65- 407 C.M.R. ch. 815, § 4
A utility shall not disclose, sell or transfer, other than for debt collection, credit reporting, or usage reporting pursuant to state and federal law or to law enforcement agencies pursuant to lawful process, or as otherwise authorized by law, Commission rule or Order, individual customer information, including, but not limited to, a customer's name, address, telephone number, electricity or gas usage, or payment history, to a third party without the consent of a customer. Utilities may accept oral certification from a social service agency that they have received authorization from the customer to discuss that customer's account information. For a consumer-owned utility where its customers are members of the utility's corporation, the utility may share customer information with its corporation members only to the extent necessary to allow for the election of officers and for the utility to perform other functions necessary for the operation of the utility. A utility may also share customer information with State, County, tribal, and local emergency management agency personnel when the customer information is requested at the time of that agency's response to an emergency situation.
65- 407 C.M.R. ch. 815, § 4