Smart Cities, Big Data, Artificial Intelligence and Respect for the European Union Data Protection Rules

Introduction

Cities are large population centres which, in the medium term, are expected to concentrate even more inhabitants and percentage of the population. UN estimates suggest that cities currently consume 78% of the world's energy and produce more than 60% of greenhouse gas emissions despite covering less than 2% of the Earth's surface. In this regard, it is essential to take measures to avoid such concentration of emissions in cities and relevant measures are already being taken at the global level and by the European Union.

The European Green Deal claims for the EU to be "climate-neutral" by 2050¹, not contributing to global emissions as a whole. The success of the smart city projects discussed in this paper will be fundamental to achieve that goal.

Due to the growing trend, mentioned above, of population concentration in cities, it is essential to have mechanisms and technologies that guarantee the sustainability of urban developments, respect for the environment, rational use of available resources and adequate treatment of the waste generated. It is therefore essential to make a decisive and global commitment to smart cities, to improve the provision of public services and to meet the challenges that, in the medium term, must be faced at world level in the management of urban spaces.

As an approach to the concept, we can say that an smart city is a place where traditional networks and services become more efficient thanks to the use of Information and Communication Technologies (ICT) for the benefit of city inhabitants, businesses and the environment.

The smart city means going beyond the use of ICTs just to make more rational use of resources, improving the environment and reducing emissions or waste generated in large urban areas. The implementation of a truly smart city involves much more: the optimisation of urban transport networks and the movement of vehicles and people, the improvement of essential services for citizens such as water, gas or energy supply, the restructuring and rethinking of urban planning, carrying out much more efficient management of urban waste or reducing energy consumption by committing to smart lighting in the urban public domain, as well as public-private collaboration to ensure that this management model is implemented at both levels of action and to increase citizen participation both in improving the model and in its governance and transparency.

Cities have begun to take advantage of the Internet of things² and to use ICTs to create more efficient spaces, as we have already mentioned, and not only in the environmental aspect, but also in the social, economic or operational aspects. On the other hand, the smart city interacts with the citizens, in such a way that the information generated by the connected citizens themselves directly facilitates both the organisation and management of the daily services and processes addressed to them by the Public Administrations and the effectiveness and efficiency of public management, thus complying with such principles that must govern it³, and facilitating many of the rights of European Union citizens set out in the Charter of Fundamental Rights of the European Union⁴: the rights of the elderly “to lead a life of dignity and independence and to participate in social and cultural life” (art. 25), the right to integration of persons with disabilities wich can benefit, in a smart city from “measures designed to ensure their independence, social and occupational integration and participation in the life of the community” (article 26), to (digital) health care (art. 35), environmental protection (art. 37), and consumer protection (art. 38), to vote and to stand as a candidate at elections to the European Parliament (art.39) and municipal elections (art. 40), and finally the right to good administration (art. 41).

Literature Review

According to the European Parliament, smart cities can be identified and classified according to six main axes or dimensions: smart governance, smart economy, smart mobility, smart environment, smart people, and finally, smart living⁵. Therefore "a city can be defined as 'smart' when investments in human and social capital and in transport and ICT infrastructure contribute to sustainable economic development and to improving the quality of life, with rational management of natural resources, through participatory governance" (VILLAREJO GALENDE, 2015).

From 2012, the European Commission launched a specific initiative for the development of smart cities called "Smart Cities and Communities-European Partnership for Innovation", providing 365 million euros for innovative ideas and projects in the field of energy, transport and ICT in urban areas and demonstrating Europe's commitment to the sustainability of its cities.

There are currently numerous European initiatives aimed at boosting the digitisation of cities and successfully addressing the transformation of cities into smart cities, such as those carried out by the European Innovation Partnership on Smart Cities and Communities (EIP-SCC), the Digital Transition Partnership of the Urban Agenda for the EU, or the Horizon 2020 projects, as well as the above-mentioned initiatives included in the European Green Deal.

In the case of Horizon 2020, the eighth European Framework Programme for Research and Technological Development (H2020)⁶ is a programme that funds research and innovation projects in various thematic areas in Europe, with a budget of almost 80 billion euros for the period 2014-2020. It is open to researchers, companies and technology centres as well as public entities, and integrates all phases of a project, from the knowledge generation phase to the transfer of knowledge to activities closer to the market. However, as these are fragmented projects and solutions, their results and impact are limited and it is necessary to develop global and integrated solutions for smart cities, which combine low carbon and energy efficiency with citizen participation and transparency in management. In this sense, the "Join, boost, bustain" movement mentioned above becomes fully valid, as well as its objective is to support the creation and extension of digital platforms and open digital solutions throughout the EU, which have the characteristics of being interoperable, cross-sectoral and cross-border.

The aforementioned European Innovation Partnership on Smart Cities and Communities (EIP-SCC), which was established in 2012 and has since helped to bring together stakeholders in six action groups and to generate calls for projects called Smart Cities Lighthouse⁷ under the Horizon 2020 programme, reflects this EU effort to maximise efficiency and flexibility through interoperability and standardisation, as a first important step towards a future European Union policy on cities.

By 2050, two thirds of the world's population will live in cities and in Europe, almost 75% of the population currently lives in urban areas of different sizes, with European cities being major contributors to energy consumption and pollutant gas emissions as we have highlighted, so it is essential to minimise their climate impact. On the other hand, we cannot ignore the fact that cities are the main engines of the Union's economy, and the main responsible for the creation of growth and employment. In this respect, EU initiatives are aimed at promoting more attractive and competitive, healthier and sustainable urban areas in which to live, integrating environmental protection and the fight against climate change. The initiatives being implemented are very numerous and diverse. Some sectors where notable progress has been made are the area of Smart Grids, energy efficiency and the digitisation of the water sector. In relation to smart grids, the Smart Grid working group is examining the possibility of establishing a common format for the exchange of energy data at EU level as a basis for an interoperability framework. On energy efficiency, the EU has defined a readiness indicator for smart buildings, which aims to measure the ability of buildings to use digital technologies and electronic systems to optimise operation and interaction with the grid⁸.

For its part, the European Economic and Social Committee has drawn up an Opinion⁹, in which, among other issues, it establishes the need to carry out the integration of the following fundamental pillars in order to achieve a more advanced and effective model of smart cities:

technologies and instruments for energy efficiency and the integration of renewable sources;

dissemination of technology and connectivity platforms to create the new digital services systems;

new digital services to improve the quality of life and work of citizens and businesses;

modernisation of urban infrastructure and urban redesign;

education and training of citizens, enterprises and the public sector in digital skills; and an economic and financial sustainability model for investments.

Recently, in January 2020, the European Union published “Living.in.EU – The European way of digital transformation in cities and communities” or "Join, boost, sustain" Declaration to lay the foundations for the digital transformation of European cities. This is an initiative signed by representatives of EU cities and supported by the Committee of the Regions and the European Commission.

The Declaration comes at a time when cities and communities in the European Union are facing an increasing number of challenges and are coming together to do so¹⁰. It proposes to address these challenges through digital solutions based on locally generated data, which are essential for providing better services in areas such as mobility, public services and energy efficiency, stressing the need for cooperation between the different actors involved (through multilevel governance in the EU) in order to boost innovation, enabling citizens to be the focus of public policies that provide efficient and cost-effective services. It insists on the need for sufficient public and private investment in digital services, technologies, infrastructure and skills in order to achieve this goal, to ensure technological leadership of the EU (in the words of the declaration, since no such leadership currently exists at global level) while respecting European values and diversity, as well as the digital rights of individuals. It includes clear commitments such as the creation of a joint investment plan focusing on digital solutions; the creation of standards focusing on ensuring interoperability of data and platforms between cities; and bridging the digital divide by promising to provide all citizens with the digital skills they need to be able to benefit from the services and solutions offered by the smart cities¹¹.

It is important, as the declaration underlines, that the public has confidence in the systems to be implemented in smart cities, for which the data must be used responsibly through digital platforms that guarantee the quality, security and privacy of such data collected and processed for the better functioning of the cities. In this sense, the core of the declaration is the implementation and expansion of open, interoperable, cross-sector and cross-border platforms, as a means of driving the digital transformation. The aim is to provide guarantees for technological sovereignty in the EU, and to promote the joint creation of digital solutions in order to avoid specific disparate and scattered technologies isolating and blocking European cities.

Regarding the regulation of smart cities by the European Union, public institutions have a key role in driving new developments and generating new opportunities for companies in the smart city sector. In this respect, the role of the EU is clearly fundamental, given the scope of its regulation and the possibilities it has for harmonising the legislation of its Member States in many of the aspects relating to smart cities, as well as the capacity, which we have pointed, to finance the initiatives it launches. The international scope that the EU represents and the understanding of its role in this process means opening up opportunities at international level for companies that have innovative and valuable products and services at Union level.

We therefore consider that the two main functions of the EU in relation to smart cities are, firstly to promote and fund initiatives that facilitate the development of projects in this field, as we have seen in the previous section, and secondly the function of harmonising or coordinating the legislation of the Member States to make this possible.

Only with the intervention of the EU a homogeneous legal framework can be created to provide a model of smart city that can be homologated throughout its territory. The main binding regulatory instrument for the Member States with a view to achieving this objective are the European Directives, but also other mechanisms such as the European Regulations (to establish common guidelines for the approval of certain products or technologies, a particularly important issue in the field of the Internet of Things or Big Data, aspects in which European regulations are already advanced, as we shall see later), the creation of seminars or working groups to share ideas through the publication of White Papers¹², etc.

The most immediate benefit of this policy is that it creates a large internal market that increases the attractiveness of EU business and is aimed at this as we will see the Digital Single Market as a parallel EU initiative. An example of this action is the European Framework of Reference for Sustainable Cities (RFSC)¹³, a web tool or application designed to enable all European cities to have a common conceptual framework when assessing and planning policies aimed at development and sustainability, fields in which the sector of smart cities is a key player. The Framework defines in detail 30 sustainability objectives for European cities, and provides online tools for public and private actors to assess the situation of their cities in relation to these objectives. Among them we can highlight:

Spatial dimension: sustainable urban planning, spatial equity, sustainable mobility, territorial resilience, heritage preservation, quality public spaces.

Government dimension: continuous improvement processes, citizen participation...

Social dimension: inclusion, equity, access to housing

Economic dimension: green growth, local economic resilience, sustainable consumption and production

Environmental dimension: mitigating climate change, adapting to climate change, reducing pollution, conserving resources...

The concept of the smart city comprises multiple aspects, linked in terms of their purpose but very diverse in terms of the regulations that govern them. Without wishing to be exhaustive, if we analyse the smart city we will have to look in depth at aspects such as personal data protection, the digital single market, open data, public procurement, the use of artificial intelligence and its impact on decision-making, the impact of ICT on our current model of liberal democracy, citizen participation, the concept of the accessible city and the inclusion of people with disabilities or digital administration.

In this sense, the concept of smart city “can be considered a transversal phenomenon that can, and must, be approached from multiple branches of knowledge” (VELASCO RICO, 2019). This author defends that, despite the fact that the concept is not legal and has a poorly defined profiles "for the reserchers of Administrative Law, it allows the limits of the discipline to be extended, in the sense that smart cities invite Administrative Law to act in scarcely explored or even non-existent scenarios before this new experimentation. In short, the concept of smart cities brings Administrative Law closer to the universe of public policies" (all translations to authors are our own). She believes that a technocratic vision is being imposed in this area, based on the consideration that policies based on up-to-date data are more intelligent and that the city is a space that can be managed in real time through the use of ICT and cloud computing. We share, however, her opinion that "This technocratic vision cannot obscure the importance of citizens' rights in this environment and, precisely, the role of Administrative Law and its institutions and categories plays a central role in protecting and guaranteeing them".

Taking the case of Spain as an example, in addition to the legal aspects, there is a need for the homogenisation or at least the interoperability or compatibility of the smart city projects, since the first experiences suffered from the heterogeneity and insufficient dimension of the projects¹⁴. It is therefore essential that standardisation, and in this sense in Spain, the initiatives in the field of the smart cities must comply with the standards developed by the Technical Committee for Standardisation of AENOR- AEN/CTN 178¹⁵ "Ciudades Inteligentes" (smart cities). This Committee has approved by now more than 30 technical standards for the standardisation of five areas related to smart cities: infrastructure, indicators and semantics, governance and mobility, and energy and the environment¹⁶.

The public-private collaboration is evident in this area, since the leadership of the CTN 178 Committee is based on public initiative but the Committee itself is part of UNE, a privately based association. On the other hand, the technical standards of standardisation approved by the Committee are a source of soft law, in the absence of express regulatory standards for smart city projects. It should be remembered here that the standardisation rules approved by the UNE Committees are voluntary, although in certain areas sectorial legislation or public administrations may require compliance (in public procurement, p.ej.). In this sense, collaboration between the public and the private sector in the development of smart cities is chosen as the best way to advance in this area instead of chosing an strict regulation from the public sector.

Methodology

Our methodology will consist of the analysis of the legal implications of smart cities, confronting the existing regulation in the European Union on personal data protection and its effectiveness in relation to the use of emerging technologies such as Big Data, necessary for the operation of such smart cities.

Discussion

The development of smart cities can have a number of legal implications that are important to consider:

a) Big data and Artificial Intelligence techniques and personal data protection regulations (see below)

b) The regulations on e-administration. In this sense, we must take into account that currently the use of electronic means is the main instrument for the management of data and information by Public Administrations, with paper and "physical" procedures being increasingly relegated. The current situation of teleworking and de facto closure of the physical headquarters of the Public Administrations caused by the state of alarm and confinement declared as a result of the covid19 virus pandemic, accentuates and accelerates the importance and progress of e-Administration.

The process has difficulties and has revealed serious errors in its operation and development. However, once the required technological means have been implemented, it will be possible to gain immediate and automated access to the data generated in relation to any procedure carried out by a citizen with the Public Administrations, always in compliance with data protection regulations. The information thus generated must respect the standards established to facilitate its reuse and the storage and management systems must be interoperable as a fundamental basis for the proper functioning and progress of smart cities.

c) Transparency: smart cities need provisions on transparency and access to public sector information. Information and data cannot be reused (a necessity in smart cities), if they cannot be accessed. Transparency regulations and the right to access public information are the basis and guarantee of access to the data needed by the smart city.

(d) Re-use of data/information: smart city projects need rules that allows the re-use of public sector information. The data needs to be open and reusable. The problem in countries such as Spain is that while municipalities can impose data openness obligations on their instrumental entities and on the companies awarded contracts through the technical prescriptions of the contracts, they cannot do the same with the private actors involved in the smart city projects, mainly technology and consulting companies. In this sense, VALERO TORRIJOS (2017) believes that in specific issues such as compliance with reuse standards or open data obligations, it would be necessary to broaden the subjective scope of the administrative regulations either by modifying them directly or by extending them through contractual clauses on public procurement. This should be done when there is a legal relationship between the municipal administration and the private subjects in the samrt city. When this is not the case, collaboration formulas or other open government techniques should be used to favour accessibility or the transfer of data for its processing by third parties.

e) Citizen participation¹⁷: smart cities are based on data, from which the city is managed by making decisions with Big Data and Artificial Intelligence techniques based on algorithms. There are numerous ethical, legal and political problems derived from the creation and use of these algorithms. It is important that the principle of transparency is also extended to the algorithms, and that there is no blind trust in them because of their "scientific basis", since they are programmed by people who may have biases (of discrimination by race, ethnicity, sexual condition, etc.) that even they do not know and that may end up being transferred to the algorithm. It is essential that citizens not only have access to public data, but also that they can participate in and have access to the design and control of the algorithms on the basis of which, for example, profiles of citizens themselves are developed and decisions made based on those profiles. In this respect, Article 22 of Regulation (EU) of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation or GDPR hereinafter), under the heading of 'Automated individual decisions, including profiling', prevents decisions with legal effects or similar effects on individuals from being taken in an automated manner on the basis of profiles and without human intervention, by providing that “1. The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her”.

We see that one of the legal implications that causes most concern in terms of smart cities is related to the privacy of citizens, who may see their privacy or the protection of their most personal or family sphere diminished by the control that cities can make over their data for the proper development of that smart citiy.

One case which in my opinion clearly violates citizens' rights to privacy, personal liberty, personal data protection and non-discrimination is China's 'social credit system', which is already in place¹⁸. This system gives a score to each citizen according to their civic habits, their lifestyle, the websites they surf, what they buy on the internet and other variables such as their traffic offences. The score obtained marks the position of citizens in the country's social scale so that those with high credit will be entitled to preferential treatment by the Administration. On the other hand, those with a low score, face reprisals such as the impossibility to access certain jobs, the prohibition to buy train or plane tickets, to stay in the best hotels, to have their children go to a good school or even to have their pets taken away by the state, all this in addition to be included on public blacklists of bad citizens. China's social credit system is made possible by the combination and integration of various technologies of Big Data, facial recognition and internet monitoring in an environment whose freedoms are not comparable to those of a Western democracy and with the help of more than 600,000 surveillance cameras with artificial intelligence.

A smart city works through mobile applications that, developed by the public body that manages it, allow users to share information about the city they live in so that this information is transformed into useful data that allows better and more personalized development of public services, savings in certain costs or the implementation of certain functions or facilities for citizens, as we have already highlighted. Likewise, many cities implement public wi-fi networks so that citizens can register beforehand and connect through them, being able to know the public entities through them, issues such as the exact location of each user, the means of transport they use or the websites they visit, among others, which constitutes information of great value for these public entities.

This reality shows that the progress of an intelligent city cannot be understood without the collection of millions of data from its inhabitants. Although in many cases these data are processed by the corresponding public administrations in an aggregate or dissociated manner, in such a way that it is not possible to identify the specific citizen to whom the data belong (e.g., with the identification of patterns related to age, sex or marital status), the truth is that in many other cases it would be possible for the public bodies acting behind these connected cities to identify the users who interact with them, through reidentification or inference.

It is clear that if the appropriate safeguards are not in place, the development of the smart city could result in disproportionate interference with the privacy and intimacy of its citizens. Such guarantees, among other issues, would include requesting, from citizens who access (voluntarily) the connected services provided by the smart city, only those data strictly necessary for the provision of the service or specific functionality, without collecting in any case data that may be disproportionate or excessive for the purpose. In this sense, the above-mentioned "join, boos, sustain" Declaration of the EU includes a section on “Ethical snd Socially Responsible Access, Use, Sharing and Management of Data”¹⁹.

Furthermore, citizens must be clearly informed, among other things, of what their data will be processed for, who will do it and for how long. And the use of individualised data should be avoided as far as possible: this is achieved by means of anonymisation and pseudonymisation techniques, only aggregated data that do not allow direct identification of citizens should be used.

Analysis

Smart Cities, Big Data and the Fundamental Rights of City-Dwellers

Talking about smart cities without talking about Big Data would be meaningless. Big data can be defined as "large amounts of digitized data that are controlled by companies, public authorities and other large organizations that have the technology to perform extensive analysis of them based on the use of algorithms”²⁰. The term Big data refers to a massive accumulation of data that exceeds the capacity of traditional tools to capture, manage and process it in a reasonable time (BALDOMINOS GÓMEZ, MOCHÓN MORCILLO, NAVAS DELGADO, et. al., 2016). A data set is considered to fall into the category of Big data if it requires specialized analysts because it is too large to be handled properly with conventional software programs available to the general public. The approach to collecting, analysing, processing and displaying massive amounts of data, not necessarily structured, for decision making is quite recent, but is becoming increasingly relevant and has enormous potential, thanks to the massive accumulation of data favoured by the widespread implementation of ICT. The essence of Big Data lies in the use of data to solve problems, whether in the business, personal or public administration fields, which gives it enormous potential in the field of smart cities.

Among the common characteristics of the Big Data, independently of the sector we are talking about, we find among them, besides the variety, volume and speed ("the 3 v's"), a fourth "v", the veracity, to which a fifth "v" is normally added, referring to the valorization (ISHWARAPPA and ANURADHA, 2015). The latter is fundamental and consists of identifying, in the case of smart cities, how the municipal government can analyse the data and draw conclusions in order to carry out actions such as predicting the behaviour of public service users, identifying tastes or needs by user groups or segmentation and their subsequent application to the provision of the services²¹.

In short, the Big Data or Macrodata involves the collection of massive amounts of data by public or private organizations that, through the use of technological tools of Artificial Intelligence and Automatic Learning (Machine Learning) based on algorithms, are able to analyze such data in order to obtain information that can be very valuable and profitable. And that is why Big Data is closely linked to smart cities and IoT (Internet of Things), as well as to privacy and personal data protection, provided that their use involves the processing of such data.

The European Union's establishes certain data protection principles that are mandatory for all smart city projects. Among others, the principle of data minimization stands out, which implies that the information collected and processed will be the minimum essential to meet the pursued purpose, the obligation of pseudonymization or the principle of privacy from the design. Projects carried out on the basis of anonymised data will not be obliged to respect this regulation, since as the GDPR points out in Recital 26 “ The principles of data protection should therefore not apply to anonymous information, namely information which does not relate to an identified or identifiable natural person or to personal data rendered anonymous in such a manner that the data subject is not or no longer identifiable”.

In this regard, and in order to determine whether there is processing of personal data and use of Big Data techniques in smart cities, it would be necessary to establish firstly whether the information collected is going to be processed (the answer is logically positive, as it will be used and processed to design, improve and provide services to citizens) and secondly, whether or not this information makes the final users involved identifiable. As the data protection regulations rightly point out, there are techniques that make it possible to reduce the risks inherent in the maximum processing of personal data, such as anonymisation and pseudonymisation. However, these techniques should not be confused: while anonymization allows the specific person to be unidentifiable, since the link with the personal data is completely dissociated, pseudonymization does not eliminate this link with the person's data, but rather assigns the user a series of data that do not a priori make him or her identifiable but which, in connection with other data, would allow them to be associated with a specific user.

In particular, what must be borne in mind in relation to the use of Big Data techniques in smart cities is the need to use certain techniques that allow massive data processing to be carried out in a responsible and secure manner, in order to protect the rights and freedoms of the users themselves at all times, who could see their data or personal information being marketed by third party companies for their own benefit, trying to avoid as far as possible for the information collected to be directly identified with each end user. This is why it would be highly recommendable to use anonymisation or, where appropriate, pseudonymisation techniques, which make it impossible to identify the end user of the smart city services and which ensure that the information is only processed in an aggregate and dissociated manner.

Prior to the implementation of a smart city project, in relation to the protection of personal data, an analysis of several issues must be carried out, as provided for in Section 3 Chapter 4 GDPR on 'Data protection impact assessment and prior consultation': (1) the volume of information subject to processing, (2) the number and type of sources to be used to obtain the data or information, and (3) the time of conservation of such information (Article 35 GDPR).

This prior assessment shall include at least a) a systematic description of the envisaged processing operations and the purposes of the processing, including, where applicable, the legitimate interest pursued by the controller; b) an assessment of the necessity and proportionality of the processing operations in relation to the purposes; c) an assessment of the risks to the rights and freedoms of data subjects referred to in paragraph 1; and d) the measures envisaged to address the risks, including safeguards, security measures and mechanisms to ensure the protection of personal data and to demonstrate compliance with this Regulation taking into account the rights and legitimate interests of data subjects and other persons concerned (art. 35.7 GDPR).

In addition, the Data Protection Authority should be consulted, according to Article 36.1 GDPR which provides that the controller "shall consult the supervisory authority prior to processing where a data protection impact assessment under article 35 indicates that the processing would result in a high risk in the absence of measures taken by the controller to mitigate the risk”.

Another consideration prior to the development of smart cities projects is the prior consent of the persons concerned for the collection and processing of data. In this respect, it is important to remember that, as a general rule, Public Administrations do not need the consent of the data owners when they collect the data for the exercise of their own competences, as long as its use is lawful and in accordance with the law and the data to be used is provided. This is a prerogative of the administrations in the generality of the countries of the EU that cannot be applied in a direct way to the operations of commercial exploitation of the personal information, since in this case it is incompatible with the purpose that in principle justified its collection and treatment, although the access to the same ones is considered necessary to be able to develop the concrete project.

In the smart cities, the data processing operations carried out are not simple transfers of data, but rather generalised interconnections between different actors whose fundamental characteristics are their massive and automated nature. As in the smart cities diverse services are integrated and there is a horizontal and not vertical management of the same, which goes beyond each of the services considered separately, this directly affects the principle of quality of the data, according to which the same could not be used for other purposes incompatible with those that justified their collection.

With the exception of what has been said with respect to the data collected and processed by the Public Administrations for the exercise of their powers, the entire system for the protection of personal data is based on the idea that the processing of personal data requires the prior and unequivocal consent of the interested party or owner of the data, since this principle allows the person to exercise effective control over the use of his or her data by third parties. This translates into the requirements set out in the GDPR for the consent of the interested party to allow the processing of his or her personal data: that it be free, specific, informed and unequivocal, and that it be done either by means of a declaration or by means of a clear affirmative action, never in an implicit or supposed manner. Thus, the General Regulations define “consent” of the data subject" (art. 4.11) as “any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her”²².

The GDPR has therefore tightened the requirements for the consent given to be considered valid. Tacit consent is no longer valid, and not only that, when data processing has several different purposes, consent must be given for each and every one of them.Consent, as WG 29²³ has rightly stressed, if properly used, "is a tool which gives the subject control over the processing of his data. If it is used incorrectly, the control of the subject becomes illusory and consent then constitutes an inappropriate basis for the processing of the data".

The inadequacy of privacy policies and the provision of user consent to such policies has become apparent in recent times, considering that the vast majority of users do not even read the terms of privacy policies or if they do read them they do not understand them. For this reason, with the implementation of the principle of transparency, which is set out in article 12 GDPR and plays an important role, the need has been incorporated for a different wording of the privacy policies, which guarantees effective notification, and for the development of mechanisms that allow truly informed consent to be given.

With the introduction of new information technologies such as Big Data, consent is clearly insufficient in itself for the protection of personal data, and it is questionable whether it is truly informed consent and also the principle of data quality, since the data is clearly used for purposes other than those for which it was obtained, as can easily happen in smart city projects. However, as we have stated, the data can be used if, due to anonymisation, they are no longer considered personal data and therefore not subject to data protection regulations (Recital 30 GDPR).

Although solutions have been put forward to the wording of the information to ensure that the consent of users is truly informed consent. We reiterate here that "The operation of new ICTs such as Big Data makes this task extremely difficult, since data move from one place to another, from one recipient to another in an unpredictable manner, and especially because the value that the data may have is not known and cannot be known at the time they are collected, making consent an 'all-inclusive' and distorting or violating other essential principles of data protection such as data quality (DURÁN RUIZ, 2019).

In this sense and in relation to this technology, GIL GONZÁLEZ (2016) points out that "the chain of data senders and receivers is potentially infinite, and includes actors and institutions whose role and responsibilities are not delimited or understood. Thus, the transfer of data can become relatively obscure". It raises the question of whether the obligation of the data controller to inform about the collection of data is limited to the information he explicitly collects, or whether a broader criterion should be adopted and it should be understood that this duty of information also extends to that information that the institution may obtain after processing, as may be the case if the information is reused or transferred for processing by means of Big Data by third parties from data collected by the municipal administration in an smart city.

The majority doctrine is of the opinion that the consent and information provided to the person giving it must also refer to the information that can be extracted from a sophisticated analysis of the personal data, including the information that can be extracted by aggregating that data with other files and sources, and not only to the fact that primary data is collected. However, in practice, because of the very characteristics and nature of technologies such as Big Data, where it is not possible to predict the results or relationships that will be obtained from the data, this solution seems impractical. If the data controller himself cannot know in advance what use, application or results the data obtained will yield, the user cannot be informed in advance of the purpose for which the data are being collected. As GIL GONZÁLEZ (2017) states, "a new difficulty has arisen from the fact that the greatest value of information no longer lies in its primary use, but now lies in its secondary uses, and this affects the core of personal data protection".

This has led experts (GIL GONZÁLEZ, 2017; DURAN RUIZ, 2018b), to suggest that attention cannot be so focused on the moment of giving consent for the processing of data and on the systems for giving true informed consent, but that it must be moved to the moment of actual use of the data, and this must be done in the data collected for processing in the smart cities.

Conclusions

The tendency to concentrate the population in cities makes it essential to have mechanisms and technologies that guarantee the sustainability of urban developments, respect for the environment, the rational use of available resources and the adequate treatment of the waste generated. It is therefore essential to make a decisive and global commitment to smart cities, in order to improve the provision of public services and to face the challenges that, in the medium term, must be faced at world level in the management of urban spaces.

The European Union is trying to be a world reference in smart city projects, and to promote them, firstly is funding initiatives and projects in this field, and secondly is playing the role of harmonising or coordinating the legislation of the Member States and technical standards in order to make this reality. Only with the intervention of the EU will it be possible to create a homogeneous legal and technological framework that will provide a standardised model of smart city throughout its territory. The most direct benefit of this policy is that it creates a large internal market that increases the EU's business attractiveness and this is what the Digital Single Market is aimed at as a parallel EU initiative. The European Reference Framework for the Sustainable City (RFSC) is an example of this initiative.

The legal implications of the implementation of smart cities in the EU are numerous, affecting the regulations on e-government, transparency and the right to access public information, citizen participation and personal data protection. It is clear that if the appropriate guarantees are not fulfilled, the development of smart cities could mean an excessive interference in the privacy and intimacy of its citizens and a form of social control by the Administration, as in the case of China.

Before an smart city project is developed, in relation to the protection of personal data, it must be carried out, as provided for in Section 3 of Chapter 4 of the GDPR on "Data protection impact assessment and prior consultation". In compliance with the GDPR, the development of smart cities projects must be based on the prior consent of the persons concerned for the collection and processing of the data, although, as a general rule, the Public Administrations do not need the consent of the data owners when they collect them for the exercise of their own competences, as long as their use is lawful and in accordance with the law and the data to be used are provided. However, this prerogative has limits and cannot be directly applied to the operations of commercial exploitation of personal information. The nature and operation of Big Data techniques applied to the personal data of citizens that are collected and processed in a smart city, cause the consent as the basis of the treatment to lose sense and therefore it is necessary to change this paradigm, moving the consent to the moment of actual use of the data.

References