Smart cities and personal data: balancing innovation, technology and the law Cidades inteligentes e dados pessoais: equilibrando inovação, tecnologia e o Direito Jesús Manuel Niebla Zatarain* Faculty of Law of Mazatlan, Autonomous University of Sinaloa, Mexico 1. Introduction One of the technological developments that have deeply influenced society is, without a doubt, the Internet. Its impact can be seen in areas that were, prior to its arrival, considered of human realization only. In this aspect, the relation between government and citizens has been shifting towards the adoption of ubiquitous technology and digital platforms, which has incentivised communication and increased transparency levels. This is the particular case of smart cities. Nonetheless, these technologies operate through schemes that require gathering personal data, generating a potentially harmful scenario for their holders. To answer to this situation, many jurisdictions have developed their own version of digital driven legislations, having mixed results at best. This is due to several reasons ranging from the incompatibility of the traditional approach to enforce the law in digital scenarios to a lack of collaboration between experts in these areas. It is within this last position that law compliant operation of smart cities is currently located. As a result of the importance of this scenario, a proper understating of the particularities of the environment is proposed, along * Professor and researcher of the Faculty of Law of Mazatlan of the Autonomous University of Sinaloa, Mexico. His areas of interests are legal informatics and digital regulation. Email: j.niebla@uas.edu.mx. Direito, Estado e Sociedade 06_PUC_Revista_Direito_54_fm.indd 205 n. 53 p. 205 a 223 jul/dez 2018 10/07/2019 10:16 206 Jesús Manuel Niebla Zatarain with the cooperation between the technical and legal aspects to deliver law compliant and technical efficient development. 2. Turning traditional urban centres smart The Internet of Things (IoT) is a technological platform that presents a new paradigm where everyday life objects will be equipped with devices such as microcontrollers, transceivers and communication protocols that will allow communication with each other and with its users, becoming an integral element of the Internet1. This development has been addressed by a sector of the information technology community as the natural evolution of the cyberspace, making it more pervasive. Relevantly, the IoT monitors and interacts with a large variety of appliances, such as surveillance cameras, monitoring sensors, actuators, vehicles, etc. producing a large variety of data that can be used for efficiency purposes. In this context, the next step on the evolution of the IoT has been its insertion into urban spaces. This idea has been supported by many governments that considers it as a suitable platform to achieve urban efficiency goals such as managing resources, to increment the quality of public services and encourage government-citizen interaction2. Additionally, smart cities favours transparency, facilitating cooperation of citizens in the achievement of public strategies, increasing awareness of urban needs and enabling the collaboration between local and state public spheres3. Overall, these elements have allowed smart cities to rise. However, the development of smart cities is a long term process, which, needless to say, requires large volumes of economic investment. To achieve this, several initiatives have been proposed, in the case of the European Union, the Smart finance for smart buildings initiative4, which aims to create attractive schemes for investing in smart technologies for residential and private buildings. This project will operate from 2018 to 2020 creating up to 22,000 new jobs and developing a sustainable market for smart cities infrastructure. 1 ATZORI; IERA; MORABITO, 2010. 2 ATZORI; IERA; MORABITO, 2010. 3 CUFF; HANSEN; KANG, 2008. 4 To know more see: EUROPEAN COMMISSION, 2018. Direito, Estado e Sociedade 06_PUC_Revista_Direito_54_fm.indd 206 n. 54 jan/jun 2019 10/07/2019 10:16 Smart cities and personal data: balancing innovation, technology and the law 207 In this scenario, infrastructure development has proved to be a considerable challenge that has led to the cooperation of the public and private sectors. In the United States, IBM is closely working with the public sector to develop a cognitive model to process personal data relevant to support social, health and educational issues5. Another technology organization that is deeply involved in smart cities is Cisco. This company provides physical components required to connect, protect and securely collect personal data in smart urban environments6. Microsoft is currently aiming to provide digital solutions for four main areas: optimization of natural resource use, urban security, smart buildings and improvement of field services, through their platform CityNext7. Overall, technological development still remains as the core element in smart cities research. Wireless communication, analysis of relevant data and security have become key areas and have been delivering relevant advances. However, each city has its own identity and particularities, which makes the creation of a general framework a complex task. In this sense, the European Union has developed several approaches according to the characteristics of each city, focusing on objectives that are more likely to be achieved in the short term according to their particularities8. 3. Big data in urban environments Ubiquitous computing along with the IoT had increased the production of large datasets with a variety of information, both public and private. Among the first classification, there are national census, government records and surveys, whereas on the second one there are information about data, market operations and customers9. Big data techniques allows us to manage and properly process a large volume of information. They are ca- 5 To know more see: https://www.ibm.com/smarterplanet/us/en/smarter_cities/solutions/human_solutions/ Last access 15 of March 2019. 6 To know more see: https://www.ibm.com/smarterplanet/us/en/smarter_cities/solutions/human_solutions/ Last access 15 of March 2019. https://www.cisco.com/c/en/us/solutions/industries/smart-connected-communities/what-is-a-smart-city. html. Last access 15 of March 2019. 7 https://www.microsoft.com/en-us/internet-of-things/smart-city. Last access 15 of March 2019. 8 See: EUROPEAN COMMISSION, 2017. 9 KITCHIN, 2014. Direito, Estado e Sociedade 06_PUC_Revista_Direito_54_fm.indd 207 n. 54 jan/jun 2019 10/07/2019 10:16 208 Jesús Manuel Niebla Zatarain pable of transforming such data into usable knowledge, suitable for commercial and government purposes. In relation to its technical compositions, big data possess the following characteristics10: • Data processed are considerably large in volume; • It operates in high velocity, almost in real-time; • It can be structured or unstructured; • Operates in entire populations or systems; • Results are as fine and particular as possible; • Capable to operate on different data sets and • Flexible to extend and escalate the volume of data processed. As the adoption of digital platforms such as the IoT expanded, the necessity of adopting big data strategies to properly process digital data became evident. Likewise, the conversion of traditional devices into “smart” ones created a new market for the generation of electronic information. Depending on the type of source used to collect information, big data may be classified as one of the following types11: • Directed: These are generated by traditional methods of surveillance. Here, a device is set to collect specific data from particular users or places. A classic example of this is immigration control. • Automated: Data is generated without the direct intervention of the user. This is the scenario when data related to the purchases made by a costumer is used for profiling purposes. • Volunteered: These are data provided by the users. These covers social media interaction and those obtained and from crowdsourcing12. Naturally, the automated approach has attracted the attention of designers and developers of smart cities. Inherited from the IoT, most of these approaches have been adapted to obtain data through the combination of ubiquitous technologies such as surveillance, sensors and other tracking devices. Compatibility with dynamic scenarios has been also fundamental, 10 BOYD; CRAWFORD, 2012 and MAYER-SCHONBERGER; CUKIER, 2013. 11 KITCHIN, 2014. 12 KITCHIN; DODGE, 2011. Direito, Estado e Sociedade 06_PUC_Revista_Direito_54_fm.indd 208 n. 54 jan/jun 2019 10/07/2019 10:16 Smart cities and personal data: balancing innovation, technology and the law 209 for example, automatic meter reading (AMR) allows an efficient management of domestic services; automated monitoring of public services is also having a positive impact, this is the case of RFID chips attached to garbage collectors that provide whether they need to be collected thus, making this service more efficient and positively impacting public opinion13. Smart technology can also be used to measure the state of public infrastructure. In this case, bridges and roads can be monitored to calculate when they would need to be maintained, allowing a better allocation of public resources.14 Additionally, public transportation is also shifting towards smart technology approaches. This is the case of the Oyster card in London, which allows travel in both surface and underground services15. Consequently, smart cities are conceived as urban areas where personal data is obtained on real time, through objective measurements and the adequate technological infrastructure. To address this scenario from the perspective of municipal governments, in the following section, this perspective will be presented. 4. Cities, personal data and smart technologies It is well known that the approach presented by smart cities has been adopted in different urban centres around the world. The selection of this technology can be seen in strategic sectors such as transport, where data is collected from cameras located in relevant areas of the city16. At the same time, these technological devices can be used by other departments of public service. In the previous scenario, police departments can obtain relevant information in relation to a particular crime from cameras located in the surrounding areas. In large cities, sensors gather relevant data related to environmental conditions, permitting to establish countermeasures and assessing the impact of contingency plans. In relation to areas where the smart city approach is currently being developed, Latin America has very interesting scenarios. In Brazil, Rio de Ja- 13 To know more about this approach see: HANCKE; DE CARVALHO E SILVA; HANCKE, 2013. 14 HANCKE;, DE CARVALHO E SILVA; HANCKE, 2013. 15 https://data.london.gov.uk/blog/improved-public-transport-for-london-thanks-to-big-data-and-the-internet-of-things/. Last access 15 March 2019. 16 DODGE; KITCHIN, 2007. Direito, Estado e Sociedade 06_PUC_Revista_Direito_54_fm.indd 209 n. 54 jan/jun 2019 10/07/2019 10:16 210 Jesús Manuel Niebla Zatarain neiro has one of the most ambitious projects, centralizing data from thirty different sources into a single analytic centre17. This development operates on the following initiatives18: • Rio connected: It aims to expand the telecommunication infrastructure of the city of Rio de Janeiro. It has the objective to interconnect 2.437 governmental points through high speed connections, to facilitate the interaction with citizens. • Knowledge ships: This initiative is oriented to reduce the digital gap existing within the city’s population in terms of digital culture. It will also incentivize the adoption of digital platforms as communication ports with the government to provide relevant knowledge about important events. • Rio Ágora: This module operates as a social network to discuss and propose public policies. It strengths involvement, participation, transparency, clarity and supervision of public environment. • Rio ideas and Rio apps: This method of public participation is based on two type of contests. In the first type, participants present their solutions to a particular problem according to the characteristics of a given scenario. The second one attracts the participation of specialists in technology, who present a technological solution (apps) for a public problem. • Rio call centre: This is the main communication channel between the people and the government. It operates 24 hours and covers more than 1.000 municipal services. It complements services already provided through digital services, serving citizens that are still within the digital divide. • Rio operations centre: This initiative processes the data obtained from different sources, such as sensors and cameras located in different areas of the city 24 hours a day, delivering detailed information about the condition of the city. These initiatives facilitate citizen participation in municipal management. This also impacts positively in terms of transparency, delivering a more adequate process of resource allocation. 17 GAFFNEY; ROBERTSON, 2018. 18 SCHREINER, 2016. Direito, Estado e Sociedade 06_PUC_Revista_Direito_54_fm.indd 210 n. 54 jan/jun 2019 10/07/2019 10:16 Smart cities and personal data: balancing innovation, technology and the law 211 The integration of services maximize efficiency in resource consumption. For example, if a car accident is detected through police cameras, the same data can be used by emergency dispatches to send the appropriate number of ambulances. Smart cities and their algorithms process, visualize, analyse and monitor an immense volume of datasets, aggregating relevant data emerged later and creating projections of potentially relevant scenarios. Mexico City is currently developing its own smart city approach. According to a report published by the communications agency Llorente and Cuenca: “Mexico City wants to face these challenges [misery and violence] and be a leader within the region by putting in place proper planning initiatives and utilizing the third wave of the internet”19,20. Since 2016, there has been the “Connectivity Master Plan for Mexico City” through the Secretary of Economic Development in coordination with the National Autonomous University of Mexico and the World Bank. It has four main objectives21: • To analyse governmental structure and identify its needs; • To identify the current connectivity structure of the city; • To estimate the connectivity demanded in Mexico City; • To propose the design of the Connectivity Network of Mexico City; and • To propose the redesign of the broadcast network in Mexico City. However, Mexico City faces a series of challenges that need to be fulfilled to achieve a fully functional smart city approach. This focus on three equally important areas: technology, priority inclusion from the government and citizen participation, and legislation22. Romero and Ellstein (from Llorente and Cuenca) mentioned on their report that these need to be addressed from an inclusive participation position, where relevant aspects overlap23. Here, technology is seen as a 19 ROMERO; ELLSTEIN, 2018. 20 ROMERO; ELLSTEIN, 2018. 21 https://www.sedeco.cdmx.gob.mx/comunicacion/nota/inicia-gcdmx-plan-maestro-de-conectividad. Last access 15 March 2019. 22 https://www.consultancy.lat/news/236/latin-american-smart-city-potential-mexico-city-leads-the-way. Last access 15 March 2019. 23 ROMERO; ELLSTEIN, 2018. Direito, Estado e Sociedade 06_PUC_Revista_Direito_54_fm.indd 211 n. 54 jan/jun 2019 10/07/2019 10:16 212 Jesús Manuel Niebla Zatarain product directly obtained from innovation that brings citizens together and diminishes social exclusion. In relation to legislation, Mexico has a solid framework to process personal data in the form of the Federal Law on Protection of Personal Data Held by Individuals and the Federal Law on Protection of Personal Data Held by Obliged Subjects. The first one regulates scenarios where the collection of data is performed by private citizens, whereas the second one addresses those interactions where the collector is the public body. Nonetheless, it is perceived that the Mexican legal framework requires further adaptation to the reality of emerging digital environments to bring accurate legal certainty to the parties involved. The third and last objective aims to provide and strengthen civic and democratic principles within the Mexican society such as responsibility, transparency and participation24. Citizen interaction and participation is the cornerstone of smart urban environments. Thus, it shall be taken as a fundamental element in the design and functioning of these scenarios. They provide input that measures both operational efficiency and the levels of public acceptance, which are the ultimate goals of smart cities. A more advanced scenario is the city of New York. Here, the Office of Policy and Strategic Planning has developed an analytic hub that allows gathering data from a diverse variety of public sources to manage, regulated and plan more efficient urban goals. A relevant feature presented by this project is the considerable amount of open data made available for independent designers. In relation to connectivity, Cisco systems in collaboration with the New York City council has lunched the 24/7, a platform that integrates information from governmental sources, local business and citizens to provide relevant knowledge anytime, anywhere and to any device. This project presents three objectives:25 • Inform: It delivers relevant information to their immediate proximity. This scenario can be seen in situations when a user receives information of the events that are taking place in his neighbourhood. • Protect: This approach allows a better management of security resources by allowing police and security forces to locate their units in areas where critical events are occurring. 24 MOORE, Mark. Creating Public Value: Strategic Management in Government. 1995. 25 FRAZIER; TOUCHET, 2012. Direito, Estado e Sociedade 06_PUC_Revista_Direito_54_fm.indd 212 n. 54 jan/jun 2019 10/07/2019 10:16 Smart cities and personal data: balancing innovation, technology and the law 213 • Revitalize: After having established security and informing strategies, cities are more likely to receive investors to develop commerce and tourism. Additionally, real estate prices will increase, which will lead to greater tax revenue that can later be used to revitalize the community. The dynamic nature of this scenario and the flow of personal data has led the authorities to establish a series of strategies to ensure lawful management of personal data. Unlike other cases like Mexico City, New York has established Chief Privacy Officers26 who will be in charge of creating protocols and policies to ensure that not only data requests from different areas will be performed lawfully, but also that the resulting data will be properly managed. Additionally, it requires safe personal data management practices among employees and contractors27. In relation to transparency, New York City Council has also introduced the Public Oversight of Police Technology (POST) Act, which aims to regulate the use of surveillance tools by the city’s police. Another relevant case is London. In this city, real-time information is provided to citizens in relation to several topics, such as weather, public bike availability, electricity demand, transport, stock market and twitter trends in the city and even access to traffic camera feeds. Additionally, the city has developed the London Dashboard28, which makes data related to twelve key areas available, these are: jobs and economy, transport, environment, policing and crime, fire and rescue, communities, housing, health, and tourism. Overall, this site provides processed information for nonskilled users, which facilitates their interaction within the city of London. Overall, urban smart centres are delivering a new approach towards management and delivery of public services. Unlike conservative positions, which perceives this as a replacement of the human element in favour of automation, a better understanding perceives the technology behind smart 26 EUROPEAN COMMISION, 2018. 2 7 http://www1.nyc.gov/office-of-the-mayor/news/167-18/mayor-de-blasio-appoints-laura-negr-n-chief-privacyofficer. Last access 15 March 2019. To read about this approach implemented in other cities, see: https://nextcity.org/daily/entry/santa-clara-county-hires-first-chief-privacy-officer. Last access 15 March 2019 and https://www.seattle.gov/Documents/Departments/InformationTechnology/privacy/PrivacyProgramIntroductionE-TeamBriefing.pdf. Last access 15 March 2019. 28 http://citydashboard.org/london/. Last access 15 March 2019. LAURIAULT, 2012 and RIBES; JACKSON, 2013. Direito, Estado e Sociedade 06_PUC_Revista_Direito_54_fm.indd 213 n. 54 jan/jun 2019 10/07/2019 10:16 214 Jesús Manuel Niebla Zatarain cities as a quality increasing tool for public services. However, regardless of the evident benefits that smart technology offers in urban environments, it also raises a serious concern in relation to the lawful management and processing of personal data and its political value. These scenarios will be presented in the following section. 5. Digital data and its impact on urban politics Digital data contains a series of complex elements that reflects a person’s particular ideas, along with the context through which they were conceived, produced, processed, managed, analysed and stored29. Consequently, these pieces of information cannot be considered as a mere product of human interaction: they are the result of particular choices made on specific circumstances and beliefs, containing ethical considerations and even political opinions. Big data is not indifferent to this, it adapts its gathering process according to characteristics of the sampling frame, the context in which data is gathered, the ontology implemented (the logical description of how data is going to be regulated and standardized), the technological architecture adopted and the legal framework related to privacy.30 This has generated a new form of technocracy where management and regulation of the city resources are based on the assumption that all aspects can be measured and monitored as technical problems31. However, such position needs to be properly assessed, since technocracy, by its own nature, may not include all the relevant elements of a particular scenario thus, operating in inaccurate and narrowed terms. Consequently, its results would not provide an adequate solution, especially in highly dynamic and complex environments. Ironically, this classification and assessment of urban data, proper of smart cities, goes against the classic conception of technocracy32. Matter mentions that the implementation of this approach makes data suffer from “datafication, the presumption that all meaningful flows and activity 29 LAURIAULT, 2012 and RIBES; JACKSON, 2013. 30 KITCHIN, 2013. 31 KITCHIN, 2014. 32 HILL,2013. Direito, Estado e Sociedade 06_PUC_Revista_Direito_54_fm.indd 214 n. 54 jan/jun 2019 10/07/2019 10:16 Smart cities and personal data: balancing innovation, technology and the law 215 can be sensed and measured’’33. Consequently, technology has to deal with deeply rooted problems within the structure of a particular city in order to be efficient and accurate. However, it is mostly implemented over the already existing burocratic structure, centralizing data flow, but compromising its effectiveness. The operational process through which smart functions function requires gathering massive levels of personal data. In the following section, the impact of this on three different legal frameworks will be addressed. 6. European Union The General Data Protection Regulation (GDPR) of the European Union has provided its citizens with more control over their personal data. Naturally, as the adoption of the smart city approach increases, the necessity to develop lawful strategies to gather personal data becomes urgent. This has led non-governmental organizations (NGOs) to propose that “people should always know that their data is being collected, and that these can be accessed and deleted” and that “all the initiatives developed by a smart city should be carried out in the name of public interest and not in the one of companies providing cities with the technological infrastructure”34. One of the main objectives proposed by the GDPR is to harmonize privacy laws across Europe. Here, the figure of the Data Protection Officer (DPO) emerges as a required element whose work is to guarantee legal compliance in relation to personal data legislation. In reference to the scenarios where a DPO is required, the GDPR in its article 37 states: “appointed for all public authorities, and where the core activities of the controller or the processor involve ‘regular and systematic monitoring of data subjects on a large scale’ or where the entity conducts large-scale processing of ‘special categories of personal data”35. The objective of this figure is not to strictly implement the law but try to facilitate the collaboration between the legal and technological sectors to facilitate the adoption of safe practices. DPOs could be private contractors or members of the staff and can operate in more than one organization, as long as they present similar 33 MATTER, 2013. 34 https://cordis.europa.eu/news/rcn/130305/en. Las access 15 March 2019. 35 EUROPEAN UNION, 2016. Direito, Estado e Sociedade 06_PUC_Revista_Direito_54_fm.indd 215 n. 54 jan/jun 2019 10/07/2019 10:16 216 Jesús Manuel Niebla Zatarain operational structures. We can see the presence of this new officer in several private organizations, nonetheless city councils have yet to implement it in the structure of the city. This lack of preparation has led the public sector to hire private elements to properly implemented the GDPR, while preparing their own. Overall, the GDPR has given the much needed step towards the implementation of a functional legal framework compatible with the reality of technological advance. In this sense, it also provides certainty to data collectors by defining the steps required towards lawful processing of personal data. Several cities have been successfully implementing this regulation to their smart architecture, this is the case of Barcelona36 and Vienna37. 7. The United States Like many European countries, the United States has experienced a development in smart urban technologies. US legislation has addressed personal data from the perspective of civil rights legislation, such as: the Fair Housing Act (1968), the Fair Credit Reporting Act (1970), the Equal Employment Opportunity Act (1972), the Electronic Communication Privacy Act (1986), which is applied to service providers that transmit data, the Privacy Act (1974), which is based on the Fair Information Practice Principle (FIPP) Guidelines, and the Breach Notification Rule. As it is possible to infer, US legislation has tried to provide data owners control over their information since at least 2012. This can be seen in the “Consumer’s Bill of Rights”, developed on the “Fair Information Practice Principle” (FIPP), which provided two relevant principles38: 1. Respect for Context Principle: consumers have a right to claim that the collection, use, and disclosure of personal data by companies are done in ways that are compatible with the context in which consumers provide the data, and 2. Individual Control Principle: consumers have a right to exert control over the personal data companies collect from them or how they use it. 36 To know more visit: https://ajuntament.barcelona.cat/digital/en. Last access 15 March 2019. 37 To know more visit: https://ajuntament.barcelona.cat/digital/en. Last access 15 March 2019. To know more visit:https://smartcity.wien.gv.at/site/en/. Last access 15 March 2019. 38 To know more visit:https://smartcity.wien.gv.at/site/en/. Last access 15 March 2019. RANCHORDÁS; KLOP, 2018. Direito, Estado e Sociedade 06_PUC_Revista_Direito_54_fm.indd 216 n. 54 jan/jun 2019 10/07/2019 10:16 Smart cities and personal data: balancing innovation, technology and the law 217 As it has been delivered, American legislation has evolved along with technology, creating Acts or Bills that aim to regulate particular scenarios. This is the case of the Smart Cities and Communities Act of 201739, which addresses the implementation and use of smart technologies and systems in communities of various sizes. By “smart city or community” it is understood one: in which innovative, advanced, and trustworthy information, communication, and energy technologies are applied to: (1) improve the health and quality of life of residents; (2) increase efficiency of operations and services; (3) promote economic growth; and (4) improve safety, security, sustainability, resiliency, livability, and work life40. This bill includes commercial, labour and data protection elements to regulate the interaction between technology and citizens. Relevantly, it also provides mechanisms to protect personal data that may be distributed among different parties as part of the smart infrastructure. This model is also designed to bring rural and urban communities together by developing technologies that facilitate the integration of both scenarios. Like insertion models implemented in other countries, this bill stimulates financial investments to make possible the migration from traditional to smart urban approaches. Complementarily, the Internet of Things Cybersecurity Improvement Act of 201741 establishes the obligation to provide an adequate level of security to devices connected to the cyberspace under this approach. It demands contractors and developers to comply with particular controls and requirements that may lead to potential vulnerabilities. This bill, if passed, would allow the Department of Homeland Security to provide a vulnerability disclosure guidance for government contractors; amend federal statues, particularly the Computer Fraud and Abuse Act and Digital Millennium Copyright Act, particularly in terms of cybersecurity42. 39 UNITED STATES, 2017a. 40 UNITED STATES, 2017a. 41 UNITED STATES, 2017b. 42 NUSRATY, 2017. Direito, Estado e Sociedade 06_PUC_Revista_Direito_54_fm.indd 217 n. 54 jan/jun 2019 10/07/2019 10:16 218 Jesús Manuel Niebla Zatarain Whereas the legal framework related to smart technologies is still being discussed in the United States, it provides interesting positions towards the impact of this technology. It distinguishes itself from other international approaches by delivering provisions created through the cooperation with the developing sectors, which delivers an accurate description of the technological and legal scenarios. 8. Mexico As mentioned on section 4, Mexico is on the process of developing a smart urban infrastructure for Mexico City. On this note, the legal aspect of ubiquitous technology has raised considerable attention among developers, which intend to provide a compliant infrastructure. In this sense, the obligation of lawful management of personal data is contained in the Mexican Constitution on its articles 6th and 16th. The first one on its second paragraph states: “Every person has the right to freely access plural and pertinent information, as well as to search, receive and spread information and ideas of any type through any form of expression”.43 Additionally, article 16th of the Mexican Constitution states, on its second paragraph: “Every person has the right to have their personal data protected, in relation to access, rectification and cancellation, as well as to manifest their opposition, in the terms expressed by the law, which will provide the assumptions of exemption to the principles that direct data management for reasons of national security, dispositions of public interest, public security and health or to protect the rights of a third party”.44 From this constitutional precept, two main federal laws emerged: the Federal Law on Protection of Personal Data Held by Obliged Subjects45 and the Federal Law on Protection of Personal Data Held by Individuals46. These legal documents provide the legal requirements to properly process personal data for both public bodies and private citizens. It also defines the term “sensitive data” as:47 43 MEXICO, 2012. 44 MEXICO, 2012a. 45 MEXICO, 2017a. 46 MEXICO, 2017b. 47 MEXICO, 2017b, article 3 section VI. Direito, Estado e Sociedade 06_PUC_Revista_Direito_54_fm.indd 218 n. 54 jan/jun 2019 10/07/2019 10:16 Smart cities and personal data: balancing innovation, technology and the law 219 Personal data that affects the most intimate sphere of its owner or that its use may generate discrimination or a serious danger. Particularly, it is considered sensitive data information that may reveal aspects such as race or ethnicity, present or future health condition, genetic information, religious, philosophical and moral beliefs, labour affiliation, political opinions and sexual preferences. In this context, the cyberspace presents itself as a considerable challenge, due to its complexity and high speed dynamics. Additionally, since most of the processing and management of data occurs through a third party that in a variety of cases is located in foreign countries, jurisdictional problems are likely to occur. Overall, whereas the Mexican legislation presents a suitable framework to traditional transactions of personal data, it should remain in close contact with the technological sector, in order to guarantee an adequate level of legal protection to digital scenarios such as smart cities. Complementary, the Law to Promote the Development of Mexico City as a Digital and Knowledge-Based City48 provides the technological architecture required to guarantee information access to the population of Mexico City. The article 5th of this law defines digital cities as49: The local environment where a considerable advance in the implementation of the Information and Knowledge Society exists in every scope of the activities performed by citizens, covering the private and public sectors, as well as individual and collective levels, generating new forms of interrelation, strengthening communication among the parties involved, specially between the government and citizens. In a Digital City, public administration is the leader integrating initiatives and responsible of reducing the digital gap. Overall, this law sets the framework through which inclusion can be delivered to citizens of all social sectors as part of governmental objectives. Additionally, relevant technological elements are perceived not only as part of the operative infrastructure, but as a strategic element to ensure the quality of life of its citizens. Conclusively, it proposes the development 48 MEXICO, 2012b. 49 MEXICO, 2012b, article 5. Direito, Estado e Sociedade 06_PUC_Revista_Direito_54_fm.indd 219 n. 54 jan/jun 2019 10/07/2019 10:16 220 Jesús Manuel Niebla Zatarain of smart cities through smart citizens, encompassing the development of digital citizens, people capable of interacting and understanding the nature of smart cities. Nonetheless, this objective does not appear achievable in the short term. The disparity among social sectors in Mexico City has made the dissemination of technology slow and, in some scenarios, barely productive. This makes the generation of the necessary conditions to benefit from technological advances a fundamental goal. In this sense, one of the main contributions of this law is that it conceives smart cities as a scenario where the efforts of the private and public sectors need to converge and complement, rather than compete against each other, developing a tailored model of governance for Mexico City50. 9. Conclusions Smart city is a concept that is currently being adopted by many countries around the world. Beyond the evident benefits it offers as a model to improve operational efficiency and resource management, it raises legal concerns, especially in relation to the lawful processing of personal data. However, the complexity of this platform is such that regulation cannot be achieved through traditional legal approaches, thus requiring the development of new interdisciplinary models. In this scenario, many jurisdictions have created their own version of data driven regulations, which aim to provide an accurate level of protection while remaining compatible with the cyberspace and other digital platforms. Nonetheless, it is important to state that the advances obtained so far have not reached the expected goals. However, this is caused by several factors. First and most important is the evolving nature of technology, which advances constantly, generating new potentially legally relevant scenarios. Second, the lack of adoption of legal technology currently existing in the market. Additionally, whereas the Internet has become the core of smart cities along with the capacity of personal devices to share data, it has also increased the difficulty to create a unified legal approach. This has led to the development of legal frameworks that address this scenario in a particular50 BERRA, 2013. Direito, Estado e Sociedade 06_PUC_Revista_Direito_54_fm.indd 220 n. 54 jan/jun 2019 10/07/2019 10:16 Smart cities and personal data: balancing innovation, technology and the law 221 ized manner, delivering compatibility only with other smarts cities located in the same jurisdiction. Parallel to the legal aspect, smart cities have strengthened the expansion of digital governance. These technological platforms have proved to be a valuable tool through which social interaction and inclusion can be expanded to social sectors traditionally relegated. Finally, smart cities should not be seen as mere administrative platforms, these are valuable digital resources that help spreading social values such as participation, respect and collaboration. References ATZORI Luigi, IERA Antonio and MORABITO, Giacomo. The internet of things: A survey. Computer Networks, vol. 54, no. 15, pp. 2787–2805, 2010. BERRA, Mariella. De la ciudad digital a la ciudad incluyente: La construcción de un capital sociotécnico. Sociológica (México), 28(79). pp. 7-49. 2013 BOYD, Danah and CRAWFORD, Kate. Critical questions for big data: Provocations for a cultural, technological, and scholarly phenomenon. Information, communication & society, 15(5), pp.662-679 2012. CUFF Dana, HANSEN Mark and KANG Jerry. Urban sensing: Out of the woods. Communications of the ACM, vol. 51, no. 3, pp. 24–33, Mar. 2008. DODGE, Martin and Kitchin, Rob. The automatic management of drivers and driving spaces. Geoforum, 38(2), 264–275. 2007. EUROPEAN COMMISSION. The making of a smart city: best practices across Europe. 2017. Available at: https://www.smartcities-infosystem. eu/sites/default/files/document/the_making_of_a_smart_city_-_best_ practices_across_europe.pdf. Last access 15 of March 2019. ________. Smart Finance for Smart Buildings initiative. Energy Commission. Available at: https://ec.europa.eu/info/news/smart-financesmart-buildings-investing-energyefficiency-buildings-2018-feb-07_en. Last access 15 of March 2019. ________. Decode. Reclaiming the Smart City Personal data, trust and the new commons. 2018. Available at: https://media.nesta.org.uk/documents/ DECODE-2018_report-smart-cities.pdf. Last access 15 March 2019. Direito, Estado e Sociedade 06_PUC_Revista_Direito_54_fm.indd 221 n. 54 jan/jun 2019 10/07/2019 10:16 222 Jesús Manuel Niebla Zatarain EUROPEAN UNION. General Data Protection Regulation. Available at: https://gdpr-info.eu/art-37-gdpr/. Last access 15 March 2019. FRAZIER, Jeff and TOUCHET, Tom. Transforming the City of New York New Platform for Public-Private Cooperation Ushers in Smart Cities of the Future. Point of View. Cisco. 2012. Available at: https://www.cisco.com/c/ dam/en_us/about/ac79/docs/ps/motm/City-24x7_PoV.pdf. Last access 15 March 2019. GAFFNEY, Christopher and ROBERTSON, Cerianne. Smarter than smart: Rio de Janeiro’s flawed emergence as a smart city. Journal of Urban Technology 25, no. 3. p. 47-64. 2018. GITELMAN, Lisa (Ed.), ‘‘Raw data’’ is an oxymoron. 2013. Cambridge: MIT Press. pp. 147–166. HANCKE, Gerhard P., DE CARVALHO E SILVA, Bruno and HANCKE, Gerhard P, Jr. The role of advanced sensing in smart cities. Sensors, 13(1), 393–425. 2013. HILL, Dan, 2013. On the smart city: Or, a ‘manifesto’ for smart citizens instead. City of Sound, 1. KITCHIN, Rob. Big data and human geography: Opportunities, challenges and risks. Dialogues in Human Geography. 2013. KITCHIN, Rob. The real-time city? Big data and smart urbanism. GeoJournal, 79(1), pp.3. 2014. KITCHIN, Rob and DODGE, Martin. Code/space: Software and everyday life. Cambridge, MA: MIT Press. 2011. LAURIAULT, Tracey P. Data, Infrastructures and Geographical Imaginations: Mapping Data Access Discourses in Canada. PhD Thesis, Carleton University, Ottawa. 2012. MAYER-SCHONBERGER, V. and CUKIER, K. Big data: A revolution that will change how we live. London : John Murray, 2013. MEXICO. Cámara de Diputados. Constitución Política de los Estados Unidos Mexicanos. México: Cámara de Diputados. 2012a ________. Asamblea Legislativa del Distrito Federal. Ley para el Desarrollo del Distrito Federal como Ciudad Digital y del Conocimiento. VI Legislatura. 2012b. Available at: http://www.aldf.gob.mx/archivo-815a69869b1735c03f73ce34bc0e39c7.pdf . ________. Cámara de Diputados del H. Congreso de la Unión. Ley Federal de Protección de Datos Personales en Posesión de Sujetos Obligados. México: Cámara de Diputados. 2017. Direito, Estado e Sociedade 06_PUC_Revista_Direito_54_fm.indd 222 n. 54 jan/jun 2019 10/07/2019 10:16 Smart cities and personal data: balancing innovation, technology and the law 223 ________. Cámara de Diputados del H. Congreso de la Unión. Ley Federal de Protección de Datos Personales en Posesión de los Particulares. México: Cámara de Diputados. 2017. MOORE, Mark. Creating Public Value: Strategic Management in Government. Cambridge : Harvard University Press, 1995. NUSRATY, Weiss. A Summary of the Recently Introduced “Internet of Things (IoT) Cybersecurity Improvement Act of 2017”. Inside Privacy. Covington. Available at: https://www.insideprivacy.com/data-security/cybersecurity/a-summary-of-the-recently-introduced-internet-of-things-iot-cybersecurity-improvement-act-of-2017/ RANCHORDÁS, Sofia and KLOP, Abram. Data-Driven Regulation and Governance in Smart Cities. University of Groningen Faculty of Law Legal Studies Research Paper Series No. 7/2018. 2018. RIBES, D., and JACKSON, S. J. Data bite man: The work of sustaining long-term study. 2013. ROMERO, Alejandro and ELLSTEIN, Arie. Mexico City: Keys and challenges to building a smart city for citizens. Llorente and Cuenca, 2018. Available at: https://www.desarrollando-ideas.com/wp-content/uploads/ sites/5/2018/01/180117_MEXICO-CITY-CHALLENGES_ENG.pdf. Last access 15 March 2019. SCHREINER, Clara. International Case Studies of Smart Cities: Rio de Janeiro, Brasil. Inter-American Development Bank. June 2016. UNITED STATES. Congress. H.R.3895 - Smart Cities and Communities Act of 2017. https://ajuntament.barcelona.cat/digital/en. Last access 15 March 2019.2017a. Available at: https://www.congress.gov/bill/115th-congress/house-bill/3895. Last access 15 March 2019. ________. Congress. Internet of Things (IoT) Cybersecurity Improvement Act of 2017. Congress.gov. 2017b. Available at: https://www.congress.gov/ bill/115th-congress/senate-bill/1691/text?format=txt. Last access 15 March 2019. Autor convidado. Direito, Estado e Sociedade 06_PUC_Revista_Direito_54_fm.indd 223 n. 54 jan/jun 2019 10/07/2019 10:16