The Court of Justice of the European Union (CJEU) has clarified the requirements under EU law governing the use of smart electricity meters and the associated transmission of data (EuGH (CJEU), judgment of 5 November 2026 – C‑468/24). According to the judgment, EU law does not require a distribution system operator to comply with a final customer’s request to reject a smart meter and provide a conventional meter instead. At the same time, the requirements under EU law relating to data security and the protection of personal data remain decisive.
Dispute over the replacement of a mechanical electricity meter
The proceedings concerned a customer and an electricity distribution system operator operating in the Austrian federal state of Lower Austria. Under an agreement for network use, the customer was supplied with electricity by a third party.
A mechanical electricity meter owned by the distribution system operator was installed at the customer’s residence. Its calibration validity expired on 31 December 2023. The distribution system operator therefore intended to remove the device and replace it with a smart electricity meter.
The customer did not consent to the replacement. The distribution system operator subsequently brought an action before the Bezirksgericht Tulln (Tulln District Court) on 9 October 2023. In particular, it sought an order requiring the customer to tolerate the removal of the existing meter and the installation of a smart meter and to grant access to the metering point. The Bezirksgericht upheld the action; due to the appeal, that decision is not final, and the main proceedings will continue before the Landesgericht St. Pölten (St. Pölten Regional Court) following the preliminary ruling.
The customer appealed against that decision to the Landesgericht St. Pölten. That court stayed the proceedings and requested that the CJEU interpret several provisions of EU law; consequently, no final decision has yet been made on the appeal, and the main proceedings will continue before the Landesgericht St. Pölten following the preliminary ruling.
How smart metering systems work
Differences between opt-in and opt-out configurations
According to the findings of the Landesgericht St. Pölten, smart meters can be configured in different ways. In the so-called opt-in configuration, they transmit the final customer’s consumption values for 15-minute and daily intervals.
By contrast, in an opt-out configuration, those consumption data are not recorded continuously. The difference compared with a conventional meter is then that the reading required once a year can be taken remotely. In this configuration, it is not necessary to read the meter at the location of the device. The setting activated in each case is intended to be visible on the meter’s display.
The customer’s objections
In the appeal proceedings, the customer objected to the installation of the smart meter. On the one hand, she claimed that she was exposed to “electrosmog”; this allegation is disputed in the main proceedings, which have not yet been finally concluded. On the other hand, she argued that, in her view, the data processing was not sufficiently compatible with the General Data Protection Regulation.
According to her submissions, smart meters did not ensure secure data transmission. She claimed – contrary to the distribution system operator’s position – that some data were transmitted without encryption. She also alleged that it was possible to record data from neighbouring smart meters or even from all meters within the same transformer network.
The customer further argued that smart meters were not configured by default in the opt-out configuration. The final customer had to request that setting from the distribution system operator and could not subsequently verify whether their data had nevertheless been accessed.
EU and Austrian regulatory framework
Requirements for smart metering systems
Directive (EU) 2019/944 lays down common rules for the internal market for electricity. It defines a smart metering system as an electronic system that is capable of measuring electricity fed into or consumed from the grid, providing more information than a conventional meter and transmitting and receiving data for information, monitoring and control purposes using a form of electronic communication.
By contrast, a conventional meter is an analogue or electronic metering device that cannot transmit or receive data. The Directive supports the rollout of smart metering systems in order to enable final customers to participate actively in the electricity market and exercise greater control over their consumption.
Article 20 of Directive (EU) 2019/944 requires, among other things:
-
The metering systems must accurately measure actual energy consumption and be capable of providing final customers with information on actual time of use.
-
The security of the metering systems and data communication must be ensured in accordance with the relevant provisions of EU law.
-
The privacy and data of final customers must be protected in accordance with EU data protection and privacy requirements.
-
Before or at the time of installation, final customers must be given appropriate information about the device’s functions and about the collection and processing of personal data.
Article 23(3) of the Directive additionally provides that the processing of personal data in connection with smart metering systems must comply with the General Data Protection Regulation (GDPR).
Austrian opt-out rules
The Austrian Elektrizitätswirtschafts- und -organisationsgesetz (Electricity Industry and Organisation Act) provides that the distribution system operator must take account of a final customer’s wish not to receive a smart meter. More detailed provisions are set out in the Intelligente Messgeräte-Einführungsverordnung (Smart Meter Rollout Ordinance).
If a final customer refuses metering by means of a smart device, the distribution system operator must configure the device to be installed or already installed so that monthly, daily and 15-minute values are neither stored nor transmitted. In addition, the disconnection function and the power limitation function must be deactivated. The applicable configuration must be visible on the metering device.
It remains permissible to transmit the meter reading required for billing purposes or the allocation of consumption between billing periods. To the extent technically possible, this also applies to the highest average 15-minute load within a calendar year.
No right under EU law to a conventional meter
Smart metering systems are expressly promoted
The CJEU interpreted Articles 19, 21 and 22 of Directive (EU) 2019/944 in conjunction with Annex II to that Directive. In the Court’s view, the wording, the regulatory context and the objectives of the Directive all support the promotion of smart metering systems.
As a general rule, Member States must ensure that such systems are rolled out. The rollout may be made subject to a cost-benefit assessment. If that assessment is positive, at least 80% of final customers are to be equipped with smart metering systems within the period specified in Annex II.
If the rollout is assessed negatively and no systematic installation takes place, a final customer must, under certain conditions, be able to request the installation of a smart meter. Final customers who are not equipped with such a system must receive individual conventional meters that accurately measure their actual consumption.
No general right of objection for final customers
According to the judgment, however, those provisions establish neither a general right to a conventional meter nor a right always to refuse the installation of a smart metering system.
Under EU law, a distribution system operator is therefore not required to comply with a final customer’s request to reject a smart meter and instead provide that customer with a device that cannot transmit or receive data. This must be distinguished from more extensive rules that a Member State may provide for under its national law.
Data security requirements need not form part of the statutory definition
The Landesgericht St. Pölten also asked whether a national provision may define the term “smart meter” without laying down specific data security requirements within that definition itself.
The CJEU answered in the affirmative, subject to one essential condition. Directives 2014/32/EU and (EU) 2019/944 contain binding requirements concerning the security of metering data and the protection of personal data. Those requirements must be implemented in the national provisions governing the use of smart electricity metering systems.
According to the judgment, however, it is not necessary to include all security requirements directly in the statutory definition of the term “smart meter”. They may also arise from other national provisions governing the use of such devices.
The definition in question therefore does not infringe EU law, provided that the national regulatory framework contains the necessary requirements concerning data security and the protection of personal data elsewhere.
ePrivacy consent does not apply to data transmission via the electricity grid
Requirements under Article 5(3) of Directive 2002/58/EC
Article 5(3) of Directive 2002/58/EC governs the storage of information or access to information already stored in the terminal equipment of a subscriber or user. As a general rule, this requires consent based on clear and comprehensive information about the purposes of the processing.
The CJEU had to determine whether those requirements also apply to an electricity grid over which personal consumption data may be transmitted. The decisive question was whether the smart meter could be classified as the terminal equipment of a subscriber to or user of a publicly available electronic communications network.
The electricity grid is used predominantly for energy transmission
According to the decision, a smart metering system falls within the concept of terminal equipment only if it is connected directly or indirectly to the interface of a public telecommunications network. In addition, Directive 2002/58/EC applies only where publicly available electronic communications services are provided over public communications networks.
An electricity grid with data transmission capabilities does not satisfy those conditions for that reason alone. Its main purpose is the transmission of electrical energy. It is not used wholly or mainly to provide publicly available electronic communications services.
Nor does the final customer use a publicly available electronic communications service by transmitting consumption data to the distribution system operator. Rather, the transmission of data constitutes an internal technical process carried out by the distribution system operator. It serves to measure electricity consumption and to monitor and control the grid.
Special consent requirements do not apply
According to the judgment, Article 5(3) of Directive 2002/58/EC therefore does not apply to an electricity grid over which personal data may be transmitted. The consent requirements laid down in that provision for accessing information in terminal equipment do not apply in this scenario.
At the same time, the Court clarified that the data protection and security requirements under the other relevant provisions of EU law continue to apply. In particular, the processing of personal data remains subject to the GDPR and the corresponding requirements of Directive (EU) 2019/944.
Recital 16 of Implementing Regulation (EU) 2023/1162, according to which smart meters are regarded as terminal equipment and Directive 2002/58/EC applies, did not alter that conclusion. A recital may assist in interpreting a provision, but it is not itself a binding rule and therefore could not invalidate the Court’s interpretation.
Further questions were inadmissible
The CJEU did not answer all the questions referred by the Landesgericht St. Pölten on their merits. It classified three points as inadmissible.
In the Court’s view, the question concerning Product Liability Directive 85/374/EEC had no sufficient connection with the subject matter of the dispute. The proceedings concerned neither a manufacturer’s liability nor a defect in the existing or proposed metering device.
The CJEU also considered hypothetical the question of whether the final customer had to be informed directly on the meter of data retrieval in a “justified individual case”. The proceedings did not concern access to consumption data already transmitted in such an individual case. Austrian law also provides for the final customer to be informed promptly.
The question concerning consideration of the case law of the European Court of Human Rights relating to Article 8 of the EMRK (European Convention on Human Rights) likewise failed to meet the applicable requirements. The referring court had neither identified a specific decision nor sufficiently explained why that case law should be relevant to the main proceedings.
Significance of the decision for data protection and the energy sector
The judgment distinguishes between the rollout of smart metering systems promoted under EU law and the requirements governing the handling of personal data in that context. There is no right under EU law to reject a smart meter. Nor must all security requirements be included in the statutory definition of a smart meter.
The special consent requirements under Directive 2002/58/EC do not apply to consumption data transmitted via an electricity grid as part of an internal technical process carried out by the distribution system operator. In particular, this does not affect the principles of the GDPR, information obligations, requirements concerning the security of processing or the provisions of Directive (EU) 2019/944.
The processing of metering and consumption data may therefore continue to raise various data protection issues for distribution system operators, energy companies and final customers. MTR Legal Rechtsanwälte advises companies and private individuals on the legal assessment of such matters and provides data protection law advice tailored to the circumstances of each individual case.
