Are we heading towards a signifcant data privacy problem around our homes?

Like boiling a frog, this process is slowly being extended to other data without recourse to the rights of homeowners and without them being aware of the extent their personal data is being exchanged.  Smart meter data is the next data asset being considered for public access.  The companies, trade bodies and academics that make up the ‘Retrofit community’ are pressing for as much of the smart meter data as possible to be put into the public realm, using a ‘public good’ argument.  The only discussion is about granularity - how much half-hourly detail can be put into the public sphere without revealing homeowner behaviour or habits (eg ‘they only shower on Wednesdays’). Smart meter data is covered by the ‘Smart Meter Data Access and Privacy Framework’ (DAPF) which does actually define smart meter data as ‘personal data’. 

The DAPF currently allows suppliers to access half-hourly consumption data only with the consent of the customer (i.e. the customer must “opt-in”) but there appears to be zero consumer awareness of this. Energy suppliers can access daily or less granular data without customer consent, but they must give a clear opportunity to opt-out from that access. It is unclear how a homeowner would know about this or what constitutes a ‘clear opportunity’ to opt-out.  Finally, suppliers can access monthly or less granular consumption data without customer consent, and without offering an opt-out, if the consumption data is required for billing, fulfilling a statutory requirement or fulfilling a (so far undefined) licence obligation.  The ICO have already raised concerns about these processes in a response to an OFGEM consultation (see their submission here) stating their concerns that the vague approach will result in suppliers having full access to half-hourly consumption data without customers’ consent, or potentially in conflict with a direct refusal to give consent.

Part of the challenge is that this is not a new problem.  We started boiling this frog a long time ago.  Local Authorities have long published full details and drawings of Planning Permissions and Building Control decisions on the open web. This includes publishing the full case file and detailed drawings for every decision. This barely mattered when files were buried in council filing cabinets. But with open web systems the details of your home is open to any predatory person whether stalker, burglar or data salesperson. This data is also now being extracted from council systems by data companies and sold on the open market.  Oddly, while Planning Permission information has to be published under the Planning laws, Building Control data doesn't have to be published.  Many councils are publishing this private information for no reason.

Also HM Land Registry's publishing of Price Paid Data (PPD) - which now appears on the property portals and many other property data websites - is another long-published area that appears to conflict with personal data privacy.  It would seem sensible for HMLR to publish street or local area averages, but it has never been explained why it should be public knowledge what an individual paid for their home. The Price Paid Data is published under the Government 'Open Data Licence' but is clearly tied to the finances of individual homeowners and there is a long-running dispute with ICO on this.  ICO are clear that they believe that PPD is personal data.  In 2012 ICO wrote " OGL does not cover the use of personal data, in our view, this is therefore not a suitable vehicle for the publication of property price information."  (See Owen Boswarva's summary here). This dispute is not resolved.

Most homeowners are horrified when shown how much data the organisations in the buying & selling ecosystem have on their home.  They would be equally horrified to know how this information is traded on the open market.  The RLBA believes that we need to move to a presumption that property data belongs to the property and is only shared with homeowner permission.

Not only do we NOT have this presumption at the moment, but often the homeowner doesn’t even have rights of access to any data held by publicly funded bodies on their home.  For instance, Land Registry charges a homeowner to access the information they hold about their own home, while selling it on the open market. While Trustmark, who hold certification and Retrofit data on a million homes don’t have any mechanism to share the certification and installation data they hold with homeowners.

The GDPR has a chapter on the rights of data subjects (individuals) which includes the right of access, the right to rectification, the right to erasure, the right to restrict processing, the right to data portability, the right to object and the right not to be subject to a decision based solely on automated processing. But these cover data that can be clearly defined as ‘personal’. While some data about our home has been classified as ‘personal’ most hasn’t and there is no clear precedents for homeowners exerting their rights. The RLBA believes that many of these rights need to be extended to our properties.

The starting assumption for any property-specific data set should be that it is a digital asset related to our home and is the property of the homeowner. The homeowner should be in control of the data created ‘by, for or about’ their home and they should have control of when and who it is shared with. This is particularly true if data has commercial value - if data has value then it is value that belongs to the homeowner. This may necessitate the creation, perhaps through legislation, of a special category of information that links to personally held assets whose usage and commercialisation rights are clarified as reserved to the homeowner. The first step will be to treat our property data in the round and not as individual data challenges and then to clarify the legal status of the data our homes create.

At what point does the boiled frog jump out of the water and what would that look like.  At what point do homeowners say 'no'.   The county is about to embark on the biggest national programme for house renovation ever attempted as we attempt to Retrofit 25M homes for new NetZero standards.  NetZero may be the point where policy fails because we didn't deal with the data issue.   We will not get the public to join us in the NetZero endeavour if they sense that any information created by surveys, EPC assessments and Retrofit plans will immediately be sold to the highest bidder. 

GDPR legislation has proved costly and complex for business.   Let's solve the issue of data privacy in the property world now, before the data privacy authorities do it for us.