(1) An electric utility may not sell private or proprietary customer information.

(2) An electric utility may not disclose private or proprietary customer information with or to its affiliates, subsidiaries, or any other third party for the purposes of marketing services or product offerings to a retail electric customer who does not already subscribe to that service or product, unless the utility has first obtained the customer's written or electronic permission to do so.

(3) The utility must:

(a) Obtain a retail electric customer's prior permission for each instance of disclosure of his or her private or proprietary customer information to an affiliate, subsidiary, or other third party for purposes of marketing services or products that the customer does not already subscribe to; and

(b) Maintain a record for each instance of permission for disclosing a retail electric customer's private or proprietary customer information.

(4) An electric utility must retain the following information for each instance of a retail electric customer's consent for disclosure of his or her private or proprietary customer information if provided electronically:

(a) The confirmation of consent for the disclosure of private customer information;

(b) A list of the date of the consent and the affiliates, subsidiaries, or third parties to which the customer has authorized disclosure of his or her private or proprietary customer information; and

(c) A confirmation that the name, service address, and account number exactly matches the utility record for such account.

(5)(a) This section does not require customer permission for or prevent disclosure of private or proprietary customer information by an electric utility to a third party with which the utility has a contract where such contract is directly related to conduct of the utility's business, provided that the contract prohibits the third party from further disclosing or selling any private or proprietary customer information obtained from the utility to a party that is not the utility and not a party to the contract with the utility.

(b) The legislature finds that the disclosure or sale of private or proprietary customer information by a third party, when prohibited by a contract under this subsection (5), is a matter vitally affecting the public interest for the purpose of applying the consumer protection act, chapter 19.86 RCW, to the third party. Disclosure or sale of private or proprietary customer information by a third party, when prohibited by a contract under this subsection (5), is not reasonable in relation to the development and preservation of business and is an unfair or deceptive act in trade or commerce and an unfair method of competition for the purpose of applying the consumer protection act, chapter 19.86 RCW.

(6) This section does not prevent disclosure of the essential terms and conditions of special contracts.

(7) This section does not prevent the electric utility from inserting any marketing information into the retail electric customer's billing package.

(8) An electric utility may collect and release retail electric customer information in aggregate form if the aggregated information does not allow any specific customer to be identified.

(9) The statewide minimum privacy policy established in subsections (1) through (8) of this section must, in the case of an investor-owned utility, be enforced by the commission by rule or order.

(10) The statewide minimum privacy policy established in subsections (1) through (8) of this section must, in the case of a consumer-owned utility, be implemented by the utility through a policy adopted by the governing board within one year of October 9, 2015, that includes provisions ensuring compliance with subsections (1) through (8) of this section. The policy must include procedures, consistent with applicable law, for investigation and resolution of complaints by a retail electric customer whose private or proprietary information may have been sold by the consumer-owned utility or disclosed by the utility for the purposes of marketing services or product offerings in violation of this section.