ORDER NUMBER
G-210-18
IN THE MATTER OF
the Utilities Commission Act, RSBC 1996, Chapter 473
and
FortisBC Energy Inc.
Application to Exclude Employee Information from 2015 Data Order G-161-15
BEFORE:
D. J. Enns, Panel Chair/Commissioner
R.I. Mason, Commissioner
on November 6, 2018
ORDER
WHEREAS:
A. On May 23, 2018, FortisBC Energy Inc. (FEI) submitted an application with the British Columbia Utilities Commission (BCUC) seeking the following:
• an order pursuant to section 99 of the Utilities Commission Act (UCA) that Order G-161-15 be varied so as to exclude “Employee Information” as defined in that order; or alternatively,
• an order pursuant to section 88(2), exempting from Order G-161-15 all “Employee Information” or, at minimum, particular employee data (Pension Data) held by FEI’s pension actuaries, Willis Towers Watson (WTW) (Application).
B. On October 13, 2015, the BCUC issued Order G-161-15, permitting FEI to store the Customer Information, Employee Information, and Sensitive Information on servers outside of Canada where (i) the data is encrypted or de-identified and (ii) the encryption keys and de-identification keys are located within FEI’s data centres that are located in Canada;
C. FEI advised in its May 23, 2018 filing that the Chief Privacy Officer, in a recent internal review, identified that WTW has held the employee information regarding employees who participate in pension plans on US-based servers (Pension Data), without encryption or de-identification, for more than 30 years. This includes former and current employee information. FEI wishes to apprise the BCUC of the issue, and to apply to the BCUC for an order that will determine how FEI proceeds;
D. FEI submits that the BCUC’s jurisdiction under the UCA does not extend to employee data, or alternatively the BCUC should not exercise its jurisdiction in respect of Employee Information;
E. On July 12, 2018, the BCUC issued order G-125-18, establishing a regulatory timetable to include submissions on BCUC jurisdiction by FEI and registered interveners;
F. In their submission on August 10, 2018, MoveUP made a request to suspend the regulatory timetable to afford FEI an opportunity to consult with MoveUP and explore the possibility of finding an adequate resolution to the underlying issue of employee information protection;
G. On August 20, 2018, registered parties were invited to provide comments on the request by MoveUP for a suspension of the regulatory timetable;
H. On September 24, 2018, after considering submissions by registered parties on MoveUP’s request, the BCUC issued Order G-174-18, denying MoveUP’s request to suspend the proceeding and establishing a regulatory timetable to include Final Arguments on BCUC jurisdiction by FEI and registered interveners. On September 26, 2018, the BCUC issued Order G-183-18 which replaced and rescinded Order G-174-18 to provide clarification on the next steps in the regulatory timetable;
I. On September 26, 2018, FEI applied, pursuant to section 88(2) of the UCA, for temporary relief requesting that, pending the BCUC’s final order in this proceeding, FEI is temporarily exempted from Order G-161-15 as it relates to “Employee Information” sent to FEI’s pension actuaries, WTW, for the purpose of performing analysis for the preparation of FEI’s 2018 year-end audited external financial statements;
J. On October 9, 2018, the BCUC requested comments from registered parties on FEI’s request for temporary relief. MoveUP submitted that it would not be averse to the requested temporary interim relief on the basis that practical exigencies appear to justify this measure; and
K. The BCUC has reviewed the submissions on temporary relief, considered the request and notes that no party has raised opposition to FEI’s request. The request for temporary relief for financial reporting is warranted.
NOW THEREFORE pursuant to section 88(2) of the UCA the BCUC orders as follows:
1. FEI is temporarily exempted from Order G-161-15 as it relates to “Employee Information” sent to FEI’s pension actuaries, Willis Towers Watson (WTW) provided that:
a. FEI transmits Employee Information to WTW in de-identified or encrypted format; and
b. Between the date of this Order and providing an Encryption Key to WTW to access Employee Information, FEI re-confirms with WTW that any new Employee Information delivered to WTW that is subsequently de-encrypted by WTW will be held in databases that are encrypted using AES 256 bit encryption, or another means of providing equivalent protection from inadvertent disclosure.
2. The temporary exemption referred to in Directive 1 of this Order remains in effect until December 31, 2018.
DATED at the City of Vancouver, in the Province of British Columbia, this 6th day of November 2018.
BY ORDER
Original signed by:
D. J. Enns
Commissioner