Key Issues in Smart Cities and GDPR

• Pervasive Data Collection: Smart cities gather data from sources like surveillance cameras, environmental sensors, public Wi-Fi, and smart meters. This data often includes personal identifiers, location information, and behavioral patterns.
• Data Sharing and Interoperability: Multiple entities—municipal authorities, private vendors, and third-party service providers—may access and process the same datasets, raising questions about data ownership, responsibility, and cross-border data flows.
• Re-identification Risks: Even anonymized datasets can sometimes be re-identified using advanced analytics, especially when combined with other data sources.
• Citizen Awareness and Consent: Ensuring that individuals are aware of, and can control, how their data is used is challenging in environments with ubiquitous, often invisible, data collection.

• Legal Basis for Processing: Each data processing activity must have a clear legal basis (e.g., consent, contract, legitimate interest). For example, detailed energy consumption data from smart meters may require explicit user consent.
• Transparency and Communication: Smart city operators must provide clear, accessible information about data practices, which can be difficult given the technical nature of many systems.
• Data Minimization and Purpose Limitation: Designing systems to collect only what is necessary for specific, declared purposes is complex when data may be useful for multiple city services.
• Security and Resilience: Protecting data against breaches, unauthorized access, and cyberattacks is critical, especially for infrastructure that supports essential services.

• Lawfulness, Fairness, and Transparency: All processing must be justified, fair, and communicated to data subjects.
• Purpose Limitation: Data must only be used for the purposes stated at the time of collection.
• Data Minimization: Only essential data should be collected and processed.
• Accuracy: Mechanisms must exist for individuals to update or correct their data.
• Storage Limitation: Data should be retained only as long as necessary.
• Integrity and Confidentiality: Strong technical and organizational controls must be in place to protect data.
• Data Protection by Design and by Default: Privacy must be embedded into the architecture of smart city systems.
• Data Protection Impact Assessment (DPIA): Required for high-risk processing, such as large-scale monitoring of public spaces.

• Data Collection: Smart meters record hourly energy consumption, which is personal data as it can reveal occupancy patterns.
• Consent and Transparency: Residents are informed about the data collection and must opt-in for detailed (hourly) data sharing. Daily aggregated data may be collected under legitimate interest for grid management.
• Data Minimization: Only consumption data necessary for demand forecasting is collected; personal identifiers are removed before data is sent to central systems.
• Security Measures: Data is encrypted during transmission and storage. Access is restricted to authorized personnel.
• DPIA: The city conducts a Data Protection Impact Assessment to evaluate risks, such as the potential for inferring when homes are unoccupied, and implements mitigation strategies.
• Ongoing Rights: Residents can access their data, request corrections, or withdraw consent for detailed data collection at any time.