Working Paper on “Smart Cities”
This working paper by the International Working Group on Data Protection in Technology addresses data protection and privacy issues in smart cities across three stages: data collection, data analysis, and decision-making. It outlines principles and recommendations for accountability, data minimisation, purpose limitation, integrity and confidentiality, transparency, and individual rights. The document provides practical guidance for city governments, regulators, and private sector actors to ensure human-centred, privacy-respecting digitalisation of urban environments.
Summary and content fields are drawn from the document text and are pending editorial review.
Who issued it
Who it governs
City governments, regulators, and private sector partners involved in the development and deployment of smart city technologies.
What the document contains
The document covers data protection, privacy risks, and governance recommendations for the digitalisation of cities, specifically addressing data collection methods, analysis techniques like AI and profiling, and municipal decision-making. It provides case studies and recommendations for cities, industry partners, and regulators.
It does not provide legally binding statutory regulations or enforce penalties, serving instead as a working paper with international recommendations.
- Smart city data processing must be governed across three stages: data collection, data analysis, and decision-making.
- Cities must conduct rigorous data protection impact assessments and establish accountability frameworks prior to launching digital initiatives.
- Data minimisation requires aggregating and stripping identifiers as early as possible in the collection stage.
- Personal data collected for one municipal purpose cannot be repurposed without a compatibility assessment, legal basis, or valid consent.
- Smart city IoT devices must maintain high standards of integrity, confidentiality, and security throughout their lifecycle.
· 1. Introduction · 2. Accountability and Governance · 3. Data Minimisation · 4. Purpose limitation · 5. Integrity and Confidentiality · 6. Right to be informed · 7. Individual rights · 8. Concluding remarks · Summary of recommendations
How it scores
Each score is backed by a quote verified against the document text. Editorial review has not yet confirmed them.
Accountability
4/5Clear responsibility for AI outcomes
To achieve and demonstrate compliance with all data protection principles and protection of individual rights, prior to beginning of any processing, cities and their partners should ensure they carry out a rigorous accountability and governance assessment
2. Accountability and Governance
screening score · 2026-10-23
Fairness
3/5Non-discrimination and equitable treatment
Smart city applications should always be inspired by fairness. Data of poor quality or data which does not reflect the variety of the groups in the population might lead to unfair or discriminatory decisions.
2. Accountability and Governance
screening score · 2026-10-23
Human Dignity
2/5Respect for the inherent worth of persons
In some situations, data may be used for a different purpose, for example, in the analysis phase datasets from multiple sources may be combined, compared, or matched for the purposes of identifying individuals entitled to social benefits. This carries a high risk for individuals’ loss of control of personal data and could also contribute to a lack of autonomy, or manipulation of people’s choices.
4. Purpose limitation
screening score · 2026-10-23
Human Oversight
0/5Humans remain in control of consequential decisions
screening score · 2026-10-23
Privacy
5/5Protection of personal data and private life
This paper presents a series of data protection and privacy principles relating to each of these stages of data use in a city context.
1. Introduction
screening score · 2026-10-23
Transparency
4/5Openness about how AI systems work and are used
As a precondition for the collection of personal data cities should establish methods for providing meaningful information to individuals prior to collection.
6.2 Recommendations on right to be informed
screening score · 2026-10-23
Enforcement
1/5Consequences and compliance mechanisms with real force
If cities cannot guarantee the highest data quality or data representativeness standards with respect to the processing purpose, they should abstain from using those data any longer for that purpose.
2. Accountability and Governance
screening score · 2026-10-23
Impact Assessment
4/5Required assessment of an AI system's risks/impacts before or during use
Cities should conduct impact assessments prior to beginning processing to identify and mitigate risks and consider the impact on other rights and freedoms during the assessment.
2.2 Accountability and Governance Recommendations
screening score · 2026-10-23