Customer Privacy Concerns as a Barrier to Sharing Data about Energy Use in Smart Local Energy Systems: A Rapid Realist Review

Abstract

The purpose of this review is to investigate the nature of privacy concerns in the context of smart local energy systems (SLES) to understand how SLES providers can minimize both user concerns, and cause for concern, around privacy. We conducted a rapid realist review and thematic framework analysis against Bronfenbrenner’s socio–ecological model to understand privacy concerns in different contexts. A common privacy concern was that sharing detailed energy use data had the potential to reveal information about home life, and to intrude upon people’s sense of autonomy, choice, and control. Evidence suggests that people are willing to accept new data sharing technologies if the benefits of doing so are clear, anticipated, and mutually beneficial. Building trust, through increasing knowledge and understanding, was a mechanism for overcoming privacy concerns, but this was mediated by the organization providing the information. Non-profit organizations were more trusted to ensure appropriate safeguards to privacy were in place. One key barrier to participation with good supporting evidence was that people could resist perceived intrusions on their privacy. This could be actively resisted by refusing to install data collection technologies or passively by non-participation in adapting energy use behaviours: both of which are necessary for SLES to achieve their goals of managing energy demand and building resilience in smart grids.

1. Introduction

In 2019, the UK government introduced a programme (Prospering from the Energy Revolution) [1], to accelerate innovation and research in smart local energy systems (SLES). The government views such systems as having potential to support decarbonisation as well as a range of economic objectives. SLES may feature a broad range of sociotechnical characteristics, such as coordinated integration across sectors (such as buildings and transportation) and vectors (such as electricity as gas), new financial models to encourage local investment and employment, and direct local involvement, such as through ownership.

SLES can take a diverse range of forms, generally combining existing principles, such as distributed, decentralized, and community energy with a range of novel components and approaches to meet local needs alongside national objectives [2]. They may employ cleaner generation technologies to meet both carbon targets and rising energy demands, or reduce demand through flexibility and balancing services [3], and they may use new financial models to encourage local investment and employment. Smart energy systems are focused on more than the generation and distribution of electricity, integrating other sectors, such as heating and cooling, and transportation [4]. A key element of SLES, though—the element that makes them smart—is their use of data [5].

Smart local energy systems can help deliver energy services efficiently by automating complex processes such as dynamic load management and communication in smart grids [6] self-regulating, e.g., using smart meters for demand-side management [7] learning user preferences based on feedback, behaviour or consumption patterns [8,9], or at an operational level [10]. They cannot do this without data in many different forms, from second-by-second updates on the charge of batteries to the addresses of users’ homes. Often, this means that users must actively choose to share such data.

Much of the data that SLES need to function effectively is personal. That is, it “relates to an identified or identifiable individual” [11]. Because of the general data protection regulation (GDPR), SLES operators are legally obliged to pay special attention to how they obtain and use personal data, including getting user permission. Beyond this, however, data privacy is a prominent concern for potential SLES users. Get it wrong on the data—even in appearances—and the effect on trust, participation, and data sharing in the SLES could be seriously damaging. Privacy is therefore a key issue for those planning and implementing smart local energy systems (SLES). Privacy issues have been highlighted as a possible barrier to the willingness of both energy users (e.g., consumers, residents, industry) and SLES implementers (e.g., local practitioners, companies, policymakers) to participate and share data in SLES [12]. While evidence on privacy issues has been systematically reviewed in related technology fields, including smart home technology [13,14,15] and the internet of things [16], and studied in health and social care fields that gather personal data for monitoring purposes, such as in telehealth [17] and assistive technologies [18], there has been no attempt to systematically assess the evidence on privacy concerns in smart local energy systems specifically.

The purpose of this review is to investigate the nature of privacy concerns in the context of SLES to enable us to provide evidence-informed guidance on how SLES providers can minimize both concern and cause for concern around privacy.

We aimed to answer the following questions: what are the contextual factors, interventions (and their attributes), mechanisms, and other mediating/moderating factors impacting on privacy concerns as a barrier to involvement and extent of data sharing in smart local energy systems? The following section outlines the methods used to identify relevant studies then extract and analyse the evidence. Section 3 describes the findings in terms of the types of privacy concerns that can arise at different relational domains within smart local energy systems and the implications these have for data sharing. The references of each study that are included in the theme are listed. Section 4 presents a set of guiding principles derived from the evidence to help SLES providers and designers address privacy concerns and encourage appropriate data sharing.

2. Materials and Methods

2.1. Methodology

This process of reviewing literature is similar to the process of primary research but at a higher or “meta” level. Primary research collects data directly from research participants. Systematic reviews use these primary studies as their sample. A systematic synthesis uses the results of the primary research studies to answer the research review question(s).

A systematic realist review is one that attempts to include and describe the complexity of interventions—in terms of not only what works, but how, for whom, and under what circumstances. We did this by examining the interactions between the interventions, contexts and mechanisms [19]. A rapid realist review then, is one that is faster to deliver than the traditional realist systematic review, and is done in order to respond to policy issues that are emerging and time sensitive [20]. The limits applied to a rapid review may include the number of sources searched, the types or quality of evidence, or rapid quality assessments. Any such limits must be made explicit regarding trade-offs made between an exhaustive and comprehensive review, and a timely and useful systematic review.

Taking these aspects together, we apply an “agile” systematic review method. This responds to and identifies review priorities of review users, is iterative and reflective, includes consideration of complicated and complex aspects of interventions, and develops, tests, and refines theory on how an intervention does or could work. The summary of the results is translated into a testable hypothesis in the form of guiding principles for service design that overcomes and or addresses the identified barriers to data sharing. The relationship between the contexts–mechanisms and outcomes are in the Supplementary Materials.

Initial Programme Theory

We took as the starting point a problem-oriented approach to the review:

Problem: that access and use of data are key issues in planning and implementing smart local energy systems (SLES). Privacy issues have been highlighted as a potential barrier to access and use of data for both users (customers, residences, industry) and SLES implementers (e.g., local authorities, energy providers, policy makers). These barriers could limit the potential for SLES to realize good outcomes.

Figure 1. shows the first phase of a development of a theory of change based on the contexts, mechanisms and outcomes that were identified in the review of reviews of smart local energy systems [21].

The left arrows in the diagram show the contextual factors that may influence the outcomes; these exist before any intervention and are usually unchanging. The map and review of reviews that we conducted previously identified several contextual factors that may influence the outcomes, including attitudes and beliefs in individuals, the community, and local based factors, such as features of the community-led energy project. Structural contexts included the costs of processing data (i.e., higher costs for more security) and legal and regulatory conditions of data processing.

The different data collecting technologies included those related to the balancing of energy and demand in smart grids and the attached smart home systems, Intervention strategies for addressing privacy concerns included privacy friendly metering systems and technological solutions to data security. The mechanisms that need to work for privacy concerns to be overcome as a barrier to sharing energy use data included the customers’ trust and knowledge, and understanding of the processes, purpose, and operation. These mechanisms may be mediated by individual beliefs and values, such as prior experience of a breach of privacy, or recent knowledge of such. On the supplier side, barriers of sharing energy data include the value that can be extracted from it (possibly dependent on consent to the granularity of the data collection) and the security of data that can be realized.

Expected outcomes through customer engagement include the immediate outcomes of energy use behaviour change and lower bills, as a result, and wider social acceptance of this form of data sharing. Ultimately, the longer-term outcomes include a fairer distribution of energy related benefits of data sharing and decarbonisation. Negative feedback loops include those related to data breeches, increasing customer mistrust in data sharing as a result.

2.2. Search Strategy

We developed the list of search terms connected to the initial programme theory above to identify relevant documents. We applied pearl-growing techniques to search terms in systematic reviews in other sectors that were about privacy. We ran pilot searches and used different search terms in combination (adding, altering, or removing terms where necessary) around the different concepts of privacy, privacy behaviours, and regulation to arrive at a list of documents, which was sufficiently broad and manageable given the constraints of a rapid review (Table S2 in Supplemental Information).

We selected studies relevant to the rapid review from the Energy Revolution (EnergyREV) research portal and conducted additional searches for studies published in peer reviewed journals in indexed bibliographic databases, and reports published elsewhere, such as on organisational websites. In addition to searches of bibliographic databases and grey literature, we identified papers that were linked to any effectiveness studies, either as part of an integrated mixed methods study, or as a “sibling study” (e.g., qualitative, economic, or process evaluations associated with specific effectiveness studies). Supplemental evidence for systematic reviews in related topics and sector areas was conducted in Google and Google Scholar and the UCL Library portal.

2.3. Screening Studies: Applying Inclusion and Exclusion Criteria

Inclusion and exclusion criteria were first applied to titles and abstracts. Full papers were obtained for those studies where abstracts suggest that that the studies might meet the inclusion criteria. Where the title and abstract provided insufficient information to be certain, the full paper was obtained and the inclusion and exclusion criteria reapplied. Those that did not meet these criteria were excluded.

2.4. Inclusion Criteria

• Study is published in English. The review does not currently have resource to provide translations of studies published in other languages. Studies not published in English were not excluded at the search stage but were included in the count of published studies.
• Study must include consideration of privacy concern and, in particular, the role this plays in choices around to what extent customers participate. The study will not be included if it presents only a technical privacy solution (e.g., encryption) with no interaction with consumer privacy concerns.
• The study must include numerical outcomes or views and experiences.
• Study must present clear methods for their research.
• Studies with a focus on energy will be prioritized for inclusion, with studies in other areas included on the basis of theoretical and practical relevance.

All studies that met the criteria were entered into the Evidence for Policy and Practice Information Coordinating Centre (EPPI-Centre) EPPI-Reviewer systematic review information management [22] software.

2.5. Characterising Included Studies

Data were extracted from the included studies for predefined codes, such as for study type and geographical location, and inductively from the studies, such as those about participant characteristics and programme theories. We then grouped these descriptive codes into higher order, families of codes to understand the emergent themes in different contexts.

• Date of publication;
• Study methods;
• Geographical location;
• Study aims;
• Intervention aims;
• Programme theory of change;
• Type of privacy concern;
• Privacy domain;
• Participant characteristics;
• Characteristics of the person(s)/organization(s) delivering the intervention;
• Intervention type;
• Intervention components/content;
• Outcome measures;
• Intervention contexts;
• Implementation factors;
• Type of publication;
• Funder of research;
• Quality of execution of study;
• Relevance of study to this review.

2.6. Identifying and Describing Studies: Quality Assurance Process

The review teams (C.V., C.M., and M.F.) took samples of initial hits from the search strategy results to blind screen in pairs against the Title and Abstract coding tool. Discrepancies were discussed until agreement was reached. Sampling of records continued until 100% agreement was reached. We used the same procedure when data extracting from studies, with random samples of studies selected and compared between pairs of reviewers. Data extractions were compared for clarity, meaning, and completeness and any areas of disagreement discussed with reference to a third reviewer (D.S.) as to adjudicate when consensus could not be reached.

Individual studies were quality assessed with a checklist appropriate to each of the study designs, to assess the threats to validity common to these types of studies and steps taken by authors to minimize bias. The checklist assessed the study’s:

• Internal validity: how reliable the study is in its execution.
• Construct validity: the extent to which the concrete measures in the study match up to the intervention theory of change [23].
• Conclusion validity (rigor): the reliability and trustworthiness in reaching its findings and conclusions [24].
• Relevance/generalizability: to what extent the findings are replicable and generalizable to the SLES context, as well as the relevance of the study to this rapid review.

3. Results

Thirty-four primary studies met the inclusion criteria for the review [12,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57], with a further 11 systematic reviews providing evidence from related sectors. The following chart shows the flow of studies from the initial “hits” from the search strategy through the screening on title and abstract and on full text with results for each category.

3.1. Description of the Included Studies

Smart local energy systems (SLES) is a relatively new research area [58] and research on privacy concerns around energy sharing data in this context even more so. Consequently, two-thirds of the studies included in this review were published in or after 2015 and none published before 2011. The vast majority of studies were conducted either North America (over a quarter in the USA alone) or Western Europe (with around a fifth in the UK). They covered a wide range of academic disciplines, most commonly computer science, energy, social science, technology, business and engineering. With the exception of a few industrial or commercial reports, all of the studies were published in academic journals or as conference papers. While nearly half of the studies examined either smart meters or smart grids, the rest investigated a range of technologies and approaches. For those studies carried out in a particular setting or population, most were based in an urban, residential environment with adult participants, primarily of working age, participants usually had some knowledge and experience of Smart technology use.

Around three quarters of the studies used observational methods, predominantly surveys, case studies or interviews. These were mostly used to investigate what might affect people’s perceptions and acceptance of an intervention or technology although some used these methods to assess technology development or implementation. The quality of these studies was mixed: although many were highly relevant, fewer were highly robust (half of the surveys and case studies and none of the interview studies). There was only one experimental study that tested the effect of a real-world intervention.

Most studies on people’s perceptions and attitudes, psychological measures were used more than any other type of numerical measure; most frequently measures of privacy concern or acceptability. Measures of technological performance and social norms were also used by some studies while a few measured behavioural or economic outcomes. Only one study measured environmental outcomes. Themes that emerged from qualitative studies most commonly related to the people involved in SLES and the impacts of SLES: the actors involved, who sees the data and who benefits.

3.2. Methods of Synthesis

None of the included studies measured numerical changes in outcomes that would be suitable for a meta-synthesis. Instead, a narrative, thematic framework synthesis was performed. We identified the patterns and themes in the texts of the included studies’ findings. We used the socio–ecological model (SEM) [59] as an organizing framework for understanding privacy and privacy concerns in different contexts. Understanding privacy as the management of information about oneself that it appropriate to different relationships in different contexts suggests that information sharing is which is appropriate in one contextual domain may not be appropriate in another. Breaches of privacy could be understood as the inappropriate or unauthorized transfer of information or knowledge from one domain to another. The framework offers a guide to understanding the different contexts of the determinants of privacy concerns and the barriers and facilitators to data sharing where interventions to address privacy concerns could target their efforts. The socio–ecological framework starts with the individual, their personally held beliefs, preferences, sense of self, and core values. The micro system round the individual consists of the closest interpersonal relationships of family and home, and around this is the mesosystem of two or more systems in which the individual actively participates, such as the workplace or community in which they live. The outer domain is the macro system consisting of relationships of wider influence, such as the social and cultural contexts in which the micro to meso are situated.

Compatible with the realist review approach, we considered the programme theories for studies that aimed to overcome privacy concerns and the common themes of barriers to data sharing. Where evidence was limited, we searched for additional systematic review evidence from related sectors that share comparable problems, and issues with privacy concerns to further develop and refine the theories on interventions that would be effective in overcoming privacy concerns, how, for whom, and in what contexts.

Figure 2 shows the flow of studies through the review process, from initial “hits” from searching of different sources, through the screening on titles and full texts and reasons given for each exclusion, to the final number of included primary studies and systematic reviews.

3.3. Privacy Concerns and Barriers to Data Sharing in Different Domains

The included studies suggested that, where there were privacy concerns, these were around the intensification of home-based data collection proposed by smart local energy systems, particularly smart meters, and that patterns of behaviours that could be inferred by this had the potential to disrupt the socially acceptable norms of control over information about oneself in the different domains.

Figure 3 shows the privacy concerns in the form of barriers and facilitators to energy data sharing in these contextual domains. Interventions that overcome or address these privacy concerns then, we can hypothesize, will facilitate data sharing.

The most commonly expressed type of privacy concern in the individual domain was around the individual’s sense of autonomy choice and control (16 studies).

Control was a term used in diverse ways. It could be described by study participants as control over who has access to information, or control over what happens to the information after it was collected and/or used, or could also mean a sense of being controlled. Privacy concerns around autonomy choice and control were bound up in the desire to defend and control the depth and breadth of personal data that were shared, to limit the uses of the data.

Fewer participants expressed privacy concerns around data ownership, which was around having control over the data collection and its use, as well as having the option to delete data [57]. Participants were less trusting of profit-making third-party organizations to work in the participants’ interests, but did not seem to be overly concerned with the value of the data they shared. Few thought it had or could generate value to themselves.

Participants were familiar with the idea of address and account data being anonymous. In one study [31], nearly all (90%) participants considered anonymity would be a condition of data sharing and assumed that data would be anonymized as a privacy preserving measure.

Identity privacy refers to more than the technical information of addresses and bank details in anonymity privacy, but is around protecting or reserving the information that could be used to infer who a person is, their interests, preferences, and ways of living [42]. Some felt this could create a commercial identity profile that could be used for segmented advertising and marketing, which individuals would not have visibility of and over time could limit people’s choices [56].

Even where privacy concerns are low, having a perceived lack of control over data sharing creates concerns. Participants indicated a “principled desire” to be in control of their data sharing such that they would be able to decide, for instance, which parties could access the data under which circumstances. Setting the boundaries around who has access to data and who has ownership of the data, shares both risk and responsibility between the customers and providers through the mechanisms of choice and consent

“For now, I don’t see any way of misusing my data that could turn out to be my downfall. […] It would be nice, however, to see what data is transferred or stored. If I can control this, it’s on me to decide what may be transferred or used.” ([40] single-person household).

Perceived loss of control over the use of data can be a barrier to participation. For many participants, costs savings were an incentive to share data, and one way of realizing costs savings was through flexible energy demand use tariffs. Included studies that considered privacy and balancing energy demand to access lower charges found that relinquishing control and decision-making over the use of their appliances or vehicles to balance energy demand was intrusive and perceived to be disempowering for some people [29,33,35,40,42,43].

There were some positive views over giving over some control, if this meant that there was an energy expert overseeing the function of the system and could warn of any issues suggested by higher than usual energy consumption.

Participants expressed a desire to keep control over times of day or that some practices that should not be given over to remote control [26]. For some participants, the thought of losing control over appliances or level of heating in the home was given as a reason for non-participation.

A community-based energy project also showed sensitivity to the fact that not everyone can change their individual energy demands on demand from the community energy systems and the reasons may be unknown to the group. None of the participants suggested that the group had a right to know what those circumstances were.

“…because you don’t know the situation of the people in the house… So just to…choose to switch off someone’s electricity...... I know that we could make do and we’d be fine. .... But there are other houses maybe they couldn’t or maybe there’s something about them that we don’t know…” (Frances, [44]).

Options to opt out are often a condition of opting in. In nine studies, participants raised issues over having the choice over setting the boundaries of data sharing, and this was a conditional barrier to data sharing [12,29,33,40,42,43,46,48,51]. Even when privacy concerns were low, participants wanted to know what information was being shared with third parties in order to make informed choices in what data to share and with whom, and in doing so, share responsibility for the data sharing with the vendor [40,43]. When given the choice, most customers do make some changes to disclosure settings [42]. Projects noted the need to involve customers at the earliest opportunity to allow them to choose the level of involvement [33]. Where no choice exists in the form of opt outs, the numbers of people who wanted smart meters dropped by a third in one study [29]. Some people do not wish to relinquish control at any price. For some, this is due to the lack of trust in energy providers to work in their best interests [12], while others do not wish to see their choices limited in their ways of living, such as by lowering heating temperatures or turning off appliances [38,51].

When people are given detailed information about potential privacy risks for all situations, this can seem overwhelming, create a sense of lack of personal control, and in some studies; participants then withdrew consent. Providing information does not necessarily overcome privacy concerns and can have a negative effect where concerns were low to start with [40,43]. It was also reported in one study that many of those with a smart meter could not recall the level of consent they gave and a third of the respondents could not recall what level of data they gave consent to share [29]. Another study found that people would withdraw their consent at the point in time that the terms and conditions were presented to them [42].

People’s prior experiences and direct knowledge of data sharing affects their decisions and understanding of potential risks. Increasing the practical knowledge of how technologies work can alleviate privacy concerns.

Few people reported that they had personally experienced a data breach, but those who had showed less support for smart meters and data sharing [37]. Knowledge around data sharing and privacy was generally low. People had little knowledge of what opportunities and benefits there were in data sharing as well as little knowledge of the energy efficiency of appliances and actual prices of services [27,31]. On the other hand, people who considered that they had a good understanding of how things worked were more positive towards data sharing [29,30]. People who were more positive towards technology use in general were less opposed to smart meters [37].

When asked about what the most important elements of informational campaign to introduce smart metering systems, participants said it was knowing more about how they worked [26]. People who have the smart meters (and know more about how they work in practice) are more willing to share data [29].

Additional review evidence on technology use and acceptance, find that “privacy perceptions influenced trust, which in turn influenced the perceptions of risk” [60]. As perceived risk ultimately impacts on an individual’s intention to use, this was a negative predictor of new technology use and acceptance [51]. The individual’s trust in the sender of information about risk influences their decisions about the balance of risk and rewards and intention to use the technology.

Several studies show that people are already familiar with settings and controls over their data sharing. Nearly all participants in studies who were offered options to adjust controls over data sharing did so. Some participants accept that controlling privacy and access controls may be necessary, but also inconvenient, even annoying [56]. Most people shared information informally with friends and neighbours to compare energy use, costs, and efficiencies of appliances and so on. People felt that sharing of data to third parties was a fact of life, even if they were not necessarily enthusiastic about it [46] or felt that it was largely out of their control. However, it is worth noting that participants in seven studies were selected for their prior knowledge of smart meters, or similar data collection technologies, in order to have an opinion about them [12,26,41,42,49,57]. As a result, people who are already comfortable with using technology (and privacy controls for them) are likely to be over-represented in research about data sharing technologies.

In one large UK based study, people who did not have smart meters were more likely to believe them to collect intrusive data than people who had smart meters [29]. As this is comparing people who have meters with people who do not, but not comparing attitudes before and after, we do not know whether (a) privacy concerns were a barrier to participation for the people who did not have the smart meters, or (b) that privacy concerns are allayed for customers once they get them, as they get to know how they work or that privacy is no longer a concern at all, given how useful and integrated into usual routines it becomes, like other data sharing technologies in common use.

Saving money is often cited as an incentive for the enrolment in initiatives that require sharing private data, but the evidence on how they achieve cost savings is mixed.

People tend to be willing to share data for cost savings from paying only for the energy they have used instead of estimates and forecasts, and changing consumption patterns to cheaper tariffs at different times, but there is less sustained behaviour change in reducing consumption and some reluctance to allowing energy providers to decide energy saving consumption patterns for them.

However, there is a danger that low energy use customers will be unable to realize any cost savings if they cannot reduce their consumption further and/or are unable to change their energy use habits, e.g., single, older people (for whom cost savings were more of a priority), people on low income who are operating their energy usage at a minimum already, people with caring responsibilities, and people at home with health conditions that have higher heating needs.

In order to anticipate energy costs savings, customers should be able to anticipate what sorts of savings they are likely to make before consenting to share data in exchange. A 2018 systematic review of consumer perceptions of energy use and energy savings in the area of energy savings strategies suggest that people are not very knowledgeable in this area and tend to underestimate energy usage in high-energy using devices and overestimate energy use in low usage appliances [61].

The review found four studies that said that people who were concerned for the environment were more likely to engage in data sharing and were less concerned about privacy. These individuals were sometimes described as intrinsically motivated—that is, participating towards the benefit of the environment was its own reward, but some participants also respond to seeing proof of environmental gains, and being seen to “do the right thing”. However, the sustainability of exchanging privacy for environmental gains is not clear. Two of these four studies measured behaviour change. One found that students who belonged to an environmental group performed better than non-member participants, in reducing their consumption of energy when energy use data were made public. It was not clear whether the positive behaviour change was sustained over the longer term. The other study showed that people with pro-environment values were less concerned about privacy and had a higher enrolment rate in utility-controlled charging for their vehicles. The other two studies tended to ask people about their future intentions, or reactions to hypothetical situations.

Looked at another way, the social desirability of having concern for the environment could be considered a potential source of bias in surveys that ask people about their values and associated future intentions. While beliefs and values are predictors of future behaviour, there exists a value-action gap between what people say is important to them and acting on it when given an opportunity to do so [62]. Studies that have identified this value-action gap related to environmental and climate concerns include waste recycling (at home [63], at schools [64], and colleges) [65] use of transport [66], electric vehicles [67] hydrogen energy [68], eating meat [69], and more. There appears to be a weak relationship between pro-environmental values and sustained behaviour change [70].

3.4. Privacy, Barriers and Facilitators in the Micro, Interpersonal Contexts

Types of privacy in the home domain included: location privacy—i.e., that data may reveal the physical location of the home to inappropriate individuals; traceability—i.e., that data breaches and subsequent inference may reveal information about the household; and relational privacy—i.e., that data contains information about oneself that manages the norms, roles, and expectations of one’s relationships with others. Relational privacy mediates the choice and control over who one enters into relationships with.

Second only to the individual’s sense of self, autonomy and control, studies revealed that the home was considered a reserved space and can be guarded on principle without any direct or specific threat to privacy identified. Home was described as a “castle”, a refuge, a protected and private space for peaceful enjoyment and non-interference [12,28,42,52,53,54,55,57]. Vehicles enjoyed a similar level of privacy that was valued by customers.

“The fact that the electric company can tell when I’ve turned on the dishwasher or a light bulb or the TV—that’s pretty fascinating to me. I don’t know how they do that, but do I want them to know that? well it’s not a bad thing. It’s still a private thing…” [28].

Positive family influences as a facilitator to exchanging privacy for benefits of reducing energy consumption. There is some evidence of enthusiasm to view and share data on household energy use for the purpose of comparison with other family members. There was (at least initially) interest in knowing how much energy different devices used, and in educating family members in energy use. These studies usually asked participants about hypothetical scenarios and intentions to use so it is not clear to what extent the change in household energy use is sustained in the longer term after this initial enthusiasm (see also privacy exchange for cost benefits through behaviour change in the individual domain). Some studies showed that the initial enthusiasm waned after the implications of detailed energy use data sharing became apparent [12,28,42,45].

Several studies indicate that people were reassured of their privacy concerns with personalized and detailed communication about the purpose, use and benefits [26,27,30,33,41,42]. Personal visits were preferred in one study [26], with over half of the participants saying that they would like detailed information on how the system worked, and would enable fast detection of faults and repairs, while older people preferred communication by letter followed by a visit [26]. Successful interactions and communication of benefits were tailored to the household. In one study, people were disappointed and surprised that the smart meters did not seem to be compatible with other smart devices in the home, and felt left to their own devices to work out how to make the system work, with concepts that were unfamiliar to them (such as using if-then-else algorithmic logic) [42].

There is some recognition of the potential for privacy issues to arise when data on activities, etc., are shared within households, as well as to third parties. In households with multiple users, there may be many different privacy concerns and energy saving or cost saving priorities [49] and a model of the consent with the sole “bill payer” may not reflect the diversity of risk and benefits of sharing energy usage data within the household. One participant in a study of a smart home co-design [57] expressed concern over other members of the same household being able to access to her credit card details, and suggested voice recognition as an authentication that could allow for multiple users.

Detailed energy use data could reveal patterns of behaviour that family members would wish to control or limit visibility of under typical circumstances, such as adult content TV viewing or who is (or is not) doing the chores around the house [28]. Detailed and real-time energy use data could enable some family members to monitor and control the behaviours of other members of the household in ways they were not able to do before, and may not be welcome by other members of the household [49].

“So… he monitors it all on his thing (computer) and it drives her insane! So, she thinks its dreadful, she feels violated all the time, cos his workmates will be walking past his desk. One even called her one day saying ‘Wow Kay, your power is going through the roof!’” [49].

Such technologies that can reveal patterns of behaviour, location, or control over devices and will need to consider how such technologies can be used as “vectors of control”. There was little direct evidence from the energy sector on the impact of energy data collection on coercive control in the home, although this was indicated in the disquiet of members of the household, aware that there could be a shift in power through information within the home.

Research on the use of smart technology for coercive control in the home is limited, most likely due to the fast-changing pace of new smart technologies for the home being developed, but the UK charity Refuge had already identified that 72% of their service users had experienced some form of technology-mediated coercion and control. In response and in consultation with domestic abuse charities, IBM has recently published a report on coercive control resistant design principles [70], which, in the context of providing smart local energy, are:

• Diversity. SLES providers should recognize their diverse user base and have a diverse development team.
• Privacy and choice. SLES providers should empower all of their users (not just the named “bill payer”), to easily make active and informed decisions about their privacy settings.
• Security and data. SLES providers should build secure technology, and only collect necessary data, which will limit the risk that the data can be intercepted and/or be used maliciously.
• Combatting gaslighting. Data collection and control over data should disrupt attempts at manipulating someone into doubting their memories and judgement with pertinent, timely notifications, and auditing, i.e., there should be limits to deletion of records of activity.
• Technical ability. SLES providers should ensure that the use of the technology is intuitive and can be understood by all who could be affected by it, regardless of their technical confidence.

Participants in four studies [42,43,44,45] expressed concerns that there was potential vulnerability to criminals who could use detailed energy use data, i.e., patterns of no (or very low) usage data that could show when the resident is not in the house. Perhaps surprisingly, this was an aspect that was only superficially explored in the studies.

“…They could even ‘see’ when you are going to bed [by seeing when you] switch off the lights.” [41].

3.5. Type of Privacy Concern, Barriers, and Facilitators in the Mesosystem of Community, Social Groups, and Work

Reputational privacy is difficult to define. The person whose reputation is in question may be largely unaware of it, except when it is perceived to be damaged. This includes the control of information about oneself that affects others’ opinions about one’s good standing. Reputation represents a shorthand heuristic for the confidence that can be placed in us to “do the right thing” or to be trusted, and for this reason, reputation has value and is to be protected.

The internet and records held in digital form provide an element of risk to privacy and reputation not seen before. Digital records offer greater levels of access to a greater number of people and makes the diffusion and lifespan of information difficult to control. Eight studies considered reputational privacy or related privacy concerns in the mesosystem of community and workspace [12,27,28,31,44,49,50,53].

People tend to be willing to share energy data with family, friends, and neighbours to make comparisons of technology (demonstrating little privacy concern in this kind of data sharing) [12,31,48,50]. Comparing new technologies can be a conversation-starter, a way of learning about how technologies work, and their functionality and other people’s experiences of them perhaps show them off, but there was less interest in their energy use [48]. Learning that a technology is widely used suggests that its use is socially acceptable, and so the risks are assumed less [50]. Sharing knowledge can foster a supportive environment where individuals learn and get recognition from their peers [31] and feel part of a collective good [44].

“Sometimes it feels a bit futile if you don’t think anyone else is doing it. So, I think if you know that other people are doing it, it makes you feel you’re having a bigger impact” [44].

One of the studies was based on a community energy project and considered peer pressure in the context of a community project, with the other studies mainly limited to participants’ views of their future intentions and hypothetical scenarios. The study of community energy in practice also cited some negative effects of peer pressure, which could impact one’s reputational privacy in the community. Willingness to share energy use data with neighbours seemed to decline as individuals considered how these data might be used.

“You can also see it as an invasion of your privacy. Someone is going to meddle in. You might experience some sort of social pressure on the way you do your housekeeping.” [47].

Participants in several studies were more trusting of organizations that did not have vested interest in energy to handle their data. These included government agencies, consumer organizations, and environmental organizations [46]. One study [29] found that it would be acceptable for police to have access to energy use data to identify some kinds of crime and for data to be shared with health care providers for vulnerable customers.

While these organizations were seen to uphold standards, to be neutral, and provide safeguards, study [28] found that a regulatory framework provided reassurance (and overcame privacy concerns) to customers who appropriated safeguards over their data was in place.

Other studies suggested that the energy provider could be the trusted organization, but that involving more organizations posed a greater risk to data in terms of misuse and data breaches.

Rather than being seen as intrusive, input from local energy providers as experts may be welcomed, where this helps with complex or unfamiliar technologies or provides a clear benefit, such as monitoring for safety or spotting unusual consumption patterns that could indicate a problem, and could even harm the user experience if this expert oversight is absent when it is expected [12,35,42].

“We have those sensors in the rooms; then I see it as natural that they look if it runs alright. Or are they just letting everything run without even keeping an eye on what is going on? There must be a reason for why we have sensors in various rooms.” [35].

While community control and accountability can be appealing, it undoubtedly requires time and effort [29,53]. Some energy users expect this to be part of the service provided by energy companies (part of the premium), particularly enforcement, which can lead to ethical issues or could create unpleasant environments when done by peers. Energy companies can provide the middle ground, neither too close nor too distant. This means that relational and reputational privacy between the members of community’s energy groups can be maintained by being released from responsibilities of monitoring and disciplining its members [46].

In study 30, participants pointed to the energy company as arbiter in “conflict situations” that could arise in the absence of formal rules and with “a lack of authority over someone else’s roof”. Energy companies could serve to provide the “new balance” that allows for more de-centralized and democratic control over energy production [12].

“…If you have the ambition to become energy-neutral, then you need to have an element of exchange. And if you exchange, you need an institution to organize that.” [12].

Without the right incentives or regulation, there was a general shared feeling that companies may prioritize their interests at the expense of their customers’ interests, which may have a self-defeating impact on uptake [29,35,38,40,42,51,53]. Customers believed that the main benefit was likely to be to the energy companies and not to themselves [42,51], or at least not enough benefit to make any disruption or change of energy use habits worthwhile [29]. Study aims of providers suggested that without widespread support from the public, the commercial benefits of SLES may not be realized [40,53].

Only one study suggested privacy concerns around work life could be a barrier to data sharing. In one area, it suggested that energy use data could be used to over-monitor workers’ behaviours—employers monitoring employees’ time spent making coffee, for instance—and in another it suggested the differences in the appropriateness of sharing data for professional purposes compared to personal use [42]. In vehicles, the event data recorder (EDR) was acceptable in professional vehicles, but most refused to equip their private cars, as they perceived this to be an invasion of privacy.

As mentioned in the relational privacy in the home, this detail of data collection has a potential to be a vector of control, in providing opportunities for more surveillance than would be expected than in private life. On the other hand, increased patterns of home working are likely to blur the distinction between home and work-life, and home and work energy demands. Before the COVID-19 pandemic, figures from the Office of National Statistics (ONS) [71] showed that 13.7% of the UK workforce worked from home, and was part of an already rising trend (the latest figures from ONS, 2020, under COVID-19 now shows this is now 46.6%). Homeworking may become the default for those that can, at least for the foreseeable future.

In terms of privacy, people are likely to share their home with others who are not part of the same organization and confidentially and security of data may be at risk in the home. There may be security issues around the transmission and storage of data and the use of personal devices for work use. This was a concern raised by organizations, but not for individuals.

Most of the information on types of preferred communication came from one large study of four case studies with several thousand participants [54]. The case studies described lessons learned in the implementation of community wide smart local energy systems; however, privacy was discussed only briefly. The study found that customers want simple, timely and tailored communications (e.g., weekly emails about bills). Customers valued reliable and predictable bills; weekly emails were appreciated to avoid monthly “bill shock”.

It was clear that there was no one-size-fits all solution when it comes to channels of communication, with some customers preferring self-guided means of accessing information, while others preferred active communication from the energy providers. Web portals were more mixed in their success and their overall effectiveness was still “an open question” customer requests were for website interfaces to be easier to understand and use than currently.

3.6. Types of Privacy Concerns and Barriers and Facilitators in the Macro Socio–Political, Economic, and Cultural Context

The types of privacy concerns that related to the macro, socio–political, economic, and cultural contexts were surveillance and discrimination by social, political, or market stratification. Concerns around surveillance talked about government spying and “Big Brother”; a general unnerved sense of being watched or investigated without any specific reason [12,26,30,36,38,42,44,47].

Data used to discriminate against individuals included price and product discrimination, where individuals were presented with different offers and tariffs based on their membership of groups of similar types. This erodes individual choices and rights by being subsumed into broader political, commercial, and social groups. There were concerns around not being able to know that they were being treated in non-preferential ways, and so would be unable to challenge or rectify this [12,25,34,47,56].

Social norms are defined as the “rules and standards that are understood by members of a group, and that guide or constrain social behaviours without the force of law” [72].

In a review of reviews on social norms [73], authors found general agreement in the reviews on what social norms were in that they incorporated some element of “social” and that they usually help with decision making in some way. Most of the reviews said that they incorporated an understanding of cooperation and social order, and that social norms affect people’s wellbeing. On the other hand, social norms can encourage negative behaviours, such as smoking or drinking alcohol, discrimination, even violence against socially perceived outgroups. Expectations of social norms are not seen to influence participation more than individual beliefs about technology, concerns for the environment, or incentives. Widespread adoption may help establish a social norm and expectations that something that is widely used, or approved of by their friends, can be assumed trustworthy. The impact of increased individual understanding of smart meters, however, was contradictory in this context as it both reduced the demand for social norms by emphasising individual decision making, whilst simultaneously increasing the expectation for social norms against smart meters when more was known about the types of data they could collect [12,37,39,50].

Social norms around privacy and data sharing technologies are an influence on people’s decisions—that there is societal consensus that privacy is an important aspect of life that should be preserved. Social norms can take time to catch up to the new challenges of emerging technologies and their uses. Companies that use data in novel ways may find resistance from customers who find its use “creepy”, in that its use may be legal, but not generally considered socially acceptable [74].

In related systematic reviews, social norms were found to have a significant effect on a range of pro-environmental behaviours, and in other studies, people who expressed environmental concerns appeared to be less concerned about data sharing). In defining social norms, the review adds to the definition given above the idea that social norms are something that are conditionally followed, and motivated by external (vs. internal) enforcement. What people approve of doing (injunctive norms) and what people actually do (descriptive norms) can be considered another expression of the value–action gap.

For people who look to social norms, to decide whether new technologies are generally accepted, there is a risk of over- or underestimating the general consensus view.

In the review of reviews of social norms, correcting misperceptions was, by far, the most commonly cited intervention through which to change social norms across the reviews.

Social norms can be influenced or corrected for misconceptions in normative beliefs by sending/receiving more accurate information as individuals can over-estimate the approval or disapproval of others in the same social group to reflect their own beliefs. Injunctive norms are commonly more effective in changing behaviour as they signal clearly the approval or disapproval of the group in taking a given action. Moreover, injunctive norms are more effectively used in interventions when framed positively. Focusing only on the negative behaviour one wants to change signified that this behaviour is a social norm, so, for good or ill, acceptable.

The correcting misconceptions approach was often used by health interventions that encourage change in behaviour by demonstrating that fewer (or more) people than thought engage in the behaviours.

Three studies considered the impact of the public mood on privacy and data sharing [27,29,46]. All consider the recent impacts of negative experiences of data sharing on general acceptance and participation in smart meters [44], smart grid [46], and energy markets, particularly in switching [29]. Negative media stories could communicate more widely any problems and issues around privacy and data sharing, affecting societal acceptance. For people coming from a low-knowledge base of energy systems, these media stories could be the main source of information for people on the risks of data sharing with energy companies. The intensity of the telling and retelling of news stories of data breaches and online privacy violations may amplify this perceived risk [75], to a wider group of people, and now other platforms, such as Twitter and Facebook [76]. Recent examples of how smart meters are represented in UK media, on both left and right, include media stories with headlines of “is your smart meter spying on you?” Guardian 2017, “The smart meter snoopers: already in homes as part of a little known 20 m plan to track energy habits” Daily Mail 2019.

Allowing market forces alone to govern the types of in-home displays available to customers, to help them change their energy use behaviours, may have been the reason uptake has been slow and the projected energy savings were not realized [53].

In the same study, it was suggested that competitive tendering needs to balance being specific and being realistic about the level of security that is required: being too specific could limit the market actors that can meet such high standards and so raise prices, and yet leaving the requirements too vague would lead to a “race to the bottom”, in terms of pricing and standards.

Manipulation of the goods and services displayed to customers via targeted advertising was generally unpopular [12,42,55]. The balance of market forces and regulation are also context specific; UK rules on using data for marketing goods and services falls under GDPR, which states (amongst other things) that “Marketers must offer a clear opt-out, inform the individual of the processing activity and have a compelling case for why someone may be interested in their goods or services.”.

Trust in government represents confidence of citizens in the actions of a “government to do what is right and perceived fair” [77]. There were mixed impacts of trust in governments: in some cases, a lack of trust in government may encourage the independence offered by SLES individually or in community projects [12]. More frequently, however, the distrust of technology that passes data to government (e.g., smart meters) may discourage participation in SLES.

Many of the studies reported that there was a general fear of government surveillance, but this concern was often non-specific, a general unnerved feeling of being watched or of a creeping of authority and surveillance into the home, sometimes described as “Big Brother” [26,34,36,53].

The sharing of data for one purpose did not raise concerns, however combining with other data sets to form “big data” did. Such large-scale data uses could socially, politically, and economically “sort” individuals [72], leading to discriminatory practices that, being a commercial practice, would be subject to less scrutiny and regulation that that of data collected and used by the state. This may limit the choices available or make correction of mistakes near impossible, as this segmentation would be hidden to the individual [12,56].

“I have nothing to hide. It is just that connections will be made between different databases. That will result in a profile. For many that profile will be just fine, but for a small minority this profile will mark them as terrorists!” [12]

A systematic review of the potential applications of “big data” in smart energy management reported potential benefits [78]; it also listed security and privacy as one of the most serious challenges. The review suggested customer ownership of data as a right, and customer data used only with explicit permission. It also suggested governmental regulation and industry self-regulation as possible solutions.

Concerning data sharing, profit-making organizations tend to be trusted less than other data users [46]. This was either based on experience or it was seen as safer by default to distrust them until more was known about them. Organizations with vested interests were the least trusted (insurance companies for vehicles specifically, and advertisers generally) [37].

Public opposition is heightened where there is no opt-out provision. Providing “opt outs” that require consent to share data will likely reduce public opposition to smart meters but perhaps at the expense of slower uptake.

Where the implementation of smart meters was compulsory, this was met with organized, public resistance that was enough to delay national implementation (The Netherlands [38,53], Canada, USA, [53], and European countries [42]).

In Germany, where smart meters are mandatory for large energy use customers, new builds and existing structures undergoing renovation, privacy, and data security concerns were a major reason for the late introduction of an opt-out clause for customers (although not for large energy use customers or prosumers) [42].

National case studies of implementation of smart meters in the USA consistently found that giving customers the choice of opting out was a condition of opting in. However, opt-out rates were also lower where there were financial penalties or costs of opting out.

The regulatory environment applied to data sharing may affect perceptions of risk by the public and, therefore, the expectations of privacy protection that govern policy decisions [38,42,48,53]. Data policies in a single country may fall foul of regional, e.g., European laws. In one study [53] the initial proposals of laws for smart meter rollouts did not consider consumer privacy beyond the Dutch data protection act and conflicted with article 8 of the European Convention on Human Rights.

3.7. Demographic Factors That Impact Data Sharing

All demographic groups expressed concerns over data privacy and there were no specific demographic characteristics that made people more likely (or less) to share data than others. Across all social groups, two factors indicated reluctance to share data: prior knowledge and experiences of data violations.

Most of the participants in the studies were well informed, “tech-savvy”, and already engaged in technology and data sharing. Often this was a condition of participation, or participants self-selected into the study based on their prior knowledge and interest in the topic. Groups that were underrepresented in studies were those groups that are often described as “hard to reach”. Groups that are hard to reach are at risk of social exclusion or isolation and in the context of technology, or SLES, may be left behind from the benefits of shared decision-making and a decentralized, more democratic energy system. The definition of hard-to-reach is not uncontested; it will vary from place-to-place, and understandings may differ based on the level of their “hard to reach-ness”. One reconceptualization of hard to reach is “far to reach”, which places the emphasis on the service provider to make the effort to overcome barriers [79].

People in lower socioeconomic groups in the included studies said that they were less likely to be aware of the data sharing choices available with smart meters. Research from related areas suggest that people with low income are less likely to have the technology resources that would gain confidence in the privacy implications of data sharing [80]. On the other hand, people on low incomes are more likely to rely on data sharing technologies that are insecure (such as cheap, older smart phones). In one survey of U.S. low-income privacy attitudes, lower income groups were more (not less) concerned for potential privacy violations than their wealthier counterparts, as they were aware of the privacy risks, but felt they had little choice in the technologies available to them [80].

Fuel poverty organizations, such as the National Energy Action (NEA) campaign for Action for Warm homes, recommend sharing of energy use data to support fairer, accurate and transparent billing, and to give greater control over energy consumption [81].

Barriers and facilitators for older people identified in these studies included a greater interest in saving money than in environmental concerns [26] (people who are more environmentally concerned are less concerned about privacy when saving energy). This is also found in other research that says that environmental concerns and active participation (joining environmental groups, outdoor recreation activities) declines with age [82].

Older participants expressed more expectations of (social) norms against smart meters [40]; however, as with other groups, individual assessments of risk were more important than perceived social norms when making their decisions about smart home devices [83].

Evidence from related sectors show that families are often involved in decisions in using home-based technologies, such as assistive technologies [18] and providing additional support on tailoring the technology to meet individual needs encourages its use [15].

Older people’s incentives to share data may differ to younger people priorities: families may welcome the opportunity to remotely monitor their loved one, to alert them to safety or health issues by tracking usual activities [36,42], but older people themselves had mixed feelings about data sharing from not wanting to be a burden, to feelings that an over reliance on technology could replace human contact. Older people were generally positive about the benefits of smart homes for assisting with independent living and health monitoring but it was important that they were to make this choice for themselves.

There was no direct evidence of privacy concerns being barriers and facilitators to tenants in the private rented sector in the energy related studies, but in related sectors, a systematic review of the tenant and landlord perspectives of energy efficiency interventions finds that, in areas of high demand, tenants may not feel they are in a position to bargain or negotiate with their landlords over sharing data for energy efficiencies, particularly if there are installation costs involved. In terms of privacy concerns, suggesting that tenants engage with sharing energy use data and install smart energy technologies may infringe upon their relational privacy between the landlord and tenant in unwelcome ways. Tenants may not feel that any disruption brought about by installation is worthwhile if they are not staying in the property for a long time, or they may fear retaliation in their tenancy not being renewed if they develop a reputation for being troublesome. There is a mismatch between the investment of the landlord and the beneficiary of the tenant in energy efficiency measures; the so-called principal–agent problem.

“If the potential adopter [of energy efficiency measures] is not the party that pays the energy bill, then good information in the hands of the potential adopter may not be sufficient for optimal diffusion” [84].

The review suggests that private rented tenants, without a central unified tenants association, are in a poor position to negotiate with landlords, and not necessarily uninterested in data sharing. Likely solutions to this problem include economic and regulatory incentives as well as working with both the landlord and tenant.

More barriers to landlords include the time and financial investment needed when there is a high turnover for tenants as technologies would fall into disuse over time as tenants change fairly frequently [85]. According to the Office for National Statistics, younger households are more likely to rent privately, with those in the 25 to 34 years age group representing the largest group. The private rented sector accounted for 20% of households in the UK [86].

UK government figures for the proportion of households renting from social landlords were 17% of UK households (3.9 million) in years 2016–2018. The average age of social housing tenants tends to be older than for the private rented sector. The average tenancy length in social housing is 11 years compared to 3.9 years in the private sector [87].

While landlords in the private sector may be reluctant to install data sharing technologies for their tenants, social housing landlords appear more enthusiastic [88]. There are benefits of economies of scale and stability of tenure compared to the private rental sector.

In related systematic reviews [89], found that social housing tenants were more motivated by cost savings than environmental concerns (this may be a function of the older average age of social housing tenants). Tenants were willing to respond to energy use feedback, but this was sustained only with ongoing engagement and education efforts [90].

Lack of genuine engagement and involvement of social housing residents in the development and implementation of renewable energies led to declining trust and a lack of belief in the benefit of engagement, which in turn led to little or no change in energy use behaviours [91]. Residents may not have had much of a choice, an intrusion on their relational privacy, about whether to share data or not, but they were able to resist in-kind with non-participation in adapting their energy use behaviour. Social housing residents who were characterized by being elderly, fuel poor, high-heat users may be less likely to engage in or benefit from sharing data without additional support.

The review suggests that implementers should be careful not to “oversell” the positive outcomes expected [92]. Providers who work with and involve social housing tenants, cost-in, and provide ongoing support, education, training, and maintenance of the technologies were more likely to be successful in achieving tenant’s acceptance and engagement [93].

3.8. Theories of Change in Studies

Few studies directly addressed people’s privacy concerns with interventions designed to overcome them. Instead, studies described privacy concerns around data sharing technologies as potential barriers and facilitators to technology use and associated data sharing. Mechanisms were the behind-the-scenes, cognitive, emotional or behavioural “triggers” that act as elements in decision making balancing privacy concerns with benefits of data sharing.

Privacy concerns were related to the perceived individual and social consequences that an unauthorized sharing or use of personal data would have in different contextual domains. As data sharing technologies are not without risk, interventions to overcome concerns about the impacts of privacy breaches would be successful if they can minimize the impact of any potential breach of privacy by design, as well as understand the how different types of privacy concerns are incorporated into people’s decision making about sharing data.

Thirteen studies explicitly referred to a theory of how interventions to address privacy concerns could work, while nine studies cited social theories and theories about individual behaviour.

The theories in the studies could be grouped into types of mechanisms across a continuum of entirely social influences on behaviour to entirely individual. Social behaviour mechanisms were bound up in social norms to provide a framework on the general consensus on what is approved or disapproved of, whereas theories of individual decision making were bound in rational choice decisions of calculating risks against the rewards.

Privacy ethics lie between the normative understanding of social norms (what one should do) and individual decision-making (based on rational and free choice). These ethical frameworks provide the guiding principles on differential impacts, by which different stakeholders can deliberate over what the risk and benefits of novel technologies could be in the absence of established social norms, legal, and frameworks and without direct experience or full and perfect information. They are conditional in that they depend on the current contexts and technology being reviewed at the time and may change over time.

Five of these were studies of smart meters [34,36,39,43,56], three about the smart grid [12,35,51], two studies were about incentives [40,43], one study on energy governance [48], one study was about public vs. private energy use feedback [31], and one study was about views on demand side response [32].

Programme theories around trust included the theory of “phantom risk”. This theory aims to understand why there may be a lack of trust in expert opinions by laypersons on risks associated with unproven (sometimes disproven) causes. Examples of this include wireless radiation associated with mobile phone masts. In the context of smart meters, public opposition cited fears around potential causes of health risks, as well as fire hazards, loss of jobs, threats to security (theft), which expert opinion dismissed as non-existent or minimal.

The theory of phantom risk indicates that other factors than privacy concerns alone may underpin people’s concerns and non-acceptance of technology, such as lack of power and agency, sensationalist stories in the media, and lack of knowledge around the technologies [94,95,96].

As mentioned previously, social norms are defined as the “rules and standards that are understood by members of a group, and that guide or constrain social behaviours without the force of law” ([40], p.152). Social norms reflect a perception of a generally held positive or negative societal consensus view. In theories of social norms, norms emerge in response to new behaviours that may incur a cost, and as such, the behaviour needs social regulation by approval or disapproval. In the case of smart meters, expectations of normative rules increase where threats to privacy present as the potential costs of the new technologies. The more harmful an individual thinks the new behaviour is, the greater assumption that there is (or will be) social norms to control it. However, people often under- or overestimate the consensus view and interventions that aim to influence social norms tend to be around correcting misconceptions. People’s actual behavioural response to social norms is also conditional; people can still decide for themselves and individual goals can take precedence, regardless of the social norms, as these are not rules that can be enforced.

This study used the understanding of social norms and norms emergence to understand the ways in which new privacy threats affects the expectations and demands for social norms in response to smart meters.

Social norms around energy conservation establish a moral benefit of conserving energy [93] and, conversely, societal approval of establishing one’s green credentials by adopting energy conservation behaviours signals a moral benefit [94].

This study sought to test this norm through a nudge intervention, by making energy use data public to comparable households (in the university halls of residence) energy conservation for all to see would signal one’s “green virtues” as well as some gentle competition to encourage behaviour change [95]. Unlike providing only private data, making data public could activate the extrinsically motivated with the potential for social approval with associated benefits of an enhanced pro-social reputation. Common knowledge of energy conservation behaviours establishes a normative conduct, i.e., this is what one should do, whilst keeping these data private does not. The theory of warm glow altruism acts as the reward for prosocial environmental behaviours, which is: it feels good to do good.

3.9. Theories of Privacy Ethics: Between Social Norms and Individual Decision Making

Techno-ethics [56] explores the connections between two worlds of information and communication technologies and ethics, a moral framework by which we can anticipate what people might consider good, acceptable, or fair.

Smart meters pose new challenges to the norms of a separation of private and public spheres and potential conflicts between moral and political values. For example, on the one hand, by ensuring fair access to the benefits of convenience and efficiency that detailed data collection and data sharing can offer, and on the other, a potential for intrusion on personal and private sphere, or discrimination in the political or economic sphere where governments or corporations treat people differently [96]. The authors examine the norms that individuals refer to and rely on when it comes to expectations on what is ethical practice in data sharing, and its use and the normative conflicts that underpin the anxieties and concerns around smart meters.

Theories of social practice [29,42] take the everyday routines of people as the unit of analysis “to draw attention to the social and material context of human conduct” [29]. The theory balances the two opposing paradigms of voluntarism—that it is individuals and their attitudes and beliefs that determine how they act; and the systemic—that structural paradigms of external pressures of new technologies and policies will influence behaviours. By focusing on social practices, the theory considers the coproduction and feedback loops missing from purely individualist and structuralist approaches in explanations of how Individuals think, choose, and act, such as in managing their privacy and sharing data, but also are drawing from “rules of the game”, culture and shared knowledge [97].

In study [42] a practice-based approach is applied to understanding how people make sense of smart meters and privacy in the protected area of the home. The study considers how transparency in the communication of risk is used to make privacy decisions and is incorporated into everyday practices. In smart meter energy data collection, consumers try to understand the abstract nature of energy use data and apply this to the real-world implications of intended and unintended disclosure.

This study considers the decision-making processes of householders’ decision to participate (and share data) in smart grid development, and how these decisions and practices are shaped by power and social relations in which the smart grid is embedded [12]. The study looks at the factors that enable these households to become “change agents” and the privacy and autonomy barriers that could prevent them from adopting new practices. A social practice approach recognizes that the households’ role has changed over time from passive agents or captive consumers, to active change agents through the expanded opportunities of cooperation through sharing of information—through horizontal engagement with other households, in citizen- and community-led smart grid projects, and vertically, opening up the household to outside by outsourcing tasks and disclosure of information. In this theory of social practice, smart local energy systems offer opportunities to transform the everyday “energy management practices” of households through revealing and quantifying ways of living through monitoring and generation of data on energy consumption; thus, making the home an explicit site of environmental action [12].

In terms of fairness, procedural justice was a theory put forward by Guerreiro [34] to understand the acceptance and use of smart meters. Procedural justice is when the processes of decision-making are transparent, fair, and appropriate [98], and would involve stakeholders in the decision-making process. The understanding is that if the process is transparent and seen by all to be fair, that they respect and recognize people’s agency, dignity, and voice, then people are more likely to accept the outcome, even if they do not agree with it. On the other hand, feelings of injustice and unfairness can create suspicion, resistance, and loss of trust, and which is difficult to regain, and will pose a barrier to acceptance and participation.

The social contract theory has a long history of explaining why people consent to being governed, apparently accepting restrictions on personal liberty for the benefits of social protection. A widely used definition would be that citizens “comply with the fundamental social rules, laws, institutions, and/or principles of that society”, “by rational agreement” even though individual reasons for complying differ [99]. From the 20th century on, this idea of contract by rational consent considers the conditions under which citizens would consent [100], assuming they had all of the relevant information on a particular issue and acted reasonably and fairly.

Given the complexities of consent, and what individuals can reasonably know and expect about what they are consenting to in terms of their privacy rights and data sharing, [101] argues that from a data implementers’ perspective, data protection should too be framed not just in terms of individual rights and responsibilities, but also as a collective public good. Sharing of data and consent should be that to which individuals would reasonably and fairly choose to consent to and for purposes that they could reasonably expect. Services that use data in unexpected ways, while perhaps legal, may not yet be acceptable.

Scripting—in-scripting and de-scripting [35]—describe the different ways individuals can take control of and adapt prescribed behaviours that were “scripted” for them. Authors refer to two conflicting visions of the future energy consumer: either the main change is purely technical, and customers passively respond to this new arrangement or they are to be active agents of change themselves, by engaging with the processes of energy provision and consumption.

The study describes the ways of understanding control from an implementer and customer perspective, such as “control over,” technological control, or “being controlled” and the meaning of control in the reserved space of the home. The design of the smart grid trial in the study allowed for remote control of appliances as a way of balancing demand and appeared to promote a preference for passive customers in its design (in-scripted), but in practice, finds that customers find ways to negotiate with, adapt, and control devices to work for them into their everyday practice, which, at times, were at odds with the original intention and design (de-scripted).

3.10. Theories of Individual Behaviour

Technology Acceptance Model (TAM) proposed by Davis (1989) [102] has the perceived ease of use and perceived usefulness as the mechanisms that influence attitudes towards smart meters and towards intention to use [103,104,105].

In the study [34], the author refers to the theory of reasoned action (TRA) to explain how getting from intention to use to action was mediated by the individual’s sense of self-efficacy and control, similar to the concept of ease of use in the technology acceptance model. Both TAM and TRA assume that the individual balances the perceived risk of smart meters with their usefulness and ease of use, making the rational choice for smart meters.

The theory of planned behaviour [106] links attitudes, subjective norms, and behaviour with two aspects of people’s assessment of their ability to act effectively (self-efficacy), and the extent to which control is available to them (controllability).

A psychological explanation behind the capacity of a person to assess their ability to act effectively is the theory of locus of control [107], which is the extent to which an individual believes that that they have power and influence over the outcomes of events in their lives. An external locus of control is a belief that one is not in control of events, a fatalistic view, while conversely the internal locus of control, holds beliefs in one’s own power in influencing events and outcomes.

In terms of smart meters, the authors consider to what extent an individual’s internal or external locus of control is associated their intentions to engage in demand response energy use behaviours [32].

Innovation adoption and innovation diffusion theories are theories of individual behaviour explaining and predicting how and why some people are more willing to adopt new innovations before others within a social system [108], and diffusion is through which channels, and at over what time period these ideas of adoption spread. Early adoption of innovation may be mediated by individual personality attributes, such as openness to change, risk aversion, and innovativeness, while innovation attributes can affect whether an innovation is adopted or not [51]. Gärling and Thøgersen 2001 [109] identified five attributes:

• Relative advantage;
• Compatibility;
• Complexity;
• Trialability;
• Observability.

Research in this area also suggests that consumers’ involvement in the product as having a strong effect on the intention to adopt, while demographic factors have less of an impact on predicting who would be an early adopter consumer [110].

Modelling studies [40,43] tested what level of incentive offer tips the balance for a customer to trade privacy for benefits. In the first study, this was in the form of discounts offers, in the second this was in the form of virtual credits or coupons. In game theory, the first player is the energy provider that needs the fine, granular data from the customer to design reliable responsive grid systems, but this comes at a risk for player 2, the customer, in terms of sacrifices of privacy and potential risk of data being intercepted and customer’s safety compromised. Players in this scenario “compete” to achieve their interests. Assumptions in these modelling studies are that players are rational and seek to maximise their advantages and benefits.

4. Guiding Principles for Interventions to Address Privacy Concerns

From these barriers and enablers of data sharing and privacy concerns in different contexts, and the mechanisms underpinning how people make decisions privacy and sharing data we derived the following eight guiding principles for the smart local energy service providers. These principles would be relevant to all stakeholders, energy service providers, community groups, private, and cooperative who are involved in the design and delivery of smart local energy services. These principles would also be relevant to any data collection organisation that depends on their customers’ participation in consenting to share data that may reveal information about their preferences and identity, activities, and ways of living.

• Recognize the mutual benefits of data sharing for smart local energy systems and work with customers as partners.
• Involve people in the design of data sharing technologies from the start.
• Give people a say on the third parties that they are happy to share data with.
• Empower people to set the boundaries around the flow of information about themselves.
• Ensure that the purpose and value of the data collected are transparent and fair.
• Ensure that everyone affected by sharing of data are involved in giving their informed consent.
• Recognize that technologies for revealing and monitoring behaviours in the home can be used in unexpected and unwanted ways.
• Ensure there are channels of feedback and ongoing communication to continuously improve service delivery.

4.1. Guiding Principle 1—Recognize the Mutual Benefits of Data Sharing for Smart Local Energy Systems and Work with Customers as Partners

This principle was derived mainly from barriers and enablers in the mesosystem of community and one barrier that related to the wider socioeconomic and cultural contexts. This was in recognition and acceptance (mechanism) that the benefits of sharing data through knowledge and understanding was not one sided on the side of the consumer with promised of lower bills, but an integral part of the smart local energy system sustainable success. The stated aims for SLES in the studies included reducing system costs, increasing the use of renewables, reducing total energy consumption, especially reducing peak demand. Energy customers’ active participation in data sharing is an essential part of meeting these aims (outcomes). By working with customers as partners should overcome the privacy concerns that data are being extracted and exploited for profit with little to gain on the customers’ side (mechanism).

Some populations are at risk of exclusion from decision making about data sharing, for instance when any initial cost investment is not theirs, or access to other income and benefits have been made conditional on their data sharing. SLES implementers should make resources available for ongoing support, education, and involvement to realize ongoing participation for mutual benefit (mechanism).

4.2. Guiding Principle 2—Involve People in the Design of Data Sharing Technologies from the Start

Most of the privacy concerns expressed in the studies were around the sense of loss of choice autonomy and control, this sense of loss of autonomy and control was met with active resistance, even on a national scale, and passive non-participation in other cases (outcomes). This was overcome when implementers tailored their approaches to address individual concerns and values and were clear about what benefits could be expected, while at the same time, not overselling the benefits (mechanisms). Some people were keen to save money, while others were attracted to environmental benefits of conserving energy and enabling increasing renewable energy (mechanism). While people who were familiar with technology were more likely to be research participants (as this was a factor in self-selection or a condition of participation), some of the participants still found the website portals difficult to understand and use. Others found integrating new technologies with other connected devices in the home challenging and were surprised when their integration was not straightforward, as they had expected. Involving people at the earliest opportunity in the design of the data sharing technologies will be more likely to be trusted (mechanism) and used (outcomes).

4.3. Guiding Principle 3—Give People a Say on the Third Parties That They Are Happy to Share Data With

People are already familiar to some extent with the right to have some control over privacy settings, and new technologies are assumed to include these everyday controls (contexts). However, usable privacy policies—that is, those that people can actually read, understand, and make informed decisions about—are currently the exception not the rule. SLES designers and implementers have an opportunity to build-in the concept of useable privacy from the start. People differ in their opinions of acceptable third parties to share data with, although for profit organizations are lower on the list for most people (mechanism). However, some people find the idea of targeted advertising appealing, while for others, this is the least acceptable third-party they would be happy to share data with. People should be given the option of choosing for themselves (mechanism).

4.4. Guiding Principle 4—Empower People to Set the Boundaries around the Flow of Information about Themselves

Privacy represented the controlled flow of information about oneself in the different contexts of individual beliefs, and valued (mechanism) the family and home, and wider contexts of work life and community, and the socioeconomic and cultural domains (contexts), what is considered acceptable or appropriate sharing or revealing of information about oneself or family, one domain may not be in another. The loss of control over this flow of information was felt to be disempowering (mechanism). The setting of boundaries can vary for different domains, for different purposes, and change over time. To make privacy settings usable, they should be easy to access, understand, and to change (mechanism).

4.5. Guiding Principle 5—Ensure That the Purpose and Value of the Data Collected Are Transparent and Fair

A lack of clarity over the extent and purpose of data collection led to declining trust and ambivalence (mechanism) over whether people would really see any benefit themselves. Some were disappointed that the flexibility in energy use to qualify for lower tariffs, meant losing some functionality in their day-to-day routines, which they did not anticipate (mechanisms). Concerns of the use of energy data were, overall, low (context), and people were more interested in how the technologies worked and for what purpose (mechanisms). Overwhelming people with hard-to-understand privacy conditions generated suspicion and a withdrawal of consent as a default safety position (outcomes).

4.6. Guiding Principle 6—Ensure That Everyone Who Is Affected by Sharing of Data Are Involved in Giving Their Informed Consent

There are wider impacts of data sharing, of both risk and benefit, than traditional notions of the single bill payer, and informed consent should reflect this, as participation of all members of the household are needed for the benefits of data sharing to be realized (outcomes). Family members may differ in their priorities and perceived benefits of data sharing (mechanism), for instance, families of older people saw some advantages in being able to remote monitor their loved one, but this was received less enthusiastically by the older people themselves who did not want to see this kind of monitoring replace human contact. There was an assumption in some studies that understanding new energy data sharing technologies was probably too difficult for older people, while studies in other sectors suggested that, in fact, they were quite keen to learn about smart technologies potential to retain independence and maintain health. Low income and vulnerable people in receipt of social protection may already feel more monitored in their everyday lives compared to the general population, and energy related benefits often call for energy use data collections as a condition of energy related benefits. Social housing landlords may be enthusiastic over the economies of scale of the benefits of energy efficiency, but neglect to involve their tenants in this decision making, but what was clear from the studies of energy data collection and related sectors was that, without involvement and support for active participation of the person sharing the data, these energy efficiencies would not be realized as the desired behaviour change will not be sustained.

4.7. Guiding Principle 7—Recognise That Technologies for Revealing and Monitoring Behaviours in the Home Can Be Used in Unexpected and Unwanted Ways

New technologies and new uses for technologies can have unintended consequences (outcomes). The use of detailed energy use data (mechanism) can shift the balance of power within the household to the one who can access and control these data. Reactions to previously unknown information about energy use ranged from being found to be fun and interesting, to a bit annoying, to controlling and abusive. SLES should incorporate design principles that energy use data cannot be exploited by those who seek to use this to control and abuse others.

4.8. Guiding Principle 8—Ensure There Are Channels of Feedback and Ongoing Communication to Continuously Improve Service Delivery

The principle is related to the principle above, that new technologies and uses of technologies can face unintended consequences. Taking an ethical approach to responsible innovation (RI) should include ways of quickly learning and responding to these unintended consequences (outcomes). Open channels of communication will encourage collective reflections and evaluation of different stakeholders (mechanism) on the successes and challenges of new ways of using data and their potential and actual impacts. Technology innovation should be an ongoing process rather than only a linear one of design followed by implementation, but should include mechanisms of evaluation, stakeholder involvement, redesign, and refinements. Ethical issues may not be apparent at the design stage, but emerge over time and from different perspectives.

5. Conclusions

The findings from the review show that ustomer privacy concerns that had the potential to act as barriers to data sharing, were wide ranging, and depended on the different privacy concerns in different domains. One barrier to participation with good supporting evidence was that people would resist the intrusion on their autonomy, choice, and control in the individual domain. This could be actively—by refusing to install data collection technologies, for instance, or passively—by non-participation in changing or adapting energy use behaviours. Evidence from other sectors suggests that people are willing to accept new technologies and sharing data if the benefits of doing so are clear, anticipated, mutually beneficial, and includes choice and control. Non-profit organisations are trusted more than for-profit organizations, to work in customer interests.

Inclusion and informed consent will require active outreach from SLES providers in a variety of ways to meet people’s abilities and preferences, as well as ongoing education and support to ensure that privacy concerns are adequately addressed; that the benefits of sharing data are realistic, and that participation is by informed and active choice.

Future research that aims to identify the views and perceptions of the general public should also ensure that they are reaching out beyond the usual groups of people already interested in the topic. The privacy review identified many studies that were biased towards already knowledgeable and engaged participants and perhaps do not reflect the views and perceptions and experiences of the general public. This self-selection bias is common to technological studies and other fields that then translates into intervention designs, which, while intended for all, is at risk of excluding the hard to reach. If the aim is to achieve outcomes of energy justice and enhanced access to benefits of data sharing, then research should endeavour to extend its inclusion of the views and experiences of people who are often overlooked.

This perennial problem of self-selection in research may be minimized with more imaginative and purposive sampling of groups of people who are often overlooked. A framework of stratification could be used as a guide. PROGRESS-plus [111] is an acronym of participant characteristics that have been shown to stratify health participation and outcomes, but these characteristics of stratification are likely to be indicated in mediating wider aspects, social participation, including the sharing of the benefits of new technologies.

PROGRESS: P—place of residence, “R—race”/ethnicity/culture/language, O—occupation, G—gender/sex, R—religion, E—education, S—socioeconomic status, S—social capital.

The Plus refers to additional characteristics that can impact social participation and equity of outcome: [112].

(1)

Personal characteristics associated with discrimination (e.g., age, disability);

(2)

Features of relationships (coercive, abusive relationships);

(3)

Time-dependent relationships (e.g., temporary, insecure accommodation).

The contribution of our study is intended for the design of smart local energy systems that incorporate these guiding principles into usable, ethical privacy policies and practice. The hypotheses that follow this review’s findings are that incorporating the guiding principles will address the privacy concerns in different domains; customers will, through increased knowledge, understanding, and trust, consent to share data, and reach the intended positive proximal and distal outcomes described in the theory of change (Figure 1). The review’s findings are primarily intended for smart local energy service providers, but will be relevant to other data collection organisations who depend on detailed data collections from customers for their successful operation.