A California judge has ruled that a decade-long surveillance program conducted by the Sacramento Municipal Utility District (SMUD) and local law enforcement to monitor smart meter data of 650,000 residents for cannabis grows violates state privacy laws.
The program, which involved sharing granular electricity usage data without suspicion of criminal activity, was deemed a privacy violation under California’s data privacy statutes. The court found that the program did not constitute a traditional law enforcement investigation, as it involved systematically sifting through data of all residents in specific areas without any indication of particular wrongdoing.
The Sacramento County Superior Court determined that SMUD and police had developed a relationship beyond that of a utility provider and law enforcement, with the police requesting regular data searches of the 650,000 customer base to identify potential cannabis cultivation sites. The ruling emphasizes the need for evidence to support any suspicion of crime when accessing consumer data, setting a precedent for public utilities in California.
The case was brought by the Electronic Frontier Foundation (EFF) and its co-counsel, representing three petitioners: the Asian American Liberation Network, Khurshid Khoja, and Alfonso Nguyen. They argued that the program created a host of privacy harms, including criminalizing innocent people, creating menacing encounters with law enforcement, and disproportionately affecting the Asian community.
According to court findings, SMUD and police made over 33,000 tips about households with high electricity usage to the police, and the program involved analyzing granular 1-hour electrical usage data to identify residents with specific consumption patterns. The court ruled that this type of systematic data collection without specific investigatory aims was a breach of obligations of confidentiality under the state’s data privacy statute.
The ruling signals a significant shift in how public utilities and law enforcement can interact with data privacy laws in California. Moving forward, public utilities are advised that they cannot disclose customers’ electricity data to law enforcement without any evidence to support a suspicion of crime. This decision is expected to influence similar data-sharing practices across the state and beyond.