User Privacy Concerns in Commercial Smart Buildings 1

2.1. Security and Privacy in Smart Homes

While the research on smart commercial buildings is still sparse, researchers have well studied the security and privacy issues of smart homes. Here, we covers some of these studies. With the increased usage of smart devices within home environments, there is the possibility of increased security and privacy risks. This is possible due to “vulnerable and unreliable devices” [5] that are interconnected and may be connected to the internet. In a recent study [23], it has been shown that via a side channel attack, a malicious attacker can extract PIN codes and text messages from recordings collected by a voice assistant at a home environment located up to half a meter away. The authors of [24] studied the users’ concerns in smart home devices through an analysis of 128 online reviews about smart home hubs. Based on their observations, they provide some insights to improve the design of smart home devices in order to alleviate some of these concerns. The authors in [5] focus on the privacy concerns of the end users who live in smart homes. They found these out through the use of semi-structured interviews with people living in smart homes. The paper found that a lot of the participants weren’t aware of the possible threats due to a “limited technological understanding of smart homes” [5]. In addition, the threats they were aware of, they weren’t too concerned about because of this lack of knowledge. Similarly, in [25], the authors conduct user studies through semi-structured interviews to find out how knowledgeable the users are and how this affects their perceived risks. The paper finds that “knowledge of their smart home does not strongly influence their threat models” [25]. Instead, it finds that the users’ concerns are shaped by their prior experiences in other contexts with the companies that design the products. Authors of [26] focus more specifically on “Smart Home Personal Assistants” [26] such as Alexa by looking at the “users’ security and privacy perceptions” [26] through semi-structured interviews. The paper finds that the users have incomplete threat models, meaning that they are not fully aware of the possible threats involving their devices. This is deemed to be due to incomplete mental models of these devices and so have incorrect perceptions of how the data is stored and what is done with it.

The authors of [27] look into predicting the preferences of smart home users and how these may change under different circumstances by developing machine learning models that can predict how a user will feel about a newly supplied scenario. In order to train the model, the individual is asked to give their privacy preferences for a set of scenarios. The model is then tested by being given a set of new scenarios and comparing the results to what the user would want. A major focus of the paper is that those designing smart products need to consider the individuals’ preferences and how these could change. Another paper [28] looks at the concerns users have involving Internet of Things (IoT) devices. The large scale study involved just over 1000 participants, asking them to give their privacy preferences in a variety of supplied scenarios. The study finds that “privacy preferences are diverse and context dependent” [28]. They are more comfortable with data collection being done in a public setting as opposed to a private one. Furthermore, they are more comfortable about data that they think will be beneficial to them. The participants also wanted to be notified about any of the data collection they are less comfortable with. The study also finds that they were able to predict the preferences of a person by looking at their decisions in “just three data-collection scenarios” [28], and achieved an accuracy of up to 86%. Similarly, in [29], the authors look at the concerns of users regarding smart devices. However, this paper focuses on the concerns of parents about their children’s use of smart devices in the house and what restrictions, if any, they put in place. The paper also looks at how these devices can be beneficial within the family setting. These were found out using both focus groups and semi-structured interviews. The study found that the use of these devices “may help build familial relationships and foster open communication” [29]. Additionally, the paper found that parents feel it is on them to protect their children from the threats of these devices due to a lack of trust in them.

In [30] Zheng et al. performed semi-structured interviews with 11 smart home users to gain insights into long term experiences living with IoT devices. They found that users suggest “the need for improved privacy notifications and user-friendly settings” and that these smart home users trust IoT device manufacturers to protect their privacy. [31] looks at how concerns for user privacy influences their intended use of smart homes and finds similar results. In this study, Guhr et al. conducted an anonymous self-reported survey and found that participants suggested more user-friendly interfaces to help with privacy concerns.

2.2. Security and Privacy in Smart Commercial Buildings

Smart buildings are becoming increasingly more available and can be further expanded, allowing new devices to be added thanks to integration features [32]. These additions introduce new security and privacy threats to these systems and those that use them [33]. The sensors and devices used in these buildings capture, process and manage large amounts of occupant-centric and environmental data [34]. Furthermore, despite the increase in the number of these devices being used, occupants of these buildings have no control or knowledge of their captured data [35]. Given the large number of these devices and the massive amounts of data that they collect, privacy is a key challenge [36]. Privacy can be described as an individual’s ability to control who can access what, when and how their personal information is processed and disclosed to others. Ziegeldorf [37] defines information privacy, in the context of the Internet of Things, as a guarantee to the data subjects, the awareness of the privacy risks associated with the smart things and services, user control over their personal data, and the awareness and control of the subsequent use of personal data. When using Internet of Things (IoT) technologies, privacy is an obvious trade-off.

Users and occupants of smart buildings use and interact with these building environments in different ways to take advantage of the services they offer. The ways in which these devices can be interacted with vary greatly, with sensors, devices with limited interfaces, Radio Frequency Identification (RFID) tags, Near Field Communication (NFC), as well as small devices that respond to buttons or touches. The majority of smart building devices have limited or no user interface at all with users having no control of their configuration. The data that is generated from user interactions with these building environments is managed by the smart building’s facilities management, in a centralised approach, in order to provide building services. Given the design of these smart environments, occupants are likely to be subject to a multitude of privacy violations through monitoring, tracking, surveillance, profiling, and identification.

Surveillance technologies are used to detect and control the behaviour of those within an organisation. To perform this effectively, the building’s user’s activities and images are recorded continuously, typically without their consent [38], e.g., via CCTV systems. CCTV systems capture these images and activities in order to detect and report, with evidence, unusual behaviours [39], to ensure the health and safety of its occupants. This poses a potential threat to the privacy of occupants concerning their activities inside the building [38,40]. Installed wireless sensors are a popular feature of connected environments such as smart buildings. Their purposes are to detect the temperature, room occupancy, carbon dioxide, lighting, and fire detection [41]. The continuous collection of this data, combined with data processing algorithms may allow for the monitoring of users through revealing their behaviour, activity and work patterns, potentially violating their privacy. Likewise, existing technologies within smart buildings may enable user tracking, identifying the locations and movements of users within specific building zones [42]. This may be possible through users connecting to the building’s WiFi. Building management systems collect, store and share the information regarding the occupants’ locations and movements while they use the building facilities, potentially violating their privacy.

Access control mechanisms are implemented within smart buildings to identify users and provide access to the correct users for the variety of services available. However, observing this data can allow someone to draw conclusions regarding an occupant’s activities and behaviours [43]. This may result in occupants changing their work patterns and habits if they realise that data about them is being continuously captured, potentially revealing their identity. This form of invasive user profiling could occur within smart buildings by, combining the multiple pieces of data linked to an individual user, that are collected via the IoT devices and sensors.

Moreover, the IoT devices (e.g., webcams, routers), used in a smart building can be accessed by malicious external entities via an existing search engine belonging to internet-connected devices (i.e., Shodan), which therefore possesses a privacy threat to smart building users [44]. Data collected through these building sensors aids in managing the smart building’s operations and can provide valuable information when analysed. For example, machine learning techniques can be applied to room temperature data, allowing for the identification of an individual’s activities, whether they are reading, standing, walking, or working on a laptop in a specific area [45]. This is given the extensive amounts of various data collected by these devices and that the collected data are typically linkable [34]. If access to this is not managed sufficiently, the occupants’ privacy may be threatened given the possibility of monitoring, tracking, and surveillance, as well as the profiling of occupant behaviour, activity, and preferences. In [46] Bilogrevic et al. focus on this aspect of data combination and user concerns relating to it. Through an online study of 918 participants and a smaller set of follow-up interviews (14), participants were found to view combinations of data about them to be more identifying than data such as their physical location.

2.3. User Studies

Despite the increased number of smart commercial buildings in a variety of sectors, limited research has been done focusing on the perceptions of those that use these environments. A user study was conducted by Vasileva et al. [47] looking at the experience, preferences and concerns of the users, focusing on smart campuses as a smaller scale of smart cities. Their findings show that using this collected data and making it publicly available helps to improve the users’ experience. However, users must be properly educated about this collected data and sufficient protection measures must be established. In [48], office users were interviewed after relocating to a smart office building, looking at their social interactions as well as user satisfaction. Tuzcuoglu et al. find that users have a need for spontaneous meetings and non-work-related conversations with their fellow employees and that they expect these smart buildings to help facilitate these needs. This tells us that attention needs to be paid to the layout of smart offices so that users have social areas, away from their workspace, that offer privacy and enable interaction.

In [49], Martin focused on a smart university building and the conflicts involved in shared control systems, to get an understanding of the users’ experience. For this study, a factorial survey was used to understand to what degree users are affected by office control interfaces and the conflict types that may arise among the users. Their results illustrate a limited impact on users relating to these shared control systems, with a lack of conflict with management decisions to control the building environment, e.g., room temperature. Further interviews were conducted with academic staff from this building to better understand their experience within these environments. Their results highlight complaints and concerns regarding temperature and noise control. Overall, Martin suggests that these evolutions in technology should be providing an improved and more pleasant user experience within a more comfortable environment.

Marky et al. performed 42 interviews to understand the privacy perceptions and concerns of users in smart environments that also use personal IoT devices, e.g., smartwatches [50]. Their results demonstrate a desire for visitors of these environments to be informed about what data is collected about them, the ability for them to communicate their privacy preferences, and for certain privacy measures to be considered. Owners of these personal IoT devices find themselves wanting to adjust their outputs whilst visiting these environments. With the number of IoT devices increasing, there is an urgent demand to address these concerns, while owners of these personal IoT devices and bystanders also need to work towards their own personal privacy requirements. A recent study was conducted consisting of 575 participants from three different countries (Germany, Spain, Romania), focusing on smart health environments, to work towards understanding what impact using these environments may have on their users [51]. They find that the users of these environments are significantly concerned about their security and privacy, showing concerns about the possible misuse of personal data, spying, profiling, privacy violations, burglaries, personalised ads, and identity theft. As can be seen, these results show a high level of awareness among users of the possible threats that may arise through using these smart environments.

Previous studies have focused either on the impacts of the shared control environments on users’ behaviour, the levels of user interaction, and the threats to user privacy while using these environments [47–51]. Our literature review confirms that users’ perceptions of privacy in smart commercial buildings have not been extensively investigated. Therefore, the main focus for our study is understanding the user privacy concern when working in these buildings in regards to the technological elements, i.e., the embedded sensors that make these environments smart.

3.1. Case Study

For designing our questions, we tailored them according to the sensors and features of a smart building, the USB (Urban Sciences Building) which is currently the work environment of the first group of the participants of this study. The USB has been designed for a variety of activities including teaching, laboratory research, events, and the testing of real-time smart technologies for urban sustainability. On average, the building houses approximately 1,200 students, 55 academic staff and 120 post-doctoral researchers as well as regular visitors from across academia, industry and government. Large parts of the USB are also accessible to the general public. The core functionality of the USB is comparable to other smart buildings however its Building-as-a-Lab design means over 4000 digital sensors have been integrated into open spaces and the building structure itself making it one of the most densely monitored buildings in the world. For details of this building please see the Information page in the Appendix, and/or visit its website (newcastlehelix.com/about/urban-sciences-building). The key types of workspace environmental data available are: CO₂, Temperature, Humidity, Brightness, and Occupancy. The staff, students and visitors of the USB are typically only given a brief explanation about the features of this smart building via general induction sessions. There is no specific sign and/or informational leaflet to sensors and devices that make such a building smart. The employees and students of this building are not given dedicated induction sessions about the sensors in the building. There is more detailed information available online for people to research themselves.

In order to be able to evaluate our participants’ knowledge, concerns, and preferences more accurately, when presenting them with a list of sensors embedded in the USB, we included a few dummy options. These sensors include: Sound level and Air pressure. Please note that while our case study smart building (USB) does not collect data via these dummy sensors, they might be embedded in other smart buildings or be added in the future. Since we are working in a smart building ourselves, we have had several informal conversations with colleagues and students about the present technologies and sensors in the USB and found out that people can only speculate about the existing sensors. When designing our survey, we reflected such observations in our research by including these dummy sensors in order to study the accurate knowledge that our participants actually have on these sensors.

3.2. Questionnaire Design

We have designed the questions of our studies based on the set of tools and techniques suggested for measuring privacy concerns in [52] and [53] as can be seen in the Views on Privacy section of the questionnaire. We used a subset of the statements about personal information suggested in [53] and removed the redundant ones in order to avoid survey fatigue and focus on smart building privacy more. Among the existing individuals’ information privacy measurement methods such as [53] and [54], we chose the former one since it focuses on the organisational privacy practices and individuals’ concerns. Given that our study was on smart buildings for work, this was a good fit for our methodology. As suggested in [52], we built upon the well-established privacy concern scale [53], focusing on questions from the collection subscale. We also included a question from this scale regarding the unauthorised use of this data (Q7 in our questionnaire, as seen in Section x); where all of these questions were also used in [54]. We didn’t take any further questions from [54], since its focus is on control and awareness of online privacy practices and our focus is privacy in commercial smart buildings.

We have added questions to our questionnaires according to the characteristics of a smart building, asking questions about concerns regarding the specific types of sensors used. For this, we used some of the ideas and questions relating to privacy concerns previously adopted in the context of smart homes [5,25–28]. More specifically and inspired by those works, we included questions about the type of data collected about users, who has access to them and when and for what purposes. We also followed our previous methodology in studying the underlying components of smart infrastructures by listing sensors, e.g., in mobile devices [55,56] studying the users before and after being informed about such technologies, and tailored it to the context of smart buildings accordingly.

We have included experts from various backgrounds (security, privacy, and law researchers, admin and building management staff, and partners from the smart infrastructure industry) in the design process of these questionnaires, aiding in the design of questions and the overall structure, through their feedback on their sections and questions. This was mainly done via formal and informal brainstorming sections by including various stakeholders in the meetings, as well as sharing the survey with those experts and asking for explicit feedback on certain sections.

3.3. Questionnaire Structure

In order to find out about the users’ concerns towards data collection within the smart building and how this data is used, a questionnaire was created and distributed. The aim of this questionnaire was to both find out how aware the participants are of the data collection and its use, as well as any concerns they have regarding this. A more general user group were also studied to see how both their general and more context specific privacy concerns compared against those using the studied smart building. Here, we present an overview of our questionnaire. Please see the complete questionnaire in the Appendix.

Information Page. Next, the participants are informed about the smart building and its data usage, e.g., operational and research. The information was gathered from university and architect publicity materials, USB data researchers, and our own USB research (e.g., [10,57]).

Consent. Finally, we asked our participants to consent to their results being used. That they understood what their data would be used for and were okay with their data being used. Note that in addition to this explicit consent, we also explained to our participants in our email invitations that taking part in this study is completely voluntary and they can drop out at any stage. They also were provided with email addresses to share their ideas and concerns about the study.

For our second user study (non-resident group), we included an additional question asking our participants to describe a smart building as a workplace in their own words. Beyond this, we kept all of the questions the same apart from the background information section. In this section, we altered and added questions to find out whether participants have been in a smart building. Throughout the rest of the questionnaire, questions were kept the same but reworded so that they make sense in the context of non-residents.

3.4. Questionnaire Distribution

The questionnaires were created using ‘onlinesurveys’2

Once created and live, the first questionnaire was distributed to both staff and students that use the USB via the university email service. 81 participants took part in this questionnaire during April and May 2020. A large majority (67.9%) of the participants go into the smart building 4–5 days a week, with another 24.7% going in 2–3 days a week. Our participants included 33 students (undergraduate and postgraduate), 45 staff (academic and support), and 3 visitors, aged between 18 to over 60 years old. It took about 15 minutes on average to complete the questionnaire. Participant demographics for the first user study can be seen in Table 1.

The second questionnaire was distributed amongst a wider range of participants via sending the participation link to mailing lists, colleagues, family, friends and sharing on social media. To incentivize people to take part, participants were able to enter a draw for a £50 Amazon voucher. 40 participants took part in the questionnaire from late January to early February 2021. 85% of the participants do not and have never visited a smart building for work. However, 6 of these participants have visited a smart building for work (3 people: less than once a week, 1 person: once a week, and one person: 2–3 days a week, and one person: 4–5 days a week). Since only 6 of the participants in this group had been in a smart building for work, we refer to this group as non-residents. Please note that since we manually distribute our questionnaires, we are confident that the two groups (study 1 and study 2) did not overlap. Note that when analysing our results we include all these participants in study 2 since our quick analysis showed that excluding those 6 participants would not impact our results. These people were aged between 20 to over 60 and had various occupations. It also took around 15 minutes on average to complete this second questionnaire. Participant demographics for the second user study can be seen in Table 2. The main point of having a second user study was to discover what similarities and differences exist between the users who occupy a smart building as their workplace and those who are not stationed in a smart building for work. To make sure that the two sets of participants do not overlap, we distributed our survey by emailing it to specific mailing lists within the smart building (USB) and outside of it. Naturally, there could have been people who had visited a smart building in the past in the second study, however since they were not stationed in a smart building, we consider them non-resident (non-occupant) users.

Our method involved processing the collected data in order to report our results using a mix of quantitative and qualitative analysis. The results for most of the questions are presented by stacked bar figures where the number of the answers to each category is counted. For some of our questions with free-text style, we run thematic analysis to report our results. We take an inductive approach and allow the data to determine our themes. We facilitated a conventional line-by-line coding [58] of all the responses from the open-text questions. Three independent researchers (two of the paper’s authors and an independent researcher) contributed to our thematic analysis. Two of these researchers performed the coding and extracted the key themes independently. The small number of our data units allowed the two researchers to independently complete the process and agree on the same themes. The third researcher crossed checked all the data units with the extracted themes.

Additionally, the authors discussed these themes and chose the user comments that represent such themes for inclusion in the paper. As occupants of a smart building as their workplace, the authors could understand almost all the user comments very well. However, we acknowledge that some of these comments include more insight than the extracted themes from them and a more focused study is required to uncover such insights. Such focused studies can be in the form of semi-structured interviews and/or focus group studies. We plan to conduct that research in the future.

3.6. Ethics

This research includes collecting data from users and had full approval from Newcastle University’s Ethics Committee before the research commenced. In addition to having undergone independent ethical review, we designed our user studies to address pillars of responsible research in computer science (Menlo Report) [59]: respect for persons, beneficence, justice, and respect for law and public interest. Participation in this study was completely voluntary and anonymous.

View on General Privacy. As it can be seen in Fig. 1, the majority of our participants are fairly concerned with their personal data being collected and used. Most of our participants were concerned when companies ask for personal information and would sometimes think twice before giving consent. They also believed that companies generally collect too much data about them. When it came to privacy concern in the workplace and knowledge about data privacy regulations, the answers were more scattered across categories. Yet, participants were more likely to be concerned if they were knowledgeable and participants who were less knowledgeable were less likely to be concerned.

The results are generally similar among the two user groups (smart building residents and non-residents). However, the non-residents showed slightly less concern about their general privacy in comparison to the smart building residents who were consistently more likely to either agree or strongly agree, apart from for Q7. This could be due to the fact that the USB is the home of the School of Computing and most of the participants of the first study were more familiar with the technology in general and the potential risks to their privacy.

OPEN IN VIEWER

Fig. 2.

Comparison of participant awareness of data collection and data access in smart buildings, 1st: residents of smart building, 2nd: non-residents.

Awareness of Data Collection. The majority of the first group (residents) selected that they partially knew what environmental data is collected in a commercial smart building. This suggests that while they know some sort of data collection is happening in the building, they are not confident about the process and its details. In contrast, the most of the second group said they did not know what data is collected.

Regarding what sensors they thought were present in the building, the majority of our participants chose most of the listed sensors (including the dummy ones). With not too much of a gap from Brightness, Humidity, CO₂ and Occupancy, Temperature was the most selected sensor. The least selected options were the two dummy sensors Sound Level and then Air pressure, respectively. Yet, around half of our participants thought such sensors exist in the building. This reconfirms that our participants can only guess what type of data may be collected by a smart building, but they do not have proper knowledge of the actual sensor collection in their work environment. Note that the percentage of the users choosing the dummy sensors is even higher in the second study. This was expected since the second group’s participants are not residents of a commercial smart building and are less familiar with the existing features of such environments.

For how the collected data is used, the first group of participants chose Building Operation the most, followed by Research, Maintenance, Public Information, Security, Student/Staff Information and then Work-based Operations respectively . The same results were observed in the second group. The only major difference is that the second group chose Work Operations much more frequently than the first group (62% vs 38%).

Concerning the roles that can access the data, Building Operations Management was selected more than any other option. This was followed by Estates Support Service, Researchers, Security, Professional Support, External Third Parties, Students, Public and then Other. The order of these groups are slightly different across the two user groups, but generally follow the same pattern.

OPEN IN VIEWER

Fig. 3.

Comparison of participant sensor privacy concerns, 1st: residents of smart building, 2nd: non-residents.

Privacy Concerns for Sensors. As it can be seen in Fig. 3, the participants were mostly concerned about the occupancy data which they thought revealed personal data and would deny access to it. Sound level, CO₂, Temperature, Brightness, Air pressure and Humidity come with a large gap after Occupancy in both groups. With a considerable gap, the second group was more concerned about the Sound Level sensor in comparison to the first group across these series of questions, potentially due to a lack of understanding of what these sound level sensors do. In both groups, around half of the participants did not choose any sensors.

Views on Sensor Data Collection Process. In Fig. 4 (bottom), it can be seen that participants were mostly neutral or agreed that access given to data collected in their workspace was beneficial to them and that the data is collected securely. At the same time, they mostly believed that access to the data should be disclosed more clearly. In the next section, we discuss reasons that may be behind these statements.

OPEN IN VIEWER

Fig. 4.

Comparison of participant privacy concerns revisited, 1st: residents of smart building, 2nd: non-residents.

Privacy Concerns for Sensors – Revisited. Recall that at this stage of our study, we presented our participants with an Information Page including data collection and data access processes in the USB, the benefits of its use, and potential privacy issues. It can be seen from Fig. 4 (top) there is an increase in concerns about all sensors across the two groups. Concerns about Occupancy data remain relatively high. There is also a clear increase in the number of the sensors that our participants said they would deny access to. In general, our second group of participants (non-residents) chose more sensors across these questions after being informed about commercial smart buildings from the information page.

Views on Data Collection Process – Revisited:. In Fig. 4 (bottom), it can be seen that, overall, there is not much difference across the two groups and before and after they are informed about smart buildings in views about the security of data collection, transparency in the processes, and the benefits of such data collection in their workplaces

Data Control Preferences. As it can be seen in Fig. 5, the participants in both groups in the have more or less equal preference towards the ability to control (i) what is collected in their workspace (ii) who can have access to it (iii) controlling what the data is used for and (iv) deciding what data is sensitive. Participants had a lesser preference for controlling when the data could be accessed. However, the participants in the second group, chose all the items more frequently than the first group. These suggest that a wide range of features and options can be included in a system which can enable the building occupants to have control over their data (e.g., a privacy dashboard).

OPEN IN VIEWER

Fig. 5.

Comparison of participant workplace data control preferences for commercial smart buildings, 1st: residents of smart building, 2nd: non-residents.

Through our analysis, we identified a few common themes in the free-text questions answered by our participants. A summary of these findings can be seen in Table 3, where the left section presents why users think certain sensors collect personal data, the middle part covers the concerns users expressed about access control to sensor data, and the right section contains the extracted themes about addressing their concerns. Here we present them for each question.

4.3. Thematic Analysis – Second Questionnaire (Non-Residents)

Apart from all the free-text questions, our second study also included a question to reflect on users’ understanding of smart buildings when used as a workplace. A summary of these findings can be seen in Table 4, which follows the same format as Table 3.

5.1. Further Analysis

Privacy concern. As discussed before, most of our participants were generally concerned about their data privacy (Fig. 1). They also had a basic knowledge about the types of sensors available in the smart building (Fig. 2). However, only around half of our participants expressed concern about data collection by these sensors, this is very similar to [5], which found that half of their smart home using participants were not especially concerned about any privacy risks. While this concern slightly shifted after knowing about sensors and their risks, the general trend stayed the same (Fig. 4). This lack of change further demonstrates that knowledge does not affect the users’ threat models as found in [25], which showed that past experiences have a bigger impact. When analysing our results, we could not find any notable correlation (using Pearson’s correlation coefficient) between participants’ general data privacy concerns and the concerns they expressed in relation to smart building data. In other words, although most of our participants were concerned about their general privacy, only half of them were bothered about smart building privacy and there was no notable correlation between these groups.

The second user study was very similar in that participants answered that they were generally concerned about their data privacy, but at most 65% selected a sensor in the concerns sections. Again, there was an increase in sensor selection after the information page, however, fewer participants would choose to deny access to the data collected by a sensor. This makes sense given the participants in the second questionnaire were more likely to view the data collection as being beneficial, believing that the building “uses information to make an optimal working environment”. Like with the first questionnaire, through analysis, no correlation was found between participant general concerns and specific concerns regarding the data collected in a smart building. This may be for similar reasons to before.

When we tried to find a correlation between those participants who chose none of the sensors to contribute to their privacy concerns in smart buildings and their descriptive concerns in open-text questions, we concluded that the majority of such participants did not have any concerns (by commenting ‘None’) or leaving such questions empty. Similarly, only around a quarter of such participants agreed to the question about their privacy in their workplace, while most of them agreed to other privacy concerns questions in the second part of the survey (2. Views on Privacy), as seen in Fig. 1.

Demography breakdown. In addition, our demographic breakdown (Table 6 and Table 7) demonstrates that there are not any notable differences in privacy concerns about sensors across the age ranges. The participants from different age groups chose around the same number of sensors for Qs 17, 26 (personal data collection), Qs 18, 27 (usage), Q20 (who access), Q28 (access purpose), and Qs 23, 32 (deny access). The only exception was the age group of 30 to 40 who chose more sensors in comparison to other groups in response to most questions. Our second questionnaire saw more of a difference in privacy concerns between the age groups. The age group of 30 to 40, again, chose the most sensors by far. Next was the 40 plus group and then the age group of 20 to 30. All groups saw an increase of about 2 sensors on average after reading the information page, apart from the 40 plus group who only selected one more sensor. Overall, much more sensors were selected by this set of participants.

Benefits vs. risks. While analysing the comments, we realised that some of our participants were not convinced about the benefits of data collection in a smart building. For example, someone commented: “… But the underlying premise of simply collecting more data to solve problems is false: actually, many of the issues people face are individual and social, and will not be solved through more data [collection] alone… Other similar comments highlighted how some of the participants were disappointed about some of the basic features that they expected from a smart building (e.g., physical comfort) and thought the data collection and processing should be refocused.

Although the non-residents mostly viewed the use of the collected data as being more beneficial to the occupants, a large percentage were still unsure. Some of the non-residents were not convinced about the benefits, questioning whether smart building workplaces are “being used as a PR attempt to look good”.

We also noticed that many of the participants say they do not understand the usage of this data collection and its benefits to them, and hence desired more transparency. [28] shows that users of smart homes are more likely to consent to data collection if they view the use of this data as being beneficial to them. By being more transparent about the use of smart building users’ data and its benefits, these users should then be more likely to consent. Similar research in other contexts has shown that multiple factors influence user willingness to adopt a technology. For example for a Contact Tracing Covid-19 app, these factors include: the technology features, benefits to themselves and the community, the technology provider, privacy and accuracy [60]. In this study, we did not evaluate the impact of various factors concerning user views and preferences in a smart building and leave it as future work.

This study is based on two user studies on occupant and non-occupant users of smart buildings as their workplace. It reports on the similarities and differences found in these two user studies. We found that the residents of smart buildings are slightly more concerned about their general privacy than the non resident users which could be due to their expertise in the field of computing since the USB is the home of the School of Computing. The first group also expressed more knowledge about data collection in smart buildings, while we did not find many differences across the two groups in regards to what type of data is collected, who would use such data and for what purpose Overall, the non-resident users chose more sensors which would concern them and specifically about sound sensor which is not present in the USB, which can actually explain why the first group were not as much concerned since some of them knew such sensor does not exist in the USB.

In terms of the privacy concerns of the participants for sensors, we observed an increase in all the related questions in both groups after being informed about the different sensors used ins mart buildings, though the second group had a bigger shift in their responses. Interestingly, the non-resident users chose more items for the type of control that they want to have on their workspace data (who, when, what data, how used). This could be due to the differences that they have in the accurate knowledge about these buildings and the control infrastructures. The first group’s mentality may have been impacted over time by working in such a smart building by observing the realistic experiences, potential risks, and existing control mechanisms.

While the types of themes that were extracted from the open-text questions in the two studies were overlapping, there were differences in the frequency of such themes among the participants of the two groups, as can be seen in Table 3 and Table 4. For instance, in terms of personal data, the first group expressed a much bigger concern over monitoring and tracking at work, while the second group highlighted their concerns over audio recording much more than the first group. In terms of other concerns such as lack of transparency and consent, the two groups expressed more or less the same level of concern in the open-text questions. Interestingly, the suggestions raised by the participants for improving privacy in such buildings are the same with transparency and consent being on top of the list for both groups. The first group also suggested a couple of privacy-enhancing technologies such as control dashboards which could be due to the fact that the majority of them were indeed students and academic staff in Computing.

5.3. Comparison to Other Studies

Our results show that the most concerning piece of data, for both sets of our participants, was that relating to the occupancy of smart building spaces. By selecting this option the most in addition to the mention of smart cards and tracking in the open answer questions by the users, our participants have shown that they are mostly concerned with being tracked whilst within a smart building. The same conclusion has been made by previous research in the context of a smart home [5,24,27], where residents are also worried about being tracked within their homes. This shows that some of the user concerns about commercial smart buildings are indeed shared with the users of other smart environments.

The lack of knowledge among our participants about the possibility of using non-occupancy data to determine occupancy is not surprising. Similar studies on smart homes, e.g., [30] have also found that users are unaware of the privacy risks from inference algorithms where they combine the environmental data in IoT infrastructures. [46] finds that when the participants are aware of this possible combination of data, they view it as being a higher risk to their security and privacy. This confirms our findings, and again shows the similarities of user perceptions within varying smart environments, with our participants becoming more concerned and selecting a greater variety of sensors after being informed how other sensors can be used to determine occupancy.

In terms of suggestions to alleviate concerns, [30,31] also recommend changes to the regulations regarding privacy in smart homes and the need for dedicated industrial privacy standards. [24,25,30,31] recommend a more user-friendly interface with smart devices, with some suggesting the ability for the users to be able to control what and how the data is used. Similar to our findings, improving transparency of the data practices and user awareness is the most common suggestion in the previous work, e.g., [5,24–28,30,46,61,62].

In our study, despite there being an increase in privacy concerns, after learning more about the building, both groups of participants also saw an increase in how beneficial the use of this data is to them. This shows that our participants are conflicted on whether this data should be used about them, which may be alleviated through increased transparency and control over the use of their data. These findings are similar to those from previous research such as [5,28], who found users that would accept the additional security and privacy risks because of the building’s functionality and convenience.

Our findings demonstrate that the concerns of smart home users are also shared by people when discussing commercial smart buildings as a workplace. [5,27,30] discuss how power imbalances in home environments can be a cause of user privacy concerns, whilst [63] investigates how to readjust power relationships in smart cities to increase the user’s trust towards these environments. Some of our participant responses reinforce this cause for concern, mentioning worries of being monitored by their bosses at work. Given the nature of these buildings and that they are used for work, these power imbalances are likely to be much more common, resulting in shared privacy concerns with smart home users, despite being in a more public environment [5].

We highlight that there are multiple blind spaces in this sector that remain unexplored. For instance, are the privacy concerns in smart buildings less serious, the same, or more serious than smart homes’ privacy issues, e.g., technology-facilitated abuse such as ‘revenge porn’ and intimate partner violence [64]. Note that the initial purpose of this study was to explore the privacy concerns in smart work environments and for an in-depth comparison between smart environments, a dedicated study should be conducted in the future.

5.4. Recommendations

Our studies demonstrate that the current practices for empowering users in smart buildings are not enough since most of our participants expressed serious privacy concerns about data collection in such buildings. Here we provide a set of recommendations for different stakeholders in order to improve user privacy:

Regulations. As suggested in [17–19] there are many blind spots in the current regulations on user data privacy (e.g., the GDPR) in the context of smart buildings. Therefore, providing clarification in the law and potentially developing context-specific regulations by standardisation bodies will significantly impact the current practices.These changes are necessary to work towards alleviating the privacy concerns, that we have highlighted in this paper, of those using these buildings.

Smart building owners/managers. Through our research, as well as the comments provided by our participants, we have identified many areas where the smart building owners and managers can improve the user experience. The majority of our participants said that the use of private data is not a problem, but how it is used is important or may be of concern. A more transparent practice is on the top of the user list, which can be enabled by induction sessions, online pages, visual dashboards, explicit consent, opt-out options, etc. [24] recommends similar actions to better inform users and give them more control over their data. Greater transparency may also help with the public perception of smart buildings, alleviating concerns that people may have as smart building workplaces become more commonplace. To ensure ethical and governance requirements are met when sharing smart building data, a socio-technical ethical process for owners and managers has already been proposed by our research team using the USB as a case study [10].

Occupants. The current practices by smart buildings do not offer much to users to enhance their privacy. However, when occupants of such buildings are concerned about their privacy at work, they should be able to communicate their concerns with their employer. We believe that such feedback will raise awareness around the issue and impact the existing practices.

5.5. Limitations

As mentioned before, it took 15 minutes on average for our participants to complete both questionnaires, each with a few outliers. When excluding these, the average times decreased to 11 minutes and 12 minutes respectively. It is possible that the long number of the questions might have caused some levels of questionnaire fatigue, e.g., not everyone provided answers to the open answer questions. We specifically went through our results without including our participants’ demographics in our initial analysis to avoid sampling biases. Additionally, due to the smaller number of longer responses we received, nearly everything brought up was discussed in the thematic analysis. We acknowledge that due to a bug in our survey, we could not log the gender of our participants correctly. While most of our student and academic staff participants were anticipated to be men (since it was in the USB which is the home of the School of Computing with much more male students and academic staff), it remains as a research question how gender has an impact on user perceptions and preferences which we will study in the future. In addition, the questionnaires were completed by our participants during the lockdowns (as a result of the Covid-19 pandemic) and while they were working from home. For this reason and since we conducted our experiments early on in the Covid-19 lockdowns where online interviews were not the best practice yet, we could not arrange for in-person interviews and conducted all the experiments by online surveys. Working from home might have impacted the number of attendees, as well as their concerns and preferences in various ways.

We do acknowledge that our first study was conducted on the residents of one smart building only (USB). In addition, given the USB’s residents’ computing science background, there is a chance that the results are biased, i.e., that the first group of the participants are more knowledgeable and suggest more technical solutions. However, as we discussed before, similar concerns are shared between our participants in comparison to the users of smart homes. Though, further studies are required on residents of other smart buildings, which we leave as future work. Additionally, we acknowledge the differences in the number of participants between the two studies. Additional participants in the second study may have given further insight into their concerns or lack thereof, however, given the more distributed nature of this group, recruitment proved more challenging and we feel that our sample gave a good insight into this user group’s concerns and preferences.