# COMAR Title 20 — Public Service Commission

## Subtitle 63 — Community Choice Aggregation

### Chapter 16 — Data Privacy

**Authority:** Public Utilities Article, §§1–101(b), (f), and (k), 7–306(f)(5) and (h), 7–306.2(d)(3), 7–507(a), 7–510(f) and 7–510.3, Annotated Code of Maryland

**Administrative History:** Effective date: February 5, 2024 (51:2 Md. R. 76)

#### Regulation .01 Scope.

*COMAR 20.63.16.01*

This chapter applies to electricity supply services that a CCA or its designated agents provide to residential and small commercial electric customers.

#### Regulation .02 Good Cybersecurity Practice.

*COMAR 20.63.16.02*

All CCAs shall follow good cybersecurity practice.

#### Regulation .03 Cybersecurity Plans.

*COMAR 20.63.16.03*

As part of its Aggregation Plan, as described in COMAR 20.63.11.02, the CCA shall submit to the Commission a proposed cybersecurity plan, including:

A. Cybersecurity-related governance, risk management, procurement practices, personnel hiring, training policies, situational awareness, response, recovery, and transparent reporting of cybersecurity incidents to State and federal entities;

B. How the CCA will inform the Commission of a cybersecurity breach; and

C. An explanation of the application of the county’s cybersecurity plan, policies, procedures, and support to the CCA, if applicable.

#### Regulation .04 Disclosure of Customer Information.

*COMAR 20.63.16.04*

A. A CCA or its Aggregation Supplier may not disclose customer information provided to the CCA or its Aggregation Suppliers by the electric company or collected from the customer as part of the CCA, including a customer’s billing, payment, enrollment, and credit information, to an entity other than the electric company without the customer’s written or electronic consent, except that a CCA may disclose a customer’s billing, payment, enrollment, and credit information but only if necessary to facilitate billing, bill collection, enrollment, or credit reporting.

B. A CCA shall provide, upon request of the customer, a copy of the CCA’s customer information privacy policy via the CCA website or by mail.

C. The Aggregation Supplier shall protect all customer information when it ceases to be the CCA’s Aggregation Supplier or the CCA is terminated, and the Aggregation Supplier may not use for marketing purposes any information obtained as the Aggregation Supplier once it ceases to be the Aggregation Supplier.