Privacy Issues in a Smart City

A city is described as being smart when it has high technological advancements. Such technological advancements include intelligent transport systems, smart energy grids, sensor networks, cloud computing, logistics management system with the desire to use digital technology to create a better life for citizens. Thite (2011) interprets the term ‘smart city’ as a creative city, “aimed at nurturing a creative economy through investment in quality of life which in turn attracts knowledge workers to live and work in smart cities” and fits as such in the ‘smart people’ category in Meijer and Bolivar (2016). An example of using smart people is given in the municipality of Utrecht, where City Talks were initiated on the environmental strategy to be taken by the city (Eurocities, 2016b).

According to the overview by Meijer and Bolívar (2016), there are generally three types of smart cities identified: those using smart technology (technology focus), smart people (human resources focus), smart collaboration (governance focus), or some combination of the three. Central to the creation of smart cities is the generating, processing, analyzing and sharing of vast quantities of data about city infrastructure, services, and citizens. Indeed, smart cities technologies are precisely about making cities data-driven: enabling city systems and services to be responsive to and act upon data, preferably real-time data (Kitchin, 2015a). It is thus no coincidence that the drive to create smart cities dovetails with the unfolding data revolution (Kitchin, 2014a). This report focuses on privacy issues regarding Smart Cities, such as the ethical, legal, social, and professional issues.

Ethical and Social Issues

There are clearly a number of ethical issues that arise from the creation of the smart city. Using the following ethical theories: the deontological approach claims that actions, regardless of the solution are either right or wrong no middle ground; and the utilitarian approach focuses on how the end justifies the means (Shakib and Layton, 2014). Cyber attacks can be performed by hostile nations, terrorist groups, cyber-criminals, hacker collectives, and individual hackers. Former FBI director, Robert Mueller, details that 108 nations have cyberattack units, targeting critical infrastructure and industrial secrets (Goodman, 2015).

The majority of attacks are presently being repulsed using cybersecurity tools, or their effects have been disruptive or damaging but not critical for the long-term delivery of services (Singer and Friedman, 2014). Indeed, it needs to be recognized that to date, successful cyber attacks on cities are still relatively rare and when they have occurred their effects generally last no more than a few hours or involve the theft of data rather than creating life-threatening situations. That said, it is clear that there is a cybersecurity arms race underway between attackers and defenders, and that more severe disruption of critical infrastructure has been avoided through the threat of mutually assured destruction between nations (Rainie et al., 2014). This is not to suggest that smart city initiatives should be avoided, but rather that the cybersecurity challenges of creating secure smart cities are taken seriously. It is likely that cyber attacks will increase over time; they will become more sophisticated and have the potential to cause significant disruption to city services and the wider economy and society (Townsend, 2013; Kitchin, 2014a).

Legal Issues

The Data Protection Act (1998) states that: “Personal data shall be obtained only for one or more specified and lawful purposes and shall not be further processed in any manner incompatible with that purpose or those purposes”. This law enforces the processing of confidential data adequately and lawfully. The main purpose of this principle is to guide the interests of the individuals whose personal data are being processed and the information is in line with the acceptable expectations of the users concerned.

The hack of Sony PlayStation in June 2011 resulted in the loss of 77 million accounts including credit card details, names, addresses, date of birth, and log-in credentials, and cost the company more than $1 billion in lost business, lawsuits, and outside contractors (Goodman, 2015). The consequence for the individuals to whom the data refers is identity theft, leading to criminal activity that is attributed to them, and the stress and effort involved in trying to clear one’s name. 12.6 million Americans were reportedly the victims of identity theft in 2012 at the collective loss of $21 billion (Finklea, 2014). The Data Protection Act (1998) assures the privacy and integrity of data held on individuals by businesses and other organizations. The law gives the users the assurance that only them have access to their data and can change any detail in it (Data Protection Act, 1998). Moreover, while there is common ground on how to address privacy harms, such as advocating privacy by design, enhanced data security, and access rights to check and correct data, there are differences in approach and how to implement them (in terms of obtaining consent, notification of data breaches, cross-border data flows) Santucci (2013).

Professional Issues

A professional code of conduct is a necessary component of any profession to maintain a standard for the users within that profession to adhere (Martin, 2011). Technical exploits can be significantly aided by a human error, for example, employees opening phishing emails and installing viruses or malware, or inserting infected data sticks into computers (Singer and Friedman, 2014). Errors can also occur in relation to how data are released. For example, in 2014 a freedom of information request resulted in the release of data on 173 million journeys undertaken by New York taxis in one year.

The data were incorrectly anonymized and relatively easy to decode, revealing the driver IDs, pickup and drop-off times, and GPS routes taken for all cab journeys (Pandurangan, 2014). In a different case, Experian sold personal data relating to 200 million US citizens, including names, addresses and social security numbers to an ID theft ring in Vietnam (Goodman, 2015). This negligence goes against the BCS Code of Conduct section 2(G) which states “professionals shall reject and will not make any offer of bribery or unethical inducement” (BCS, 2016).