Energy retailer Utilita manages data on behalf of 800,000 customers. Sean Lambert, group privacy and information governance manager, says it’s vital to remember that each piece of data relates to a person.

Sean Lambert, an information governance leader at Utilita, explains there is a list of regulations utilities need to comply with when it comes to data. These include not just GDPR but also the Data Protection Act 2018, not to mention privacy and electronic communication regulations, which impact direct marketing activities. “Policy-wise, the landscape is quite clear. It’s based on principles such as making sure data is accurate and lawful, and that you are processing it in an efficient and secure manner.” Fairness and transparency are also key, he says.

Lambert stresses that it is important data specialists always recognise that beneath each record there is a person. “You aren’t just processing data; you are processing someone’s life. You need to take that into account with any data that comes into the system or leaves it. You need to make sure you have all the right security controls in place.”

He adds that you wouldn’t necessarily think of an address or postcode as highly personal or sensitive. But if that information ends up in the wrong hands (Lambert cites an example given recently by the ICO where address data about an individual ended up in the possession of an abusive ex-partner) it can cause real problems. “Data managers should always treat data with care and sensitivity.”

Risks come in financial, reputational, organisational and legal forms, he says. “When you return to the fact that you are always dealing with a person, there is a person risk too. A data breach might cause financial or reputational issues, but is that as important as what is happening to the consumer?”

While reputational issues impact on trust, get data management and privacy right, and it not only increases efficiency but also enhances customer loyalty. “You should know what data you are processing, where it is stored, and where it is going. There won’t be any ambiguity about processes: it will be very clear what you do and how you do it. If you are a trusted business and you can prove that you are processing data in a manner that is fair, lawful and transparent, it helps sell your product.”

Should companies be sharing data? Lambert points out that any company that is using services in the cloud is already sharing data with an external organisation. “Data sharing is crucial for innovation and for making sure things work properly. But it must be shared in the right way. You need controls, contracts and clear data-sharing agreements. You also need to make sure you are sharing data with the right partners.

“If you’re trying to keep that level of trust and good practice in processing data, you want companies you are sharing data with to also have that ethic. Otherwise, it has the potential to damage your reputation.” That means performing due diligence before engaging in any data-sharing exercise.

Lambert agrees there is merit in exploring PSR-related data sharing between utilities. “But PSR data is by definition very sensitive. So, we need to ask if sharing is secure. Is the data going to the right places, and to the right people? We also need to ask if there will be an end benefit for the consumer.

“I think there is. If you are vulnerable, you may need additional support. In fact, it can be crucial to keep you on supply or water flowing into the property.” Utilita and the rest of the utilities industry are currently working behind the scenes to enable sharing PSR data more widely, he explains.

“Supporting vulnerable customers is always at the top of our list.”