information—
      1. (a) that the Secretary of State expects the customer account associated with a specified MPAN to be entitled to receive a payment under an anticipated scheme, and
      2. (b) which is provided in writing by the Secretary of State to a supplier;
   3. ‘MPAN’ means a meter point administration number;
   4. ‘personal data breach’ has the meaning given in article 4 of the UK GDPR;
   5. ‘processing’ has the meaning given in section 3(4) of the Data Protection Act 2018, and ‘process’ shall be construed accordingly;
   6. ‘supplier’ means any person authorised to supply electricity under an electricity supply licence granted or treated as granted under section 6(1)(d) of the Electricity Act 1989;
   7. ‘UK GDPR’ means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation) (United Kingdom General Data Protection Regulation), as it forms part of the law of England and Wales, Scotland and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act 2018 (and see section 205(4) of the Data Protection Act 2018).
   8. (2) In this direction the singular includes the plural, and the plural includes the singular.

Processing and notification of inaccurate or irrelevant data

1. 4. (1) A supplier must not process anticipated scheme beneficiary data for any purpose other than to prepare for an anticipated scheme.
   1. (2) Paragraph 4(1) does not prevent a supplier from processing an MPAN that it otherwise holds or receives in connection with the performance of its obligations under its electricity supply licence.
   2. (3) A supplier must reasonably promptly notify the Secretary of State if it becomes aware that any anticipated scheme beneficiary data is inaccurate or irrelevant to the supplier’s preparations for any anticipated scheme.

Disclosure to other persons

1. 5.—(1) A supplier must not disclose anticipated scheme beneficiary data to any other person except in so far as is necessary for the supplier to prepare effectively for an anticipated scheme.
   1. (2) A supplier may only make a disclosure in accordance with paragraph 5(1) if the recipient is under—
      1. (a) an obligation not to disclose the data to any other person; and
      2. (b) obligations equivalent to those placed upon a supplier by paragraphs 4(1), 6(1) and 7(1).
   2. (3) Paragraphs 5(1) and 5(2) do not prevent a disclosure which the supplier or any other person is required to make—
      1. (a) by applicable law;
      2. (b) by order of a court;
      3. (c) by the rules and regulations of a regulatory body; or
      4. (d) by an enquiry or investigation by a governmental, parliamentary or official body which has the power to compel disclosure.

Appropriate technical and organisational measures and notification of a personal data breach

1. 6.—(1) In relation to anticipated scheme beneficiary data, a supplier must maintain appropriate technical and organisational measures sufficient to comply with the security, integrity and confidentiality obligations imposed on a controller by the UK GDPR and the Data Protection Act 2018.
   1. (2) A supplier must promptly inform the Secretary of State upon becoming aware of any personal data breach involving anticipated scheme beneficiary data and must promptly respond to any requests for further information by the Secretary of State relating to the breach.

Deletion of data when preparations are complete

1. 7.—(1) Once a supplier has completed all relevant preparations for an anticipated scheme, and by 31 March 2023 in any event, the supplier must cease processing anticipated scheme beneficiary data and securely and permanently delete it from its systems.
   1. (2) Paragraph 7(1) does not require a supplier to delete an MPAN that it otherwise holds or receives in connection with the performance of its obligations under its electricity supply licence.

Secretary of State for Business, Energy and Industrial Strategy,
December 2022