Birchley2017_Article_SmartHomesPrivateHomesAnEmpiri

RESEARCH ARTICLE Open Access Smart homes, private homes? An empirical study of technology researchers ’ perceptions of ethical issues in developing smart-home health technologies Giles Birchley 1* , Richard Huxtable 1 , Madeleine Murtagh 2 , Ruud ter Meulen 1 , Peter Flach 3 and Rachael Gooberman-Hill 4 Abstract Background: Smart-home technologies, comprising environmental sensors, wearables and video are attracting interest in home healthcare delivery. Development of such technology is usually justified on the basis of the technology ’ s potential to increase the autonomy of people living with long-term conditions. Studies of the ethics of smart-homes raise concerns about privacy, consent, social isolation and equity of access. Few studies have investigated the ethical perspectives of smart-home engineers themselves. By exploring the views of engineering researchers in a large smart-home project, we sought to contribute to dialogue between ethics and the engineering community. Methods: Either face-to-face or using Skype, we conducted in-depth qualitative interviews with 20 early- and mid- career smart-home researchers from a multi-centre smart-home project, who were asked to describe their own experience and to reflect more broadly about ethical considerations that relate to smart-home design. With participants ’ consent, interviews were audio-recorded, transcribed and analysed using a thematic approach. Results: Two overarching themes emerged: in ‘ Privacy ’ , researchers indicated that they paid close attention to negative consequences of potential unauthorised information sharing in their current work. However, when discussing broader issues in smart-home design beyond the confines of their immediate project, researchers considered physical privacy to a lesser extent, even though physical privacy may manifest in emotive concerns about being watched or monitored. In ‘ Choice ’ , researchers indicated they often saw provision of choice to end-users as a solution to ethical dilemmas. While researchers indicated that choices of end-users may need to be restricted for technological reasons, ethical standpoints that restrict choice were usually assumed and embedded in design. Conclusions: The tractability of informational privacy may explain the greater attention that is paid to it. However, concerns about physical privacy may reduce acceptability of smart-home technologies to future end-users. While attention to choice suggests links with privacy, this may misidentify the sources of privacy and risk unjustly burdening end-users with problems that they cannot resolve. Separating considerations of choice and privacy may result in more satisfactory treatment of both. Finally, through our engagement with researchers as participants this study demonstrates the relevance of (bio)ethics as a critical partner to smart-home engineering. Keywords: Choice, Engineering ethics, Empirical ethics, Health technology, Privacy, Qualitative research, Research ethics, Smart-home, Ubiquitous computing * Correspondence: giles.birchley@bristol.ac.uk 1 Centre for Ethics in Medicine, University of Bristol, Bristol, UK Full list of author information is available at the end of the article © The Author(s). 2017 Open Access This article is distributed under the terms of the Creative Commons Attribution 4.0 International License (http://creativecommons.org/licenses/by/4.0/), which permits unrestricted use, distribution, and reproduction in any medium, provided you give appropriate credit to the original author(s) and the source, provide a link to the Creative Commons license, and indicate if changes were made. The Creative Commons Public Domain Dedication waiver (http://creativecommons.org/publicdomain/zero/1.0/) applies to the data made available in this article, unless otherwise stated. Birchley et al. BMC Medical Ethics (2017) 18:23 DOI 10.1186/s12910-017-0183-z

Background Smart-home technologies — technologies that interact with the home occupier to remotely automate utilities and appliances — exact interest in a range of domains. While the concept of smart-homes has existed since the 1960s [1], the creation of inexpensive wireless devices and powerful computers means that many observers see smart- homes as an idea whose time has come [2, 3]. Interest in smart-homes extends beyond automation for convenience [4] to healthcare applications for older people [5]. A review of technology by Tamura [6] describes using sensors on doors, furniture and appliances, wearable devices and video cameras. Such devices can make physiological measure- ments, detect activity and inactivity, falls and other acci- dents. Combined, the information from such devices can track health related routines of smart-home occupants by monitoring their patterns of daily living. While more studies of smart-homes are focused on the possibilities of data collection [7] than its ethical limits, research has tried to understand the ethical impli- cations of smart-home and related health technologies. These studies commonly raise concerns about privacy, but also suggest consent, social isolation [8] and equity of access [9, 10] are major areas of concern. End-users have been observed to allow their privacy to be compro- mised if they perceive sufficient personal benefits, which some scholars claim is a fair trade of privacy for in- creased autonomy [11 – 13]. Others complain such a compromise neither fosters end-user autonomy nor avoids serious moral harms to personal agency [14, 15]. For example Brown and Adams [9] argue that perva- sively observed and monitored individuals will find themselves pressured to alter behaviours in line with particular conceptions of health. While such arguments can appeal to popular notions of personal responsibility, there are good arguments to suggest health and ill- health are normative concepts; [16] what is normal health varies from one time or place to another — consi- der, for instance, debates about criminal responsibility and mental illness, [17] or changes in attitude toward the status of homosexuality as a health aberration [18]. There are numerous instances germane to smart-homes where provision of a diagnosis brings ethical consider- ations to the fore. For instance, a diagnosis of dementia raises questions about autonomy, and the suggestion that an accident is a ‘ fall ’ is a label that may imply frailty and decline. Whether ethical concepts common to bioeth- ics are the most appropriate for discussion of new engineer- ing technologies is the subject of some debate. Distinctive ethical frameworks have arisen in the field of engineering. Floridi has influentially argued that much of bioethical rea- soning is “ biocentric ” and favours an ontological approach to ethics that gives moral consideration to data entities on bases other than whether or not they are biologically alive [19]. His view is not universally embraced, [20] although the need for new forms of ethics that are fit for an age of intelligent machines is widely discussed [21]. These rich dialogues identify numerous ethical issues that may be germane to smart home health technologies, but is largely missing the views of those engineers who work in smart-home research. Orr ’ s [22] fascinating ethnography of the working lives of photocopier techni- cians notwithstanding, studies that probe the views and opinions of the engineering community are a relatively slim volume in academic literature, particularly studies of ethical issues [23 – 25]. Nonetheless their views may be important for a number of reasons. Smart-home re- searchers play a key role in the inception and implemen- tation of new technologies, and their ethical perspectives may be expected to influence the way ethical problems are responded to. Within a general context this informs a description of the approach of engineering scholars to ethical issues which may directly inform pedagogical or governance perspectives. This task fits within our own empirical bioethics perspective. We are a group of re- searchers from a variety of academic disciplines, the ma- jority of whom have experience of conducting qualitative studies in order to stimulate (bio-)ethical dialogue about practical situations. Such dialogue may contribute insights useful both to theoretical and practical perspectives. More specifically, these insights might be critically analysed to ex- plore both the problems that are identified and the efficacy of the solutions that are offered to them. While empirical ethics has a rich methodological tradition, [26] the current project takes the relatively modest approach of offering (bio)ethical reflection on the results of a qualitative study we undertook with smart-home engineers. Such an approach, in line with current attempts to foster responsible research and innovation at a European level, [27] aims to contribute to existing dialogue between applied ethicists (including those within our own bioethics community) and the engin- eering community. The intention is that this will contribute to the ethical rigor of the solutions developed in this area. Methods To investigate the views of smart-home researchers, a quali- tative interview study (hereafter “ the qualitative study ” ) was undertaken with researchers on a large project (hereafter “ the smart-home project ” ) concerned with the utilisation of smart-home technologies. To maintain the anonymity of participants we do not identify the smart-home project. It is a large, interdisciplinary research collaboration involving more than 80 academics and support staff at several UK universities including early-, mid- and late-career re- searchers (respectively defined for this study as PhD students and research associates; lecturers and research fellows; and readers and professors). By examining large sets of data for relationships and patterns (data mining) using Birchley et al. BMC Medical Ethics (2017) 18:23 Page 2 of 13

participant(s). Interviews lasted between 52 min and 79 min. Four interviews were conducted by Skype, and the rest were conducted face-to-face. In publishing these results we are particularly con- cerned to maximise anonymity of participants. Partici- pant area of expertise is pertinent to the themes, and several quotes are included where this information is given either in the quote or in the discussion. This ele- vates an already high risk of participant identification within a small research community, even when the usual steps to preserve anonymity, such as pseudonymisation, are taken. Even if widespread identification was impos- sible, if participants are able to self-identify, this may both undermine the consent that participants have given to have extracts from the interviews published and more generally undermine the confidence of participants in further studies of this type. For this reason, further steps have been taken to increase anonymity; described below. Enhancing anonymity No table of participants is given, as details such as occupa- tion, grade and length of time on the smart-home project would lead to recognition. Given the presence of identify- ing features in some quotes, simple pseudonyms were found to provide inadequate protection of participants ’ identities. However, removal of pseudonyms decreased the readability of the paper and, further, may give inadequate reassurance to readers that quotes from a narrow pool of participants did not dominate the discussion. Nor did re- moving pseudonyms provide easy traceability between the authors when writing the article. Therefore each partici- pant was assigned two possible pseudonyms, which were securely stored on an encrypted keybreaker table. The cluster ensured that quotes from each participant featured no more than twice in this article, allowed traceability and enhanced readability. Name genders reflected the gender balance of researchers on the smart-home project, but gender was assigned at random to decrease researcher identifiability further. Finally we do not give precise or dir- ectly identifying details of the smart-home project in the text of this article, although we are aware that it could be identified by other means. This is primarily because we felt that anonymising the study was a sign of good faith to participants, but also because many discussions in the in- terviews are about considerations that were broader than the project itself and did not directly reflect the solutions that were adopted within the project. Data analysis Transcripts were analysed using the method of thematic analysis described by Braun and Clarke [29]. Individual transcripts were read and, using NVivo 10, inductive codes were assigned to portions of text by the first author (GB). A total of twenty per cent of transcripts were independently coded by a second member of the study team (RGH, MM, RH, RtM) and codes were checked for consistency. Incon- sistent codes were discussed until consensus was reached. When coding was complete, 37 codes had arisen from the text. Similar codes were then grouped into broader themes, which described concepts or understandings that recurred in many interviews. Text that contributed to these themes was re-read in context to ensure the topics reflected the content of the interviews. Quotes that exemplified these themes were selected, lightly edited for readability and par- ticipants given pseudonyms. Results Two themes arising from the analysis are discussed here. The first, ‘ privacy ’ , encompassed smart-home project re- searchers ’ discussions about the desirability of personal privacy, the necessity for the privacy of end-users of the technology and the reasons for this. The second theme, ‘ choice ’ focused on the paradox between solving ethical dilemmas in research by allowing end-users freedom to choose, and the need to ultimately impose ethical judgments that limited end-users ’ choices. Privacy Privacy is a “ volatile and controversial concept ” [30], and is thus difficult to define in a way that satisfies all reasonable objections. Nevertheless, there are clear soci- etal norms protecting personal privacy, even if their boundaries are debated. One taxonomy of invasions of privacy includes: the collection, storage, and computerization of information; the dissemination of information about individuals; peeping, following, watching, and photographing individuals; intruding or entering “ private ” places; eavesdropping, wiretapping, reading of letters; drawing attention to individuals; and forced disclosure of information [31]. Encouraged to speculate on the problems and possibil- ities of smart-home technologies, issues germane to privacy arose frequently in the interviews. In particular, smart-home project researchers predominantly charac- terise privacy as the unbidden sharing of data, rather than as an invasion of personal space. Researchers vary in their concern about privacy: several indicate they are relaxed about their own privacy. For example, Julian thinks that the loss of privacy is a ‘ done deal ’ , and therefore, not an important worry: Julian: if you ’ ve got a mobile phone, I think people can track you if they really want to. Indeed, I think there are apps where you can, in fact, track your child ’ s or your partner ’ s phone, so you do know where they are. Birchley et al. BMC Medical Ethics (2017) 18:23 Page 4 of 13

Well, that ’ s “ not a big problem ” , so I don ’ t know what is? I ’ m not too worried about that. Similarly, Brian suggests he is relaxed about large-scale commercial collection of personal data: Brian: Actually, Google products are really good. If you use them you get a lot of benefit from having - and actually do I really care about what they ’ re doing with my data? It ’ s not like that they ’ re looking at my data personally. These responses conceptualise privacy as access to data, and suggest the participants may not contextualise quite distant, person-neutral, corporate information col- lection as problematic in privacy terms. Even where more personal notes are struck, privacy is often consid- ered in terms of data, rather than in more abstract terms, like being watched. For instance, Margaret and Sally, both researchers who specialise in video technolo- gies, contend that researchers in their field are less sensi- tive about being filmed in the course of their research than others: Margaret: To be honest I think maybe [video researchers] are less sensitive than other people. For video we really want to get that data and we think it is really okay, so if you put it in my home I am okay with it. … I would be okay with [other sensors too]. Sally offers a similar reflection, which seemed to corroborate this suggestion: Sally: I ’ m a [video researcher] and for years we ’ ve been videoing each other hopping and walking up and down and I truthfully don ’ t care if there ’ s a picture of me doing that in a conference paper at all. There needs to be some balance I think. It ’ s frustrating as well because I know other research groups don ’ t do that [gain research approval]. Although Margaret and Sally ’ s willingness to share im- ages of themselves in research contexts could, on the face of it, speak of a relaxed approach to being watched, their aims regarding sharing suggest that imaging is again linked to data privacy. Margaret links video to the need for data, while Sally is relaxed about sharing video at a conference of herself moving, as this takes place in a research context. There is no contrast with this data- centred conception of privacy when Sally and Margaret express strong resistance to sharing other types of infor- mation about themselves with others: the focus is again on sharing data , rather than on sharing prompting more emotive responses (such as feeling exposed). Discussing her resistance to sharing location data, Sally says: Sally: A lot of people [share location data] all the time but then you can look at people, you can tell what time they leave work, if they ’ ve left early, you can see where they go afterwards. I think they ’ re potty to leave that thing running. … I suppose I just don ’ t want people knowing exactly where I am at what time of the day. … the journey to and from there and the journey from home to work, I don ’ t want those patterns of my behaviour being public. Similarly, when asked to talk about the types of sen- sors that might make her uneasy if used outside the pro- ject, Margaret expresses concern about sensors that recorded the voice: Margaret: For me I probably don ’ t like voice sensors in there to record the environmental voice in it. Interviewer: So recording speech and so on. Margaret: Yes, the speech things. It is just a personal [thing] for me. I think somehow it is also difficult to process that data. Sometimes people say something and you don ’ t really want to process that data. Maybe it is better than having the voice recognition system at home or those constrained environment is probably better for users otherwise they have this and they probably think, “ Every single word I say will be recorded. ” It will always make them think, “ That data has to be recorded should I say something? ” They always need to think about this so it will probably affect their life. Margaret and Sally ’ s reflections are interesting because their desire not to be located or audio-recorded relates to the unbidden sharing or storage of data. Sharing video is tolerated because it is innocuous data. Location is un- acceptable if it is shared with the public. These concerns about data privacy were visible in a range of discussion of specific technologies, including less overtly intrusive smart-home technologies, such as door sensors, noise detectors or, as in the following examples, accelerome- ters and electricity usage monitors: Norman: if someone has access to, let ’ s say, that data, and he sees you made 2,000 steps, it means if you were home, you ’ re somewhere else now, because you cannot walk 2,000 steps in your home at a single time. Derek: The reason I don ’ t like all this data collection is just because I ’ m a data mining researcher. I know what they can do with the data. … [for example] I can simply use the electricity metering to detect whether someone has played their PlayStation. … [to detect that] this guy is playing video games for the whole night. Birchley et al. BMC Medical Ethics (2017) 18:23 Page 5 of 13

The quotes in this section exemplify a significant senti- ment: ethical problems, especially of privacy, could poten- tially be dissolved if an end-user chose to share their data. Indeed, some researchers take choice to imply responsibility: for example, Oliver suggests the dilemma of gaining consent for (inadvertent) data collection from third parties can be left with the end-user: Oliver: If you have third party children coming into the house obviously their guardian would have to say if this is okay or not. It is very difficult. It will probably have to be then on the [end-user] ’ s shoulders to bear that burden to tell people and inform people. I think it is really difficult. On the other hand, some researchers state that per- sonal choice can only go so far. For instance, Godfrey avers that, because a smart-home system could hypo- thetically indiscriminately monitor anyone who was in that smart-home, the nature of smart-home projects ex- poses the notion of end-user choice to wider problems: Godfrey: [end-users] can say, “ I am going to record my own self doing anything I happen to feel like. And I can do that for my own personal ends; whatever those personal ends might happen to me. And that is completely my choice. ” And that is legally, if not ethically uncomplicated. The problem becomes when [end-users] have a family and things like that and then you blur the boundaries of what is personal. Godfrey indicates that the special problems of dealing with the multiple occupants and visitors, who might include chil- dren or non-consenting adults, mean that choice is much more dynamic than simply allowing individual end-users to choose their preference. Firstly, since choices needed to be made before the implementation of the system, research choices are potentially a major conduit for researchers ’ own value judgements. Secondly, even if there is clear evidence of particular end-user choices, these could not be unrestricted. As detailed in the first theme ( ‘ privacy ’ ), many researchers are concerned that a smart-home environment has hypothet- ical potential to broadcast data that would damage the end- user if shared in an unrestricted way; as such it is logical that sharing is prevented, even if that prevention brings the choices of end-users and researchers into conflict. Making research choices Researchers voiced near unanimous support for end- user choice to be the arbiter of ethical dilemmas. But researchers also had to make choices about selection, design and implementation of technologies and these by their very nature imply that ethical choices are being made. While these might be framed as choices of a purely technical nature, or choices driven by others, at some stage the researcher themselves has to make basic choices that, plausibly, would affect the ultimate direc- tion of the project. Blake summarises this succinctly: Blake: Well, in research, you make your own choices. You decide whether you use this technique or something else, and so on. While such an explanation does not explicitly address ethical issues, certain aspects of design clearly took a (very standard) ethical position. For instance, consider this explan- ation by Gwen of the way the home network was designed: Gwen: … if you have a physical network, you don ’ t really need to encrypt because you just have a cable between device A and device B. Whereas, if you ’ re using a wireless link, then you definitely have to encrypt data. That basically slows things down, so an advantage of using a wired link is that you can possibly avoid having to encrypt anything. Therefore, you can increase the speed of your storage system. Gwen assumes data security — either based on encryp- tion or the inherent features of a closed circuit — to be embedded in design. An ethical choice is made that (for example) there is a duty to end-users to keep data se- cure. While this is clearly a choice that is bulwarked by societal mores, regulatory norms, the law, and research ethics, it should nevertheless not be overlooked that the opposite choice can be made. It is open to researchers to decide that data is not personally identifiable, and data security can be relaxed. Indeed, it is not uncommon for researchers to report taking such a position, for instance: Phoebe: The wristband is basically just accelerometer counts of my hands swinging around as I move around. Maybe it ’ s got location data that coarsely says which room I ’ m in in my own home, which is pretty meaningless. Carter: I know for a fact that there ’ s absolutely, well, nothing they can know about me that I really don ’ t want them to know. The microphone is not able to record sound or send a sound anywhere else. The accelerometer data is literally just accelerometer data and at the end of the day there ’ s really only so much you can find out from that. You can ’ t really find out if someone is doing any specified task. Yet, while researchers tend to defer to research guide- lines in spite of such value judgements, some ethical Birchley et al. BMC Medical Ethics (2017) 18:23 Page 7 of 13

questions required a decision to be taken at the design stage. For instance, should the project focus on tech- nologies with a high risk of personal identifiability (like video)? Where is the balance between gathering valuable data and user acceptability? What is practical? What is relevant? Some of these questions about what should be monitored had been put to clinicians, but Florence high- lights the ultimate need for researchers to discover what information to gather: Interviewer: Presumably you ’ re collecting this data because clinicians have said that this type of data would be useful? Florence: Yes. That ’ s a question for us, as well. In the very beginning, we didn ’ t know, even though we had a literature review. Many literature said that ’ s a wearable sensor, so you can use it to detect that kind of activity. Daily activity. But that ’ s not a strong conclusion to say that we need these sensors, these sensors, and that this list of sensors can give you this list of activity recognition. Interviewer: So you ’ re almost collecting data to see what you can find out. Florence: That ’ s one of the tasks we need to do. We deploy a list of sensors, to see which one, what list of sensors is actually useful to detect the daily living activity of the user. Florence ’ s comments point toward a paradox of experi- mental research. To decide what to monitor, the re- searcher must first start monitoring. While discussions with clinicians and the public could be useful to guide these decisions, the researchers explain that some guess- work was always needed. For example, Connor indicates the need for researchers to anticipate what end-users would accept: Connor: Basically, we are basing our choices on the fact that we think that the [end-users] that volunteer are happy to do that. Connor ’ s comment contains an echo of the earlier ap- peal to end-user choice. Indeed, design choices are not framed as explicitly restrictive of ethical choices, but simply technical decisions. Nonetheless, as stated earlier, allowing end-users to follow their preferences in unre- stricted ways is ultimately problematic for some re- searchers, and leads to discussion of controls on end- user behaviour, although such controls are rarely, if ever, made explicit to end-users. Influencing end-user choice In some instances, researchers describe decisions that had been explicitly made to prevent end-users from making ‘ bad ’ choices. Sometimes these were framed, as above, as technical decisions, but these technical consid- erations merge with clear intentions to prevent users from acting in certain ways. At a whole-project level the smart-home project would not store ‘ raw ’ data as collected by sensors. Instead, such data would be proc- essed immediately by the system (a server) within the home into higher-level data, and the system in the home would not be connected to the wider internet beyond the home. In the following exchange, Seth justifies re- strictions to end-user access to processed data, because access may cause them to reflect negatively on their actions: Seth: [end-users] shouldn ’ t have access [to their data]. Because when you look at your own data, you feel like you didn ’ t do very well. Other researchers suggest that end-user data should be shared with health professionals, but that the decision about what to share should rest with researchers, rather than the end-user themselves: Austin: But I think the user isn ’ t necessarily to be the one to decide what data they will share. As with Mia ’ s statements about allowing users to record video, such questions could still conceivably be framed as technical choices, so rightly in the ambit of researchers to make. However several re- searchers assert that end-users may use the technol- ogy for ethically suspect purposes. Roger is among several researchers who found the possibility that parents could hypothetically use smart-home tech- nology to monitor their children ’ s behaviour ethically troubling: Roger: [a smart-home system] would really have to be well thought out to avoid misuse … let ’ s say that you ’ re living with your children in such a house that you can monitor their every step. I think that ’ s not appropriate, or that ’ s not ethical. You would not want your children to behave good because you ’ re monitoring them, but you want them to behave in a good way because that ’ s the right thing to do. Birchley et al. BMC Medical Ethics (2017) 18:23 Page 8 of 13

users. It is difficult to gauge the scale of this problem. The positive levels of user acceptance of sensing tech- nologies seen in some studies [37] have limited value due to their small scale. Research has also tended to focus on people living with long-term conditions [38], who may react more positively than those less invested in monitoring their health; by contrast, a third of users of wearable health technologies stop using these prod- ucts within six months [39]. Moreover, research has fo- cused on discrete technologies [40, 41] rather than the ubiquitous sensors and monitoring devices envisaged as the end-point of smart-homes. End-users ’ responses to these technologies in the field have much to tell us. Some studies of end-users suggest that unobtrusiveness and invisibility are valued at least as highly as assurances of informational privacy [42]. Such tendencies toward physical privacy may manifest in the rejection of some or all types of smart-home monitoring that cannot be overcome by reassurances about data protection. Quite how these issues can be solved in the context of smart- homes ultimately demands input both from the people who use their technologies and those who actively reject such technologies, about how they feel. Until this is investigated, we should be wary of overestimating what can be achieved with data privacy. 2. Researchers saw offering end-user choice as an effective way of addressing ethically sensitive issues, but also acknowledged end-user choices should be restricted in some instances. How much choice should end-users be offered? Writers often link choice to autonomy, and both healthcare ethics [43, 44] and the ethics of research par- ticipation are concerned with patient or participant choice. Some bioethicists reduce most ethical dilemmas to respect for autonomy [43]. They justify this position by referring to a plurality of values and the lack of an overarching moral consensus. However, this position is often guided by libertarian motives and extreme em- phasis on individual freedom [45]. In this case, they might argue that, if individual can agree with the intru- sion of their life sphere, there is no ethical issue any more. In our study, researchers ’ inclination to offer choice to future end-users could be interpreted in two ways. First, as described in the results section, reducing ethical dilemmas to choice could allow smart-home re- searchers to avoid taking responsibility for ethical deci- sions. Second, the desire to offer choice may relate to a libertarian approach to end-user choice in which choice is seen as a completely individual process in which no others are (or should be) involved. The first of these is more pragmatic in orientation and the second is a more principled basis for provision of choice. Both possibilities may operate alongside each other, or in an intertwined manner, which accords with research in other contexts. For instance, Mol observed that the rhetoric of autono- mous choice in healthcare can be interpreted both as ra- tionale by practitioners to excuse themselves from caring about the patient who makes choices and as prin- cipled (we would say libertarian) respect for those pa- tient choices [46]. The nature of privacy is “ one of the most obvious and pressing issues in computer ethics ” [47] and a vexed one in ubiquitous computing [48]. If the researchers in this study largely endorse the thesis that choice can resolve ethical issues (whether for principled or self-serving rea- sons), it is germane to ask how choice might relate to per- sonal privacy. The close identification of privacy with choice is only reflected in some areas of existing literature, mainly in context of U.S. constitutional law and related academic literature, where privacy has been argued to underpin rights to autonomy [49]. However, many writers have not taken this approach, [50] for instance, Nissenbaum [32] argues that personal privacy is measured by degree of access rather than degree of choice. Similarly, Cate suggests, “ individual choice is not the same as per- sonal privacy, so focusing laws, regulations and enforce- ment on the former will not necessarily enhance the latter. ” [51]. Cate also argues that a focus on choice allows data collectors to shirk their obligations to maintain priv- acy, shifting responsibilities in relation to privacy onto the individuals who provide the data. This analysis suggests that an inappropriate focus on choice may also raise social justice concerns. Furthermore, asking end-users to make frequent choices about participation (which we may wish to do in smart homes, with their perpetual monitoring) may place excessive burden on individuals [51, 52]. Other contexts where patients and consumers are routinely pre- sented with choices, such as informed consent documents, terms of credit documents or software terms-of-use con- tracts have been empirically demonstrated to result in poor exchange and understanding of information [53]. Therefore, offering choice may not be the solution to priv- acy issues, may place burden on individuals, may not en- hance understanding and may raise social justice concerns. The imperfections in ensuring privacy by providing more choice may be behind the tensions about the role and extent of choice within the interviews. By disconnect- ing choice from personal privacy we might begin to ex- plore what other benefits and harms flow from choice (a number of which were identified by researchers). Possible benefits may include a feeling of reassurance to end-users that a smart-home system is delivered in a professional manner and the sense that they are able to withdraw if use of the system is burdensome. Possible harms that should be guarded against include giving end-users the ability to Birchley et al. BMC Medical Ethics (2017) 18:23 Page 10 of 13

monitor others within smart-homes without appropriate consent, disenfranchisement if end-users are given infor- mation that they do not understand, and negative impact on end-users if they are provided with access to data about themselves without interpretation and support. These harms could be serious, and may be justifiable rea- sons for restriction of some choices to end-users. Such re- strictions should be monitored to ensure appropriateness and carefully balanced against possible benefit of broader choices, informed by ethical reflection on the meaning of privacy as a widely shared value. By decoupling choice from privacy, the duty to protect the privacy of end-users and third parties is placed more firmly with researchers. Limitations The study has some limitations. The lead researcher was not a smart-home engineer and thus may have interpreted technical distinctions in a naïve way. However, this naïvety is generally considered an advantage in qualitative research, since the researcher investigates basic assumptions. The participants were early- and mid- career researchers and so the material presented here accurately reflects their views rather than decisions about the smart-home project as a whole, which are not explored within this study. However, the study is intended to reflect on smart-home research in general rather than on particular solutions adopted in a sin- gle project. The study only investigates the views of the re- searchers and not of the end-users, and it will be important to gather the views of end-users to be able to compare the views of users and engineers. We recruited from a single smart-home project, and it is possible that the micro- culture does not reflect experiences in other projects. As study participation was voluntary it is possible that the re- searchers who took part had particularly keen or specific interest in the topics that the study addressed. Despite this we have confidence in the findings because we encountered diverse opinions and were able to include participants from several institutions. We appreciate that interviewing and thematic analysis are subjective processes, and it is possible that other researchers would have encountered different themes. However, we conducted interviews and analysis until thematic saturation was achieved, and the process of analysis included double coding and deliberative discus- sions within our experienced multi-disciplinary research group. We therefore suggest that the interpretation pre- sented here is appropriate and germane to the developing research in this area. Conclusions Applying smart-home technologies to healthcare appli- cations represents not only a technical, but an ethical, challenge. Ethical analyses of these technologies raise concerns inter alia about loss of privacy, the adequacy of consent and maintaining agency. Exploring the views and experiences of researchers of smart-home technolo- gies brings insights into which ethical issues researchers see as pertinent to their technologies, and the ap- proaches that they take to solve these issues. Qualitative interviews with researchers in this large, multi-centre smart-home project indicated that privacy and choice were the major areas of ethical focus in the de- sign and implementation of smart-home health technolo- gies. Researchers primarily viewed privacy as a problem of data security, and expended efforts to develop a system that would minimise the exposure of data to the outside world. Laudable as such an approach is, a focus on data privacy may take too little account of the much less tract- able problem of ensuring end-users felt that their physical privacy was respected. While actual respect is clearly eth- ically important, favourable end-user perceptions are es- sential to public acceptability of new technologies and thus ensuring that their benefits are spread equitably. Even where researchers were able to ensure adequate data priv- acy, the lack of a commonly agreed concept of privacy could mean that, even with sustained attention, privacy is limited in its solubility as an ethical problem. Essential to developing approaches to these problems will be to con- tinue research with those end-users who both engage, and do not engage, with smart home technologies. Researchers also indicated considerable efforts in en- suring end-user choice were addressed in the system de- sign. Many saw this as a ready solution that addresses many of the ethical problems involved in maintaining privacy. At the same time, the interviews revealed aware- ness among researchers of the limitations of this strat- egy, and despite an overwhelming endorsement of the moral desirability of user choice many researchers dis- cussed elements of design which restricted such choice. Researchers tended to describe these as technical solu- tions to engineering problems, and did not seem to ex- plore or question the normative assumptions that accompanied them. Researchers overtly discussed re- striction of end-user choice in only a few cases and even then, with extensive caveats. This may point to a desire to avoid making ethical choices, but might equally be consistent with a pro-autonomy position. Choice may then, be a way to address ethical issues. Nevertheless, given the pervasiveness of privacy concerns in ubiqui- tous computing, it is notable that identification of priv- acy with choice is not a ethically acceptable strategy. Indeed some privacy scholars suggest it misidentifies the sources of privacy and risks the unjust burdening of end-users with a problem that researchers themselves have greater resources to address. Such analysis suggests that considering choice and privacy as separate issues is likely to result in a more satisfactory treatment of both. Our research aimed to document the perspectives of re- searchers in a rapidly developing technological field. We Birchley et al. BMC Medical Ethics (2017) 18:23 Page 11 of 13

Communication Technologies (PICT) ethical challenges, opportunities and safeguards. Dordrecht: Springer Netherlands; 2014. p. 71 – 87. 16. Turki AT. On the normativity of the immune system. Med Studies. 2011;3(1):29 – 39. 17. Waller W. Criminal insanity, diagnosis, and public morality. Wash U Jurisprudence Rev. 2011;4:183 – 212. 18. Smith G, Bartlett A, King M. Treatments of homosexuality in Britain since the 1950s — an oral history: the experience of patients. BMJ. 2004;328(7437):427. 19. Floridi L. On the intrinsic value of information objects and the infosphere. Ethics Inf Technol. 2002;4(4):287 – 304. 20. Tavani HT. Floridi ’ s ontological theory of informational privacy: Some implications and challenges. Ethics Inf Technol. 2008;10(2-3):155 – 66. 21. Gunkel JD. The machine question. Cambridge: The Massachusetts Institute of Technology Press; 2012. 22. Orr JE. Talking about machines: an ethnography of a modern job. London: Cornell University Press; 1996. 23. Kalpana S, Connelly KH. Ethics and pervasive technologies. Teach Ethics. 2010;11(1):75 – 85. 24. Kehagia AA, Tairyan K, Federico C, Glover GH, Illes J. More education, less administration: reflections of neuroimagers ’ attitudes to ethics through the qualitative looking glass. Sci Eng Ethics. 2012;18(4):775 – 88. 25. Mecca JT, Gibson C, Giorgini V, Medeiros KE, Mumford MD, Connelly S. Researcher perspectives on conflicts of interest: a qualitative analysis of views from academia. Sci Eng Ethics. 2015;21(4):843 – 55. 26. Davies R, Ives J, Dunn M. A systematic review of empirical bioethics methodologies. BMC Med Ethics. 2015;16(1):15. 27. The EU Framework Programme for Research and Innovation. [https://ec. europa.eu/programmes/horizon2020/en/h2020-section/responsible- research-innovation]. Accessed 6 Nov 2016. 28. Rapley T. Some pragmatics of data analysis. In: Silverman D, editor. Qualitative research. 3rd ed. London: Sage; 2011. p. 273 – 90. 29. Braun V, Clarke V. Using thematic analysis in psychology. Qual Res Psychol. 2006;3(2):77 – 101. 30. Schoeman FD. Privacy and social freedom. Cambridge: Cambridge University Press; 1992. 31. Gavison R. Privacy and the limits of law. Yale Law J. 1980;89(3):421 – 71. 32. Nissenbaum H. Privacy in context: technology, policy, and the integrity of social life. California: Stanford University Press; 2010. 33. Thomson J. The right to privacy. Philos Public Aff. 1975;4:295 – 314. 34. Murtagh MJ, Demir I, Jenkings KN, Wallace SE, Murtagh B, Boniol M, Bota M, Laflamme P, Boffetta P, Ferretti V, et al. Securing the data economy: translating privacy and enacting security in the development of DataSHIELD. Public Health Genomics. 2012;15(5):243 – 53. 35. Allen AL. Coercing privacy. William and Mary Law Rev. 1999;40(3):723 – 4. 36. Moreham NA. Beyond information: physical privacy in english law. Cambridge Law J. 2014;73(2):350 – 77. 37. Fensli R, Pedersen PE, Gundersen T, Hejlesen O. Sensor acceptance model – measuring patient acceptance of wearable sensors. In: Methods of information in medicine. 2008. 38. Chiauzzi E, Rodarte C, DasMahapatra P. Patient-centered activity monitoring in the self-management of chronic health conditions. BMC Med. 2015;13:77. 39. How the science of human behavior change offers the secret to long-term engagement. [http://endeavourpartners.net/assets/Endeavour-Partners- Wearables-and-the-Science-of-Human-Behavior-Change-Part-1-January- 20141.pdf]. Accessed 6 Nov 2016. 40. Shammas L, Zentek T, von Haaren B, Schlesinger S, Hey S, Rashid A. Home- based system for physical activity monitoring in patients with multiple sclerosis (pilot study). Biomed Eng Online. 2014;13:10. 41. Sandroff BM, Riskin BJ, Agiovlasitis S, Motl RW. Accelerometer cut-points derived during over-ground walking in persons with mild, moderate, and severe multiple sclerosis. J Neurol Sci. 2014;340(1-2):50 – 7. 42. Ziefle M, Rocker C, Holzinger A. Medical technology in smart homes: exploring the user ’ s perspective on privacy, intimacy and trust. In: 35th IEEE annual computer software and applications conference workshops. 2011. p. 410 – 5. 43. Gillon R. Ethics needs principles – four can encompass the rest – and respect for autonomy should be “ first among equals ” . J Med Ethics. 2003;29(5):307 – 12. 44. Sandman L, Munthe C. Shared decision-making and patient autonomy. Theor Med Bioeth. 2009;30(4):289 – 310. 45. Coggon J, Miola J. Autonomy, liberty, and medical decision-making. Camb Law J. 2011;70(3):523 – 47. 46. Mol A. The logic of care: health and the problem of patient choice. Abingdon: Routledge; 2008. 47. Floridi L. The ontological interpretation of informational privacy. Ethics Inf Technol. 2005;7(4):185 – 200. 48. Langheinrich M. Privacy in ubiquitous computing. In: Krumm J, editor. Ubiquitous computing fundamentals. Florida: Chapman and Hall/CRC; 2010. p. 95 – 159. 49. Cohen J. Regulating intimacy: a new legal paradigm. Princeton: Princeton University Press; 2002. 50. Solove D. Understanding privacy. Cambridge: Havard University Press; 2008. 51. Cate FH. Protecting privacy in health research: the limits of individual choice. California Law Rev. 2010;98(6):1765 – 803. 52. Reidenberg JR, Russell NC, Callen AJ, Qasir S, Norton TB. Privacy harms and the effectiveness of the notice and choice framework. ISJLP. 2015;2:485 – 524. 53. Ben-Shahar O, Schneider CE. The failure of mandated discourse. Univ. Penn. Law Rev. 2011;159:647 – 749. • We accept pre-submission inquiries • Our selector tool helps you to find the most relevant journal • We provide round the clock customer support • Convenient online submission • Thorough peer review • Inclusion in PubMed and all major indexing services • Maximum visibility for your research Submit your manuscript at www.biomedcentral.com/submit Submit your next manuscript to BioMed Central and we will help you at every step: Birchley et al. BMC Medical Ethics (2017) 18:23 Page 13 of 13