Guidance for Third Party Users of ECOES

Transcription

1 Guidance for Third Party Users of ECOES 1. Introduction The Electricity Central Online Enquiry Service (ECOES) is governed under the Master Registration Agreement (MRA) and funded by all licensed electricity Supplier and Distribution Business parties to the Agreement. ECOES is primarily designed to assist Suppliers in the customer transfer process. The service provides a consolidated view of MPAS data for all metering points in the GB market, enabling suppliers to view data for all their customers from one location as well as information regarding customers who are about to switch. The service is administered by the Central Administration Service (CAS) on behalf of the MRA. 2. Access to ECOES Data 2.1 Overview Access to ECOES is available to Suppliers, Distribution Businesses, and Supplier Agents (e.g. Meter Operators and Data Collectors) in order to assist them in fulfilling their obligations in respect of industry processes. Non-domestic customers with multiple MPANs are also able to gain access in order to manage their portfolios of sites. Access is processed through a separate set of rules, via the ECOES website. MPANs are added to a portfolio upon Supplier authorisation. As explained in MAP15, there are a number of other organisations who are able to obtain access to ECOES for defined purposes; these include law enforcement agencies, and government departments and agencies. These organisations will still need to complete an access request, but are exempt from certain conditions. The CAS helpdesk is able to provide further guidance to such organisations. Other third-parties may be granted access to either the live service or reports from ECOES, if approved by the MRA Executive Committee (MEC). The rules for the granting of this access are set out in an MRA Agreed Procedure (MAP), MAP15 ECOES, which can be located on the ECOES page on the MRASCo website. In order to obtain access, these third-parties must: Complete an application form; Agree to pay all costs and charges associated with the access; Sign a licence agreement; and Comply with data protection and information security requirements, this will involve at being audited at least annually.

2 2.2 The Application Process There are seven steps to the application and access process: 1. initial application 2. initial CAS assessment 1 3. agreement of terms for access or data provision (including charges) 4. MEC approval 5. licence terms agreed and signed 6. initial audit completed 7. access or data provided Applicants should note that this process will typically take between 4 and 8 weeks. In order to assist third-parties in assessing if they have a valid reason for applying and to assist them through the process further information on these steps is contained below Initial Application The initial application should be made via the application form found on the MRASCo website. The notes below provide guidance on completing the form. Company Details All applicants must be either: a company registered in England & Wales or Scotland; or a registered charity; or a government department or agency. The registered (or equivalent) address must be provided, and although not mandatory, provision of a website address will assist CAS in making the initial assessment. Primary Contact Details This should be a person whom the CAS can easily contact to discuss any queries regarding the application. Role in Industry This section is designed to allow for the provision of information by the applicant in relation to the part they play in industry processes. The information provided should be relevant to the grounds for access as contained in MAP15. 1 Where there is any potential conflict of interest between the CAS and the party requesting access, MEC will carry out the initial assessment.

3 Data Access Required In order to fully assess the application, CAS needs to have information regarding which data items the applicant is seeking to obtain access to, and also whether the request is for live access or reports. If the application is for a report, it should contain details of the fields and file format required. Reason for Request The application must set out a clear and detailed explanation for the request; this should be aligned to the principles for access as set out in MAP CAS Assessment On receipt of a correctly completed application, the CAS will assess it against MAP15 requirements. In particular that access will accomplish one of the following: 1. Satisfies a legal entitlement to access the data on ECOES shall be granted access. 2. Fulfils a licence obligation on MRA parties. 3. Provision of a clear benefit to MRA parties. In addition the request must: 4. Be for a specific use; 5. Relate to systems & processes governed by the MRA or its products, or improve data quality; and 6. Relate to those data which cannot be obtained via an official route from an MRA party. Having carried out this assessment, the CAS will inform the application of their decision. At this stage, the application will either be progressed to the next stage or rejected Agreement of terms and charges Assuming the CAS accepts the request, the applicant and the CAS will agree the proposed terms of access and costs and charges. This will include costs for admin, data access, audit and any bespoke reports or extracts which need to be created. The agreed terms and costs will be subject to MEC agreement MEC approval Once the terms and costs have been agreed in principle, the request is presented to the next meeting of MEC. These meetings are generally held on a monthly basis. MEC will review the application and terms of access and make a decision regarding the granting of access. MEC may: Agree the request as drafted; Agree access subject to modified terms; or Reject the application.

4 2.2.5 Licence agreement Following MEC acceptance of the request for access a formal licence agreement will be drawn up to reflect the agreed terms. This will need to be signed and returned by the applicant prior to the further progression of the process Audit Once the licence has been signed, the Gemserv assurance team will contact the applicant to arrange an information security audit on behalf of the CAS. The purpose of this audit is three-fold; it will ensure that the organisation is: compliant with data protection legislation; compliant with the terms of the access licence granted; and, not carrying out activities which represent a material risk to the MRA or MRASCo. In order to satisfy the conditions of the audit, organisations accessing ECOES will need to demonstrate the following: Registration as a Data Controller with the ICO; Information Security Management Systems to the standards of ISO27001; Appropriate controls over the use of ECOES data within the organisation; Appropriate processes regarding system and data access; and Appropriate training for users, including admin users being aware of criteria for access to, and use of ECOES in relation to their organisation 2. Initially, organisations will be requested to provide evidence of the above to the CAS. The scope of any resultant on-site audit will be risk-based taking the evidence provided into consideration. Once the audit has been completed, all observations and findings will be reported to MEC along with risk-based recommendations for any remedial actions required. MEC will then approve or suspend access based on any findings Access provided Once MEC has approved the audit results, access to the live system or data reports agreed will be granted. 2 It is intended that all Master Administration Users will be able to receive training via one-day seminars to be held by Gemserv from time-to-time.

5 3. On-going use of ECOES 3.1 Help and Support The CAS provides a helpdesk service for all ECOES users, including third-parties who are receiving regular reports. This helpdesk is available during normal office hours and can be contact via telephone on or at CAS@Gemserv.com. 3.2 Monitoring The CAS monitors use of ECOES and the data therein; in particular volumes of searches made by users of the live service are checked along with checks to ensure that data are not being passed to other organisations or being utilised for purposes outside the stated reason for access. If any misuse if suspected, CAS will make a report to MEC who can withdraw access without notice in extreme cases. 3.3 Licence and Audit Licences for access to ECOES are generally renewable annually, and on renewal may be varied in regard to the access terms and/or costs In addition, an annual audit will be carried out at, with reasonable charges being made to the applicant for this.