Privacy Policy

Effective Date: January 1, 2020

Last Reviewed: December 19, 2019

Your privacy is a top priority for PG&E and we make every reasonable effort to protect the information we hold about you. This Privacy Policy addresses information obtained from California consumers (California residents), PG&E customers, website visitors, and mobile application users and is intended to inform you about how PG&E treats personal information that we collect and use about you. This Policy covers Pacific Gas and Electric Company and its parent company, PG&E Corporation. As used herein, "PG&E" refers to Pacific Gas and Electric Company and/or PG&E Corporation.

Except as noted in this Privacy Policy, this Privacy Policy does not apply to employment-related personal information collected from California-based job applicants, employees, directors, officers and contractors.

PG&E provides our deaf, hard of hearing, and visually-impaired customers, customers who have a speech disability and customers who seek support in other languages, with various services. Those customers can access PG&E Privacy Policy by contacting our Assistive Resources or calling our toll-free number at 1-800-743-5000.

In addition to PG&E's general privacy policies, California consumers and PG&E customers who are California residents have specific rights under the California Consumer Privacy Act of 2018.

The rights include:

• The right to request that PG&E disclose what personal information we collect, use, disclose and sell about you;
• The right to opt-out of PG&E's sale to third parties of any personal information about you (PG&E does not sell and will not sell personal information about you for any monetary value);
• The right to require PG&E to delete personal information about you if the information is not legally required to be retained or otherwise subject to an exception from deletion.
• The right to be notified that we collect personal information about you, and the purposes for which the information will be used. This right applies to job applicants, employees, directors, officers and contractors, as well as other California consumers.

You may exercise your rights under the California Consumer Privacy Act as described in more detail below. You can also download a pdf copy (PDF, 47 KB) of this information about the California Consumer Privacy Act. Requests may be submitted through PG&E's California Consumer Privacy Act consumer request webpage, or by toll free telephone number 1-800-743-5000. You can also exercise your rights by visiting a PG&E local office. Locate a PG&E office near you.

For information specific to the privacy of Energy Usage Data, please see PG&E's Notice of Accessing, Collecting, Storing, Using and Disclosing Energy Usage Information.

Definitions

"Personal information" means any information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular California consumer or household or PG&E customer. Such information may be subject to confidentiality requirements.

"Service providers" means any entity other than PG&E that processes information on behalf of PG&E and/or to which PG&E discloses a consumer's personal information for a business purpose pursuant to a written contract.

"Third parties" means any person or entity other than PG&E or its employees, which collects, uses or accesses personal information from PG&E for any purpose other than a business purpose on behalf of PG&E.

"You" means any California consumer, PG&E customer, website visitor, or mobile application user.

Information We Collect and Disclose

Personal information that we collect and disclose about PG&E customers and California consumers

If permitted by law, we collect information about you from a variety of sources, including:

• From you: When you set up your account or interact with us regarding your account, your utility service, and your participation in utility programs. This may be collected by phone with a customer service representative, by mail, by text, by email, through our website at pge.com, or through vendors who provide or deliver services on our behalf.
• From our utility meters and other equipment: When you use electricity and gas, Energy Usage Data is collected by our metering systems.
• From third parties: When we work with third parties such as service providers, vendors, contractors, credit agencies, or market researchers who provide utility products and services on our behalf.
• From other sources: We may supplement the information described above with information we obtain from other sources, including from both online and offline data providers.

For each category of personal information, the category of sources from which that information is collected, if permitted by law, is indicated in the table below:

Examples of information that we collect about you include:

• The information you provide to us when you start, receive or discontinue energy services or products, such as your name, address, phone number, email address, and Social Security Number.
• Billing and payment information used to pay your energy bill or for PG&E products and services, including your financial information, credit history, and Social Security Number.
• Information you provide to determine eligibility or participate in certain energy programs or services, such as Energy Efficiency, Demand Response or clean energy programs.
• Information used to visit, register for, manage, or access your online or other PG&E accounts, such as your PG&E account number, name, address, phone number, and email address.
• Information you fill out in any form on our website, mobile applications, or otherwise, such as signing up for outage alerts, signing up for bill notifications, or authorizing another person on your PG&E account.
• Information you give us when you communicate with PG&E and/or any of its representatives.
• Information which identifies you through information regarding the location of equipment and facilities we use to provide you utility products and services, such as the location of electricity and gas meters and delivery facilities.
• Personal information you provide us when applying for employment or a contract with PG&E, or as an existing or former employee or contractor of PG&E.

For some applications, such as rate analysis, we link usage information with your personal information.

We may supplement the information described above with information we obtain from other sources, including from both online and offline data providers. Such supplemental information may include contact information, such as your email address, demographic data, or other relevant information.

In particular, within the preceding twelve (12) months, PG&E has collected, through its website or otherwise, and disclosed to service providers and third parties the categories of personal information identified below in order to provide services to our customers, as required by law, or otherwise. The categories of personal information identified below include the categories of personal information about our customers, including California consumers as well as PG&E job applicants, employees, directors, officers and contractors. In addition to PG&E, service providers and third parties to whom personal information has been disclosed on behalf of PG&E include contractors, vendors, service providers, government regulatory agencies, courts, and other third parties with a legal right to the information, as well as marketing, advertising and analytic companies. See also Information we obtain from your use of our website or mobile apps and How We Use Information below.

Personal information does not include:

• Publicly available information from government records;
• De-identified or aggregated consumer information;
• Information excluded by law from the definition of personal information, such as:
  • Health or medical information covered by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the California Confidentiality of Medical Information Act (CMIA) or clinical trial data; and
  • Personal information covered by certain sector-specific privacy laws, including the Fair Credit Reporting Act (FRCA), the Gramm-Leach-Bliley Act (GLBA) or California Financial Information Privacy Act (FIPA), and the Driver's Privacy Protection Act of 1994.

Information we obtain from your use of our website or mobile apps

• Your visits to PG&E's website or mobile apps: we collect information about visits to our website and mobile applications, such as the number of visitors and the number of users that click on certain links or use certain services. For some applications, such as rate analysis, we link usage information with the customer visiting the website. We use industry standard software to create summary statistics of the data we collect, which may then be used to highlight what our visitors find interesting, to improve the website design and usability, to identify system performance issues, or for other internal purposes. We may use information about your location when you use certain features on our website, such as our Outages map.
• Log Data: we receive information that is automatically recorded by our servers when you visit our website or mobile applications, including your Internet Protocol ("IP") Address. An IP address is a number automatically assigned to your computer every time you browse the Internet. When you visit the website, our servers log your current IP address. We may use your IP address to help diagnose problems with our servers and to administer the website. We also use IP addresses to provide localized content to you on our website, which is related to your geographic region. Your IP address is not associated with your personal information and we do not use it to identify you when logging IP address data.
• Cookies: when you visit or use our website or online services, our server may create cookies, which are small pieces of information placed on your device that provide a more convenient experience to you. PG&E uses cookies and other similar technologies on our website and online services. We may also allow business partners to use their cookies or similar technologies on our website or online services for the purpose of selling or distributing the cookies to provide targeted advertisements or other commercial uses about programs or services that they offer. As a result, when you use or visit the website, you will provide or make available certain information to us and to our business partners, unless you opt-out of or disable the business partners' use of your personal information.

The data we collect about website usage from cookies is not tied to your personal information and is only used in an aggregated form for the purposes of our own customer support, analytics, research, and improving our website. When you use features such as "Remember My Username," the cookie is associated with your personal information in order to provide you with a more convenient experience. We do not sell or transfer the data we obtain from cookies for a monetary value. We use cookies to evaluate website usage or provide energy services to you, or to offer programs and/or services that you may be interested in.

You may disable our usage of cookies through your browser settings. Please note that if you disable your browser's ability to accept cookies, you will be able to navigate PG&E's website, but you will not be able to take advantage of certain features, such as "Remember My Username," and will not receive targeted advertisements related to our programs or services. In addition, you must contact our business partners directly to disable their use of cookies about you that you have consented them to use based on your use of their on-line services.

You may also click on the Do Not Sell My Personal Information button to direct PG&E to not sell your personal information without your consent.

Targeted Communications on Social Media Sites

We use social media sites like Facebook and Twitter to communicate with you about our programs and services. You can follow us on these social media sites to receive regular updates. These social media sites also allow us to target ads to you using the information they maintain about you with your consent, even if you do not specifically follow us on their site. We may target ads to you using information such as cookies, pixels, zip codes, and interests.

You will only see our targeted ads if you agreed to receive this type of communication through your social media provider. You may be able to disable some, or all the advertising targeted to you on a social media site by adjusting your privacy settings on their site. Please see our Social Media Guidelines for more information.

Web Browser "Do Not Track" Signals and Other Similar Mechanisms

Our website does not respond to "Do Not Track" signals. "Do Not Track" signals are used by some Web browsers to attempt to limit tracking related to your visits to a website.However, our website does provide an option for viewers to opt out of the transmittal of "cookies" about their viewing data to third parties.

Links to other websites

While browsing PG&E's website or online services not sponsored by PG&E, you may encounter and choose to access websites or online services operated by PG&E business partners, companies or agencies that may not be associated with PG&E by clicking on hypertext links or icons. These websites may send their own cookies to you, log your IP address, and/or otherwise collect data or personal information about you and your online activities. PG&E does not control and is not responsible for what outside entities do in connection with their websites or online services, or how they handle your personal information. Please use caution and consult the privacy policies posted on each outside website that you visit for further information.

How We Use Information and Share Information with Service Providers and Third Parties

PG&E collects, uses, and discloses your personal information to fulfill the following business and legally required purposes:           

• Provide energy services or products to you.
• Operate and maintain safe, secure and reliable public utility services and equipment under PG&E's legal obligation to serve you as a regulated public utility in California.
• Comply with a valid warrant, subpoena, or court order, or exercise or defend legal claims.
• Comply with a California Public Utilities Commission (CPUC) request or order, or comply with a request or order from other local, state or federal governmental agencies with legal authority to obtain the personal information from PG&E.
• Develop and implement marketing, education and outreach plans to improve the services and products we provide to you and other consumers.
• Protect the safety and security of PG&E's customers, visitors, employees and contractors by collecting and reviewing personal information to protect against fraud, other crimes and threats to safety.
• Enable third parties, service providers, vendors and contractors to provide energy-related services, products or equipment on behalf of PG&E, as required in order to provide products and services to you, or for other business purposes consistent with PG&E's commercial relationship with you, or to comply with PG&E's legal obligations as a regulated California public utility, subject to appropriate confidentiality and security requirements;
• Notify credit reporting agencies and collection agencies to evaluate your credit or if your account is assigned for collection.
• Assist emergency responders in situations of threat to life or property.
• For any other business or lawful purpose reasonably anticipated within the context of PG&E's relationship with you.

Sharing Personal Information with Service Providers and Third Parties

In order to provide you with services or to complete transactions requested by you, we may transfer your personal information to service providers who act on our behalf. Service providers acting on PG&E's behalf are required to follow the similar privacy and security practices as PG&E and are subject to an extensive security review of their data handling processes before PG&E permits any sharing of personal information, except as subject to different requirements under applicable laws or regulations.

PG&E does not disclose a consumer's personal information to any other person or business entity without your prior consent, except as necessary for the purposes listed above.

PG&E may share aggregated, non-customer specific data and information derived from personal information with other entities for the purpose of performing activities that may help PG&E provide and improve its utility products and services, including such programs as Energy Efficiency and Demand Response, or to inform California energy policy as directed by the California Public Utilities Commission and other California government agencies which regulate PG&E.

If permitted by law, we typically disclose the following categories of personal information to the following categories of entities for a business purpose or to comply with legal obligations:

Sharing Personal Information at Your Choice

You may authorize other companies or persons to receive your personal information from PG&E, including your Energy Usage Data. Before sharing information, it is important that you understand how other parties intend to use your information, if they will share it with others, and your rights as a consumer. We encourage you to protect the confidentiality of your username and password and other personally identifiable information specific to your PG&E account.

Selling Personal Information

Except possibly for "cookies" obtained by third parties when you visit PG&E's website or online services, PG&E has not sold consumers' personal information in the preceding 12 months for any monetary value and does not intend to sell in the future for any monetary value. However, we could be involved in programs that could be considered a "sale" under the California Consumer Privacy Act, such as in connection with cookies that our business partners may have collected on our website or online services in the preceding 12 months. If you have visited PG&E's website or a website operated on behalf of PG&E in the last twelve months, electronic "cookies" and other metadata about you may have been obtained by PG&E business partners for their commercial use, unless you have disabled or opted-out of the use of your "cookies" when you visited the websites.

PG&E does not and will not sell the personal information of minors under 16 years of age without affirmative authorization.

Click the Do Not Sell My Personal Information button on the website you have visited to direct PG&E to continue to not sell your personal information without your consent.

Retention

We retain your personal information based on legal requirements or business needs. Generally, we only retain personal information for as long as is reasonably necessary for our business purpose or as required by law. Secure disposal methods are used when information is no longer needed.

Accessing and Managing Your Personal Information

Most customers have secure access to information about them through their monthly bills or their online account on our website. To help protect your privacy and provide you with quality service, we rely on you to provide us with complete and accurate information. If you think the information, we have about you is inaccurate or outdated, we encourage you to contact us at your earliest convenience to update or correct the information. You may update or correct your information by calling the number listed in the "Contact Us" section below, or by signing into your online account through the Your Account portal at pge.com to edit your profile.

We offer certain choices about how we communicate with you and what Personal Information you provide to us. In some cases, you have the right to limit, or opt-out of, the information you provide to us.

• Social Security Number: In order to establish or re-establish service, you may be asked to provide your Social Security Number for us to validate your identity. You have the right to not provide your Social Security Number, however, a deposit may be charged, and we will request an alternate form of identification (e.g., driver's license, passport, State identification, etc.). The establishment deposit can be waived if the account is enrolled in paperless billing and recurring payment via pge.com or secured with a bill guarantor. The re-establishment deposit can be waived if secured with a bill guarantor.
• Your Account: As a customer, you may sign up for Your Account online at pge.com to get instant access to your bill, make payments, and receive important alerts. If you choose to sign up for Your Account, you will be asked to provide your email address. You have the right to decline to provide your email address; however, you will not be able to take advantage of our online services such as electronic billing and payments.
• Email Communications: If you have opted-in to receive email communications from us, you can opt out of receiving these emails at any time by following the unsubscribe process in the footer of the email or by contacting us in the manner described in the "Contact Us" section of this Policy. If you are a customer who has registered to use Your Account to access your account on our website, you can opt out of future mailings by updating the preferences section on the Profile & Alerts page within the Your Account portal at pge.com.

Your Rights and Choices under the California Consumer Privacy Act

As indicated above, the California Consumer Privacy Act provides California consumers (California residents) with specific rights regarding their personal information. This section describes your rights under the California Consumer Privacy Act and explains how to exercise those rights.

Access to Personal Information Upon a Verified Request

You have the right to request that PG&E disclose certain information to you about our collection and use of your personal information over the past 12 months.

You may review those rights, including submitting a verifiable request to access the personal information we collect about you, at the following link: https://pgeipaprod.service-now.com/privacy_consumer.

Once we receive and confirm your verifiable consumer request (see Exercising Your Access, Data Portability, and Deletion Rights), we will disclose to you:

• The categories of personal information we collected about you.
• The categories of sources for the personal information we collected about you.
• Our business or commercial purpose for collecting or selling that personal information.
• The categories of third parties with whom we share that personal information.
• The specific pieces of personal information we collected about you (also called a data portability request).

Deletion Request Rights

In addition, you have the right to request that PG&E delete any of your personal information that we collected from you, subject to certain exceptions, including when required to be retained by law or for our essential business or public utility purposes, such as providing services or products to you. These exceptions include record retention schedules and other requirements mandated by the California Public Utilities Commission that effectively prohibit deletion of certain personal information.

Once we receive and verify your consumer request, we will delete your personal information from our records, unless an exception applies.

Exercising Your Access, Data Portability, and Deletion Rights

To exercise the access, data portability, and deletion rights described above, please submit a request using one of the following methods:

• Visiting https://pgeipaprod.service-now.com/privacy_consumer.
• Calling us at 1-800-743-5000.
• Visiting any PG&E office. Locate a PG&E office near you.

PG&E cannot respond to your request or provide you with personal information if we cannot verify your identity or authority to make the request and confirm the personal information relates to you. Making a verifiable consumer request does not require you to create an account with us.

We will only use personal information provided in a verifiable consumer request to verify the requestor's identity or authority to make the request and whenever feasible, we will match the provided identifying information to the personal information provided when you started your PG&E utility service. If you wish to authorize a third party to make a request on your behalf, you must contact the PG&E Privacy Team directly and must provide a valid California power of attorney or comparable documentation of written permission from you and verification of your identity with PG&E. Such power of attorney must meet the requirements of Probate Code sections 4000 to 4465.

You may only make a verifiable consumer request for access or data portability twice within a 12-month period.

You may also make a verifiable consumer request on behalf of your minor child.

Response Timing and Format

We will respond to a verified consumer request for personal information within 45 days of receipt. If we require more time (up to 45 additional days), we will notify you of the reason and extension period in writing. We will deliver our written response by mail or email address submitted by you and through a secure link, at your preference. Any disclosures we provide will only cover the 12-month period preceding the verifiable consumer request's receipt. The response will also explain the reasons we cannot comply with a request, if applicable.

For data portability requests, we will select a format to provide your personal information that is reasonably useable for transmittal of the information from one entity to another entity.

We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.

Personal Information Sales Opt-Out and Opt-In Rights ("Do Not Sell")

If you are 16 years of age or older, you have the right to direct us to not sell your personal information at any time (the "right to opt-out"). We do not sell the personal information of consumers we actually know are less than 16 years of age, unless we receive affirmative authorization (the "right to opt-in") from either the consumer who is at least 13 but not yet 16 years of age, or the parent or guardian of a consumer less than 13 years of age. Consumers who opt-in to personal information sales may opt-out of future sales at any time. Except possibly for "cookies" obtained by third parties when you visit PG&E's website or online services, PG&E has not sold consumers' personal information in the preceding 12 months for any monetary value and does not intend to sell in the future for any monetary value. However, we could be involved in programs that could be considered a "sale" under the California Consumer Privacy Act, such as in connection with cookies that our business partners may have collected on our website or online services in the preceding 12 months. If you have visited PG&E's website or a website operated on behalf of PG&E in the last twelve months, electronic "cookies" and other metadata about you may have been obtained by PG&E business partners for their commercial use, unless you have disabled or opted-out of the use of your "cookies" when you visited the websites.

To exercise the right to opt-out of the sale of your personal information, you (or your authorized representative) may submit a request to us by clicking on the "Do Not Sell My Personal Information" button.

Non-Discrimination

We will not discriminate against you for exercising any of your California Consumer Privacy Act rights. Unless permitted by law, PG&E will not as a result of you exercising your privacy rights under the California Consumer Privacy Act:

• Deny goods or services to you.
• Charge you different prices or rates for goods or services, including through the use of discounts or other benefits, or imposing penalties.
• Provide a different level or quality of goods or services to you, if you exercise your rights.
• Suggest that you will receive a different price or rate for goods or services or a different level or quality of goods or services.

Security

Protecting personal information is a top priority for PG&E. We take extensive measures to ensure the integrity of our systems and protect your personal information. We continuously implement and update administrative, technical, and physical security measures to help protect personal information about you from unauthorized access, destruction, or alteration. In addition, any account information you enter while logged in to your online account, or that is displayed on our website in your browser window, is secured using an industry standard security technology known as Secure Sockets Layer ("SSL"). By using SSL, we attempt to protect the confidentiality of your personal and financial information. Your browser must be capable of supporting SSL. Please check with your browser manufacturer for details.

Children's Privacy Online

Children's privacy is important. We have areas of our website intended for use by children that contain information about energy and safety. We also provide free classroom materials for teachers about energy awareness and safety. We do not monitor the age of users of the website and do not intentionally collect information from children under the age of 13. If you are under the age of 13, you should not submit personal information on this website or any other website without the consent of your parent or guardian.

Changes to this Privacy Policy

We will review this Privacy Policy when significant changes occur and at least every 12 months. We will notify you of material changes through updates on PG&E's website, pge.com, including how to obtain prior versions of this Privacy Policy upon request. We will also notify you annually in a bill insert to revisit the most updated version of this Privacy Policy on our website.

Contact Us

If you have questions, concerns, or complaints about this Privacy Policy, would like to request a current or previous version, or would like more information regarding our process for updating this Privacy Policy, you can contact us using the following options:

PG&E Residential and Business Customer Service
Correspondence Management Center
Attention: Privacy Management
P.O. Box 997310
Sacramento, CA 95899-7310

PG&E Residential Customers: Call 1-800-743-5000
PG&E Business Customers: Visit the Business Customer Service Center

Email: pgeprivacy@pge.com