Summary

  • Ofgem sent P494 back because its proposed code framework and GDPR basis did not establish Elexon’s legal authority to create and operate the Smart Data Repository.

  • A consultation proposes prior Authority approval and a limited initial scope, while supplier transmission into the repository and third-party access to personal data follow distinct consent rules.

A settlement system can collect electricity readings for one purpose and later make them useful for others. That possibility does not answer the prior question: who has the legal power to operate the new service? Ofgem put that question at the centre of its Smart Data Repository (SDR) proposals on 14 September, sending the underlying code modification back while consulting on licence changes.

The Authority said it could not form an opinion on Balancing and Settlement Code modification P494 as submitted. Elexon’s proposal would establish a repository for settlement-derived electricity data and make it available to third parties. Elexon had argued that the processing could rely mainly on the UK GDPR basis of Public Task, with Legitimate Interests for some activities. Ofgem’s response draws a boundary between a lawful basis for processing personal data and the legal vires to create and run a repository. The former, it says, cannot supply the latter.

That distinction matters because the existing Electricity System Operator (ESO) licence defines what the Balancing and Settlement Code (BSC) may cover. Ofgem says the licence does not currently provide for an SDR and that a BSC change alone cannot make the function lawful. Its proposed amendment to Condition E1 would expressly let the BSC provide for Elexon to establish and operate the service, pending a more enduring regulatory framework. This is a proposal in a statutory consultation, not an authorization already in force.

The proposed licence would put a limit around the first version. For at least a year, an approved repository would be confined to electricity-consumption data Elexon receives through its Great Britain settlement role, plus associated data the Authority approves. Elexon could not establish or materially expand the SDR without the Authority’s prior written approval. Ofgem also describes later scope changes as case-by-case decisions involving the Digitalisation Board and Authority through licence and code modifications. Expansion is a separate decision, not an automatic consequence of building a repository.

Operations would carry additional duties. Ofgem proposes high-level requirements for fair and non-discriminatory access and charges, privacy and security, independent audits and transparent reporting. It is consulting on whether ongoing obligations belong in a future Code Manager licence for Elexon or another bespoke licence. Detailed rules, the operations manual, access controls and incident procedures are still being developed; the September documents do not establish that those safeguards have already been tested in a live SDR.

Consumer consent raises a different question from Elexon’s authority to operate. Proposed changes to Supply Licence Condition 47 would let suppliers seek, gain and retain consent for onward transmission of domestic and microbusiness half-hourly readings into the SDR. The notice describes an existing-style request process: data could be placed after consent is obtained or when the customer has not objected within seven days to the request. That is a placement rule. Ofgem separately says access to identifiable, MPAN-level data by third parties would require express and informed consumer consent through RECCo’s Consumer Consent Solution (CCS).

Aggregated data is treated separately. A supplier’s ability to place readings in a repository should not be read as a third party’s permission to inspect an individual household’s record.

The two Ofgem documents also leave a drafting question visible. The P494 send-back letter says the revised text should reflect Elexon processing data to meet a statutory obligation in licence conditions, and it describes Legal Obligation as the appropriate UK GDPR basis rather than Public Task. Paragraph 4.21 of the statutory consultation, however, says storage and retention are proposed on the basis of Legal Obligation and Public Task through licence and BSC changes. The documents agree that a new licence foundation is needed; their wording does not yet present one settled formula.

The revised text will show how the Authority resolves that difference.

The timing remains conditional. Ofgem expects the revised P494 report, legal text, detailed SDR rules, operations manual, guidance and a DPIA version for consultation by 15 December 2026. It expects licence changes in early 2027, subject to consultation responses and internal consideration; any adopted modification would take effect no sooner than 56 days after the decision. Elexon’s proposed phases—non-personal SVA data first, then MPAN-level data once CCS is live—are plans, not confirmed delivery dates.

The governance lesson is concrete. Consultation responses from suppliers, consumer groups and data users can inform the design, but they do not themselves grant Elexon authority. The binding controls named in the record are the statute, licence conditions, Authority approval, BSC procedures and the consent required for access. Ofgem’s proposal is an attempt to make those decision rights explicit before a settlement dataset becomes a wider data service.

Sources