Smart City Citizen Data Protection Is the Next Digital Privacy Frontier

The advancement of the General Data Protection Regulation (GDPR) in Europe, the Facebook congressional hearings in the US, and the growing adoption of connected devices have thrust the issue of personal data collection to the forefront. Social media and search companies have borne the brunt of this scrutiny to date, but smart cities are now at the forefront for establishing data privacy systems.

Guidehouse Insights is tracking more than 350 smart city initiatives globally. These initiatives cover technologies and applications such as smart street parking, smart street lighting, mobility, intelligent buildings, and Internet of Things (IoT) enabled services more broadly. There is wide variation across these cities’ approaches to protect and enforce citizen privacy rights.

How Do We Ensure Citizen Data Privacy?

A growing cadre of service providers are targeting integrated smart city services that could pose unforeseen data collection issues. These issues were faced initially by internet search and social media service providers that operated for years without fully disclosing what data was being collected and how it was used. Airbnb‌, Uber, Lyft, and others have confronted such issues in the physical world. As smart city platforms and solutions are rolled out, data collection issues will need to be confronted across all city functions.

Smart city solutions providers, vendors, city government officials, and developers will need to eventually answer the central questions: Who will own the data? Who has access to the data? What can be done with the data? The answer to these questions will differ due to the prevailing political, social, and cultural norms present in each city.

From Dubai to Toronto: No One Size Fits All

Different approaches to citizen data protections will vary—from Dubai to India to Toronto. Consider the Dubai Data Initiative, which represents a mostly government-led approach and claims to be the world’s most comprehensive and ambitious data initiative. The Dubai Data Establishment (DDE) is responsible for supervising the implementation of the rules, procedures, regulations, forms, and mechanisms regulating the classification, dissemination, exchange, and protection of data in the Emirate of Dubai. It classifies data as one of the following:

• Open data: Data that may be disseminated without restrictions or with the relevant minimum restrictions prescribed by the DDE.
• Shared data: Data that is exchanged among data providers in accordance with the relevant conditions and rules determined by the DDE. There are three subcategories: confidential data, sensitive data, and secret data. 

By comparison, a public-private partnerships approach drives Sidewalk Labs’ approach with the Toronto city government. The Alphabet company’s 12-acre contentious redevelopment project in Quayside will “combine forward-thinking urban design and new digital technology to create people-centred neighbourhoods that achieve precedent-setting levels of sustainability, affordability, mobility, and economic opportunity.”

Will Citizens Be Heard?

Privacy is at the heart of discussions of Sidewalk’s ambitious future city project debate. Bianca Wylie has been one of the strongest voices in Toronto raising the need for greater transparency and citizen privacy protections with respect to the Sidewalk Labs project. She cofounded Tech Reset Canada, which is pro-growth, pro-innovation, and understands the role of tech in economic development. But it also seeks “to improve policies and procedures that achieve a balance between reaping the benefits of fast-moving innovation opportunities and delivering long-term benefits to all residents.”

There are benefits to integrating smart technology into cities. Such integration will lead to demand for more coordination across technologies—taking the shape of a smart city platform. The next step is to implement adequate enforcement mechanisms to ensure these policies are followed and citizen voices are heeded.