Cybersecurity Policy Report, PUC Amends California LifeLine Decision to Address Privacy Concerns, (Sep 10, 2024)

By Carrie DeLeon

The California Public Utilities Commission has amended its proposal to establish a process for Californians without a Social Security number (SSN) to enroll in the California LifeLine program to address concerns about consumer privacy and the use of identity verification software.

The commission is slated to vote on the draft order at its Sept. 12 public meeting.

In response to concerns regarding the integration of TrueID into the application process, the commission said in the revised decision that staff “will work with the Commission’s Information Technology (IT) Services Division to confirm that any new vendor providing identity verification services to California LifeLine complies with the Commission’s privacy policy and the United States General Services Administration’s (GSA) Information Technology Security Procedural Guides.”

In addition, the commission said it was reasonable to adopt the Greenlining Institute and The Utility Reform Network’s recommended privacy protections. “As such, Staff will ensure that the new identification software does not retain California LifeLine consumers’ personal identification information submitted during the application process,” it said.

The commission said it was also reasonable to require that any identity verification vendor not retain California LifeLine consumers’ personal information submitted during the application process. “This data minimization process will effectively and automatically opt out California LifeLine consumers from having their information sold or shared,” the commission said in the revised draft order.

The commission also clarifies in the revised draft decision that it will not use facial recognition practices in its California LifeLine identity verification software.

The commission’s proposal includes a four-phase approach to implement the non-SSN enrollment pathway that “allows for an expedient near-term solution and later refinements.” In phase 1, staff recommends updating the application process by allowing individuals to check a box certifying that they are applying without an SSN. During phase 2, staff will work with the program administrator to integrate LexisNexis TrueID, a new identity verification software, to expand the acceptable forms of identification for individuals applying without an SSN. In phase 3, service providers would implement the identity software onto their platforms. An optional phase 4 includes transitioning the enrollment processes for all applicants to the third-party administrator (TPA), according to the proposal. (Calif. Pub. Util. Comm’n No. 20-02-008).

News: StateLegislation DataPrivacy