Principle 1. Create Processes for the Affected Community to Participate in Making and Modifying the Rules Around Data.

Ostrom’s original principle: Ensure that those affected by the rules can participate in modifying the rules.

This principle speaks to the need for different stakeholders to provide input and collaborate with lawmakers and authorities, so the rules created will best serve local needs and conditions. This is crucial for smart cities, as residents often cannot opt out of smart city initiatives.

For smart city data, “rules” revolve around:

• How data is collected, retained, used, shared, combined, and secured;
• Who profits or benefits from this data, and on what terms;
• Where the technology is located (i.e., sensors); and
• The technology’s capabilities.

The goal is to ensure that technology is deployed in ways that reflect and align with a community's self-identified needs. For example, before deployment of surveillance technology by a police department, “local input can play a valuable role in ensuring that surveillance policy is consistent with local crime rates, the competence and trustworthiness of the police department, and local political preferences.” Failure to account for community input could lead to the adoption of technologies or data policies that are out of step with local preferences, and a subsequent loss of trust.

Community input is also crucial for equity, as the consequences of data misuse will not impact all residents equally: Minorities and low-income neighborhoods are more likely to suffer from poor data governance.

The best methods for engagement, and the expected level of involvement, depend on the characteristics of each community. For example, Oakland, California has a strong tradition of activism, with dedicated citizens spending their evenings and weekends in city meeting rooms, and a high level of concern about police abuse of power. Strategies that work in Oakland may not work in a community that is disengaged politically or maintain a different relationship with the police.

Below are a few questions to guide the creation of more democratic decision-making processes around data.

1. How and where are community engagement processes documented, and how are opportunities to participate communicated to the community?

Both documentation and participation opportunities should follow a “meet-residents-where-they-are” model, and outreach should reflect efforts to include all residents. Ask yourself:

• Is there a documented set of standard procedures for public engagement?
• Where is the public engagement process published?
• Where are opportunities for public participation publicized, and are full details about location and time included?
• How is outreach managed? Are community-based organisations involved?
• Is it clear that all are welcome to participate?

Chicago’s Array of Things (AoT) Operating Policies, available on their website, list a public engagement process to be followed before any new AoT nodes are deployed, with a short summary about who must coordinate meetings and what topics must be discuss?

2. How will the city or project engage with the public during the rule creation process? Who is involved, where does it take place, what happens, and when?

There is no single model for engagement, and it is important to match available methods to current needs. Ask yourself:

• Who is invited? Is the process open to everyone, or to only a select group, such as an advisory committee of experts or a citizen task force? What is the best way to balance representation with efficiency?
• Where do engagements take place? Are physical locations accessible by public transportation? Is an online option available?
• When are meetings scheduled? Are meetings during the day or evening? On weekdays or the weekend? Do meetings accommodate a variety of work schedules?
• What is the meeting structure? An open house to display technology and answer questions? A series of consultations? Public town hall-style meetings? Or targeted focus groups? What languages are materials provided in? Are interpreters present?
• What are the expected, or target, outcomes? To make a decision about whether a technology is deployed? To map and scope potential negative consequences for further contemplation? To determine limits around how technology is deployed? Or to draft some document or policy (i.e., data retention and privacy policy for the project)?
• Are participants compensated for their time, through stipends for transportation or meals?
• How long does the total review period last? How many engagement opportunities occur?

Seattle's surveillance technology review process involves both a public comment period, including release of a new technology’s Surveillance Impact Report (SIR) for public feedback, as well as review by the Surveillance Advisory Working Group, a standing group of diverse community leaders, that comments on the SIR and conducts a Civil Liberties and Privacy Assessment of the technology.

3. How and where are engagement results documented? How are these results communicated to stakeholders?

Communicating about feed review processes and clearly presenting final recommendations is crucial. Public engagement is most meaningful when organizers are clear regarding how feedback impacts outcomes. Ask yourself:

• How detailed are published results? Are initial comments, incorporated recommendations, and final decisions shared with the public?
• Where are the results published? Only online or physically, as well (i.e., at public libraries)?
• What language(s) are the results published in? Is the writing accessible and easy to understand?

Seattle posts detailed reports from the public comment period for each new technology on their website.

4. How are residents involved in changing rules after deployment? Is there any channel for ongoing engagement?

It is crucial to incorporate continued opportunities for engagement following roll out of new technology. New information will come to light during the lifespan of a product or system. There will be unexpected effects. Changes or upgrades will be made to technology or policy. There must be a way for residents to provide input after initial decisions are made. Ask yourself:

• Are there continued opportunities for residents to submit comments or complaints?
• Are there public notifications off future comment periods?
• Are future meetings scheduled to discuss the project? Who is invited?
• Who is consulted on potential changes to the technology or governing policies?
• Is there an effort to build relationships with nonprofits and community leaders?