Canadian Lawyer

34 J U N E / J U LY 2 0 1 9 w w w . c a n a d i a n l a w y e r m a g . c o m Cavoukian, who leads the Privacy by Design Centre of Excellence at Ryerson University, is adamant that all the data collected through networks of sensors in a connected community needs to be protected. And she draws on a concept of hers called "privacy by design," which aims to embed privacy into the design specifications of the technologies, infrastructure and business practices. She developed this concept during her 17-year tenure as Ontario's privacy commissioner. It's a framework that has since been adopted or referred to internationally. While some smart cities already exist in the world, protection of data often comes as an afterthought. Smart initia- tives in Silicon Valley have been referred to as "surveil- lance capitalism" while the Chinese model is largely considered dystopian. Barcelona implement- ed smart city programs using sensor networks on services such as transpor- tation, energy use, noise levels and irrigation, driv- ing data to the city as well as private sector partners. Finding that the approach compromised individual rights, Barcelona started changing its control of the flow of data. In the interim, the Euro- pean Union introduced new safety and privacy practices through its General Data Protection Regulation, further restricting how data is used, which resulted in the implementation of more protections in Barcelona. Last summer, the European Commission highlighted concerns in its study, "Reclaiming the Smart City — Personal data, Trust and the New Commons." It identified risks to privacy through large-scale surveillance of citizens, where people have few opportunities to say how their personal data is collected and municipalities face many uncertainties in this new information age. The study then A clear, consistent definition of smart city has been elusive largely because the factors for each project often differ. Open North, a Montreal-based non- profit specializing in open data and civic technology, has launched a year-long collaborative project to best describe it. It concluded that a smart city is where aspects of the community collaborate with public officials to mobilize data and technologies in an ethical, accountable and transparent way to govern the city as a fair, viable and liveable commons and balance economic development, social progress and environmental responsibility. A smart city, it determined, includes five characteristics: • There is governance of social and technical platforms, which includes data, algorithms, skills, infrastructure and knowledge; • It is participatory, collaborative and responsive; • It uses data and technologies that are fit for purpose, can be repaired and queried, its source code is open, adheres to open standards, is interoperable, durable, secure and, where possible, locally procured and scalable; • Custody and control over data generated by smart technologies is held and exercised in the public interest; • The right to disconnect and the right to be anonymous in a connected city is recognized. WHAT IS A SMART CITY demonstrated some policy changes that some communities made to address these issues. There are examples closer to home of how protecting data is sometimes forgotten in the rush to take advantage of new technologies. Last year, after Infrastructure Canada issued its Smart Cities Challenge dangling $50 million in financing for the winning project, the federal and provincial privacy commissioners wrote a joint letter to the feds pointing out the impor- tance of privacy in this area, adding that some smart cities projects have failed "in part because of their impact on privacy rights or because the public trust in the systems was lacking" and urged that privacy be a major consid- eration through a threat risk assess- ment. A privacy impact assessment and consultation with local privacy c o m m i s s i o n e r s was then made a requirement for the five finalists of the Infrastructure Canada initiative. Planning of the Toronto project through Alphabet, Google's parent company, is taking place, while cities around the world address data protection and governance. Cavoukian sees it as an opportunity to provide an example to the rest of the world of how to properly address issues related to privacy by de-identifying information and scrubbing it at source. But she says she was disappointed through her first attempt as an advisor to Sidewalk Labs when Alphabet decided to create a civic data trust that would only encourage and not enforce the practice of privacy by design. She then quit as its privacy advisor. "We could do privacy and smart city. . . . And now it wasn't going to happen," she says. Then she was approached by Waterfront Toronto. The governing body of the Quayside "In most cases, our cities are just becoming smart by increments. All of our cities have smart technologies that they're currently using; they just haven't got the whole city wired from the ground up." Teresa Scassa, University of Ottawa

• Cover