The typical citizen does not know what a smart city is, would not know how to recognize if the technology was present, and would likely not have enough knowledge about the way the technology is used to formulate an informed opinion about whether the benefits to them outweigh the costs.

To many urbanites in Canadian cities, like Toronto, Mississauga and Kitchener, the developments their own cities are undergoing to make them “smarter” is perhaps appreciated for its convenience, but it is yet to be fully understood for its effect on privacy rights. Until citizens have a more robust understanding of how these projects work, it will be impossible to produce informed consent.

Until citizens have a more robust understanding of how these projects work, it will be impossible to produce informed consent.

The concept of the smart city is constantly evolving as new projects are shaped to fit the unique needs of different urban centers. However, at its core, smart-city technologies are made up of sensors attached to real-world objects, like roads, cars, electricity meters, domestic appliances, and human medical implants. These sensors connect the objects to digital networks, the internet of things, generating a huge quantity of data that can be combined, technologically analyzed to uncover patterns and connections, and repurposed for use.

Most Canadians today already interact with the IoT in their homes and their private lives by using popular devices, like fitness trackers, smart speakers or smart thermostats, to name a few.

The Office of the Privacy Commissioner of Canada has acknowledged that with these new technologies, notices about data collection and the opportunity to decline service are not present the same way they are in the online digital world. When engaging with online platforms, for example, there is at the very least a dim awareness of crossing a threshold into the domain of that platform. This awareness is an important bedrock for consent.

Lilian Edwards, a U.K.-based academic in internet law, points out that public spaces like smart cities further dilutes the level of consent in the IoT: “While consumers may at least have theoretically had a chance to read the privacy policy of their Nest thermostat before signing the contract, they will have no such opportunity in any real sense when their data is collected by the smart road or smart tram they go to work on, or as they pass the smart dustbin.”

If citizens have expectations that their interactions in smart cities will resemble the technological interactions they have become familiar with, they will likely be sadly misinformed about the level of control they will have over what personal information they end up sharing.

The typical citizen understands that "choosing convenience" when you engage with technology can correspond to a decrease in their level of personal privacy. On at least some level, this is intended to be a choice. Most users may not choose to carefully read a privacy policy on a smartphone application or a website; however, if that policy is well-written and compliant, the user can exercise a right to decide whether they consent to the terms and wish to engage with the company.

The right to choose what personal information you exchange for services is lost in the smart city.

Theoretically, the smart city can bypass this right because municipal government services are subject to provincial public-sector privacy legislation, which can ultimately entail informing citizens their personal information is being collected by way of a notice.

However, the assumption that smart city projects are solely controlled by the public sector is questionable and verges on problematic. Most smart-city projects in Canada are run via public-private partnerships as municipal governments lack both the budget and the expertise to implement the technology system. Private companies can have leading roles in designing, building, financing, operating and maintaining smart-city projects. In the process, they can also have a large degree of control over the data that is created and used.

In some countries, these partnerships can even result in an unprecedented level of privatization. For example, Cisco Systems debatably has a larger claim over Songdo’s development than the South Korean government. Smart-city public-private partnership can have complex implications for data control even when both partners are highly engaged. Trapeze, a private-sector company in transportation software, cautions the public sector on the unintended transfer of data control when electing private providers to operate data systems in a partnership.

The complex structure of smart-city projects continues to create jurisdictional confusion.  

This is a problem because it becomes very difficult for the typical citizen to understand whether their personal information in a smart city is being held by a business or by a government entity. Citizens often have stronger opinions about who should have access to their information than about which information is accessed. Studies show many citizens are more resistant to governments using their information than private companies. Meanwhile, many citizens might be operating under traditional assumptions about the governance of city service by municipal actors.

Canada must take steps to determine how its own specific privacy legal structure is going to play a role in responding to these privacy issues in our own emerging smart-city projects. 

Maddeningly, there is no explicit Canadian privacy law that says you have a right to be informed of the identity of the actor collecting your data in a smart city, yet it feels like a right has been lost that should be a foundation of informed consent.

When the typical citizen enters a smart city, they will not know 1.) what personal information is being collected, nor will they know 2.) who is collecting it. The former is an established requirement of informed consent, and the later has debatably never been an issue until the development of smart cities.

While similar privacy issues are playing out in smart cities all around the world, Canada must take steps to determine how its own specific privacy legal structure is going to play a role in responding to these privacy issues in our own emerging smart-city projects. 

photo credit: Thomas Hawk Burning Bridges via photopin (license)