*6.1. Conclusions*

In this paper, we have presented a smart metering scheme (strategy and model) to prevent privacy risks (operational and ethical) raised by the smart meter. The proposed scheme has three communication channels to enables power system managemen<sup>t</sup> and operation, TOU billing, and value-added services three functionalities. The di fferent channel transmits di fferent interval resolution data. As for privacy aspects, we divide all privacy issues related to the smart meter into two categories, data sensitivity, and algorithm sensitivity.

There are two main contributions of this paper to existing operational methods to deal with privacy intrusion. Firstly, in the high-frequency aggregation channel, we adopt the distribution-level substation as "aggregator", the substation supplies power to over 400 houses in a light rural area and over 7000 houses in a moderate urban area. In this way, we eliminate the risk of an inner attack from the TTP. Secondly, we use the private platform as a data processor, only reporting billing details monthly without frequently sending individual energy consumption data to the utility. Thirdly, privacy preserving NILM algorithm is employed to the value-added services to protect both consumers and ES's privacy. Finally, an evaluation is implemented to the system which demonstrates the proposed system satisfies all privacy requirements. From the evaluation, the conclusion is made a dataset with aggregation size over 50, and interval resolution larger than 24 h can overcome both data sensitivity and algorithm sensitivity.

#### *6.2. Implications for Policy*

Current smart metering systems always share the real-time household-level smart meter data with the utility. Smart metering system policymakers (e.g., the Department for Business, Energy & Industrial Strategy (BEIS) in the UK) should be aware of the trade-off between functionalities and privacy when operating the system and should have a clear idea about the data granularity required by different stakeholders. [83] suggests that the policymaker should classify the smart meter data into different openness categories, ranging from open data (the data can be totally open to the public) to closed data (private data that is confidential). In this case, the operators can maximize the value of data and minimize the privacy and security issues. Different stakeholders (e.g., NO, ES, TP) should access different granularity of smart meter data, while the granularity of the data includes the interval resolution, the aggregation size, etc.

Policymakers could also find it di fficult to sacrifice functionalities to protect individual consumers' (i.e., households') privacy. The importance of the smart metering system is to provide accurate real-time reading and further reduce energy costs. Policymakers could carefully implement methods such as noise-adding or load curve distortion. Although these methods would reduce the sensitivity of personal information and thus risks of privacy intrusion, the usability and the value of the data would decrease as well, potentially undermining the achievement of benefits for stakeholders. The proposed strategy and model sugges<sup>t</sup> that it might be possible to balance demands and benefits without compromising household privacy; rather other opportunities could emerge if policy considers freedom from digital surveillance and analysis as a creative situation. In this regard, and through the inclusion of adversaries and aggregators as potentially valuable 'stakeholders' of smart meters, it might be possible to help households comply with societal functionalities whilst retaining their sense of freedom and using it creatively for other purposes than energy e fficiencies.

## *6.3. Future Work*

In this paper, only the overall smart metering system is proposed. However, the e fficient of the proposed smart metering system should be evaluated in practice, a pilot network with small groups of residence to be built to validation the availability of proposed system. Secondly, the functionality for grid managemen<sup>t</sup> and operation in the proposed system should be verified via simulation. Thirdly, since we adopt multi-frequency communication channels in the proposed system, the noise would be generated in data transmission; we would propose a further study to investigate the influence on the quality of data. Finally, we could also devise participative methods to continue exploring the ethical consequences of smart meters for di fferent (digital and non-digital) stakeholders.

**Author Contributions:** X.-Y.Z. and S.K. did the methodology, simulation, and validation. X.-Y.Z. did the analysis and wrote the paper. Writing-Original Draft Preparation, X.-Y.Z. and S.K.; Writing-Review Editing, X.-Y.Z., S.K., J.-R.C.-P., and C.W.; Supervision, S.K., J.-R.C.-P., and C.W. All authors have read and agreed to the published version of the manuscript.

**Funding:** This research is funded by The Leverhulme Trust. This research is a part of the project "Ethics and Laws of Algorithms" funded by Royal Holloway, University of London.

**Acknowledgments:** The author acknowledges the support of the Department of Electronic Engineering, Department of Computer Science, School of Business and Management, Royal Holloway, University of London. Thanks to the anonymous peer-reviewers and editors whose comments helped to improve and clarify this manuscript.

**Conflicts of Interest:** The authors declare no conflict of interest.
