Smart buildings and the legal risks associated with new technologies

27 March 2020

‘Smart buildings’ is a term increasingly used within property circles. Projections show that the smart building market is likely to reach US$105.8 billion by 2024.1 Smart buildings are accordingly big business, and the development of these buildings presents enormous opportunities for property developers.

Smart buildings are developments which invest in and incorporate technology to improve their environment and operations. They are the microcosm of ‘smart cities’ which are predominantly developed and driven by local government authorities. However, there is a growing consensus that smart city developments require partnership between local government and private sector businesses, such as smart technology vendors, financiers and even property developers.

Smart Opportunities for Smart Developers

Astute property developers will recognise that there is potential to leverage the growing smart buildings market and government smart city initiatives and thereby add value to their businesses. Opportunities for developers can include:

  • Government development concessions and offers: Developments incorporating smart technologies could enjoy additional concessions made by local governments with a smart city focus, for example, the streamlining of the planning approval process for development proposals, greater building height limits and increased grants and funding opportunity initiatives;
  • Price premiums for developments with smart technology: Buildings that incorporate sophisticated technology and provide for more efficient operation will often be seen as more desirable as consumers increasingly demand more responsive and personalised services; and
  • Greater accessibility to data to make informed investment, planning and design decisions: Underlying most smart building and smart city technology is data collection which can be used to improve the quality of evidence available to property developers to justify future development strategies and decisions.

Smart Building Technology

A key component of smart building technologies is the collection, communication and analysis of big data – large volumes of data that are analysed to uncover hidden patterns, correlations and other valuable insights in a relatively short timeframe.

(a) Internet-of-Things technology

An increasingly common example of such technology is known as the Internet-of-Things (IoT) which is considered one of the most important components used in smart cities and buildings.

IoT works by collecting and communicating data between connected devices/sensors through the Internet. The data is then analysed to detect patterns, correlations and other valuable insights in a relatively short timeframe. Buildings can be made ‘smart’ by using IoT sensors and devices that detect environmental conditions within the structure, collect data on the conditions and use it to self-diagnose irregularities in the buildings’ operations and self-regulate accordingly.

For example, sensors can detect rises in temperature of a conference room when it becomes crowded and respond by activating the HVAC system to increase ventilation and air conditioning. They can similarly detect the presence and number of people in individual spaces of the building and adjust the lighting and temperature accordingly.

Data collected from occupancy sensors are also helpful to improve space utilisation and optimise building layouts based on changing demands. In a retail environment, sensors can also be used at shopfronts and footpaths to detect customer traffic. The data generated from these sensors can allow store managers to adjust product placement and plan staff rosters around peak times.

(b) Video analytics and facial recognition

Video surveillance technology is also commonly applied in smart buildings. While use of video surveillance systems in residential and commercial buildings is not new, most smart building applications now involve surveillance systems that incorporate video analytics and facial recognition capabilities that help to enhance safety and security.

Video analytics allow surveillance systems to do more than monitor or record activities and are capable of analysing and distinguishing what constitutes ‘normal’ and ‘abnormal’ activities using algorithms. Anomalies such as the presence of an individual in an access-restricted site, or an object being in the same spot for a certain period of time, can then be detected and brought to the attention of human monitors.

Similarly, facial recognition technology can be used to identify persons within the building and their respective locations for use by emergency workers in evacuation situations. It can also be used as part of the building’s access control system to authorise entry of individuals without using PINs and RFID cards. This, combined with the IoT sensor technologies discussed above, can also be used to initiate a sequence of actions (eg turning on the lights in the individual’s workspace or room, activating the HVAC system in that space or summoning an elevator to the floor where the individual is present).

(c) Other technologies

While a majority of smart building solutions rely on IoT and enhanced video technologies described above, there are a number of other discrete, but notable technologies that may be used in respect of smart buildings:

  • Virtual reality (VR) technology: Software is used to create an artificial environment which users can interact with, and experience through sensory stimuli. It is a versatile tool capable of use in most phases of property development, including the generation of immersive architectural plans for more precise design and efficient construction, and use by clients to better visualise the building or home so that they can make more informed development decisions prior to completion;
  • Drones: In office and retail spaces, drones can be operated remotely to provide support and complete routine tasks, such as tracking on-shelf inventory or inspecting hard-to-reach equipment such as rooftop machinery, thereby freeing up workers and staff; and
  • Smart home technology: Automation technology is now used in homes to provide highly personalised services and experiences to residents. Devices and fittings within homes, such as lights, appliances, sprinkler systems, alarm and security systems, can be connected to a central network, and automated and/or controlled remotely. For example, lights can be programmed to turn on or off at specific times of the day, or when the security system alarm is triggered, and appliances, such as smart refrigerators can be equipped with cameras that allows users to see its contents remotely.

Legal implications

It is important to note that the use of technologies such as those discussed above is not without risks. Property developers that are investigating, or engaging in smart building solutions should be aware of the following legal issues.

(a) Privacy

Use of technologies that rely on data collection naturally gives rise to data protection and privacy concerns.

Property development businesses will be subject to obligations under the Privacy Act 1988 (Cth) (Privacy Act) if they have an annual turnover of more than $3 million. In the event that they do not meet the $3 million threshold, they may still come within the ambit of the Privacy Act in a number of circumstances, including if they are related to a larger body corporate that is subject to the Privacy Act, or if they collect certain information as part of its operations (eg where the operated building has gym facilities and certain health information is collected as part of it).2

Businesses subject to the Privacy Act must comply with the Australian Privacy Principles (APP) in collecting and handling personal information which includes:

  • Sensitive information (eg health information, information about an individual’s racial or ethnic origin, political opinion and religious beliefs);
  • Information about a person’s private life (eg name, signature, home address), working habits and practices (work address, contact details, job title); and
  • Any information or opinion that can be inferred from their activities (eg web browsing history).

Unsurprisingly, most of this information is often collected, directly and indirectly, by the technology used in smart buildings.

Accordingly, property developers seeking to utilise data-collecting technology in their developments should be aware of their APP obligations and ensure compliance. This will include implementing an open and transparent management of personal information (eg adopting a privacy policy which specifies the personal information collected and stored, the methods and purposes for collection and other requirements as prescribed by APP 1), obtaining consent from individuals when seeking to collect sensitive information, and taking steps to protect the collected information from misuse, interference and loss, and from unauthorised access, modification or disclosure.

Failure to comply with the Privacy Act and APPs can incur significant penalties, all the more so with the Federal Government’s recent announcement to impose a tougher penalty and enforcement regime under the Privacy Act. Proposed changes to the regime include an increase of penalties for serious or repeated breaches of the Privacy Act from the current maximum of $2.1 million, to the greater of, $10 million, three times the value of any benefit obtained through the misuse of the information, or 10% of a company’s annual domestic turnover.

(b) Surveillance

Property developers employing smart building technology will also likely come under state and territory-based legislation which governs the use of surveillance devices.

Depending on the jurisdiction applicable, surveillance devices may not be limited to video surveillance systems, but can include IoT sensors and drone technology as discussed above. By way of example, the Surveillance Devices Act 2016 (SA) broadly defines surveillance devices to include:

  • Tracking devices, which are devices capable of being used to determine geographical locations of a person, vehicle or thing; and
  • Data surveillance devices, which are programs or devices capable of being used to access, track, monitor or record information into or from a computer.

Use of smart building technologies that fall with these definitions will be subject to the requirements of the Surveillance Devices Act 2016. For example, the installation, use and maintenance of such technologies are prohibited without the express or implied consent of the person subject to the tracking, or the owner of the information to be accessed. Breaches of these prohibitions may incur penalties of up to $75,000 for a body corporate, and $15,000, or 3 years imprisonment for a natural person.

(c) Cybersecurity

Cybersecurity risks are becoming an increasing concern for businesses. Regulators such as ASIC have begun to proactively take steps to ensure that organisations and entities have sufficiently robust data breach prevention measures.

These risks are particularly pronounced in buildings which rely on IoT technology and big data collection. Increased connectivity and data collection means that such buildings would become even more susceptible to cyber-attacks. It would only take the breach of a single IoT device to be able to infiltrate the entire network, thereby disrupting the operations of a building and resulting in the loss of sensitive data of its occupants.

Businesses subject to the Privacy Act will also need to comply with the Notifiable Data Breach (NDB) scheme. Under the scheme, businesses must undertake certain steps in the event of a notifiable data breach, including by preparing a statement to the Office of the Australian Information Commissioner detailing the breach, notifying the individuals affected and taking remedial action where possible to reduce potential harm to the individuals.

Developers and building owners employing smart building technology should accordingly ensure that they have robust cybersecurity protection measures in place, and implement necessary procedures to deal with data breaches in a way which complies with their obligations under the NDB scheme.

(d) Civil Liability

Potential civil liabilities may arise from use of smart building technology, such as damage to property or economic loss due to technology malfunctions, personal injuries arising from use of drones and data breaches from use of IoT.

Civil liability legislation in most states and territories impose specific duties on occupiers and landlords to take reasonable care to avoid foreseeable risks of harm occurring to the entrants and occupants of the premises. Similarly, builders of premises will generally be subject to a common law duty of care to individuals, or to the properties of those who could foreseeably suffer injury through defects in the developed premises.

As smart building technology remains relatively new and experimental, entrants and occupants of smart buildings are especially vulnerable. Smart building developers and owners should therefore be particularly mindful of the potential risks and dangers that may arise in using such technology, and take appropriate measures to eliminate, minimise or warn entrants and occupants against these dangers.

Concluding remarks

A property developer’s decision to develop and manage smart buildings should not be without a thorough assessment of the risks involved and the considerations of the type of precautions it should undertake to mitigate these risks. Such precautions will include securing consent of the entrants and occupants of the smart building regarding the collection and use of data, proper maintenance, storage and security of the data collected, implementation of satisfactory privacy policies, data breach response procedures, and other relevant safety procedures in order to minimise the risks associated with the technology.

How can we assist?

If you are interested in getting involved in the smart buildings and smart properties sector, or if you need help navigating the legal requirements for your technology and property projects, please feel free to contact a member of our Intellectual Property & Technology, or Real Estate & Project teams to discuss possible solutions and next steps.

This article was written by Luke Dale, Partner and Stephanie Leong, Solicitor.


1 Marketsandmarkets, Smart Building Market by Component, Solution, Services, Building Type, Region – Global Forecast to 2024 (October 2019).
2 Organisations that provide a health service and holds health information will be subject to the Privacy Act regardless of their annual turnover figures. Examples of such organisations include gyms and weight loss clinics.

Subscribe to HWL Ebsworth Publications

HWL Ebsworth regularly publishes articles and newsletters to keep our clients up to date on the latest legal developments and what this means for your business.

To receive these updates via email, please complete the subscription form and indicate which areas of law you would like to receive information on.

Contact us