A Special IREG meeting took place on 6th March 2018 and discussed the following:
The group was given an update on the current position of the developments of phase 2 which are currently in test and expected to be released at the end of March.
A paper had been provided outlining some of the General Data Protection Regulations (GDPR) considerations and data items held within the current ECOES1 version, such as “Date of Birth” and “Payroll Number”. These were proposed as not required due to being seen as “personal data”. One party noted they used the Payroll Number and it would be helpful to understand if other parties use either of these fields. If used, some action will need to be taken if the parties are slow in migrating from ECOES1.
IREG noted that there could be challenges for some parties who are yet to migrate to ECOES2 in meeting an end date of May 2018, if that was a desired outcome to meet GDPR needs. Notification may be required from MRA Executive Committee (MEC) to highlight any risks or potential non-compliance.
IREG discussed the letters produced by the Distribution Network Operators highlighting that all letters are still held in ECOES1, whereas in ECOES2 a change has been introduced to delete the letters after 7 calendar days. Again, if migration from ECOES1 is delayed a process will need to be added in to delete all the letters held, and then implement a weekly check to delete any new letters produced.
IREG discussed the 3 options provided on Access Controls for ECOES2. The group noted that although the ideal would be to have one option as ECOES is a central system, the reality was that many users who access ECOES may have company emails for internal use only. Thus, some options were still needed and it should be for each company to decide which option they choose in managing users and passwords, and it is for each company to manage their own GDPR and IT security arrangements.
IREG noted that the User Requirement Specification (USR) would need to be updated based on previous discussions on the Access Controls along with some checks on spelling and grammar. Some process areas were highlighted that require a wider post-implementation review such as Non-Domestic Customers (NDC), MRA Agreed Procedure (MAP) 14 (Procedure for the Allocation of Pre-Payment Metering (PPM) Payments Transacted Against an Incorrect Device and the D0312 (Notification of Meter Information to ECOES). IREG agreed for an updated URS covering all the agreed amendments will be issued as part of the post meeting documentation for review and final comment.
Next standard meeting
IREG will next meet on 14th March 2018.