lorawan® in utility and housing

LoRaWAN® in Utility and Housing

Table of Contents

Table of Contents 2 Introduction 3 Introduction to LoRaWAN® 4

Current technological status of LoRa technology and its application 4 Transmission standards used for LoRaWAN 6 Security and data protection in the LoRaWAN implementation 8

Legal aspects of LoRaWAN metering in housing and energy industries 10 Regulatory aspects of telecommunication law 11 Metering and data collection applications in the utility and housing industries 12 Stipulations of the telemedia act 14 Metering point operation law and its prerequisites for LoRAWAN metering deployment 14 a) Remote measurement unit readout in all sectors via LoRaWAN without SMGW 15 b) Linking measurement units to an SMGW via LoRaWAN (“sub-metering”) 17 Multi-sector metering – requirements for general data protection and miscellaneous items 20

Future developments 22 Regulatory initiatives influencing LoRaWAN service offerings and applications 22

Questions & answers 23 Publisher 25 Authors 25

2 LoRaWAN in the Utility and Housing Industry

Introduction

Wireless counter readout in the utility and housing industry is one of the most promising applications of all processes around counter reading, data evaluation and billing, and offers high optimization potential. Radio-based data communication is the key technology to exploit this potential. LoRaWAN with its special advantages of low energy demands and long communication range has established itself as technology of choice, digitally linking a wide variety of sensor applications in the utility and housing industry, including heat, gas and water meters, and smoke detectors.

LoRaWAN technology is evolving so quickly that legislation can hardly keep up defining and updating its regulatory guidelines. In light of such a dynamic setting, this document will try to answer any questions about the legally compliant deployment of LoRaWAN in accordance with the current German regulatory status.

January 2019

LoRaWAN in the Utility and Housing Industry 3

Introduction to LoRaWAN® Current Technological Status of LoRa® technology and its application

Wireless data transmission technologies essentially differ in terms of range, speed, data volume and costs. The main challenges in any radio transmission are range and

High BW

Medium BW

Low BW

required power. Applications in the Internet of Things thus often need to operate over long distances while consuming only minimal power. As the distance needed to

bridge in a radio link increases, the transmitter has to deliver more power; this impacts the battery life of autonomous systems. LoRa implements an optimized data communication under these stipulations. This is particularly useful for small stand-alone IoT devices like utility meters in the energy and housing industry. Data rate is another critical transmission parameter. Growing volumes of transmitted data require increasingly higher data rates. At the same time, interferences decrease the achievable range for reliable data transmission. LoRa uses a special modulation technique (Chirp Spread Spectrum) to solve this problem, reducing signal disturbances and avoiding interferences that else would arise due to signal echoes, signal reflections and doppler shifts. Lowering the rate of data transmission errors improves over-all system efficiency and enables an increased range at reduced energy input. The data rate can be

Short Range Medium Range Long Range

Fig. 1: Radio data communication - bandwidth vs. range


Tx power

EIRP

distance

Rx radio

Rx power

margin

Rx sensitivity

selected depending on the desired distance - high data rates for short ranges, or low rates for long ranges. LoRa additionally features techniques for adaptive data rates - it can modify the data rate within the chosen bandwidth. The spread spectrum factor is adjustable, giving the user control over the required transmission energy. Since LoRa radio components work efficiently, they only consume lit-tle energy. Compared to other radio technologies, LoRa has a very good Link budget. The Link budget is an efficiency metric that covers all elements from the transmitter, all involved system components (cables, antennas, free space loss, Fresnel zone) up to the receiver. What’s more, the hardware costs for a LoRa implementation are lower than for other techniques.

Fig. 2: Illustrative presentation of the Linkbudget


Tx radio

path loss

dbm

Transmission standards used for LoRaWAN

LoRa radio technology can be used to design a low-power wide-area network (LPWAN) or a or low-power network (LPN), wireless telecommunications wide area networks which enable remote communication at low data rates, e.g. for autonomous and/or battery-powered sensors. Low energy consumption, low data rate and intended use differentiate this type of network from a wireless WAN (WLAN) which is designed to connect users or companies with higher data volumes and appropriate performance.

LPWAN offers data rates from 250 bit/s to 50 kbit/s per channel. An LPWAN can implement a private radio sensor network, but it can also be used for a service or an infrastructure offered by a third-party provider. Application data of networked sensors can thus be exchanged via in-house LoRaWAN networks or using the network infrastructure of third-party providers. The LoRa Alliance was estab-lished in 2015 as a non-profit organization; it has since published a freely accessible LoRaWAN specification. By default, and depending on the application area, LoRaWAN uses different, freely available frequency bands in the ISM (Industrial, Scientific and Medical) and SRD (Short Range Device) bands. In Europe, this mainly refers to frequencies between 863MHz and 870MHz (SRD-Band Europe). In Germany, the Bundesnetzagentur (BnetzA) is responsible for the allocation of frequencies. This fre

Fig. 3: LoRaVan ™ frequency bands

quency range is dedicated to the operation of devices or appliances for industrial, scientific, medical, domestic or similar purposes (ISM applications). In a typical configuration, the 867 to 869 MHz frequency band can provide 10 upstream channels. The upstream channel bandwidth is either 125 kHz or 250 kHz. The downstream bandwidth is fixed to 125 kHz. The maximum permissible transmission power for


LoRaWAN devices in standard configurations is 14dBm, which corresponds to a link budget of 155dB. The spreading factor (SF) used ranges from 7 to 12, leading to data rates from 250 Bit/s to 50 kbit/s.

End product versions with bidirectional communication

Data communication uses the ALOHA-access method: Terminal devices (sensors, nodes) send their data packets to the gateway (uplink), followed by two downlink receive windows for data reception. Note that a new data transfer can only be initiated by the terminal device in another uplink sequence. This mode of operation consumes the least amount of energy.

Terminal devices (sensors, nodes) open a downlink receive window at fixed times. The gateway additionally sends a time-controlled beacon signal to the terminal devices. This procedure helps to inform the network server when the terminal devices are ready to receive data.

Terminal devices (sensors, nodes) have a downlink-receive window that is permanently open, leaving the terminal devices almost permanently active. The downlink receive window is only closed during terminal device data transmissions (uplinks). This mode of operation thus consumes the largest amount of energy.


Class A Class B Class C

Pet

Smoke alarm

nding shine

Security and data protection in the LoRaWAN implementation

LoRaWAN network architecture uses a star topology. The terminals (sensors, nodes) communicate wirelessly via LoRa transmission with the LoRaWAN gateways, which pass on the data packets to a network server.

The network server has further interfaces to pass on data to IoT platforms and applications. Data transfer between gateways, network servers and any downstream platforms and applications is performed using classical data networks based on mobile radio (GSM, LTE), WLAN or wireline TCP/IP-networks. The communication between terminals (sensors, nodes) and gateways uses channels at various frequencies and different data rates. The network server adapts the terminals’

data rates to the given situation (ADR - Adaptive Data Rate). If data packets from a terminal (sensors, nodes) are received by several gateways, then the downstream network server also receives multiple instances of these data packets. After analyzing repeatedly received data packets, the network server decides which of them will be processed. Data in LoRaWAN is doubly 128 bit AES encrypted - between the terminal (sensors, nodes) and the network server, and a second time between terminal and application server. LoRaWAN thus offers two independent security layers, and uses a network session key (NwkSKey) as well as an application session key (AppSKey). The network security level ensures the authenticity of the node in the network. The application safety level serves to prevent the network provider from having access to the end user’s application data.

Tra

W m

Ve ma

End Nodes Concentrator / Gateway

Network server Application Server

LoRa® RF LoRaWAN®

TCP/IP SSL LoRaWAN®

LoRa® RF LoRaWAN®

AES Secured Pavload

Fig. 4: Structure of the network architecture


Two security key implementation methods

Activation by Personalization (ABP): Some application cases may benefit from having hard-coded, factory-set authentication data in the terminal devices.

Over-the-Air-Activation (OTAA): This is the safest and therefore preferred method. It uses an application ID, a unique device ID and root keys for AES encryption, all of which serve as a base to derive the NwkSKey and AppSKey security

keys. The terminal devices perform a joining procedure with the network, leading to the assignment of a dynamic device address (DevAddr) and the generation of a security key. This is the recommended method because keys are not predetermined and can be re-generated. The gateway is permanently assigned to the network server, and is only responsible for data transfer. It cannot decode data. Data will only be decoded in the application server using a closed-system application.


Legal aspects of LoRaWAN metering in housing and energy industries

“Long Range Wide Area” networks and services have propagated into diverse and innovative application areas. As a consequence, there isn’t a single, exclusively applicable “LoRaWAN law”; instead, a number of regulations from various legal fields apply depending on the area of application. The Telecommunications Act (Telekommunikationsgesetz - TKG) and the Telemedia Act (Telemediengesetz - TMG) are the first pillar of the legal LoRaWAN™ framework. The second pillar consists of the data protection law, especially in the form of the General Data Protection Regulation (Datenschutzgrundverordnung - DSVGO), the Federal Data Protection Act (Bundesdatenschutzgesetz - BDSG) as well as specific data protection regulations of the Telecommunications Act and Telemedia Act. Furthermore, other general and specific fields of law can be relevant depending on the LoRaWAN services and networks. An important role, especially for sales-related aspects of LoRaWAN play the Criminal and Labour Law, parts of the Competition Law, especially the Copyright Act (Urheberrechtsgesetz -UrhG), the Unfair Competition Act (Gesetz gegen den unlauteren Wettbewerb - UWG) and the Act against Restraints on Competition (Gesetz gegen Wettbewerbsbeschränkungen - GWB). If LoRaWAN is used for measuring purposes in utility and housing industries, then the following legal regulations should also be considered: Energy Industry Law (Energiewirtschaftsgesetz - EnWG), Metering Point Operation Law (Messstellenbetriebsgesetz - MsbG) and calibration law.


Regulatory aspects of telecommunication law

The operation of LoRaWAN-based networks or the provision of corresponding services are governed by Telecommunication Law. This also applies to machine-to-machine (M2M) communication since the data exchange is being installed, operated, maintained and used by natural entities. “Telecommunication” in terms of the Telecommunications Law is defined as the technical process of sending, transmitting and receiving signals using “telecommu-nication systems” (§3 No. 22 TKG). These systems in turn are described as technical devices or systems that can send, deliver, transmit, receive, manage or control electro-magnetic or optical signals that can be identified as messages (§3 No. 23 TKG). §§52 et seq. TKG permits using LoRaWAN frequencies without royalties. The question which particular obligations and regulations within a LoRaWAN project must be considered depends on the particular case and the respective role of the user. Depending on the (contractual) design of the measuring setup, companies in the housing

industry can take up different roles. The roles of a LoRaWAN infrastructure operator and a provider of services delivered via LoRaWAN need to be described in detail against the background of the distinction specified in §6 TKG (statutory disclosure obligation). Commercial operators of public telecommunication networks (“TK-Netzbe-treiber”) or commercial providers of publicly accessible telecommunication services („TK-Dienstleister“) are subject to various legal telecommunication obligations. Simple end users of LoRaWAN networks and services aren’t subject to any legal telecom-munication obligations. Any activity offered at least with the intent of cost coverage is considered commercial1 according to TKG law. If LoRaWAN is used for measuring purposes in the utility and housing industry, one should consider assigning a price to any resulting cost position and to pass it on to the tenant; this is why a commercial activity as per § 6 TKG should generally be assumed. A different view could only be taken if

LoRaWAN networks or services were used to the outside exclusively for “internal purposes”2. This leaves the question whether the use of LoRaWAN for measuring purposes in the utility and housing industries must be considered as the operation of public telecommunication networks or the provision of publicly accessible telecommunication services. To meet this criterion, LoRaWAN would need to be provided to an undefined group of people. However, if LoRaWAN were to be used exclusively by a group of people that could be differentiated from the general public by distinctive features, then these networks or services could not be considered as public or publicly accessible (“closed user groups”). This kind of categorization would allow to circumvent the ensuing legal telecommunication obligations. This distinction may however be difficult as LoRaWAN features various application areas and interfaces to complementary networks and services.

LoRaWAN in the Utility and Housing Industry 1 BT-Drs. 15/2316, S. 60. / 2 Tornow, in: Säcker § 6 TKG Rn. 27. 11

Metering and data collection applications in the utility and housing industries

The use of LoRaWAN for metering and data collection can be considered as a service for a closed user group if both the network and the data transmission are implemented in encrypted fashion, and if access data is only be made available to certain people. Under these conditions, the set-up can only be treated as an encrypted (closed) WLAN that clearly is accessible only to a limited circle of users3. The advantage of LoRaWAN’s high reach could however turn into a legal disadvantage if the range of users would become so large that it would lose its exclusivity. Specifically, the characteristic of being “public” can be negated if the communication between a local metrological network (LMN), a home network (HAN), a (CLS-) control box or a LoRaWAN indoor gateway and the BSI-certified Smart Meter Gateway (SMGW) is encrypted in the building or housing block, or is performed in a locally limited way. In that case, “public” accessibility

does not exist. Avoid making the communication via CLS control box or LoRaWAN-indoor gateway between LMN, HAN and SMGW accessible to everyone as this would entail an extension of the circle of users. Users (e.g. municipal utilities with a telecom department) who do not operate larger telecommunication networks (fiber optic cables, cable networks etc.) should in all cases of data forwarding from the gateway to measurement point operators and external market participants preferably take recourse to established and as per § 6 TKG BNetzA-registered telecommunication companies. LoRaWAN outdoor gateways that are intended to extensively cover entre cities can – depending on the application area - be considered as public network operations. This case would require that technical safety measures and regulations of data and information security as per part 7 of the TKG (secrecy of telecommunications, data

12 3 Tornow, in: Säcker § 6 TKG Rn. 27. LoRaWAN in the Utility and Housing Industry

personal data in accordance with the current state of technology. Moreover, § 113 TKG obliges all providers of commercial telecommunication services to provide information on request (e.g. on suspicion of criminal offenses). Apparently, further obligations laid down in TKG with respect to the classification as a public telecommunications network operator or service provider (e.g. §§ 43a et seq. TKG client protection or § 108 TKG emergency service) refer to human communication and cannot be transferred to the use of LoRaWAN for measuring purposes and data collection in the utility and housing industry. Nevertheless, new legal regulations for machine-based communication are needed for reasons of legal clarity.

Picture 6: LoRaWAN applications in the housing industry

protection, public safety) had to be met. In any case, the operation of LoRaWAN gateways requires that §109 para. 1 and § 113 TKG must be respected. As per §109 para. 1 TKG, all service providers (including those of “non-public” services) are obliged to take measures to protect confidentiality of telecommunications and counteract disclosures of


Water and heat supplier

Housing sector Energy consultants

CLS-Gateway

Smoke alarms, sub-measuremens of heat & water + other sensors

Gateway

heat & water

Gas & electricity (prescribed by law)

Supplier Measuring point operator

Stipulations of the Telemedia Act

The Telemedia Act (TMG), often colloquially referred to as internet law, focuses on information and communication services and affects mainly the regulations on handling internet-based offers. In the context of using LoRaWAN for measuring purposes in utilities or housing, the TMG can be applicable if a web portal is offered to tenants via CLS control box or LoRaWAN indoor-gateway to check meter readings or other measured data.

In that case, the service provider is subject in particular to the information requirements as per §§ 5 et seq. TMG. If the portal offers or integrates external or extrinsic content (e.g. advertisement), then specific obligations and liabilities can arise. If the service provider collects additional user data via the web portal, then the specific data protection regulations of §§ 11 et seq. TMG apply.

Metering point operation law and its prerequisites for LoRaWAN metering deployment

German legislature has issued a new, pivotal law for metrology in the field of energy supply – the Messstellenbetriebsgesetz (MsbG - metering point operation law) of 08/29/2016. Its extensive innovations relate to the definition of new market roles and contractual structures, as well as to the introduction of high technical standards and mandatory functionalities of the new measuring infrastructure. The main scope of the MsbG is the obligation to roll out intelligent measuring systems (IMS). The central component of an IMS is the communication unit aka Smart Meter Gateway (SMGW) with its integrated safety module. This is where measurement values from measurement instruments are received, saved, processed and transferred. Measuring points may only be

equipped with an IMS that has been certified to comply with the minimum technical requirements. § 22 MsbG sets extensive requirements on the SMGW of an IMS; these are formed by downstream regulations or technical guidelines (technische Richtlinien - TR). The Federal Office for Information Security (BSI) is responsible for TR development. If substantial changes are needed, then the following organizations will be involved in further TR development: the Federal Physical-technical Institute (PTB), the Federal Network Agency (BnetzA), Federal Ministry of Economics and Technology, and professional associations4. Further specific requirements for any data communication originating from the SMGW are also defined in § 55 MsbG. These can also be put in concrete terms by downstream requirements.

4 According to § 27 Abs. 1 MsbG, the Gateway-standardization board needs to be heard in cases of significant changes, see also § 27 section 2 MsbG. This board is responsible for the corresponding regulations.


LoRaWAN in the Utility and Housing Industry

SMGWs ultimately also are subject to general legal requirements, e.g. to those of the Energy Industry Law.

Prior to installing or during the operation of a measuring infrastructure in which various system components are paired via a LoRaWAN-radio connection, this legal context calls for an evaluation

if specific legal obligations of the MsbG need to be considered. A distinction should be drawn between cases in which measurement values are conveyed via radio connection without having a certified SMGW installed (see a) below), and those in which LoRaWAN is used for the communication between the measuring equipment and an SMGW (see b) below).

a) Remote measurement unit readout in all sectors via LoRaWAN without SMGW

It is technically possible to remotely read out measurement units for electricity and gas usage or any other category using via LoRaWAN using a simple communication module. An assessment is needed if this raises any legal concerns. If data other than electricity and gas usage are read out by a “simple” communication module via LoRaWAN, notably water and heat consumption, then according to the view represented here5, the application field of the MsbG is initially unaffected. It may be interesting to establish remote readability in

this way for the electricity and gas sectors, because doing without an SMGW can be economically attractive in light of increasing delays of certification procedures6 and a potentially considerable system configuration complexity reduction. In this case however, the full scope of the MsbG will apply. Based on the respective function of the device, the law distinguishes between measuring devices, modern measuring devices, measuring systems and intelligent measuring systems. The actual generation of measurement values is per-

formed by a “measurement device”. If a measurement device is integrated into a communication network, then it is considered a measurement system; if the integration is achieved via SMGW, then the law refers to it as an intelligent measurement system (IMS). If a measurement device for electricity metering features remote readout, it will thereby be categorized as a measuring system, regardless of its readout technique. According to the law’s explanatory memorandum, remote readability as such suffices to consider a measurement device by law as a measurement

5 For the legitimacy of a remote reading of water meters see also Kramer/Köhler/Lehmann, in: gwf-Wasser/Abwasser, 12/2017, p. 59 et seq.; see also data protection provisions below under 4. 6 Until creation date of this White-Paper (21.12.2018) a device created by Open Limit and Power Plus Communications AG (PPC) was the only SMGW to have obtained full certification by the BSI 15

system7..

Measurement systems are required to meet minimum technical requirements of the MsbG as per § 19 et seq. MsbG, which in particular specifies that they need to contain a certified SMGW8. In future, measurement systems may thus only be installed and operated as IMS; remote readout without SMGW will only tolerated by law during a transitional phase. The deployment of a “leaner” communication module will therefore only be legally permissible for a limited time under the grandfathering provisions of § 19 para. 5 MsbG. Housing developers should take into account possible retrofitting costs that could arise after expiry of the grandfathering period, if they initially decide – perhaps

within the scope of a bundled offer – to forego the use of an SMGW.

Communication networks and the MsbG

In contrast, some argue that a measurement device would not become a measurement system in the sense of the MsbG because there is no integration into a communication network. In fact, the radio transmission could only be considered as a “communication line” because data are only transmitted to a single recipient. The above assessment however is not convincing: The concept of a communication network isn’t legally defined in the MsbG. Although the MsbG does not contain a definition of the concept of a

communication network, there is indeed a definition in a European framework directive; this definition is technologically neutral and explicitly includes the radio transmission of signals9. On top of that, the network typology of the LoRaWAN-specification is also in contradiction to the assumption of a mere “communication line”. This is because signals are transmitted to a centralised server, which in turn bundles the data of various uplink communications and can potentially send them to multiple recipients (star topology). This structure in fact does not feature a mere point-to-point communication. Instead, the transmission occurs via intermediate stations.

16 7 See also BT-Dr. 18/7555, p. 74. / 8 See also § 21 para. 1 No. 4 iVm § 24 MsbG.. / 9 See also 2 lit. a RL 2002/21/EG. LoRaWAN in the Utility and Housing Industry

b) Linking measurement units to an SMGW via LoRaWAN (“sub-metering”)

Another field of application of LoRaWAN radio technology is setting up a radio link between separate measuring devices and a certified SMGW. A distinction must be made between links to electricity and gas measuring facilities and those for other sectors.

Linkage to electricity or gas measuring facilities

If measuring facilities for the collection of electricity or gas consumption data are linked to an SMGW, then this is considered as an IMS as defined by the MsbG. It has to meet all the minimum legal technical requirements and technical guidelines. Since these guidelines generally just define the functions to be reflected, but not the technical transmission standard, a link can be set up using LoRaWAN. The interface description in the relevant technical guideline TR-03109-1 should however be taken into account.

The guideline specifies that the SMGW communicates with the linked energy meters in a local metrological network (LMN)10. The LoRaWAN radio link however uses the CLS interface to connect to the SMGW in the home area network (HAN)11. Since a connection of meters via this interface does not comply with the requirements of TR-03109-1, electricity or gas metering facilities must be linked to the SMGW via LMN-interface. A connection via CLS-interface is legally not advisable.

Linking of measuring facilities in other sectors

In technical terms, the SMGW also allows to connect measuring devices for the collection of other quantities and substances (notably water and heat) besides electricity and gas meters. A communication using the LMN interface often is not suitable for this application area due to the distances to be bridged or to insufficient building penetra

tion. In this respect, connecting devices to the SMGW via the CLS interface in a HAN using LoRaWAN could be interesting. It is questionable however whether such an approach which is not recommended for the electricity and gas areas would not raise legal objections in the fields of water and heat metering.

Sector bundling in the MsbG

Even if the MsbG has primarily been enacted for measurement value acquisition in the electricity and gas sectors, legislators also took into account that IMS are equally suitable for many other application areas such as for energy efficiency and smart home applications, or for grouping the gas, thermal heat and district heating sectors with the purpose of simultaneous metering and transparency12. The MsbG thus contains several paragraphs which address the topic of sector grouping without fully regulating it.

LoRaWAN in the Utility and Housing Industry 10 TR-03109-1, p. 14. / 11 See above under a). / 12 Cf. explanatory memorandum for MsbG, BT-Drs. 18/7555, p. 72. 17

Does this mean that a measurement system has to meet both the requirements of the MsbG and those of the downstream technical guidelines for every kind of multi-sector measurement?

Multi-sector measurements and the technical guideline

Indeed it should be stated that the relevant Technical Guidelines describe the connection of water and heat meters also via LMN-interface of the SMGW13. According to the view represented here, a deviation from the given description is however legally justifiable. This can be deduced from the ensuing inversion of an argument: for the gas sector it is explicitly regulated that a connection of measuring devices to the SMGW must comply with the Technical Guidelines14. Consequently, the connection of a measuring facility only needs to comply with the technical guidelines if this has explicitly been specified. The cited regulation would otherwise be redundant for the gas sector. The MsbG does not contain a corresponding legal requirement for the water and heat sectors. This argumentative approach is also apparent in § 23 MsbG: It defines those components which the SMGW must be capable of integrating safely in the communication network in accordance with

the protection profile guidelines and the technical guidelines. Gas measurement facilities are again explicitly mentioned whereas facilities of other sectors are not15. Consequently, an SMGW itself has to meet the requirements of the MsbG if added value services or multi-sector measurements are provided via this unit. At the same time this does not imply that these requirements apply to water and heat metering, if the connection to the SMGW is exclusively established via the CLS interface in the HAN.

Technical requirements defined by the MsbG The MsbG also does not specify technical requirements for the implementation of value-added services that are provided by request of the connection user. Although, the MsbG does contain some regulations16, it does not define which technical requirements are specified for so-called value-added services. It is also impossible to use § 6 MsbG to argue against the view represented here. This provision only stipulates the connection user’s right to choose bundling metering point operations across multiple sectors.

§ 6 MsbG does not cover any technical details. The provision contains no regulations that require meeting the minimum technical requirements of the MsbG for connecting multiple sectors to the SMGW, if by request of the connection user the additional metering point operation for district heating or heat energy is bundled via the SGMW besides metering point operation for the electricity sector (“Liegenschaftsmodell” – property model). The legal effects of § 6 MsbG should however under no circumstances be underestimated. Responsibility for measurement point operation The automatic termination of metering point operation contracts (also for the heat sector) can provide housing companies with the necessary lawful liberty to decide in favor of bundling. For measuring point operators however, this can lead to considerable legal uncertainties and potential loss of jurisdiction over metering point operations. Since the law contains no commitment to comply with the technical guidelines for connecting water and heat meters, we conclude that the relevant rules of TR-03109-1 are not compulsory. The same applies for connecting smoke detectors.

18 13 TR-03109-1, p. 14. / 14 § 20 para. 1 clause 2 MsbG. / 15 § 23 para. 1 No. 4 MsbG. / 16 § 50 para. 1 No. 13 MsbG, § 35 para. 2 No. 4 MsbG.


Requirements for data communication

However, at least the general requirements for data communication as per § 52 MsbG should also be met when using LoRaWAN. This presupposes an encrypted electronic communication and an anonymization or pseudonymization of personal data (§ 52 para. 1, 2 MsbG).


Multi-sector metering – requirements for general data protection and miscellaneous items

Data protection standards for consumption data logging ensue from the MsbG as a sector-specific data protection law as well as from the European Data Protection Basic Regulation (DSGVO). The MsbG contains detailed regulations about the permitted data traffic of the electricity and gas measured values17. Use of measured values and data exchange extending beyond these regulations is only permitted if the connection user has given his consent or as long as no personal data are being processed (§ 70 MsbG). If personal data are processed, the general regulations of the Data Protection Basic Regulation also apply. This can be of particular importance for a legally compliant implementation of multi-sector metering, since the measured values (of all sectors) are deemed personal data. In particular, the client has to be granted the rights of the individuals affected, such as right to information and disclosure, as well as entitlement for cancellation and rectification. The graph on the left provides an overview of the customer’s entitlements. If e.g. a landlord

Rights of affected individuals as per Data Protection Basic Regulation (DSGVO)

Picture 7: Personal rights affected as per DGSVO

wants to collect data centrally using a metering point operator by way of multi-sector measurement in accordance with § 6 MsbG, then the metering point operator needs to provide proof that the landlord (in his internal relationship with his tenants) has established a corresponding contractual basis for the collection of individual measurement values for e.g. water and district heating, or has obtained appropriate permissions. On top of that, the DSVGO regulations on the security of data processing must be observed. As per Art. 32 DSVGO, suitable technical and organizational measures in accordance with the current state of technology must be taken to ensure an appropriate level of protection. If this state of technology were also to be defined for TR-03109-1, which is in force in national legislation for intelligent remote meter reading, then this could create an obligation “through the back door” to connect meters of sectors other than electricity and gas – i.e. including heat and water measuring

20 17 See also explanatory memorandum BT-Drs 18/7555, S. 64 et seq.; regarding legally unclarified relations of MsbG to DSVGO see also . Bartsch/Rieke, in: EnWZ 12/2017, p. 435, 441.



facilities – via LMN to the SMGW as per the technical guidelines18. Such an interpretation however ought to be rejected for reasons of standards hierarchy, according to the view represented here19. Which provisions result from specific regulations for water? The AVBWasserV is the main legal basis for private-law water supply20, and follows the guiding principle of on-site meter readout21. The authorization of water supply companies for installing remotely readable meters can be deduced from their right of determination of the type of measuring devices to be used22.

This however presupposes a consultation with the customer and a balancing of interests. Clients should be informed about the plans and be given the opportunity to form and express their opinion within a reasonable deadline23. An adoption of corresponding regulations as additional terms of the AVBWasserV is recommended. The requirements of the heating costs ordinance (Heizkostenverordnung) need to be considered for heating energy; these regulations oblige building owners to record their users’ proportional consumption of heat and hot water, and to install consumption metering facilities in their premises24. General requirements for measuring devices are defined in § 6 of the

Weights and Measures Act (MessEG) in conjunction with § 7 of the Weights and Measures Ordinance (MessEV). According to these regulations, measuring devices need to be protected against measurement result falsification. According to § 8.1 of rider 2 to § 7 of the Weights and Measures Ordinance (MessEV), auxiliary devices may only be connected to measuring devices at openly accessible interfaces that are free from retroactive effects. An interface without retroactive effects is a connection possibility for measuring devices, through which measurement values cannot be falsified and no functions can be triggered that could potentially falsify a measured value, see § 3 Nr. 17 of the Weights and Measures Act (MessEG).

18 Cf. contexts above / 19 For an autonomous reading of the state-of-the-art according to section Art. 32 DSGVO, see also Pilz, Gola, Art. 32 DSGVO, Rn.15 / 20 There are other legal bases for water utilities as public corporations which also contain specific regulations about the permissibility of remote meter readout, see also section 24 of the Bavarian municipal code. / 21 Cf. § 20 AVBWasserV. / 22 Cf. § 18 AVBWasserV. 21 23 § 18 section 2 AVBWasserV. / 24 § 4 HeizkostenV (Heating Costs Ordinance).

A metering operation in compliance with the laws requires to strictly adhere to the DGSVO and MsbG regulations, and depending on the specific application, to the AVBWasserV,

the Heating Costs Ordinance and the MessEG.

Future developments Regulatory initiatives influencing LoRaWAN service offerings and applications

Regulatory initiatives are currently taking place at both European and national levels which are being implemented at national level. The European Commission has created the EU Cybersecurity Act as a framework, which was adopted as guideline on December 10, 2018 by the European Parliament25. The goal if this guideline is a standardization of measures for better cyber safety in Europe and an alignment of member states’ measures on a national level26.

As critical infrastructures, utility and housing industries are also subject to these harmonization efforts. On a national level, particularly the BSI is following these trend-setting decisions from Brussels and Strasbourg with its certification standards. Another EU-guideline worth mentioning is the „Radio Equipment Directive 2014/53/EU“ aka „RED”27, explicitly specifying the requirements of “security” and data protection for all devices that are connected via radio.

Member states generally have a certain margin in their implementation of EU guidelines into national laws and regulations. The EU’s General Data Protection Regulation (GDPR) e.g. was implemented both in the new Data Protection Basic Regulation (DGSVO) as well as with some changes in the Federal Data Protection Act. It is thus possible that the

EU cybersecurity act and the RED regulation will not only be implemen-ted in new regulations, but will also continue to have an effect via changes to existing laws such as the MsbG.

25 https://www.enisa.europa.eu/news/enisa-news/eu-leaders-agree-on-ground-breaking-regulation-for-cybersecurity-agency-enisa 22 26 https://ec.europa.eu/digital-single-market/en/eu-cybersecurity-certification-framework

27 https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32014L0053&from=en


http://www.enisa.europa.eu/news/enisa-news/eu-leaders-agree-on-ground-breaking-regulation-for-cybersecurity-agency-enisa

Questions & answers

Question: Which purposes and applications can best be served using LoRa and LoRaWAN?

Answer: Featuring a maximum data rate of 50 kbps, LoRa is a cost-effective radio technology that offers greater range and very low power consumption. LoRa is a good choice for all applications that do not require an immediate, deterministic response time.

Question: What radio frequencies are used by LoRa and LoRaWAN?

Answer: LoRaWAN uses freely accessible frequency ranges in the ISM (Industrial, Scientific and Medical) and SRD (Short Range Device) Bands, in Europe mainly the frequency band between 863 and 870MHz (SRD Band Europe).

Question: Does LoRaWAN data transfer use encryption?

Answer: Data in LoRaWAN are doubly 128 bit AES encrypted* - between the terminal (sensors, nodes) and the network server, and a second time between terminal and application server.

Question: Which laws should be especially observed when using LoRaWAN?

Answer: LoRaWAN based network operation or service provisioning are generally subject to the telecommunications act (TKG). The obligations and regulations to be considered within the framework of a LoRaWAN project depend on the individual use case and on the operator’s role – especially if network provisioning is associated with commercial fees, and whether the operation is performed publicly or in a closed, non-public setting.

* The term „doubly encrypted“ refers to a cryptographic identity verification performed by the network server in combination with a payload encryption on the application server level. Both processes use separate network and application keys.


Question: Which general obligations result from the TKG for a LoRaWAN application operator?

Answer: §§ 109 clauses 1 and 113 TKG need to be observed when operating LoRaWAN gateways: Service providers (also for “non-public” services) are obliged to take measures to protect the confidentiality of telecommunications as well as against violation of protection of personal data in accordance with the current level of technology.

Question: Which general requirements apply for metering operators in the utility and housing industries?

Answer: If a measuring device is part of a communication network, then it is considered a “measuring system”; if it is integrated using a smart meter gateway (SMGW), then it is considered an IMS. In future, measuring systems may only be built and operated as IMS. Remote readout without an SMGW will thus only be legally tolerated during a transitional phase.

Question: What specific legal requirements does a metering operator have to meet? Answer: The sections of water, district heating, heating energy and smart home can generally be subject to

different provisions than implied by the MsbG28. Sub-metering and the use of the SMGW communication for channel for multi-sector measuring are therefore possible. A legislative clarification or at least a clarification of the BSI or BNetzA have however not yet been issued.

Question: Which legal regulations in terms of data protection does a metering operator have to meet?

Answer: Metering operation in compliance with data protection regulations require strict observance of the DGSVO and MsbG regulations.

24 28 See also section 4. LoRaWAN in the Utility and Housing Industry

Publisher

Semtech Corporation 200 Flynn Road Camarillo, CA 93012 www.semtech.com

Authors

Mirko Ross Helen Ruff Martin Sauerteig Thomas Schmeding Jan-Hendrik vom Wege Julien Wilmes


http://www.semtech.com/

lorawan® in utility and housing

Documents