SCEO Data Access Plan energy.gov/scep

IRA SECTION 50121: Home Efficiency Rebates

IRA SECTION 50121: Home Efficiency Rebates SCEO Data Access Plan July 2025

Table of Contents

Tables

Figures Figure 1. Table of Pathways and Associated Document Sections 8

Introduction The Inflation Reduction Act (IRA) of 2022 makes significant investments in energy efficiency with the goal of lowering energy costs, building the energy workforce, and improving the lives of homeowners and renters across the country. Under this Act, the United States Department of Energy (DOE) has been authorized to carry out two Home Energy Rebate programs – the Home Efficiency Rebates (HOMES) program and the Home Electrification and Appliance Rebates (HEAR) program. South Carolina has been granted a total of $137.2 million for these programs, with $68.7 million allocated for the HOMES program.

The South Carolina Energy Office (SCEO), a division of the South Carolina Office of Regulatory Staff, was directed by the IRA to carry out these programs. The SCEO’s serves as the principal energy planning entity for the state, and encourages energy efficiency, renewable energy, and clean transportation through a variety of initiatives. HOMES and HEAR align with this mission to promote energy efficiency and provide assistance to South Carolina residents to support energy-saving improvements.

The SCEO has established the following goals for the state’s HOMES and HEAR Programs:

(1) Provide Holistic Improvements to Residents’ Lives: Design and establish education efforts, technology systems, contractor practices, program integrations, and rebate levels to meet varied needs;

(2) Provide Statewide Program Accessibility: Encourage program participation across all regions of South Carolina through broad outreach, education, and targeted partnerships to support hard-to-reach populations;

(3) Distribute Funds Efficiently and Drive Tangible Impact: Promote program stewardship and drive impact by distributing funds efficiently, including by leveraging household and building-wide categorical eligibility; and

(4) Leverage Existing Infrastructure and Partnerships: Build upon existing energy efficiency and workforce development efforts, including through integration with utility and other programs statewide.

In alignment with the total proportion of low-income households across the state, South Carolina intends to allocate at least 39.9% of its rebate funds to the state’s low-income households (those with less than 80% of area median income (AMI)[footnoteRef:2]). Additionally, it will allocate at least 10% of the rebate funds to low-income multifamily buildings. [2: “Area median income” is the “value calculated by household size of the median income of the area in which the individual or family resides, as reported by the Department of Housing and Urban Development.” United States Department of Energy (published on October 13, 2023), Program Requirements & Application Instructions. Available at: https://www.energy.gov/sites/default/files/2023-10/home-energy-rebate-programs-requirements-and-application-instructions_10-13-2023.pdf.]

SCEO will launch its HOMES and HEAR Programs in early 2026, with a targeted soft launch followed by a full statewide launch.

Utility Data Access Plan Overview Several participating organizations will contribute to the outreach, management, and implementation of the HOMES program. The following is a list of the key entities that will be involved in making the program a success.

Organizations The South Carolina Office of Regulatory Staff (ORS): The South Carolina Office of Regulatory Staff (ORS) represents the public interest of South Carolina in utility regulation for the major utility industries – electric, natural gas, telecommunications, transportation, and water/wastewater. The ORS also represents the public interest in safety oversight of the pipeline and railroad systems. Beyond regulatory responsibilities, the ORS is home to the State Energy Office, the Equipment Distribution Program (SCEDP), the Broadband Office (SCBBO), and the Digital Opportunity Department (SCDOD). The ORS also supports South Carolina’s Emergency Management Division through Emergency Support Function 12 (ESF-12).

The South Carolina Energy Office (SCEO): The South Carolina Energy Office serves as the principal energy planning entity for the state. For purposes of the Home Efficiency Rebates program, SCEO will manage the Selected Implementer, Selected Rebate Processing Platform, and Selected Payment Processing Platform vendors, overseeing the development and maintenance of the application handling portal interactions, rebate processing, and payment processing.

Selected Implementer: The implementer is the entity responsible for implementing South Carolina’s HOMES program.

Selected Rebate Processor: The rebate processor is an entity responsible for managing and processing rebate applications for energy efficiency initiatives. This entity confirms that applicants meet eligibility criteria and that rebates are disbursed accurately and efficiently.

Selected Payment Processor: The payment processor is an entity responsible for managing and processing payments as they are approved by the administrative team and rebate processor. This entity confirms applicants are paid the correct rebate amount according to United States DOE guidelines.

Utility Companies: Utility companies are organizations that provide essential services such as electricity, natural gas, water, and wastewater services to residential, commercial, and industrial customers. In South Carolina, major utility companies include Dominion Energy, Duke Energy Carolinas, Duke Energy Progress, Piedmont Natural Gas, Lockhart Power Company, public utilities like Santee Cooper and municipal utilities, and several electric cooperatives across the state.

Overview South Carolina’s HOMES program is designed to enhance energy efficiency and promote the adoption of energy-efficient upgrades among residents and property owners in South Carolina. A critical component of this program is the secure and efficient management of energy consumption data collected from participants. This Utility Data Access Plan outlines the comprehensive strategies and protocols in place to support the secure collection, transfer, and maintenance of this data.

The primary objectives of the Plan are to protect participant privacy information related to rebate processing, provide data security, and facilitate the effective use of data to achieve the program’s goals. This Plan adheres to the standards set in SCDIS-200 Information Security and Privacy Standards and under federal guidelines provided by the DOE.

The table of pathways and associated document sections of this Plan outline SCEO’s chosen data access plans for implementing the HOMES program. The program’s primary pathway will be Opt-In: Direct Utility Provision (Section A2), with the Opt-in: Resident(s)/Owner Provision (Section A3) pathway as the alternative. The third, and final, pathway will be the Geographically Aggregated Data (Section C), providing SCEO with four different methods to obtain billing data.

Key Components of the Utility Data Access Plan

1. Consent and Documentation: Consent from homeowners, tenants, and building owners is crucial for data collection. This process involves obtaining documented consent through participation agreements from utilities or owners and fully informing participants about data usage.

2. Data Collection: Energy consumption data is collected directly from participants using secure methods or through geographically aggregated data. Program staff and/or contractors gather data from electronic access to utility bills, allowing for comprehensive and accurate data capture.

3. Data Transfer and Storage: Collected data is securely transferred and uploaded into a secure system used by program and state staff created by the program’s selected rebate processor. The secure system encrypts the data and protects against unauthorized access. The program will not collect data from applicants that is not essential for rebate verification and processing.

4. Data Access and Usage: Access to energy consumption data is restricted to eligible parties for specific program-related purposes. Strict access controls and audit logs are maintained to monitor data usage and support compliance with privacy standards.

5. Incident Response and Notification: A robust incident response plan will be in place to address any data breaches or security-related events. Contractors will develop tailored response and notification plans to address data breaches. Participants will be promptly notified of any breaches, ensuring transparency and trust.

6. Secondary Uses of Data: Beyond the primary purposes of program implementation and reporting, energy consumption data supports secondary initiatives such as demand response programs, state-based energy efficiency efforts, and research and development activities. These uses are carefully managed to protect participant privacy and data security.

By implementing this Plan, South Carolina’s HOMES program can effectively manage energy consumption data, safeguard participant information, and support South Carolina’s broader energy efficiency and sustainability goals. This Plan provides that all data handling practices are in line with the highest standards of security and privacy, fostering trust and confidence among program participants.

Utility Data Access Plan Background Requirements IRA Section 50121 states “[t]he Secretary shall develop and publish guidelines for States relating to residential electrics and natural gas energy data sharing.”[footnoteRef:3] Released in July 2023, the Utility Data Access Guidelines[footnoteRef:4] include best practices for data access and sharing and recommendations for developing a comprehensive Utility Data Access Plan. [3: 42 U.S.C. 18795(c)(5).] [4: United States Department of Energy (published in July 2023), Data Access Guidelines, IRA Section 50121: Home Efficiency Rebates. Available at: https://www.energy.gov/sites/default/files/2023-07/IRA-50121-Home-Efficiency-Rebates-Data-Access-Guidelines-1.0.pdf.]

As described in Section 3.2.3 of the Home Energy Rebates Programs Requirements & Application Instructions,[footnoteRef:5] states must develop and submit a Utility Data Access Plan that, at a minimum, includes the following: [5: United States Department of Energy (published on June 17, 2024), Program Requirements & Application Instructions. Available at: https://www.energy.gov/sites/default/files/2023-10/home-energy-rebate-programs-requirements-and-application-instructions_10-13-2023.pdf.]

· Take steps to ensure that all data are transferred and maintained safely and securely, using established standards.

· Take steps to ensure that any parties participating in a program that requires energy consumption data have secure data protection and protocols that demonstrate the capability for a safe transfer of consumer data, including data for individual dwelling units and whole-building aggregate data for multifamily buildings.

· Determine which consumer consent processes the state will implement.

· Define energy consumption as primary or secondary purpose.

Data Access Pathways The decision tree below is meant to clarify the different options, or ‘pathways,’ states have in data access and provides additional insights on each pathway, for both single-family and multifamily customers. It helps state energy offices select the most suitable pathway based on each state’s existing infrastructure and capabilities (see Figure 1).

The most suitable pathway for each state depends on the governing regulations and existing energy data collection infrastructure and capabilities, which vary from state to state. Given this diversity, DOE created the following decision tree that states may use to determine the most appropriate data access pathway given their unique circumstances and capabilities. States may implement multiple pathways depending on whether their program addresses the single-family versus multifamily residential market and/or various utility service territories. Figure 1 maps six possible pathways which align with the required data plan templates provided by DOE.

Figure 1. Table of Pathways and Associated Document Sections

A few key concepts used in this document include:

· Pre-participation targeting data refers to energy consumption data used for marketing and targeting homeowners and building owners prior to their awareness or engagement with the program.

· Program implementation data refers to energy consumption data used during or after homeowner/building owner participation, including implementation, reporting, or evaluation purposes.

· Aggregation. The Guidelines discuss aggregation as a pathway to collect data. There are two types of aggregation discussed in this document:

· Whole-Building Data Aggregation: For Multifamily buildings where individual units are metered, aggregate property-level energy consumption data is valuable to enable programs to serve these multifamily buildings without the need for individual tenant-level authorization.

· Geographic Aggregation. This pathway is typically used for pre-participation targeting data for both single-family buildings and multifamily buildings. The data would be aggregated at the geographic level to provide insights about characteristics of energy use of similarly located buildings to support program design and outreach.

Section A. Opt-In Pathways SCEO does not intend to use Green Button as a data access pathway. If SCEO decides to deploy Green Button protocols at a later date, SCEO will resubmit this Utility Data Access Plan.

Section A1a. Opt-In: Green Button SCEO does not intend to use Green Button as a data access pathway. If SCEO decides to deploy Green Button protocols at a later date, SCEO will resubmit this Utility Data Access Plan.

Section A1b. Opt-In: EPA Portfolio Manager (Multifamily Buildings) SCEO does not intend to use EPA Portfolio Manager as a data access pathway. If SCEO decides to deploy EPA Portfolio Manager at a later date, SCEO will resubmit this Utility Data Access Plan.

Section A2. Opt-In: Direct Utility Data Provision After careful consideration and soliciting feedback from the utility community in South Carolina, SCEO will work alongside a program implementer to facilitate a direct utility data provision opt-in pathway.

Pathway Background In this pathway, states work directly with utilities to collect energy consumption data based on a customized approach to transfer data so that data is made available to program implementers, contractors, and/or aggregators.

There are multiple ways that a state may work effectively with utilities located in their state including:

· Coordinate directly with utilities on multiple program aspects, including program implementation, braiding of program resources, and energy consumption sharing.

· Create data sharing agreements with utilities, including memorandum of understanding (MOU) or other such agreement based on the abilities of utilities to transfer participating customer data for the program. States may want to consider creating financial incentives for utilities to balance the effort and time required to share the data and increase the benefits for customers from more detailed data access.[footnoteRef:6] [6: DOE recommends that states reach out to utilities’ contacts in government affairs, energy efficiency, or retail procurement. Most retail procurement teams at utilities have experience providing usage data to third parties.]

· If relevant, work with regulators to require utilities to provide data to the state program and also receive cost recovery for the effort required.

For individually-metered multifamily properties, states could work out a special arrangement with utilities to conduct the whole-building aggregation in order to meet the opt-in provisions. Additionally, utilities may support the states by providing Geographic Aggregation data for pre-participation targeting purposes (see “Section C. Geographically Aggregated Data for Pre-Participation Targeting Purposes” of this Plan).

Table 1: Opt-In: Utility Pathway Summary

To support pre-participation targeting, states should also work with utilities to collect Geographic Aggregation data (see “Section C. Geographically Aggregated Data for Pre-Participation Targeting Purposes” of this Plan).

Pathway Implementation in South Carolina After careful consideration and soliciting feedback from the utility community in South Carolina, SCEO will work alongside a program implementer to facilitate a direct utility data provision opt-in pathway.

Intro and Overview of Data Access in South Carolina

· Confirm your state plans to collect energy consumption data directly from utilities for at least some program options. (If no, then please refer to the general overview and pathway sections to determine correct pathway and template for completion.)

☒ Yes

· Identify the Home Efficiency Rebates Program(s) that your state plans to use this pathway and home type for:

☒ Modeled, Single-family ☒ Modeled, Multifamily ☐ Measured, Single-family ☐ Measured, Multifamily

· Identify the utilities from which your state will collect energy consumption and billing data.

SCEO will work with all utility companies that operate within South Carolina. This includes four investor-owned utilities, one state owned utility, as well as the electric cooperatives and municipal utilities. The major utility companies SCEO will receive data from are below:

1. Dominion Energy

2. Duke Energy Carolinas and Duke Energy Progress

3. Piedmont Natural Gas

4. Santee Cooper

5. Lockhart Power Company

· Describe any existing program activities, platforms or agreements that are in place in your state that enable the collection of data directly from utilities.

SCEO will continue to work directly with the network of utilities in South Carolina to understand existing rebate programs as well as platforms and agreements in place that enable the collection of data directly from utilities.

· Provide an overview of your state program’s processes and entities that will gain consent, collect, transfer, and maintain the energy consumption data as provided by residents and owners.

South Carolina’s HOMES program will involve several key processes and entities to manage the collection, transfer, and maintenance of energy consumption data. These processes will allow data to be handled securely and efficiently, in compliance with state and federal regulations.

a. Consent and Documentation Consent will be requested from homeowners and residents before collecting any energy consumption data from utilities. This consent, in the form of a participation agreement, will be signed through the rebate processing application and documented by program staff. The agreement will outline the purposes for data collection, how the data will be used, the privacy and security measures in place to protect it, and an understanding that data gathered in the program will not be sold.

b. Data Collection Energy consumption data will be requested from utility companies after the homeowner provides consent through the application systems. The data will be collected using a secure data collection system designed to handle large volumes of energy usage and billing information. The rebate processing platform can accept paper bills if electronic bills are unavailable. The program will not collect data from applicants that is not essential for rebate verification and processing. The program will not collect data from applicants that is not essential for rebate verification and processing.

c. Data Transfer Energy consumption data will be transferred from utilities via secure protocols, such as Secure File Transfer Protocol (SFTP) or encrypted web services. The data will be imported into the secure system used by program staff. Then the data will be subsequently loaded into the rebate processing platform, such that all data transfers will be encrypted and comply with federal guidance security standards.

d. Data Maintenance and Storage Energy consumption data will be maintained and stored in the rebate processing platform – a secure system designed for the long-term storage of sensitive information. The system is managed by program staff who are trained in data security and privacy practices. Regular backups and security audits will be conducted to protect the integrity and availability of the data. The program will not collect data from applicants that is not essential for rebate verification and processing.

e. Data Access and Usage Individual energy consumption data will be provided only to eligible parties, such as program administrators and authorized contractors, for specific purposes like conducting program requirements, verifying rebate eligibility, and monitoring energy savings. Access controls and audit logs will be in place to monitor and restrict data access.

f. Data Transfer to DOE The rebate processing platform will transfer data to DOE using secure transfer protocols, such as SFTP or PNNL-provided encrypted Application Programming Interfaces (APIs). The transfer process will include data validation and encryption such that the data remains secure during transmission and meets DOE’s data reporting requirements.

References

· SCDIS-200 Information Security and Privacy Standards

· Public Sector Building Energy Benchmarking: Utility Data Access Options

· Pacific Northwest National Laboratory APIs: Method of sending data to DOE’s national program database (available at PNNL.gov)

Security and Safety of Energy Consumption Data

· Describe how your state will ensure that any data are transferred and maintained safely and securely, using established standards.

· Encryption methods for data transfers

· Protection of data collected and stored.

· Protocols in place for security guidelines and data classification.

· How the entity responsible for administering the program will notify a customer if there are data breaches or other security related events.

South Carolina’s HOMES program is committed to transfer and maintain all data safely and securely, using established standards set by federal guidelines. The following describes the SFTP and encryption methods and protocols used to achieve this.

Refer to South Carolina’s Privacy and Security Risk Assessment for additional details.

Encryption Methods for Data Transfers Encryption in Transit: All data transferred between entities, including between utilities, owners, authorized contractors, and the program’s secure system, will be encrypted using robust encryption standards such as AES-256. This encryption will allow data to remain confidential and secure during transmission, protecting it from interception and unauthorized access.

Secure Transfer Protocols: Data will be transferred using SFTP or Hypertext Transfer Protocol Secure (HTTPS), both of which provide secure channels for data transmission. These protocols are designed to protect the integrity and confidentiality of data by using encryption and secure communication channels.

References:

· NIST SP 800-52: Guidelines for the selection, configuration, and use of Transport Layer Security (TLS) implementations

· NIST SP 800-77: Guidelines for the use of IPsec VPNs for secure data transmission

Protection of Data Collected and Stored Encryption at Rest: All collected data will be encrypted at rest using industry-standard encryption methods such as AES-256. Even if the storage media is compromised, the data will remain inaccessible without the proper decryption keys.

Access Controls: Strict access controls will be implemented to limit data access to authorized personnel only. All contractors follow access control policies in-line with FIPS 199 and NSIT 800-53.

Regular Audits and Monitoring: Continuous monitoring and regular security audits will be conducted to identify and mitigate any potential vulnerabilities. Audit logs will be maintained to track access and modifications to the data, providing an additional layer of security and accountability. System vendors are responsible for maintaining security and audit readiness for their access level in accordance with South Carolina’s Privacy and Security Risk Assessment.

References:

· NIST SP 800-53: Security and Privacy Controls for Federal Information Systems and Organizations

· FIPS 199: Standards for categorizing information and information systems

Protocols for Security Guidelines and Data Classification Data Classification: All data will be classified according to its sensitivity and impact level as per the guidelines of FIPS 199, NIST SP 800-60, and South Carolina’s Privacy and Security Risk Assessment. This classification helps in determining the appropriate security controls and measures that need to be applied.

Security Guidelines: The program will adhere to the security guidelines outlined by SCEO, which include best practices for data protection, incident response, and compliance with regulatory requirements. These guidelines cover all aspects of data security, from data collection to storage and transmission.

References:

· SCDIS-200 Information Security and Privacy Standards

· NIST SP 800-60: Guidelines for mapping information types to security categories

Notification of Data Breaches or Security Events Incident Response Plan: Every entity responsible for administering the program, in collaboration with the security team, will maintain an incident response plan that includes procedures for detecting, reporting, and responding to data breaches or other security-related events. This plan allows a swift and effective response to minimize the impact of any security incidents at all levels. SCEO will be notified of any data breach or security event.

Customer Notification: In the event of a data breach, affected customers will be notified promptly. The notification process will include at a minimum:

· Detailed information about the nature of the breach and the data involved.

· Steps being taken to address and mitigate the breach.

· Recommendations for customers to protect themselves, such as monitoring their accounts for suspicious activity.

References:

· NIST SP 800-61: Computer Security Incident Handling Guide, which provides guidelines for developing and maintaining an effective incident response capability

· SCDIS-200 Information Security and Privacy Standards

Consent, Notification, and Revocation Process

· Confirm that all residents/owners will provide their consent for energy consumption data to be transferred to the state from their utility.

☒ Yes ☐ No. Describe the state’s alternative consent approach.

If the data is not available through the A2 Pathway, the alternative Section A3 (Direct-Consumer Provision) or Section C (Geographically Aggregated Data) will be used as alternative methods.

Data Details and Frequency

· Indicate the timing of energy consumption data to be collected. If multiple options are selected, indicate those use cases:

☒ Monthly ☐ Hourly ☒ Daily ☒ Other (specify) Due to receiving data from multiple utilities, the energy consumption data will be collected at varying times based on the utilities upload capacity and the program’s ability to store the data.

· Indicate the frequency for energy consumption data be collected by the program (i.e., when will data be available for the program).

☒ At the time of program intake for each participant ☒ At a set duration agreed to by the program and utility (please define duration) SCEO will collect the post consumption data 12 months after for customer that used the homeowner data collection. Throughout the whole process the homeowner is aware of how the data will be gathered. Due to the receiving of data from multiple utilities, the energy consumption data frequencies will vary between utilities.

☐ Other (specify) Primary and Secondary Purpose

· Please describe the primary purpose(s) of the energy consumption data.

· Implementation and reporting data for the program.

· Please describe any other primary purposes, if applicable (e.g., building benchmarking, emissions reductions etc.).

The primary purpose of collecting energy consumption data for South Carolina’s HOMES program is to facilitate the implementation and reporting of this program. This includes:

· Eligibility Verification: Verifying the eligibility of participants based on their energy usage patterns. Accurate data is essential for ensuring that only eligible participants receive rebates.

· Rebate Calculation: Calculating rebate amounts accurately based on the actual energy consumption and savings achieved through program participation, considering the modeled approach.

· Program Monitoring: Monitoring the overall performance of the program by tracking energy savings, participation rates, and the effectiveness of various energy efficiency measures.

To comply with the modeled savings pathway for the 50121 program, the collection of energy consumption data must be compliant with BPI 2400 protocol.

Monitoring Based on Program Rules Purpose: Another primary purpose based on program rules involves using energy consumption data such that South Carolina’s HOMES program adheres to all applicable state and federal regulations.

How regulatory compliance helps:

· Ensuring Legal Adherence: By utilizing energy consumption data for regulatory compliance, the program can demonstrate adherence to legal requirements and standards. This includes compliance with data privacy laws, energy efficiency mandates, and reporting requirements.

· Facilitating Audits and Inspections: Accurate and comprehensive data helps facilitate audits and inspections by regulatory agencies. This allows the program to operate transparently and maintain high standards of accountability.

· Maintaining Funding and Support: Compliance with regulatory requirements is often a prerequisite for obtaining and maintaining funding from state and federal sources. Regulatory compliance through accurate data collection and reporting can secure continued financial support for the program.

· Enhancing Public Trust: Demonstrating regulatory compliance builds public trust and confidence in the program. Participants and stakeholders are more likely to engage with and support programs that are transparent and compliant with legal standards.

· Identifying Areas for Improvement: Regulatory compliance data can help identify areas where the program may need to improve its processes and procedures. This continuous improvement helps enhance program effectiveness and efficiency.

· Describe any secondary purposes[footnoteRef:7] of the energy consumption data and the entities that it will be provided to (e.g., data will be provided to third parties to offer additional services like demand response initiatives, or other state-based programs). [7: Secondary purposes may include the use of customer data in outreach and education and additional product offerings that the customer does not already receive or has not authorized. Examples of secondary purposes may include targeted advertising for other energy equipment and sharing data with a third party for a service not included in the state program.]

SCEO will not provide project-level energy consumption data to third parties that have not been directly contracted with SCEO to implement 50121. SCEO may share the data with other state entities, provided they adhere to the Home Energy Rebate Privacy and Security plan.

SCEO plans to develop a public-facing dashboard to show geographic disbursement of rebates. At a minimum, there must be 20 participants per grouping (e.g., by county) to display data. SCEO will not display any project-level data or PII on any public-facing data applications.

The following are requested secondary purposes for energy consumption data.

1. Benchmarking Purpose: Energy consumption data can be used for building benchmarking, which involves comparing the energy performance of similar buildings to identify opportunities for improvement. Benchmarking may be used for future SCEO programs to improve their effectiveness based on benchmarking data gathered during the Home Energy Rebate Programs.

Benchmarking helps in:

· Performance Tracking: Tracking the energy performance of buildings over time to identify trends and areas needing improvement.

· Energy Audits: Conducting detailed energy audits to pinpoint inefficiencies and recommend improvements.

· Incentive Programs: Qualifying buildings for various incentive programs aimed at improving energy efficiency.

· Entities Involved: Utilities, building owners, energy auditors, and policymakers.

2. Consumer Awareness Purpose: Providing detailed energy consumption data to consumers increase awareness regarding energy usage patterns and promotes energy-saving behaviors. SCEO may also use the data to conduct a targeted advertising campaign.

This includes:

· Energy Reports: Offering participants detailed energy reports that highlight their consumption patterns and suggest ways to reduce usage.

· Awareness Campaigns: Developing awareness campaigns that promote energy-saving behaviors and the benefits of energy-efficient appliances and practices.

· Entities Involved: Utilities, non-profit organizations, and educational institutions.

· Identify if the program plans to Geographically Aggregate program data collected from utilities and provide it publicly.

☐ No ☒ Yes. Describe how data will be aggregated and anonymized and how it is intended to be published.

SCEO plans to develop a public-facing dashboard to show geographic disbursement of rebates. At a minimum, there must be 20 participants per grouping (e.g., by county) to display data. SCEO will not display any project-level data or PII on any public-facing data applications.

Eligibility, Oversight, and Enforcement of Third Parties

· Describe the eligibility criteria for third parties to access energy consumption data collected from utilities (e.g., contractual agreement with the state or program implementer that requires data security and privacy).

Access to energy consumption data collected from utilities is governed by strict eligibility criteria to protect the data’s security and privacy. As of the design of this program, SCEO and its contractors do not intend to use the data gathered during implementation for anything outside of intended program use.

The following outlines the key criteria that third parties must meet to access this data:

Contractual Agreement with the State or Program Purpose: Ensuring that third parties have a formal, legally binding agreement with the state, or the program is crucial for accountability and compliance with data protection standards.

Requirements:

· Legal Contracts: Third parties must enter into a contractual agreement with the state or the specific energy efficiency program. This contract outlines the responsibilities, data handling practices, and compliance requirements that the third party must adhere to.

· Data Use Agreement: The agreement specifies the purpose of data access, ensuring that the data will be used solely for the intended and approved purposes, such as demand response initiatives, research, or energy efficiency improvements.

References:

· NIST SP 800-53: Security and Privacy Controls for Federal Information Systems and Organizations

· SCDIS-200 Information Security and Privacy Standards

Data Security and Privacy Requirements Purpose: Requiring third parties to implement robust data security and privacy measures to protect sensitive information from unauthorized access, breaches, and misuse.

Requirements:

· Security Standards Compliance: Third parties must comply with established security standards, such as those set in SCDIS-200 Information Security and Privacy Standards and under federal guidelines (e.g., NIST standards). This includes implementing encryption, access controls, and regular security audits.

· Privacy Policies: Third parties must have comprehensive privacy policies in place that outline how they will protect personal information, support confidentiality, and handle data breaches in accordance with federal guidelines.

· Data Protection Measures: Third parties are required to implement measures such as data encryption (both in transit and at rest), secure data transfer protocols (e.g., SFTP, HTTPS), and multi-factor authentication for accessing data.

References:

· NIST SP 800-53: Provides detailed security and privacy controls

· SCDIS-200 Information Security and Privacy Standards

Specific Use Cases and Approval Purpose: Limiting data access to specific, approved use cases allows for data to be used appropriately and beneficially.

Requirements:

· Use Case Approval: Third parties must clearly define their intended use of the data and obtain approval from the relevant state agency or program. Only use cases that align with the program’s goals, such as energy efficiency, research, or policy development, will be approved.

· Periodic Review: Data access permissions are subject to periodic review to enable continued compliance with the approved use case and any evolving security or privacy requirements.

References:

· FIPS 199: Standards for categorizing and ensuring appropriate security measures based on the sensitivity of the data.

Monitoring and Compliance Purpose: Ongoing monitoring and compliance checks confirm that third parties continue to meet the eligibility criteria and adhere to data security and privacy standards. The information below is covered in South Carolina’s Privacy and Security Risk Assessment as well.

Requirements:

· Regular Audits: Third parties must undergo regular audits conducted by the state or an independent auditor to verify compliance with data security and privacy requirements.

· Compliance Reporting: Third parties are required to provide regular compliance reports detailing their data protection measures, incident response activities, and any security or privacy issues encountered.

Incident Response and Notification Purpose: Requiring third parties to have robust incident response plans and clear procedures for notifying the state and affected individuals in the event of a data breach.

Requirements:

· Incident Response Plan: Third parties must maintain a comprehensive incident response plan that includes procedures for detecting, reporting, and responding to data breaches.

· Notification Protocols: In the event of a data breach, third parties are required to promptly notify the state agency and any affected individuals, providing details about the breach, the data involved, and the steps being taken to mitigate the impact.

References:

· NIST SP 800-61: Computer Security Incident Handling Guide By adhering to these stringent eligibility criteria, the state requires any third-party accessing energy consumption data to do so in a secure and responsible manner, thereby protecting the privacy and integrity of the data while enabling beneficial uses such as demand response initiatives and energy efficiency improvements.

· Confirm that the entities with access to energy consumption data will only use the data as approved for program purposes.

☒ Yes ☐ No. Describe the entities and purposes of their use of the data and how consent was obtained for these purposes.

Section A3. Opt-In: Residents/Owners After careful consideration and soliciting feedback from the utility community in South Carolina, SCEO will work alongside a program implementer to facilitate a direct utility data provision opt-in pathway.

Pathway Background In this pathway, the program collects data from the homeowners, tenants, or building owners directly. The program would likely request copies of metered energy consumption bills, either in paper format or electronically directly from homeowners, tenants, or multifamily building owners. There may be other innovative ways for the program to access the data, such as third-party access of energy consumption data of program participants.

For individually metered multifamily buildings, this data collection may be especially difficult, especially for properties with a large number of units. DOE recommends using the exception path for Home Efficiency Rebates Modeled approach for these properties (see Section 3.2.4 of the Home Energy Rebates Program Requirements & Application Instructions[footnoteRef:8]). [8: United States Department of Energy (published on June 17, 2024), Program Requirements & Application Instructions. Available at: https://www.energy.gov/sites/default/files/2023-10/home-energy-rebate-programs-requirements-and-application-instructions_10-13-2023.pdf.]

Table 2: Opt-In: Owner Provision of Data or Access

For multifamily properties, the Modeled program allows exception in modeling because BPI-2400 applies only to single-family homes.

To support pre-participation targeting, states should attempt to work with utilities to collect Geographic Aggregation data (see “Section C. Geographically Aggregated Data for Pre-Participation Targeting Purposes” of this Plan).

Pathway Implementation in South Carolina Intro and Overview of Data Access in South Carolina

· Confirm your state plans to collect energy consumption data directly from residents/owners. (If no, then please refer to the general overview and pathway sections to determine correct pathway and template for completion) ☒ Yes

· Identify the Home Efficiency Rebates Program(s) that your state plans to use this pathway and home type for:

☒ Modeled, Single-family ☒ Modeled, Multifamily ☐ Measured, Single-family ☐ Measured, Multifamily

· Describe any existing program activities, platforms or agreements that are in place in your state that enable the collection of data directly from owners.

Weatherization Program Weatherization Assistance Program (WAP): This program targets low-income households and involves home energy audits and efficiency upgrades. Data is collected directly from homeowners during the audit process to evaluate energy consumption and identify potential improvements. Community Action Agencies assist in collecting and managing this data. South Carolina Office of Economic Opportunity (OEO) oversees and manages the WAP program in the state.

Utility Assistance Programs South Carolina’s utility companies, including Dominion Energy, Duke Energy Carolinas and Duke Energy Progress, Piedmont Natural Gas, and Santee Cooper offer various assistance programs that involve direct interaction with consumers. These programs often require the collection of energy consumption data from participants to tailor assistance and verify eligibility.

Low-Income Home Energy Assistance Program (LIHEAP): Administered by OEO, LIHEAP collects energy usage data from applicants to determine eligibility and provide financial assistance for energy bills. The data collection is typically done directly from applicants who provide their energy bills.

· Provide an overview of your state program’s processes and entities that will collect, transfer, and maintain the energy consumption data as provided by residents and owners.

South Carolina’s HOMES program will involve several key processes and entities to manage the collection, transfer, and maintenance of energy consumption data. These processes support the secure and efficient handling of data, in compliance with state and federal regulations.

a. Consent and Documentation Consent will be requested from homeowners and residents before collecting any energy consumption data from utilities. This consent, in the form of a participation agreement, will be signed through the rebate processing application and documented by program staff. The agreement will outline the purposes for data collection, how the data will be used, the privacy and security measures in place to protect it, and an understanding that data gathered in the program will not be sold.

b. Data Collection Energy consumption data will be collected from the homeowner after the homeowner provides documented consent through the rebate processing platform. The data will be collected using a secure data collection system designed to handle large volumes of energy usage and billing information. The format will adhere to the standards set by South Carolina Department of Administration’s Division of Information Systems (DIS) for compatibility and security. The homeowner will type their data directly into the system or upload electronic bills. The rebate processing platform will accept paper bills if electronic bills are unavailable. The program will not collect data from applicants that is not essential for rebate verification and processing.

c. Data Transfer Energy consumption data will be transferred from utilities via secure protocols, such as SFTP or encrypted web services. The data will be imported into the secure system used by program staff. Then, subsequently loaded into the rebate processing platform, ensuring that all data transfers are encrypted and comply with (DIS) security standards.

d. Data Maintenance and Storage Energy consumption data will be maintained and stored in the rebate processing platform; a secure system designed for the long-term storage of sensitive information. The system is managed by program staff who are trained in data security and privacy practices. Regular backups and security audits will be conducted to protect the integrity and availability of the data. The program will not collect data from applicants that is not essential for rebate verification and processing.

e. Data Access and Usage Individual energy consumption data will be provided only to eligible parties, such as program administrators and authorized contractors, for specific purposes like conducting program requirements, verifying rebate eligibility, and monitoring energy savings. Access controls and audit logs will be in place to monitor and restrict data access.

f. Data Transfer to DOE The rebate processing platform will transfer data to DOE using secure transfer protocols, such as SFTP or PNNL-provided encrypted APIs. The transfer process will include data validation and encryption such that the data remains secure during transmission and meets DOE’s data reporting requirements.

References

· South Carolina DIS’s SCDIS-200 Information Security and Privacy Standards

· Public Sector Building Energy Benchmarking: Utility Data Access Options

· Pacific Northwest National Laboratory APIs: Method of sending data to DOE’s national program database (available at PNNL.gov)

Security and Safety of Energy Consumption Data

· Describe how your state will ensure that any data are transferred and maintained safely and securely, using established standards. Describe:

· Encryption methods for data transfers.

· Protection of data collected and…