Data Ownership and Management

The focus on public-private partnerships in smart cities is the result of both technical expertise being resident in such companies and the fact that companies often create unique funding models to avoid forcing cities to make major upfront capital investments for the sensors, actuators, and computing platforms that make up the Internet of Things. This requires the companies to make up for such funds in alternative models of “monetization”¹ that may include selling smart city data to third parties or keeping data as proprietary information. These new business models could create problems around privacy, transparency, accountability, and other democratic values.

These new business models could create problems around privacy, transparency, accountability, and other democratic values.

Part of what should make citizens concerned is the question of data ownership and management. Most smart city implementations are done through cooperation between the private and public sectors. In most pilot programs, the private sector retains control over the data and leases it to the city, but in a mature program, the city should own the data for its services.²

However, if these conditions are achieved, several important questions remain:

• If the city owns and controls the data, where is the benefit for the private sector?
• Will the advantageous pricing offered today survive in that model?
• Can cities take advantage of these services if that kind of pricing is not continued?
• And if it isn’t, will cities feel pressure to cede control over their data or share it with the private sector in a way that puts the security of its citizens at risk?

These questions get to the heart of the last concept discussed: consent. Forward-leaning cities such as New York, Amsterdam, and Barcelona have started talking about fundamental digital rights for their citizens,³ but do those rights extend to data held by private companies? These arrangements have yet to be worked out. Other cities, like Seattle and Dallas, have begun to incorporate such concerns in their organizational structures by creating a Chief Privacy Officer position for the city or utilizing a non-profit structure to do community engagement.⁴

Even within cities, the question over data control and governance will be tricky. Data owners or the business unit (or agency) leaders that own an application typically decide how data can be used.⁵ In a smart city environment, this decision must be tied to both the method of collection and purpose of the system, which will require technical expertise. This process is an added expense that will need to be integrated into any smart city deployment. Additionally, the elements of city government that support these business unit leaders—specifically those that provide legal counsel and support the purchase of insurance—will need to be involved in this decision-making as well. In many cases, data will be a valuable asset to a city⁶ and will have to be treated as such.