Smart City Data Governance

2. Governing data in smart cities – A review of experiences

Abstract

Creating effective data governance strategies, policies and frameworks to drive data quality while preserving security and privacy in a transparency framework is key to developing (smart) cities. Thus, this chapter provides an overview of the international practice in data governance to guide public sector efforts at the national and local levels in making more efficient use of data. It first discusses the importance of a strategy, reviews the strategies to enhance trust and examines the efforts to set data standards. It then takes up the issues of co-ordination for data sharing. It concludes with the case of data governance in smart mobility.

Introduction

As discussed in Chapter 1, smart cities hold the promise of helping cities boost economic growth and resilience and reduce costs while enhancing sustainability, improving public services and quality of life, and increasing citizens’ engagement in a pragmatic, apolitical manner by using data-driven solutions. Data are the foundation of the digital society and play a critical role in the development of smart cities. Cities are facing increasing opportunities to leverage data and digital technologies to improve public services and resident well-being. However, cities must balance their data needs with concerns about privacy and data use. It is, therefore, critical to set robust data governance arrangements to manage and use the data that smart cities generate. Data governance understood as the “…diverse arrangements, including technical, policy, regulatory and institutional provisions, that affect data and their creation, collection, storage, use, protection, access, sharing and deletion, including across policy domains and organisational and national borders” (OECD, 2022, p. 13[1]) The relevance of data governance rests in that it provides the rules and parameters that govern data collection efforts aimed at producing more efficient interactions between city governments, their partners and citizens (Johnson et al., 2022[2]). If used and managed properly, data can help make smarter decisions, automate and accelerate processes, and improve communication between government, private companies and citizens.

According to international experience, how smart a city becomes, how fast and at what ratio of costs to benefits largely depends on how well public and private actors work together to govern and manage the data on which smart cities are built. Failing to govern and manage data responsibly and efficiently may hamper cities’ competitiveness and productivity, and may damage citizens’ trust in the government’s capacity to manage data and meet their needs.

This chapter explores international experiences of good practices in terms of governing data in the context of smart cities, both at the national and subnational levels. It starts with a discussion on the importance of data governance and the different elements that have an impact on it, such as trust, transparency and data security. The chapter then turns to different practices to ensure data interoperability. It concludes with the case of data governance in smart mobility as an integral part of smart cities.

Building a data governance structure for smart cities

Effective data governance involves developing and implementing the foundational frameworks in terms of institutions, roles, rules, processes and technical structures to ensure that data access and sharing are reliable, trustworthy and deliver value (OECD, 2019[3]). It is also critical to ensure that sensitive data are protected while non-personal datasets are shared or opened for reuse within the limitations of available legislation and rules (OECD, 2019[3]). The governance of data sharing must address the overlapping purposes and needs that a wide range of stakeholders may have and ensure they abide by data sharing rules. For this purpose, local governments should develop frameworks that enable targeted data sharing that respects privacy and commercial sensitivities of people and companies, and meets operational needs. New regulations demanding stricter data control and the understanding of the risk of not complying with those new requirements to protect data have reinforced the need for more capacity and capability to manage data (Algmin and Zaino, 2018[4]). Data governance is one of the key factors for enhancing the regulatory capabilities of subnational governments, unlocking market opportunities for private enterprises and improving citizens’ capacity for participation in decision-making processes (Franke and Gailhofer, 2021[5]).

As Chapter 1 highlighted, countries tend to adopt a general smart city national framework (SCNF) that guides the building and implementation of smart city projects and the provision of better services. At least three critical points can be stressed from international experience: i) the relevance attached to linkages across data from different sectors and regions; ii) the need to ensure privacy and protection of personal data; and iii) the need to ensure interoperability of data platforms. To be effective, these elements need a governance structure that facilitates co-operation across levels of government, among cities and across policy sectors, involving a wide number of stakeholders from the public and private sectors and citizens.

Smart cities should use data purposefully through a tailored strategy

The experience of OECD countries suggests that data governance and management in smart cities must enable society to turn data into benefits while ensuring public support. According to the OECD, establishing a clear vision and strategy for data is an important element of data governance (OECD, 2019[3]), which can also be applied to the city level. Existing national-level data strategies may also explicitly or implicitly support smart city data governance, as is the case with the National Data Strategy of Japan (Box 2.1). The experience of Germany and the Netherlands suggests that before designing a platform, coding algorithms and acquiring and deploying digital technologies, national and local governments need to identify the challenges first and consider the value creation and broader outcomes of possible solutions. Those solutions should be tailored to the city’s unique context and its specific social and cultural needs. Sometimes, solving a city’s challenges does not require large investments in technology.

While cities aiming to make progress on digitalisation and become a smart city also develop their own data strategy, a national model or guideline can be a reference for local governments to tailor their own strategy in the framework of their smart city plans. For example, in Mexico’s robust national statistical system, there are many opportunities to reinforce support and capacity building to local governments. However, in the absence of a national data strategy, there is a lack of concrete guidance on how the National System of Statistical and Geographical Information (SNIEG) should interact with local statistical systems, as well as on knowledge-sharing modalities between the Mexican National Institute of Statistics and Geography (INEGI) and chief data officers or CDOs (or equivalent) at the state or municipal levels (Marks, 2022[6]). Establishing a process of sustained knowledge sharing between state and municipality data officers and INEGI could foster a greater understanding of the use of data. It would inform better decision making at the local level and improve the production and data dissemination processes that support policy making and decision making at the subnational level.

National statistics offices (NSOs) lead data governance and data management within central governments and at the national scale. In some cases, NSOs may start discussions within the national government on the legal system required to enable the collection, processing, sharing and storing of data. NSOs have an advisory or leadership role in the elaboration of national data strategies and work closely with the international community in sharing experiences and good practices on data governance. Critically, NSOs have the necessary experience and expertise to advise other levels of government on ensuring data quality and complying with data management regulations. An important aspect is to develop analytical capabilities in areas such as data literacy, science and engineering across national government to ensure effective data management and support subnational governments in upgrading their data management capability.

Box 2.1. Japan’s National Data Strategy

In 2020, Japan released a data strategy that proposed a basic structure of national strategy and is also intended to support data governance at the local level. The National Data Strategy is the basic policy tool to achieve the objectives of Society 5.0,1 which sets Japan’s future vision to build a citizen-centric society with efficiency and trust where anyone can access data easily, start a business quickly and use high-quality services. Data will emanate from base registries (e.g. legal entities, land), high-value datasets (e.g. public administration data), statistics and real-time sensor data (e.g. traffic and weather). Data will be available on a platform as open data and data from the private sector.

The Smart City Reference Architecture of the strategy regards data as one of the key components of smart cities and thus aims to use different types of data jointly to create new value. Data are to be fused in the Government Interoperability Framework. For example, the government expects to combine data on land, topography, nature and weather, transportation, traffic and operations, building and infrastructure, and area services (i.e. city services, events, etc.) to manage disaster risk.

Table 2.1. Principles of Japan’s National Data Strategy – Data use

Control your data yourself	Connect	Use anytime, anywhere	Safe	Create together
Controllability Privacy	Interoperability Efficiency	Availability Quickness Cross-border	Security Trust Quality	Co-creation Creation of new value

Source: Government of Japan (2021[7]), National Data Strategy, https://www.digital.go.jp/assets/contents/node/basic_page/field_ref_resources/0f321c23-517f-439e-9076-5804f0a24b59/20210901_en_05.pdf

Table 2.2. Principles of Japan’s National Data Strategy – Administrative action

Evidence-based administration	Data ecosystem	Maximising data value
Priority area identification Business transformation Data management and open data Cultural change	Data engineering for data ecosystems Data standards Data quality management List of data assets in the administration	Rule management for data access Channel management for the various data access Open data

Source: Government of Japan (2021[7]), National Data Strategy, https://www.digital.go.jp/assets/contents/node/basic_page/field_ref_resources/0f321c23-517f-439e-9076-5804f0a24b59/20210901_en_05.pdf

Japan’s National Data Strategy promotes smart city governance trying to ensure that local-level governments follow a common architecture and data standards. It also offers the basis to use data to promote trust and achieve Society 5.0 overarching goals. A particular challenge to be addressed is to foster cross-domain data use as, in most cases, data are collected, analysed and used in silos. This means that the administrative departments of national and local governments produce large amounts of data but their benefit is limited as they are not shared nor used to their full potential.

Source: Hiramoto, K. (2022[8]), “Smart cities in Japan”, PowerPoint presentation given to the OECD team, Tokyo.

Local data strategies are a prerequisite for exploiting the potential value of data produced by the city for the benefit of its residents, businesses and academia. It should include all necessary measures to provide reliable data of the required quality in a timely manner. The city of Vienna’s Data Excellence Strategy, for example, takes a human-centric approach to managing data and digital technologies, placing residents’ well-being at the centre of decision making (Box 2.2).

Local data strategies must be tailored to the needs of each urban society. According to the experience of Germany, those strategies need to be understood and used as a tool to achieve local urban development goals and evolve continually and dynamically based on the needs and priorities of each city or community (BBSR, 2021[9]). For that purpose, all levels of government need to join forces purposefully for the use of data to achieve integrated and sustainable urban development.

Box 2.2. Vienna’s Digital Excellence Strategy – Key aspects

The city of Vienna’s Data Excellence Strategy intends to include all of the necessary measures that guarantee a timely provision of reliable, high-quality data to make the city a “data excellent” Data Capital City. It is based on three key elements:

• Data governance. The basis for company-wide co-ordinated data management, through rules, organisation and processes and the people involved at the professional and technical level.

• Data quality management. Refers to all quality-oriented organisational, methodological, conceptual and technical measures to manage data considered as an asset.

• Enterprise data management. Based on the city of Vienna’s information and communication technology (ICT) strategy, the local government intends to use the city’s modern and comprehensive enterprise data management to make innovative use of its data.

These principles intend to ensure that data are usable in key figures and data usages (reports, dashboards, open data). The experience of the city of Vienna suggests that it is essential to ensure a clean data landscape to ensure that the city management can retrieve evaluations based on quality-checked data at any given time and make informed decisions.

To ensure data quality, the city has defined performance indicators to assess and communicate progress. For a legally compliant use of data and the corresponding access rules, it is essential to classify data and to know which entity has the data responsibility. A data catalogue contains relevant information for all stakeholders.

Source: Information provided by the city of Vienna to the OECD Secretariat for this report. Further information can be found at https://digitales.wien.gv.at/en/data-excellence-strategy-of-the-city-of-vienna/.

Like Japan, the United Kingdom has adopted a National Data Strategy that may help strengthen data governance for smart cities. This strategy, issued in 2020, intends to facilitate the access, use and reuse of data to a wide range of stakeholders (Box 2.3). It leveraged the benefits and power of data to respond to the COVID-19 pandemic. A lesson from the United Kingdom (UK) experience that is relevant for the development of smart cities is that a data strategy should leverage existing digital strengths and installed digital capacity (infrastructure and organisational) to promote better use of data across businesses, government, civil society and individuals.

Moreover, the UK national experience suggests that for developing smart cities and setting a local data governance structure, a data strategy requires activity and focus beyond government. Working with local stakeholders to define how the city, businesses and other actors will co-operate across the wider data landscape is critical to ensure the functioning of smart cities.

Involving citizens from the early stages of data projects is also essential. Countries and cities use different mechanisms for this. For example, in the city of London, United Kingdom, the borough of Camden organised a citizens’ consultation where the government provided different scenarios on how the borough could use its data and asked how they felt about sharing their data in each one. The results provided them with the relevant information to design a more socially acceptable scenario, where people would be willing to share their data. Other options for cities can be to use a citizens’ jury methodology to develop a citizen’s charter and a data ethics board to get external advisers to ask the right questions on data sharing and protection.

Box 2.3. The UK National Data Strategy

In 2020, the UK government issued a National Data Strategy that sets out how best to unlock the power of data. It defines core pillars and priority areas that could be used for the development of smart cities as a guiding framework. Data are expected to: boost productivity and trade; support new businesses and jobs; increase the speed, efficiency and scope of scientific research; drive better delivery of policy and public services; and create a fairer society for all.

To address the interconnected issues that currently prevent the best use of data, the strategy adopts four core pillars:

• Data foundations: To make data fit for purpose, they need to be recorded in standardised formats on modern, future-proof systems and held in a condition that means they are findable, accessible, interoperable and reusable. Ensuring high-quality data can lead to more effective use and drive better insights and outcomes.

• Data skills: A wealth of data skills is key to making the best use of data. That means delivering the right skills through the education system but also ensuring that people can continue to develop the data skills they need throughout their lives.

• Data availability: For data to have the most effective impact, it needs to be appropriately accessible, mobile and reusable. For this, it is necessary to ensure better co-ordination, access to and sharing of data of appropriate quality between organisations in the public, private and third sectors.

• Responsible data: As the use of data grows, it is essential to ensure it is used in a way that is lawful, secure, fair, ethical, sustainable and accountable, while also supporting innovation and research.

The strategy identifies five priority areas of action, called missions, to ensure better use of data:

• Unlocking the value of data across the economy – Setting the correct conditions to make data usable, accessible and available across the economy while protecting people’s data rights and private enterprises’ intellectual property.

• Securing a pro-growth and trusted data regime – Building a data regime that is not too burdensome for the average enterprise to use data.

• Transforming the government’s use of data to drive efficiency and improve public services – Adopting a whole-of-government approach that ensures alignment around the best practice and standards needed to drive value and insights from data; and the creation of an appropriately safeguarded, joined-up and interoperable data infrastructure to support this.

• Ensuring the security and resilience of the infrastructure on which data relies – Ensuring that data and its supporting infrastructure are resilient in the face of established, new and emerging risks, protecting the economy as it grows.

• Championing the international flow of data – Promoting domestic best practices and work with international partners to ensure data are not inappropriately constrained by national borders and fragmented regulatory regimes to use them to their full potential.

Source: UK Government (2020[10]), National Data Strategy, https://www.gov.uk/government/publications/uk-national-data-strategy/national-data-strategy#data-1-2.

Strategic leadership at the local level is needed to guide the implementation of data governance in smart cities

Leadership on digitalisation and data management at the national and local levels is essential as it provides a body with official explicit responsibility for co‑ordinating smart city and data management efforts, including in terms of policy definition, implementation and co‑ordination.

OECD research shows that data-driven transformation requires more than technical skills, with countries such as France, Korea, New Zealand, the United Kingdom and the United States having attributed data leadership/stewardship to CDOs or bodies to support data governance at the strategic level (OECD, 2019[3]) (Box 2.4).

Box 2.4. Examples of chief data officers/stewards at the national level in Japan, New Zealand and the United States

In Japan, the National Data Strategy specifies that the Head of Data Strategy is appointed as the CDO of the Digital Agency, responsible for implementing the strategy and accelerating the digitalisation process of the national government. The CDO will co-ordinate the work of and collaborate with the CDOs appointed in every sectoral ministry.

In New Zealand, the Government Chief Data Steward (GCDS) supports the use of data as a resource across the government to help deliver better services. The GCDS leads by facilitating and enabling a joined-up approach across government and develops policy and infrastructure while providing support and guidance so agencies can use data effectively. Moreover, the GCDS: sets the strategic direction for the government’s data management; leads the government’s response to new and emerging data issues; co-develops a Data Stewardship Framework to enable agencies to manage data as a strategic asset and benchmark their data maturity; and leads the government’s commitment to accelerating the release of open data.

In the United States, the responsibilities of the CDOs are defined in the Open, Public, Electronic and Necessary Government Data Act. Some of the responsibilities include: being in charge of lifecycle data management; co-ordinating with any official in the agency responsible for using, protecting, disseminating and generating data to ensure that the data needs of the agency are met; managing data assets of the agency, including the standardisation of data format, sharing of data assets and publication of data assets in accordance with applicable law; ensuring that, to the extent practicable, agency data conform with data management best practices; engaging agency employees, the public and contractors in using public data assets and encouraging collaborative approaches on improving data use.

Source: Government of Japan (2021[7]), National Data Strategy, https://www.digital.go.jp/assets/contents/node/basic_page/field_ref_resources/0f321c23-517f-439e-9076-5804f0a24b59/20210901_en_05.pdf; Government of New Zealand (n.d.[11]), Government Chief Data Steward (GCDS), https://www.data.govt.nz/leadership/gcds/; United States Congress (2017[12]), H.R.4174 - Foundations for Evidence-Based Policymaking Act of 2018, https://www.congress.gov/bill/115th-congress/house-bill/4174/text.

At the subnational level, cities are also appointing officials to lead data and smart city strategies, i.e. local CDOs. They are in charge of the implementation of their respective initiatives for the management of data but this depends on the capacity of the local government, in particular municipalities, as they may not always have the staff with the right competencies and skills. Cities such as Barcelona and Bilbao (Spain), London (United Kingdom), Los Angeles and New York (United States), Paris (France), Reykjavík (Iceland) and Vienna (Austria) have created the city-level CDO.

In general, a local-level CDO requires both specific technical capabilities (e.g. cloud computing, data science analytics and data management, data collection and production processes, etc) and communications and interpersonal skills. Local CDOs need to be able to have an influence across organisational boundaries to improve data interoperability, for example, and to lead collaborations with a wide range of stakeholders (e.g. academia, private sector and citizens) (Marks, 2022[6]). Being able to engage with local civil society is of critical importance as CDOs need to demonstrate the value of sharing data and reassure them of data safety. Local CDOs need to have the ability to break down silos and explain the benefits of sharing data and open datasets (Marks, 2022[6]). This is a message that local CDOs should convey not only to the officials but to publicly elected officials. Working with the local private sector and encouraging them to share data is also a critical task. Local CDOs need to demonstrate the benefits of pulling data together from different public and private sources. In Barcelona, Bilbao and Sydney (Australia), the CDO (or equivalent) helps scale and sustain the implementation of their data strategies. The OECD (2019[3]) noted that it is important that countries do not misunderstand the role of the data leader and confine it to the information technology (IT) department when the role should be more strategic in achieving policy goals through better data management and sharing practices. Moreover, through existing research at the national level, the OECD has observed that “[p]ublic policies tend to overlook the benefits of data governance. There is a need for promoting data governance as a sublayer of policy arrangements. This can help to extract value from data for successful policy” (OECD, 2019, p. 27[3]). However, while there seems to be an acknowledgement of the importance of data for national and subnational governments (e.g. Barcelona, Bilbao, Bogotá, London, New York, Tokyo), research suggests that the private sector also considers data as a critical asset to achieve companies’ core objectives but that this does not always translate into actions that make data deliver real advantages (Algmin and Zaino, 2018[4]). This could be to the detriment of smart city projects as private companies tend to lead such initiatives and collect large amounts of data. Although data are considered a valuable asset by the public and private sectors, it does not mean that partners in smart city strategies should gather more and more data and apply them indiscriminately. Instead, leadership is required to manage and be intentional in how data create value.

Having adequate institutional arrangements for the implementation of the smart city and data strategies is critical for data-driven cities. In Japan, for example, three central bodies are responsible for implementing digital and data strategies as well as providing guidance for the development of smart cities across the country (Box 2.5). At the local level, the city of Vienna provides an example of a data excellence organisation to implement the data strategy. To ensure the efficient and effective use of data, the government of the city of Vienna seeks to master the data lifecycle in all areas of administration, minimising the effort and generating the greatest possible added value through data. As Figure 2.1 suggests, the responsibility for this does not only lie in the IT department but in all departments. The local government has set up a data excellence organisation and defined specific roles such as data stewards, experts and users in the departments.

Box 2.5. Leadership for smart city data governance in Japan

Japan’s Cabinet Office defines policy and priorities for the national-level government. It is in charge of policy planning and comprehensive policy co-ordination. It is composed of all ministries of the central government and supervises the work of the Digital Agency as well as the Reconstruction Agency. The Cabinet Office is responsible for the preparation of the Basic Plan for the Advancement of Public and Private Sector Data Utilization and for ensuring the necessary financial resources for its implementation.

The Council for Science, Technology and Innovation in the Cabinet Office leads a Smart City team composed of representatives of the Regional Revitalisation Office in the Cabinet Office and the Digital Agency, as well as the Ministries of Land, Infrastructure, Transport and Tourism (MLIT), of Internal Affairs and Communications, of Economy, Trade and Industry and of the Environment.

In 2021, the central government created the Digital Agency to lead Japan’s efforts on digitalisation. The Digital Agency is in charge of co-ordination for the implementation of the National Data Strategy and can make recommendations to other ministries and agencies at the central level of government. Its policy priorities include making online public services more user-friendly, implementing the National Data Strategy, building digital capabilities through training and education, conducting a regulatory reform to facilitate the use of new technologies, ensuring safety and security, promoting research and demonstration of digital innovations, and examining and evaluating digital programmes. Its mission, vision and values reflect a focus on human-friendly digitalisation.

MLIT also has a critical role to play in the implementation of the data strategy through the smart city initiatives. MLIT is responsible for the comprehensive and systematic use, development and conservation of the land, promotion of transportation policies, development of infrastructure, implementation of tourism policy and development and implementation of urban policy. It has a City Bureau that oversees works on urban renewal, urban planning, urban development and urban transport facilities.2 As part of its work on urban policy, MLIT promotes urban renovation and compact, low-carbon cities.3 Smart cities and digitalisation play a critical part in MLIT’s work as it contributes to the national efforts to tackle depopulation and an ageing society and the achievement of the Society 5.0 vision.

Source: Government of Japan (n.d.[13]), About the Cabinet Office, https://www.cao.go.jp/en/about.html; Government of Japan (n.d.[14]), About Digital Agency, https://www.digital.go.jp/en/about-en/#mvv; MLIT (n.d.[15]), Homepage, https://www.mlit.go.jp/en/ (accessed on 27 September 2022).

Figure 2.1. Organisation of the city of Vienna for the implementation of the Data Excellence Strategy

Source: Information provided by the city of Vienna to the OECD Secretariat for this report.

Data strategies would benefit from incorporating the development of smart cities as a tool to achieve broader urban development goals

In some countries, data strategies make an explicit case for the development of smart cities to deal with national challenges such as demographic shifts, climate change, inequality and access to services. For example, India and Japan promote the use of data to inform policy decision making and boost innovation in service creation and delivery. In Japan, the government is boosting digitalisation to cope with the challenges of providing better services at higher levels of efficiency to an ageing and shrinking population and in turn boosting economic growth and competitiveness. The Smart City Reference Architecture advocates the use of smart city data for informed decision making. The National Data Strategy promotes an evidence-based administration that manages open data across all levels of government.

However, unlike Japan, India is using smart cities and data strategies to deal with the effects of a growing population and urbanisation that is placing a significant burden on civic infrastructure and services like sanitation, water, sewerage, housing, electricity and public transport. Like Japan, India launched a National Data Strategy focused on the development of DataSmart Cities. India aims to create data to ensure a move towards outcome-based planning in governance and build data-enabled cities (Box 2.6). India’s strategy highlights that the power of data science and geographical information systems can be harnessed to exchange ideas, solutions and workforce across the country to fix local challenges (Government of India, n.d.[16]). The DataSmart Cities strategy intends to institutionalise a culture of data by putting in place formal mechanisms for data collection, management and use. For the government of India, there is a need for building on the “city-as-a-platform” concept that recognises the value of enhancing engagement among government, citizens, academia and industry, along with improvements in the internal workflow and decision-making processes of city governments. Equally, India’s strategy promotes the development of a data maturity assessment framework, which is absent in the Japanese strategy.

Box 2.6. India’s DataSmart Cities strategy to enable smart city data governance

India’s federal government has developed its DataSmart Cities policy framework to help enable smart city data governance to solve complex urban challenges. It was developed with the assistance of city officials, academics and private sector leaders. It is based on the 2015 Smart Cities Mission that paved the way towards transforming urban management with the power of digital technologies. For the government, making cities DataSmart is essential to realise the full potential of technology interventions and innovation ecosystems in cities. DataSmart Cities are defined as those that have successfully integrated a culture of data awareness and data usage in its functioning. The expected outcome is to bring greater efficiency, accountability and transparency in city governance decisions while fostering civic engagement, co-creation and innovation in problem solving.

There are three foundational pillars of DataSmart Cities that are expected to support the creation of an open data culture, leading to greater data exchange for open innovation and co-creation:

• People – which refers to well-capacitated institutional structures across all tiers of governance along with the formation of networks and alliances. This includes the identification of responsibilities and actors for implementing the principles of data governance. The idea is to encourage cities to think through the “what” and “who” of an institutional mechanism.

• Process – which refers to process enablers, such as policies and standards. This intends to address the challenges of privacy, security, rightful use and potential bias through the creation of an appropriate policy along with regulatory and institutional instruments at the city level.

• Platform – which refers to technology platforms to support the implementation of policy intents. This builds on the guiding principles and architectural blueprint of the National Urban Innovation Stack. The objective is to guide cities in the adoption of open data platforms, along with a roadmap for evolution to a mature data marketplace.

The Ministry of Housing and Urban Affairs has also launched an open data platform to serve as a single source of open datasets from multiple cities and government agencies. The platform already contains around 3 566 catalogues with more than 5 135 sources of data and 242 application programming interfaces (APIs), with information from 100 smart cities. Every participating city must appoint a city data officer to facilitate data sharing and exchange through the platform. The goal is to unlock the potential of open data, open innovation and co-creation.

The DataSmart Cities strategy also lays down the foundations of a data maturity assessment framework to be implemented through self-assessment. The objective is to encourage cities to assess their readiness against the three foundational pillars while combining the dual objective of robust processes and intended outcomes.

Source: Government of India (n.d.[16]), DataSmart Cities: Empowering Cities Through Data, https://smartcities.data.gov.in/sites/default/files/DataSmart_Cities_Strategy_Print.pdf; Government of India (n.d.[17]), Open Data Platform: India Smart Cities, https://smartcities.data.gov.in/.

At the local level, the city of Vienna’s Data Excellence Strategy aims to deal with the challenges encountered in the data lifecycle, such as data silos and redundant data, manage multiple data acquisitions and unclear data distribution of responsibility and elaborate evaluations and time-consuming reporting. Local authorities in Vienna intend to use data as the foundation for information and knowledge and the construction of the future digital twin4 of the city. Vienna’s future digital twin is expected to assist in monitoring existing processes in the city, generating new data, simulating planning in different scenarios and making better decisions based on data, offering high added value for internal tasks and co‑operation with residents, businesses and the academic community.

Cities’ data strategies should provide a methodology for data collection, defining the scope and purpose

Developing a data strategy aims to reflect real-life problems and how the strategy could help tackle and prevent them through data collection and use. In other words, while data sharing on the part of public authorities should build in minimising data requests, data collection and sharing are, in some cases, weakly linked to desired policy outcomes at the city level (e.g. improved environmental outcomes, liveable cities, etc.). In Japan, for example, the National Data Strategy does not stress or provide guidance to cities on how outcomes and methods of data collection and management should be better linked to conduct regulatory and planning actions, including the appropriate level of aggregation, data handling, data retention periods, auditability, etc. The strategy focuses largely on the methods and the need to enhance capacity but lacks an outcome-based assessment.

Regional (e.g. New South Wales [NSW], Australia; Hamburg, Germany) and local (e.g. London, United Kingdom) experience suggest that it is critical to focus on outcomes for citizens by putting data at the core of decision-making processes. This requires a collaborative, co-ordinated, consistent and safe approach to using and sharing data. The relevance of the NSW Government Data Strategy is that it embeds the data practices that delivered valuable data and insights during the COVID-19 pandemic (Box 2.7). It was developed through a cluster of collaboration of CDOs from different departments. However, the implementation of the strategy requires a regulatory reform to strengthen data-sharing laws to facilitate the work of agencies in the creation of high-value datasets. For example, the review of the Data Sharing (Government Sector) Act revealed the need to provide “legislative teeth” to the Data Analytics Centre to meet its full potential and provide actionable insights.5 Similar to the case in Japan, the NSW Government needs to streamline how the data-sharing legislation works, particularly when it intersects with other privacy legislation. A lesson from this experience is that a data strategy should be accompanied by a revision and amendment of the regulatory framework to facilitate the operationalisation of the strategy.

Box 2.7. NSW Government Data Strategy

In 2021, the NSW government in Australia published its new Data Strategy. The strategy aims to harness the power of data to execute the government’s policy priorities, respond to emerging issues and deliver better services to the public while maintaining privacy, security and ethical standards. It is built around four complementary themes:

• Accelerating actionable insights: This involves increasing the speed at which data can be translated into actionable insights to guide government decision making, including in emergency situations. To ensure insights are actionable, the government links them to strategic priorities aimed at improving community outcomes.

• Treat data as an asset: This is done by: aligning standards and practices to increase the visibility, usability and value of data; identifying the data that matters for delivering better customer outcomes, governing and managing it effectively across the data lifecycle; and using and sharing it across government and as open data to generate insights that support decision making and innovation.

• Strengthen transparency and trust: This involves maintaining privacy, ethical and security standards, taking a “by design” approach to data projects and consolidating whole-of-government data policies to accelerate the safe use and sharing of data across the government.

• Foster culture, leadership and capability: This involves ensuring that government employees understand the importance of using data to inform decisions that impact the community and that they have the skills needed to use data effectively and safely in their role. Fostering strong data leadership through the CDOs (and appointing a CDO in departments that do not have one) and the NSW Data Leadership Group (NDLG).

Each theme is supported by a set of principles and sector-wide actions.

Source: NSW Government (2021[18]), NSW Government Data Strategy, https://data.nsw.gov.au/sites/default/files/inline-files/NSW%20Government%20Data%20Strategy_0.pdf.

Although some data strategies have a complex structure, including the adoption of technical standards and common approaches while unlocking the value of cities working together to gather, analyse and act upon their data, many of them lack a clear methodology on how this data collection should be done. Poor problem definition can lead to data being analysed in a way that does not add value and therefore diverts time and resources. The experience of London, United Kingdom, shows that it is important to have not only standards for data quality but also a clear methodology for data collection and analysis. The London Office of Technology and Innovation (LOTI) has developed a methodology that intends to prevent organisations from wasting time collecting data that they may not even need, as it adds no extra value to their decision making and does not enable new actions (Box 2.8). All smart city stakeholders need to know: what is being gathered; who is collecting it; and the purpose behind any generation, collection, storage or sharing of data. Moreover, when it comes to sharing data, it is essential to be clear about the exact uses to which the data will be put to facilitate access to information. Local governments need to understand that they should be the primary users of the data they produce. They have access to an enormous amount of data but figuring out the uses of existing data and identifying data gaps is a step that many governments tend to miss. The LOTI methodology recognises that while digital technologies and data provide a powerful set of tools and approaches with which to innovate, they are rarely the whole solution. Therefore, it is essential to work with different teams to understand the real nature of the challenges to be addressed and how they can be solved. A recurrent challenge is that through smart city initiatives, governments are producing data that sometimes no one knows how to use.

Box 2.8. London’s outcome-based methodology for data projects

The London Office of Technology and Information (LOTI) suggests that local governments should try to use the data they have and see if that helps to tackle real problems rather than spending time and resources designing systems and collecting data that add no value. A critical issue for London is not to be driven by data but to be enabled by data to make better decisions and design public policies not based on the available data but on outcomes. For this purpose, LOTI has created an outcome-based methodology that focuses on how data leads to action.

The methodology has six critical stages that are designed to pin down exactly what datasets are actually needed and why, making the information governance aspects of data sharing more achievable:

• Outcomes – what are the desired outcomes? – The process begins with thinking about the target population, the change that needs to be seen and the specific ways local authorities can help them improve their situation.

• Actions – what is the intervention? – This refers to who and what can do certain things differently if they had better information.

• Insights – what is the data product? – This considers what needs to be seen on a screen to enable the actions to achieve the desired outcomes.

• Data – what data are required to create those insights? – This refers to considering if existing data can be used, whether other public or privately owned data can be accessed and used, and whether new technology is needed to generate the data.

• Ethics – is access and use of the data legal and ethical? – This considers whether the project is worthy of citizens’ trust, its potential limitations and unintended negative impacts of acting on this data, and whether action should be taken even if it is possible.

• Enablers – what other enablers need to be present? – This refers to other issues that need to be considered beyond data to achieve the desired outcome. Data alone are very rarely enough to be the solution by themselves.

Source: LOTI (n.d.[19]), LOTI Outcomes-based Methodology for Data Projects, https://loti.london/resources/data-methodology/; interview with Eddie Copeland, Director of LOTI, 4 May 2022.

The city of Columbus, United States, developed a smart city initiative that provides an example of the need to define the scope and purpose of data collection through smart city technologies (Box 2.9). Explaining what data will be collected and why is a critical element for creating support and buy-in for any smart city project and building trust. Transparency on what data are being collected and the reasons for that could be considered part of a change management or implementation strategy. It is important that smart cities provide this information from the outset and not wait until public groups request details on data collection and use.

The Smart Columbus initiative came to an end in June 2021 and the city government has continued the project as a “collaborative innovation lab”. After almost five years, according to city authorities, the Smart Columbus programme was found to have successfully or partially achieved 22 of the 29 objectives identified and created 4 220 jobs (719 direct jobs from programme-related staffing expenditures) (City of Columbus, 2021[20]). A majority of the eight projects have continued in some form. Even for projects that were not continued, the knowledge and lessons learnt have helped increase awareness of emerging technologies and their benefits to all residents in Columbus. The case of Columbus shows that managing stakeholder expectations and understanding the importance of communications is key to a city’s ability to mitigate risk and improve both awareness and technology adoption.

Box 2.9. Data governance components of the Columbus smart city initiative

In 2016, the U.S. Department of Transportation (DOT) awarded USD 40 million to the city of Columbus, Ohio as the winner of the Smart City Challenge. The funding was used to address the most pressing community transportation problems of the city through the use of digital technologies, applications and services to bridge social and technical gaps and meet the needs of residents of all ages and abilities.

With the resources, the city established the strategic Smart Columbus programme organised into three focus areas: enabling technologies, emerging technologies and enhanced human services. The programme included eight projects ranging from the development of a connected vehicle environment and smart mobility hubs to prenatal trip assistance and connected electric autonomous vehicles. The Smart Columbus Operating System was the core of the programme. It was designed and built to collect data from a variety of inputs, including public, non-profit, education-based and private sector contributors from different systems, devices and people. Data are made available for analytics, visualisation and artificial intelligence (AI) required by various smart city applications. The operating system is a platform designed for big data, analytics and complex data exchange. It captures the data and provides a means for multitenant access to aggregate, fuse and consume data. The operating system is scalable and can continue serving the city and private sector needs well beyond the life of the Smart City Challenge award period. At the end of 2021, when the programme ended, the operating system had collected more than 3 000 datasets in a wide number of areas, such as traffic, city infrastructure inventory, emergency response time, etc.

As part of the Smart City programme, the city government created a comprehensive project management plan that defined the principles and procedures for how the programme had to be managed to ensure delivery within the agreed scope, schedule and budget. Critically, it clarified the scope and purpose of the data collected by the operating system. The plan stated that the data in the operating system was defined by the data management plan (DMP) and the data privacy plan (DPP), which created the data governance components together.

The DMP documented how the data within the operating system were added, made accessible and/or stored. It also detailed how the data were created, captured, transmitted, maintained, accessed, shared, secured and archived. The DMP provided oversight for all eight Smart Columbus projects and guidance for managing the data within the programme as well as details on how and where data were shared, subject to applicable privacy, security and other safeguards, and how the data were made available to other actors to enable performance measurement and support independent evaluation.

The DPP provided high-level guidance, principles and policies to ensure the privacy of Smart Columbus demonstration data subjects and project participants. It also aimed to protect the operating system against breaches and the access of unauthorised users to personally identifiable information and other data. The DPP includes ten data stewardship principles that all DOT grant-funded Smart Columbus projects must follow. The privacy controls included: notice and consent, data minimisation, transparency, de-identification and data curation. The DPP also included a privacy impact assessment to identify and mitigate privacy risks associated with each Smart Columbus project.

Source: City of Columbus (2020[21]), Data Management Plan for the Smart Columbus Demonstration Program, https://d2rfd3nxvhnf29.cloudfront.net/2020-08/SCC-E-DataManagementPlan-Update-v1.pdf; City of Columbus (2019[22]), Project Management Plan for the Smart Columbus Demonstration Program, https://d2rfd3nxvhnf29.cloudfront.net/2019-08/Smart%20Columbus%20Smart%20City%20Challenge%20Project%20Management%20Plan.pdf; City of Columbus (2020[23]), Data Privacy Plan for the Smart Columbus Demonstration Program, https://d2rfd3nxvhnf29.cloudfront.net/2020-09/SCC-D-DataPrivacyPlan-AnnualUpdate-V2_0.pdf; Johnson, J. et.al. (2022[2]), “Data governance frameworks for Smart Cities: Key considerations for data management and use”, https://repository.law.umich.edu/jlm/vol2022/iss1/1.

A data strategy for smart cities should define the key elements of data governance

In the context of smart cities, a data strategy should set the governance arrangements that will govern how and under what conditions data can be accessed and exchanged, and the responsibilities of those in charge of managing and keeping data and platforms. An example is Colombia’s National Data Infrastructure Plan (PNID), adopted in February 2022 (Box 2.10). It contains elements or features that are worth highlighting due to their contribution to the formation of smart cities in the country and the data governance dialogue. First, the PNID defines the basic elements of the governance of data at the tactical level: rules, attributions, responsibilities and processes that could also be followed in the organisation of smart city projects. Second, it defines the leadership for the strategy implementation. This leadership should not be just a single body or person but a more collaborative body that facilitates the exchange of views and experiences. However, if local governments wish to have a more collaborative model for data management, as Colombia’s PNID suggests, there should be mechanisms or protocols for co-operation among the different local stakeholders. Third, probably the most critical part of the PNID, the technical level, is that it promotes the articulation of the data infrastructure with other data-related systems in the country, such as the national statistics system, the digital security and privacy of information, and the tools and technologies that facilitate interoperability. The message for local governments is that the smart city project must be connected to the regional or local statistics office, as is done in Bilbao, Spain. It is worth pointing out that Colombia’s PNID is not explicitly linked to urban development as is India’s DataSmart Cities strategy but provides the basic framework for the development of smart cities in the country.

Box 2.10. Colombia’s National Data Infrastructure Plan

In 2022, Colombia’s national government issued the National Data Infrastructure Plan (PNID) to promote the state’s digital transformation. This plan is to support the government’s efforts to enhance the economic recovery after the COVID-19 pandemic. For the Colombian government, the data infrastructure is a set of shared, dynamic and standardised resources arranged by different actors, which enables the permanent provision of key data for its use and the generation of social, economic and public value.

The data infrastructure is made up of six minimum components: i) the strategy and governance of the data infrastructure; ii) data (minimum, data, transactional and open data); iii) use of the data; iv) data infrastructure interoperability; v) data security and privacy; and vi) technical and technological tools. The data infrastructure governance guidelines include, among others, the following: rules (policies, standards, regulations, business rules); faculties and powers of decision; responsibilities and accountability; and processes related to data management during its life cycle.

The PNID will develop different mechanisms to promote data trust, data commons, data marketplace and data portal models. The national government led the structuring of the PNID through the Ministry of Information and Communication Technologies, the National Planning Department and the Administrative Department of the Presidency of the Republic. It also involved the participation of the private sector, academia and civil society.

The PNID sets the basic principles for data management such as: quality data; public trust and ethics in data management; standardisation and interoperability; accessibility, easy access and reutilisation; and privacy and data protection. It also sets the governance of data infrastructure that should define and integrate the different data sources into a single one, promotes the development of capacities of different actors for the adoption of a common approach in data management as well as the consolidation of standardised processes and measures for data protection.

For the development, implementation and sustainability of the data infrastructure and governance arrangements, the National Planning Department, the National Administrative Department of Statistics, the Administrative Department of the Presidency and the ICT Ministry will be in charge of co-ordination and overall oversight. The PNID is set to be co-ordinated with the interoperability model of digital citizen services. Critically, the data infrastructure must be articulated with the national statistics system and the Colombian spatial data infrastructure, particularly in relation to the classification of data, nomenclature, interoperability, concepts, quality of data and data management models.

Source: Government of Colombia (2022[24]), Plan Nacional de Infraestructura de Datos, https://www.mintic.gov.co/portal/715/articles-198952_resolucion_00460_2022.pdf.

Improving data privacy and security is at the core of data governance

Cities’ desire to improve citizens’ lives, the efficiency of city management and boost economic growth by using digital technologies raises security and privacy concerns. The reason is that smart city technologies capture personally identifiable information and household-level data about citizens, such as their location and movements, physical characteristics and daily activities. These data linked together generate a profile about individuals and communities to make decisions about them but not necessarily involving them. There are also concerns about how secure these digital technologies are, the data they generate from hacking and the costs they may imply for cities and citizens. The challenge for cities is to deploy digital technologies and gain the benefits expected from them while maintaining security and minimising the negative effects they may have on the city’s infrastructure and residents. A large number of stakeholders and interests involved are vested in smart city projects and the diversity of technologies used makes it more difficult to meet this challenge.

Local governments generally have higher levels of trust from the population than national governments

One of the tasks of data governance is offering a common basis to use data to attain shared policy goals and promote trust. The OECD considers trust as core to becoming a data-driven public sector (OECD, 2019[3]), which applies equally well to the city level. Trust may be defined as a positive perception of the actions of an individual or an organisation grounded in actual experience but determined by the subjective assessment of individuals (OECD, 2017[25]). Between 2007 and 2020, the greatest increases were in Germany and Iceland, while trust levels in Belgium and Chile fell most steeply. However, it must be pointed out that metrics of trust in government provide signals of people’s relationship with their institutions and the state of public affairs in countries; though, as the OECD (2021[26]) points out, they remain highly aggregated and could be influenced by a wide array of factors and circumstances.

Research has shown that, at least in the European Union, local and regional institutions are more trusted than national governments (Arrighi et al., 2022[27]). This level of trust in local institutions seems to be closely related to the quality of public services and day-to-day policies, that means: the prospect of a well‑functioning economy; decent schools and safe streets; security of property and data; properly maintained public transport and infrastructure; a healthy environment; and a thriving cultural landscape (Aguiar, Boutenko and Lacanna, 2021[28]). Trust is key to ensuring social stability; for that, all institutions, particularly national and subnational governments, must provide trustworthy information (Edelman, 2022[29]). That requires providing clear, consistent, fact-based information to break the cycle of distrust.

Citizens are more likely to provide the government – and its partners – with personal data providing that their data will be protected and not misused by the government or sold for marketing purposes for example, and that their data will be used to improve public service delivery. In other words, citizens need to perceive that, with the data they have provided to the government, public services will be more personalised and meet their specific needs. If the government and its partners fail to meet citizens’ expectations by using data without permission or public service experiences do not improve, then trust is damaged and may take a long time to be repaired. In 2021, a survey conducted in Lisbon, Portugal, on data protection found that citizens generally have the perception that their data are not properly protected and there are risks of leaks or being hacked, they are worried someone else is using their personal data without their knowledge and permission, and there seems to be a general lack of knowledge on the data protection measures adopted by the city as part of its smart city programme (Cró and Castro Roegiers, 2021[30]). However, the results of the OECD Survey on Drivers of Trust in Public Institutions showed that a majority of people in most countries are satisfied with access to information about administrative procedures. More than half of respondents trust their government to use their personal data only for legitimate purposes (Figure 2.2) and trust in local governments is generally higher than in national government (Figure 2.3) (OECD, 2022[31]). Yet, governments need to strengthen their efforts aimed at reinforcing trust in the way they handle citizens’ data.

Figure 2.2. Half of residents in OECD countries, on average, trust their government to use their personal data for legitimate purposes

Source: OECD (2022[31]), Building Trust to Reinforce Democracy: Main Findings from the 2021 OECD Survey on Drivers of Trust in Public Institutions, https://doi.org/10.1787/b407f99c-en.

Figure 2.3. People’s trust in civil service and local governments is generally higher than in national government

Source: OECD (2022[31]), Building Trust to Reinforce Democracy: Main Findings from the 2021 OECD Survey on Drivers of Trust in Public Institutions, https://doi.org/10.1787/b407f99c-en.

To that end, some governments have been adopting initiatives to build trust in government smart city projects and encourage citizens to share their data. Some have established practical mechanisms by which citizens and businesses can know which data government organisations hold about them. For example;

• In Japan, the Act on the Protection of Personal Information (APPI) has been amended to require more information to be provided to the individual about handling personal information in the offshore company to which they are relocating.

• In the European Union, the General Data Protection Regulation (GDPR), adopted in 2018, aims to protect citizens from privacy and data breaches. Companies can only use data that the data subject has agreed on, and consent has to be given in a clear and easily accessible form with the option to withdraw. The regulation itself is large, far-reaching and fairly light on specifics. It was designed to apply to all types of businesses, from multinationals down to micro enterprises. However, its complexity makes GDPR compliance a daunting prospect, particularly for small and medium-sized enterprises (SMEs). Thus, the European Commission created a specific website, gdpr.eu, to serve as a resource for SME owners and managers to address specific challenges they may face (EU, 2022[32]).

The phenomenon of datafication may potentially breach privacy rules

The use of digital technologies as part of smart city projects is giving place to a phenomenon called “datafication” by which concrete phenomena, situations or actions are transformed into data. Although these data can be used to improve services, it could breach privacy laws. Datafication creates concerns as the capture and circulation of data may involve a large number of individuals and the distribution of their data can occur across multiple devices, places and services as data flow easily across platforms.

Smart city technologies have transformed geolocation tracking, making monitoring people’s location continuous. For example, smart cards used to pay for public transport, such as the Navigo card in Paris, France, the Isar Card in Munich, Germany, and the Suica card in Japan, collect information on people’s movements across a city. Cities such as London have installed sensor networks across street infrastructure to capture and track phone identifiers such as media access control (MAC) addresses – a unique number used to track a device in a network6 – that could track the stores individuals visited, the duration of their stay and how often they visit a particular shop and use that information to show contextual adverts. Several cities across the world have installed digital closed-circuit television (CCTV) cameras that can zoom and track individual pedestrians (Figure 2.4). Local authorities are deploying CCTV cameras and facial recognition systems to bolster security in severely under-policed areas to prevent crime but in countries such as India, this is creating concerns about security and privacy as there are not strong enough laws to protect people (Chandran, 2023[33]). All data collected through digital technologies has the potential to assist in improving service delivery and making informed policy decisions. However, in many cases, private actors generally collect and store these data, creating concerns regarding the legitimate use of people’s data.

Figure 2.4. Some of the most surveyed cities in the world

Note: This calculation does not include cities in China.

Source: Bischoff, P. (2022[34]), “Surveillance camera statistics: Which city has the most CCTV cameras?”, https://www.comparitech.com/vpn-privacy/the-worlds-most-surveilled-cities/.

Addressing privacy concerns requires a comprehensive multi-domain approach

Protecting data privacy should be central to any smart city data governance arrangement. Kitchin (2016[35]) suggests that, to address privacy concerns, cities require a suite of solutions as there is no single solution to a complex political, technical and ethical challenge such as data privacy. Some solutions should be market-driven, others should be technical-oriented, should focus more on policy and regulations, or should be more oriented to governance and management. This mix of solutions would enable the rollout of smart city technologies in a way that protects people’s privacy while minimising privacy risks.

Market-driven solutions require regulatory tools and oversight to ensure compliance with privacy regulations. Regulation needs to define security requirements and assurance processes that companies need to follow. It is essential for all stakeholders contributing to smart city services to acknowledge security risk management requirements. But regulation also requires companies to see data privacy protection as a competitive advantage. Across the world, 68% of consumers believe companies benefit more from using their data than they do; and 76% of consumers want to take more direct control over their data instead of companies and governments (Bella, 2021[36]). A critical problem in many countries is that citizens are not keen on sharing the personal data that governments would need to better plan some services, for example commuting and geolocalisation data to improve traffic management planning. “Giving citizens the opportunity to actively decide on who can use their data and for what purposes, accompanied by trustworthy technology, processes and actors can also create incentives to share or generate such data” (Franke and Gailhofer, 2021, p. 8[5]). The experience of the city of Aizuwakamatsu in Japan shows how important it is to give residents the option to opt in to generate trust in how personal data are collected, handled, stored and protected. This allows residents to choose if they want to provide personal information in exchange for digital services and around 20% of the population have opted in to share their data.

Regarding technology solutions to address data privacy concerns, cities may use privacy-enhancing technologies (PETs), which are a broad range of technologies designed to extract data value without risking the privacy and security of the data, such as cryptographic algorithms, data masking techniques, anonymisation techniques and synthetic data generation, among others (Dilmegani, 2022[37]; Curzon, Almehmadi and El-Khatib, 2019[38]). Different technologies have been developed to assist cities in anonymising data through metadata aggregation, privacy masking, data purging and deep natural anonymisation technology (DNAT) that prevent the original subjects from being recognised by creating synthetic overlays and allowing cities to use videos and images safely without breaching privacy rules.7 PETs aim to minimise data generation, preventing unnecessary processing of personal data while increasing individual control of personal identifiable information (PII) and facilitating legal data inspection rights. In Singapore, for example, the National Steps Challenge is an initiative by which a step-tracking device is linked to a mobile application; the aim is to encourage users to adopt a healthier lifestyle by offering incentives to participate in a national competition.8 The risk regarding data privacy concerns the collection of personal quantitative information tied to an identified individual, which could expose personal and location information. According to research, PETs could protect the data privacy of participants in the National Steps Challenge initiative by, for example, applying a k-anonymity (i.e. ensuring all data entries share the values in their quasi-identifiers with k−1 other entries) to ensure that participant information is adequately protected (Curzon, Almehmadi and El-Khatib, 2019[38]). However, these technologies are not widespread yet and, until they are, cities should follow the Privacy by Design (PbD)9 principles as they take a broad view of a data system and its data: proactive not reactive; privacy as a default setting; privacy embedded into design; full functionality; end-to-end security; visibility and transparency; and respect for user privacy.10

To administer market and technology solutions to protect data, some countries have conducted regulatory reforms to guarantee rights and freedoms on data and information and cities have implemented initiatives for data protection as part of smart cities projects to build trust. Efforts to protect data tend to focus on areas of: ethics – to guide behaviours across the public sector; privacy – to protect citizens’ privacy and to establish data rights; transparency and accountability – of algorithms used for decision making; and security – to manage risk to government data (van Ooijen, Ubaldi and Welby, 2019[39]; OECD, 2019[3]). At the local level, for example, when procuring digital products and IT services, the city of Vienna applies tender criteria that ensure digital sovereignty, paying particular attention to protecting the data of critical infrastructure and operators of essential services. The aim is to ensure that the operation of digital infrastructure and digital services is as independent as possible to guarantee a high degree of independence and flexibility, as well as a high degree of sovereignty, individualisation and service orientation for the economy, citizens and public employees. This could contribute to the resilience of the digital infrastructure and digital services required to maintain the city administration and essential public services.

Different legal frameworks are built around personal rights and regarding the generation, use and disclosure of personal data and the obligations of governments to protect that data. For example:

• In 2021, Chile established the Measures to Encourage the Protection of Consumer Rights (known as the Pro Consumer Law or Ley Pro Consumidor) to protect the consumer collective or individual interest to request compensation upon breaches into their personal data. It grants the Financial Market Commission, the Chilean Transparency Council and the National Consumer Service supervisory powers regarding personal data processed within a consumer relation.11

• In Korea, the Personal Information Protection Commission, established to protect people’s personal information, is required by the Personal Information Protection Act to establish a master plan every three years to ensure the protection of personal information (Government of Korea, 2022[40]). In the capital Seoul, all citizens are able to vote on line on budgeting decisions that fall within the city’s participatory budgeting programme, launched in 2012 (Aguiar, Boutenko and Lacanna, 2021[28]).

• The United Kingdom aims to ensure that legislation is in step with innovation to protect personal data and citizens’ privacy. This work involves experts from civil society and convenes a number of departmental groups to ensure that data work is adequately scrutinised and that data protection and privacy regimes are robustly upheld (OECD, 2019[3]). In London, the city government set up the London Datastore as a free and open data-sharing portal where anyone can access around 700 databases relating to the city’s progress on issues such as job creation, public transport, housing, community safety, etc.12 The premise is that transparency enables residents to assess the government’s actions and build trust.

• In Portugal, the national government prioritised security as a guiding principle of its ICT strategy 2020. To enhance security, the government created the National Commission for Data Protection to supervise and monitor compliance with laws and regulations pertaining to personal data protection and to correct and sanction breaches of such laws and regulations (One Trust Data Guidance, 2022[41]).

• Japan has a very comprehensive regulatory framework for handling personal information (Box 2.11). This framework has solved the problem of about 2 000 local governments providing their own ordinance for personal information.

• In Germany, funding for smart cities is conditioned to abide by the European GDPR, by which data collected should be either non-personal or anonymised; cities should refrain from collecting data about individual citizens.

• In 2012, the United States set out a revised version of the Fair Information Practice Principles (FIPPs) – first published by the OECD in 1980 (OECD, 2013[42]) – in the Consumer Privacy Bill of Rights to improve consumers’ privacy protections and ensure that the Internet remains an engine for innovation and economic growth. The bill contains principles such as individual control, transparency, respect for context, security, access and accuracy, focused collection and accountability.13

Box 2.11. Japan’s comprehensive data governance regulatory instruments for data protection and management

Japan has three main laws regarding data protection. Data protection is constantly evolving as the scope of personal information disclosed by individuals in day-to-day transactions expands and use by businesses becomes more widespread. Three main laws that influence data management and governance can be mentioned:

• The Act on the Protection of Personal Information (Act No. 57 of 2003 as amended in 2020) (APPI) is Japan’s basic law on the protection of the rights and interests of individuals, ensuring the proper handling of personal information. The APPI defines the responsibilities of the national and local governments and entities handling personal information in relation to the protection and proper handling of personal data and directs the adoption of a Basic Policy on the Protection of Personal Data. The Personal Information Protection Commission (PPC) is responsible for monitoring and supervising compliance with the APPI and provides key guidelines and answers to frequently asked questions. The APPI delegates the power to request reports from the PPC to the ministers with jurisdiction over their respective business areas. For sectors such as healthcare, finance and credit, information and communications, the PPC has developed specific field guidelines taking into account the nature of the personal data handled and the particularities of the way they are used.

• The Act on the Use of Numbers to Identify a Specific Individual in the Administrative Procedure (Act No. 27 of 2013 as amended), also known as My Number Act, provides special provisions for the safe handling of personal information. In particular, the My Number Act issues rules to protect individual numbers as well as define the rules to manage and use this information efficiently in administrative organs and local governments.

• The Basic Act on the Advancement of Public and Private Sector Data Utilisation (Act No. 103 of 2016) determines the responsibilities of the state, local public entities and companies in the provision and appropriate and effective use of public and private sector data. The act is the government’s response to the need to ensure the appropriate use of the information that circulates on the Internet and other information and communication networks in a way that contributes to tackling Japan’s key challenges, such as an ageing population. The act requires the government to establish a Basic Plan for the Advancement of Public and Private Sector Data Utilisation.

Source: Government of Japan (2003[43]), Act on the Protection of Personal Information, https://www.japaneselawtranslation.go.jp/en/laws/view/4241/en; Government of Japan (2013[44]), Act on the Use of Numbers to Identify a Specific Individual in the Administrative Procedure (Act No. 27 of 2013 as Amended), https://www.dataguidance.com/legal-research/act-use-numbers-identify-specific-individual; Government of Japan (2016[45]), 官民データ活用推進基本法 [Basic Act on the Advancement of Public and Private Sector Data Utilisation],, https://japan.kantei.go.jp/policy/it/data_basicact/data_basicact.html.

One of the biggest barriers to sharing data is the interpretation of legislation. In London, for example, each of the 33 boroughs has its legal team with its own interpretation of the legislation of data protection. This creates delays in decision making and implementation of projects. London’s experience suggests that it is necessary to standardise the approach of information governance to align the thinking about the legality of data-sharing measures and tools.14 Moreover, research has found that the different legal framing and policies for data protection across jurisdictions create a fractured regulatory landscape which could diminish its impact (Kitchin, 2016[35]). There are different obligations for smart city technologies deployed within countries and even cities depending on local laws and regulations.

Protecting data privacy also requires governance measures. Principle-led governance is a condition for creating a smart city that maximises data benefits and minimises risks to individuals. To reinforce the ethical management and use of data, some countries have established independent bodies and developed ethical frameworks. The central body focuses on government-held data and support government entities to build capacity for data management and see data as a valuable strategic asset. They also provide support for the implementation of data standards and may experiment with innovative methodologies for data management and sharing. For example:

• In Australia, the Australian Research Data Commons (ARDC) is the national research infrastructure provider that enables the research community and industry access to nationally significant, data-intensive digital research infrastructure, platforms, skills and collections of high-quality data. It also facilitates partnerships to develop a coherent research environment that enables researchers to find, access, contribute to and effectively use services to maximise research quality and impact (ARDC, 2022[46]).

• In India, the Data Security Council of India (DSCI) is a not-for-profit body that seeks to make cyberspace safe, secure and trusted by establishing best practices, standards and initiatives in cybersecurity and privacy (DSCI, 2023[47]).

• In Ireland, the Data Protection Commission (DPC) is the national independent authority responsible for upholding the fundamental right of individuals in the European Union to have their personal data protected. It is the supervisory authority for the GDPR, and also has functions and powers related to other important regulatory frameworks, including the Irish e-Privacy Regulations and the European Union directive known as the Law Enforcement Directive (DPC, 2022[48]).

• Mexico established the National Institute for Transparency, Access to Information and Personal Data Protection (INAI) as an autonomous constitutional body that guarantees compliance with two fundamental rights: access to public information and the proper use of personal data (INAI, 2022[49]).

At the city level, Smart City Advisory Boards provide a strategic vision of the composition and ambition of the smart city plan as the principles underpinning the smart city plans. The advisory board could be composed of representatives of local and regional governments, regulatory bodies, the private sector, academia and citizen representatives, among other relevant stakeholders. Among its tasks, the board can set an ethical framework for data protection as a result of smart city initiatives. For example, in London, since 2022, the Data for London Advisory Board – a leadership group of data and technology experts – has advised the mayor and the CDO on the development of the new Data for London platform and a data strategy to ensure data are managed effectively and responsibly (Mayor of London, 2023[50]).

According to research, it is also recommended to set up a smart city governance, ethics and security oversight committee with a more operational focus than the advisory board. Its aim should be to oversee and audit the work of the privacy teams, certify that the smart city activities are aligned with the regulatory requirements and ensure that citizens know how the smart city is being realised and how data are being generated, used, stored and shared (Kitchin, 2016[35]). In the United States, for example, the city of Seattle set up the Privacy and Cybersecurity Committee as part of the Community Technology Advisory Board, with the goal to ensure the protection of residents’ data through information security policies and that they are free form unchecked surveillance (City of Seattle, 2023[51]).

Despite its added value to research and policy making, the use of data may be the origin of ethical considerations. For example, the use of geospatial data (location data) – critical for many smart city functions – may bring with it concerns such as: privacy, security and surveillance issues related to the capacity to directly or inadvertently observe private property, capture sensitive personal information and potentially put persons in harm’s way; uncertain consent when using data from third-party owners; unintended or unknown surveillance; discrimination consciously or unconsciously built into algorithms; lack of representativeness or robustness of data; and data that may be stored on servers that can be easily accessed by unauthorised actors (Berman et al., 2018[52]). Since geospatial data often locate individuals, addresses or businesses and generally come from personal devices such as mobile phones, citizens may consider them a special or intimate type of data.

While the use of digital technologies for service delivery and decision making may bring benefits in terms of efficiency, convenience and safety, they also bring risks; that is why countries and cities are building trust through ethical frameworks or guidelines regarding data management. These guidelines provide users with information, resources and approaches to achieve ethical practices in data management. They do not intend to be prescriptive but work on ethical concerns. These ethical frameworks can be developed nationwide by countries or by cities (OECD, 2019[3]). An example of a national-level ethical framework is the United Kingdom’s Data Ethics Framework, which guides public sector organisations on using data appropriately and responsibly in policy making and service provision. The UK government has codes of practice for the use of data-sharing provisions within the Digital Economy Act that contain checks and balances consistent with the Data Protection Act to ensure data are not used inadequately. The Data Ethics Framework is used for data outside the scope of the legislation and guides policy makers and data analysts in the ethical implications of their work (Box 2.12). Germany promotes a value-based approach to data that sets values and principles, which defines how personal and non-personal data should be managed and may fill the gaps in areas that remain unregulated (BBSR, 2021[9]). Moreover, the experience of OECD countries (e.g. Germany, the Netherlands) suggests that the different stakeholders involved in data management and processes need to be aware of the risks and challenges posed by the use and sharing of personal and non-personal to ensure data responsibility.

Box 2.12. United Kingdom: Data Ethics Framework

In 2018, the United Kingdom established a Data Ethics Framework to guide public servants in the appropriate and responsible use of data in government and the wider public sector. It is aimed at anyone working directly or indirectly with data in the public sector, such as data practitioners, policy makers, operational staff and those helping to produce data-informed insight. The framework is divided into overarching principles and specific actions.

There are three overarching principles:

• Transparency means that actions, processes and data are made open to inspection by publishing information about the project in a complete, open, understandable, easily accessible and free format.

• Accountability means that the public or its representatives are able to exercise effective oversight and control over the decisions and actions taken by the government and its officials.

• Fairness means that officials should eliminate potential unintended discriminatory effects on individuals and social groups.

Five specific actions support the principles:

• Define public benefit and user needs.

• Involve diverse expertise.

• Comply with the law.

• Check the quality and limitations of the data.

• Evaluate and consider wider policy implications.

Source: UK Government (2020[53]) Data Ethics Framework, https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/923108/Data_Ethics_Framework_2020.pdf.

At the local level, the city of Bilbao in Spain provides an example of the efforts to ensure good data management and governance in the framework of its work to build a smart city and promote digitalisation. Bilbao’s local council intends to use data only to create new services and improve the existing ones, to give citizens the guarantee that their data will not be marketed and that they will be used only for the benefit of the city and its residents. Bilbao City Council is working with a 2030 vision. The underpinning factor is to create a data-driven government based on data-driven decision-making processes that is able to provide all sectors and stakeholders with the necessary information to create value. The local government works with open and internal data. The latter requires specific governance processes as they may include personal and sensitive information. To reassure citizens about the use of the data, in 2022, the local council approved the Bilbao Data Manifesto to generate trust based on anonymised data (Box 2.13). The basic premise is that the data belong to the city and residents, not the administration. The Bilbao local council aggregates data to ensure the privacy of residents and the protection of their data.

Box 2.13. The Bilbao Data Manifesto to guide data management and governance

Bilbao City Council is determined to take advantage of this new opportunity to improve the quality of life of citizens by managing the data and guaranteeing its proper treatment within the framework of Bilbao’s values. Thus, in February 2022, the city council established a set of principles to guide the management and use of data called the Bilbao Data Manifesto, based on the ethical values already included in the Bilbao Charter of Values. The basic premise of the manifesto is that all data provided to or acquired by the local government will be used to improve existing services and create new ones. All data in possession of the city administration or acquired through third parties through different agreements and conventions are subject to the principles set in the Bilbao Data Manifesto:

• Justice, equity and solidarity – Any system based on data will contribute to global justice and guarantee all people the same benefits and results. Data management should guarantee the rights of vulnerable groups, avoid discrimination and promote social cohesion with respect to disadvantaged social groups.

• Sustainability – Whenever applicable, any system based on the use of data will ensure the protection of the environment, and its care, including its ability to improve it.

• Co-creation and co-operation – To use resources in an optimal manner, projects that impact the largest number of sectors (public, private and citizens) will have priority.

• Transparency – In the event that personal data must be obtained and used, people’s explicit consent must be reported.

• Explainability – The results of the work, analysis and/or systems based on data will be explained in detail for the understanding of all people. The decisions made, their justifications and the results obtained will be communicated in an understandable way, avoiding technical terms, so that anyone can understand it.

• Reliability and human intervention – Each of the automation processes deployed for the execution of routine tasks will be accompanied by methodologies for auditing, monitoring and verifying the executions.

• Prudence – Different alternatives will be considered for the design of the tasks, with the aim of having multiple perspectives. The conception of various approaches will allow carrying out contrasting actions, facilitating the optimal conceptualisation of the solution.

• Responsibility – Persons responsible for the work will be defined. All those involved in the chain of design, conceptualisation and construction will be taken into account and not only the developers of the technological solution as people closest to the code.

• Privacy and data protection – Bilbao City Council will ensure that the private sphere of individuals is left out of the analysis systems. It will implement policies regarding the right to technological disconnection and the right not to be profiled, measured and analysed.

• Security – Bilbao City Council will have a robust, safe and secure environment, minimising the risk of attacks and ensuring adequate access to information systems.

Source: Ayuntamiento de Bilbao (2022[54]), Bilbao Data Manifesto, https://kopuru.com/bilbao-data-manifesto-los-10-principios-eticos-que-regiran-el-uso-de-datos/ (accessed on 27 July 2022).

It is worth noting that “[t]he use of data-based applications in smart cities must not infringe on any fundamental rights or on the security, civil liberties or privacy of individuals. Algorithmic systems must not replace democratically elected bodies or the accountability of natural persons or legal entities” (BBSR, 2021, p. 17[9]). All levels of government need to work together to ensure proper data stewardship.

Collecting and sharing individuals’ spatial data can lead to beneficial insights and services. However, it can also compromise citizens’ privacy, making them vulnerable to governmental overreach, tracking, discrimination and unwanted advertisement. Therefore, countries and cities may also take into account the GeoEthics Principles proposed by a number of international organisations and statistics bureaus. Although these principles or guidelines are built for geospatial data, they can be applied to data management more generally. Table 2.3 presents a selection of available principles of guidelines to keep ethical considerations in the management of geospatial data. These guidelines or ethical frameworks provide a series of practical tools to ensure that location-enabled technologies and location data are used based on ethical considerations, and in turn, that could help enhance trust in the government’s capacity to manage and protect data.

Table 2.3. Examples of geospatial ethical principles and guidelines developed by different international organisations

Guidelines or principles	Focus	Elaborated by
Ethical considerations when using geospatial technologies for evidence generation	The use of an ethical lens to assess geospatial technologies and resulting data prior to implementation of programmes, analyses or partnerships. It provides a checklist that may be used as a practical tool to support reflection on the ethical use of geospatial technologies.	UNICEF15
The Locus Charter	It proposes that a wider, shared understanding of risks and solutions relating to the uses of location data can improve standards of practice and help protect individuals and the public interest. It intends to manage risks to enhance the benefits of geospatial technologies.	Ethical Geo/ Benchmark16
A geoprivacy manifesto	It proposes 21 theses that, in general, argue that location information is different from other kinds of personal information and show why geoprivacy (and privacy in general) needs to be protected. It integrates technological, ethical, legal and educational aspects to shape the interaction with technology.	Keßler and McKenzie17
Ethical considerations in the use of geospatial data for research and statistics	It provides a checklist of ethical considerations when designing a statistical or geospatial analysis project. It enlists 16 practical steps to help researchers and statisticians navigate potential ethical issues for all types of projects.	UK Statistics Authority18
The Responsible Use of Spatial Data	Its purpose is to raise awareness of the ethical responsibilities of both providers and users of spatial data on the web. It searches to illustrate the issues specifically associated with the nature of spatial data and the benefits and risks of sharing this information implicitly and explicitly on the web.	W3C19
GIS Code of Ethics	It is intended to provide guidelines for GIS professionals to help them make appropriate and ethical choices when using GIS data. It provides a basis for evaluating their work from an ethical point of view and preserves and enhances public trust.	URISA20
Framework on the responsible use of location data	Its purpose is to inspire data users, initiators, executive teams, clients, directors and other stakeholders and provide an additional tool for the responsible collection, use and assessment of personal location data.	Geonovum21

Source: Table prepared based on the information provided in the OECD seminar on Geo-ethics Frameworks and Governance on 4 October 2022.

Ensuring data protection is a critical pillar of data governance for smart cities

Data protection is one of the key challenges of digital transformation in OECD countries and cities implementing smart city strategies. As smart cities become more interconnected and the level of digital infrastructure becomes more complex and relevant, these services also become more vulnerable to cyberattacks. These can take different forms, close a system down or deny service use; extract data and information; or enter into a system to alter information (Dodge and Kitchin, 2017[55]). Because of privacy and security concerns, people tend not to share their data with government and private companies, which may limit the efficiency of smart city initiatives. Collecting incomplete and poor-quality data may undermine the usefulness of data and trust in government’s capacity to manage data wisely and eventually the efficiency of the smart city projects. The basic tenet for OECD countries and cities is to ensure that data remain safe and available to users at all times. In Latin America and the Caribbean, there were 137 billion attempted cyberattacks between January and June 2022, a 50% increase compared to 2021; Mexico was the most attacked country (85 billion attacks), followed by Brazil (31.5 billion) and Colombia (6.3 billion) (Fortinet, 2022[56]). Thus, countries and cities invest in cyber security, which means protecting systems, networks and programmes against digital attacks, but it is still in its infancy in smart cities (Ma, 2021[57]).

Research has found five major vulnerabilities digital technologies have (Dodge and Kitchin, 2017[55]; Cerrudo, 2015[58]). Weak software security and data encryption, which means that smart city systems are built without minimal security. The use of insecure legacy systems and poor ongoing maintenance creates serious risks as smart city technologies are built on top of much older technology that has not been upgraded (Cerrudo, 2015[58]). The interdependency of smart city systems makes it difficult to detect which components are exposed to mitigate risks. These interdependencies create cascade effects as failures and disruptions in one part of the system may have knock-on effects on other critical services or infrastructures, and it is a key risk in city operating systems (Dodge and Kitchin, 2017[55]). Human errors and sabotage can also lead to exposing weaknesses in the system.

Data protection has increasingly become a major concern, especially for cities and private companies deploying cloud-based applications. Many cities across OECD countries rely on a wide network of sensors, technologies and interconnected data-gathering portals to operate smoothly. However, digital technologies can easily be hacked if they are not implemented with proper security. Smart cities are vulnerable to cyberattacks in many ways, as several different attacks could be working in unison to disrupt urban services, often using malware and ‘zero-day’ software vulnerabilities. These may result from data breaches and misuse or relate to the cyber security of the smart city technologies and systems themselves. The risks are important because systems may be diverted from their original use and cause moral (cyber-theft), economic and physical harm.

Threats to cyber security include attacks on critical infrastructure, bringing industrial control systems (ICS) to a halt; abusing low-power wide-area networks (LPWAN) and device communication hijacking; system lockdown threats caused by ransomware; manipulation of sensor data to cause widespread panic (e.g. disaster detection systems); and siphoning citizen, healthcare and consumer data and PII. Some of the most common attacks on the smart grid, for example, are the denial of service through channel congestion, computational flooding of equipment with low computer power, delaying a time-critical message that may cause a widespread shutdown, and forgery of data from various sensors across the urban area (Marahatta et al., 2021[59]; Ebrahimian et al., 2018[60]; Ma, 2021[57]). In addition, attackers can forge a customer identity to control building equipment remotely and cause various damages to customers (Parasol, 2018[61]).

Attacks on the smart transport system can occur via, for example, fake information when the attacker sends incorrect information such as certificates, alerts, security messages and identification (ID). The attacker alters, falsifies, or repeats data to mislead other drivers (Xie et al., 2020[62]). In other cases, the attacker may send large volumes of irrelevant messages clogging the communication channel and consuming the computing resources of other nodes with the purpose of disabling the case network of a vehicle, which can have vital consequences in the event of an emergency (Yan, Liu and Tseng, 2020[63]).

Smart cities are particularly vulnerable to data theft as hackers can infiltrate data banks and steal PII (Box 2.14). Device hijacking is another threat by which attackers take control of a device and use it to disrupt processes such as road signals. Another threat is the Man-in-the-Middle attack (MitM), by which a hacker interrupts communication between two devices and sends false information to cause trouble.22 For instance, a hacker may gain access to a mobility platform and report public transport delays, which could lead to more people using a car to reach their destinations, causing an increase in traffic and bringing a city to a standstill. In Japan, the selection of Tokyo as the host city of the 2020 Olympic games represented an opportunity to enhance the capacity and capability of the country in cybersecurity. In 2015, two years after the selection of Tokyo as Olympic host, the Japanese government adopted the Cybersecurity Strategy. The strategy highlights the need to create public-private cybersecurity partnerships, improve workforce development and develop cyber exercises. It also urges business leaders to incorporate cybersecurity in their business strategy and invest proactively in cybersecurity for innovation and vigorous growth (Matsubara and Mochinaga, 2021[64]).

Box 2.14. Examples of cities crippled by cyberattacks

• In 2018, the city of Atlanta was struck by a cyberattack that shuttered municipal courts and left residents unable to access services such as traffic tickets or water bill payment systems. Hackers placed malware on a computer that restricted access and then demanded a USD 51 000 Bitcoin payment to undo it.

• In 2019, the city of Baltimore suffered a ransomware attack that froze thousands of government computers and crippled dozens of services; the hackers demanded USD 80 000 worth of Bitcoin, which the government refused to pay.

• In 2008, in Poland, a teenager hacked the city of Łodz tram system with a homemade transmitter that tripped rail switches and redirected trains and derailed four trams.

• In 2022, a hospital in Paris was crippled by a cyberattack, drastically reducing the number of patients who could be admitted and forcing a return to pre-digital workflows.

• In 2023, the software of a trading firm in London called Ion Group caused chaos for City of London traders. Ion is a key player in the UK’s financial system, with its software playing a vital role in the trading of debt, derivatives and shares around the world. Clients were forced to use pen and paper to process their trades.

Source: Business Insider (2018[65]), “Atlanta has shut down courts and people there can't pay their bills online because of a crippling cyberattack the mayor has called 'a hostage situation', https://www.businessinsider.com/atlanta-cyberattack-cripples-city-operations-2018-3?r=US&IR=T; Business Insider (2020[66]), “8 cities that have been crippled by cyberattacks — and what they did to fight them”, https://www.businessinsider.com/cyberattacks-on-american-cities-responses-2020-1?r=US&IR=T#st-lucie-florida-3; Wired (2008[67]), “Polish teen hacks his city's trams, chaos ensues”, https://www.wired.com/2008/01/polish-teen-hac/; RFI (2022[68]), “Paralysed French hospital fights cyber attack as hackers lower ransom”, https://www.rfi.fr/en/france/20220902-paralysed-french-hospital-fights-cyber-attack-as-hackers-lower-ransom-demand; Computer Weekly (2023[69]), “Suspected LockBit ransomware attack causes havoc in City of London”, https://www.computerweekly.com/news/365530214/Suspected-LockBit-ransomware-attack-causes-havoc-in-City-of-London.

Several factors exacerbate the vulnerability of smart city technology. The lack of co-ordination among different stakeholders on who is responsible for maintaining security across the systems and the infrastructure; and the need for cities to show efficiency savings leading to a lack of digital security investments in many cities are jeopardising the infrastructure, intelligence, efficiency and sustainability of future smart city developments. Many cities also face critical staffing needs. Recruiting and maintaining highly skilled IT staff is a growing problem for local governments, and in particular, investing in cybersecurity personnel is hampered by the lack of funds. Cybersecurity plans are, in many cases, built under a siloed approach preventing a cross-function assessment and response to an attack (Dodge and Kitchin, 2017[55]; Cerrudo, 2015[58]). In addition, many smart city vendors may lack experience and incentives in embedding security features into their products; and cities have been lax in demanding string security controls during the procurement process for the new systems (Dodge and Kitchin, 2017[55]). Designing flexible systems with high information protection capabilities is essential to prevent serious security incidents.

Cybersecurity workforce shortages also threaten smart city projects and hamper national and local cybersecurity strategies. The global cybersecurity workforce is estimated at 4.7 million workers but, to protect public and private organisations and enterprises from more complex threats, there is a need to fill a gap of 3.4 million cybersecurity workers worldwide (ISC2, 2022[70]). Brazil, China, India and the United States seem to have a wider workforce gap (Figure 2.5). Cybersecurity policies and strategies include measures to address training needs and raise awareness of cybersecurity but they may take a long time to mature. Due to high attrition rates in the public sector for cybersecurity jobs and low rates of availability of educational opportunities on cybersecurity, developing a digitally savvy workforce with adequate skills may take many years; thus, governments need to prioritise workforce development, ensuring adequate funding for such programmes (OAS, 2022[71]). According to research, the workforce shortage is particularly severe in areas such as government, transportation, aerospace and insurance, jeopardising the most basic functions of the profession, such as risk assessments, oversight and critical systems patching (ISC2, 2022[70]). The biggest challenges for cybersecurity professionals are the emerging technologies such as blockchain, AI, quantum computing and intelligent automation, and the continuous changes in the regulatory framework.

Figure 2.5. Cybersecurity workforce gap in selected countries, 2022

Source: ISC2 (2022[70]), “Cybersecurity workforce study. A critical need for cybersecurity professionals persists amidst a year of cultural and workplace evolution”, https://www.isc2.org/ (accessed on 23 February 2023).

The implications of a data breach or data loss incidents can represent serious challenges for public and private organisations. Failure to protect data can cause financial losses, loss of reputation and citizens’ trust, as well as legal liability, considering that most public and private organisations are subject to some data privacy standards or regulations. Therefore, countries have set formal requirements to protect citizens’ data across data collection, storage, processing and sharing exercises. Authorities are issuing regulations and strategies for the handling and security of digital big data. As smart city projects involve large amounts of data, stakeholders need to consider new methods of managing their data risk exposure. Off-the-shelf antivirus solutions are not enough as smart city projects and data strategies need a more comprehensive policy for the protection of government, companies and citizens’ data.

Countries and cities collect different types of data that could be sensitive or non-restricted, depending on their nature. Various levels of data privacy risk should be considered when making decisions about their collection, storage, use and disclosure. For example, New York City, United States, has prepared a framework for classifying three tiers of data based on privacy risk level to support decisions about data collection, use, disclosure and storage (Table 2.4). The framework is informative only and does not represent a classification structure used by the city government. However, it is based on the city’s privacy protection policies and its cybersecurity programme, policies and standards. Under normal circumstances, data in Tiers 1 and 3 will stay there, but data in Tier 2 may move to other tiers depending on several factors, such as how data collection is implemented.

Table 2.4. New York City’s privacy risk levels of IoT data

	Tier 1	Tier 2	Tier 3
Definition of the tier based on privacy risk level	Data have no means of connecting to an individual’s identity, location or behaviours. They are environmental or aggregate/statistical in nature There is little to no privacy risk expected in collecting these data with respect to individuals, except where aggregate metrics pertain to individuals in small groupings (e.g. <10), which, with other information, could lead to the identification of an individual. Typically, these data do not require the same scrutiny as the other tiers, although there may separately be policy, proprietary or other legal considerations in disclosing these data. Tier 1 data are likely to be classified as non-restricted information.	Data are highly dependent on the context, detail and the means by which the data are collected. Based on implementation, this type of data could either move up or down a tier to become restricted, sensitive or non-restricted.	These data will almost always be considered sensitive or restricted information and, if pertaining to individuals, are likely designated as confidential information by law. PII is sensitive or restricted by nature or through its ability to be used in connection with other data to identify or locate a person. Collecting, using, disclosing and storing these data should be limited, with appropriate prior legal review and safeguards in place to address any privacy or security concerns.
Examples	Examples of this type of data are: Ambient temperature Humidity Air quality Energy production (onsite) Radiation Water quality Water levels (flooding) Trash volume/servicing Gas/chemical Greenhouse gas emissions	Examples of this type of data include: Traffic counts Traffic flow (travel time) Water flow Energy usage Sound levels Pedestrian/cycling counts Building access/usage Infrastructure utilisation Shared mobility utilisation	Examples of this type of data include: Location data (vehicles, etc.) License plate/car tag data Biometrics Health data

Source: NYC Government (2021[72]), IoT Strategy - The New York City Internet of Things Strategy, https://www1.nyc.gov/assets/cto/downloads/iot-strategy/nyc_iot_strategy.pdf.

Therefore, ensuring digital security must be a fundamental part of countries and cities’ digital and data strategies. Research suggests that city governments need to adopt a security-by-design approach in the technical design and training of the workforce (Dodge and Kitchin, 2017[55]). Security-by-design implies the inclusion of security aspects from the outset of a smart city project. Conducting a security risk assessment and extensive testing of the security systems should be part of the design process. City administrations should require digital technology vendors to monitor their products throughout their life cycle to identify potential risks.

Cities should also ensure to set up a core security team overseeing the security aspects of digital technologies related to smart city projects. The team should have specialist skills and responsibilities beyond day-to-day IT administration. The security team could be in charge of threat and risk modelling, testing the security of the digital technologies to be used in smart city projects, preparing a plan of action in case of cybersecurity incidents, conducting security assessments on a regular basis, and co‑ordinating staff training on digital security (Cerrudo, 2015[58]; Dodge and Kitchin, 2017[55]). The Information Security Office (ISO) in the government of the city of Chicago exemplifies the role a security team performs to ensure security monitoring and response (Box 2.15). Installing such an office may be costly to some cities but the Chicago model operates in a “shared services” model, resulting in operational efficiencies and cost savings. In Spain, the city of Madrid is creating a Security Operations Centre (Centro de Operaciones de Seguridad, COS) to act as the backbone of the prevention, surveillance and response capabilities to cybersecurity incidents. Moreover, the city government set up the Municipal Information Security Committee, a collegiate body, to direct and oversee the implementation of the cybersecurity policy of the city and provide advice.23 At the regional level, the Comunidad de Madrid is creating a Cybersecurity Agency to protect itself from future cyberattacks. The regional governments aim to create a climate of trust, provide a centralised vision of cybersecurity, improve the capacity to respond to cyberattacks, promote cybersecurity training and improve the IT security of the regional infrastructure.24

Box 2.15. The Chicago Information Security Office

In 2013, the city of Chicago set up the Information Security Office (ISO) in charge of evaluating and addressing risks and vulnerabilities regarding cybersecurity within the city. Some of ISO’s objectives are:

• Develop and enforce an information security strategy, framework, policies and procedures that align with city of Chicago business needs, legislative and regulatory requirements and industry best practices.

• Assist the city’s IT projects and functional areas with the development of efficient processes that are required to meet requirements as defined by the ISO and/or regulatory standards.

• Develop a risk management framework to be used in information security solutions and asset prioritisation.

• Develop a security awareness programme to ensure that city users understand their responsibility in protecting the city’s assets and information.

• Ensure that information security controls assist privacy efforts.

• Monitor and measure information security vulnerabilities and incidents and provide timely responses to ensure confidentiality, integrity, availability and accountability of the city of Chicago and its third parties.

• Communicate the occurrence of significant security incidents, news, ISO decisions and actions with the city of Chicago.

Source: City of Chicago (n.d.[73]), Information Security Office, https://www.chicago.gov/city/en/depts/dgs/supp_info/information-security-office.html.

Governments are investing substantial budgets in developing state-of-the-art cybertechnologies based on AI and big data analytics, as well as strengthening capabilities to collect cyber intelligence, disturb Internet networks and disrupt major facilities. The United Kingdom, for instance, is investing GBP 2.6 billion in cyber and legacy IT between 2021-24, a considerable increase from the GBP 1.9 billion of the previous strategy. The European Commission invested EUR 249 million in digital technologies and cybersecurity in 2022.25 In 2020, the United States invested USD 5.9 billion in cybersecurity (76% of all global cybersecurity funding), followed by Israel (USD 2.7 billion) and China (USD 1.8 billion).26 It is unclear the extent these resources are reaching subnational governments in their quest to ensure data security as part of their smart city strategies.

To enhance cybersecurity, national governments such as in Korea and the United Kingdom are adopting digital security strategies (OECD, 2019[3]), which show that protecting cyberspace requires government leadership and a whole-of-society effort (Box 2.16). These efforts could inform the development of a detailed cybersecurity strategy at the city level, in line with their broader smart city projects or initiatives. Cities need to ensure that their cybersecurity strategy is in line with their interoperability systems. A key message from national governments’ experiences is that ensuring cybersecurity in cities is not only the responsibility of local governments. National and local governments should build synergies in protecting data and infrastructure from attacks, for example forming digital security committees with representatives from national and subnational governments as well as the private sector to discuss challenges, possible solutions and build agreements to provide technical support and capacity building to local governments may be one way forward. The national government could take the lead but subnational governments’ strategies should be aligned to ensure a coherent approach. These initiatives show that there should be a clear delimitation of responsibilities for data protection in the smart city ecosystem based on a strong governance model.

Box 2.16. Digital security strategies: Korea and the United Kingdom

Korea’s National Cybersecurity Strategy aims to create a free and safe cyberspace to support national security, promote economic prosperity and contribute to international peace. For this purpose, the Strategy has six strategic tasks:

• Increase the security and resilience of the national core infrastructure against cyberattacks to ensure continuous provision of critical services by: strengthening the security of national information and communications networks; improving the cybersecurity environment for critical infrastructure; and developing next-generation cybersecurity infrastructure.

• Enhancing the capacity to detect cyberattacks in advance and respond to security incidents promptly by: ensuring cyberattack deterrence; strengthening readiness against massive cyberattacks; devising comprehensive and active countermeasures for cyberattacks; and enhancing cybercrime capabilities.

• Establish a future-oriented cybersecurity governance framework based on trust and co‑operation among individuals, businesses and government by: facilitating public-private-military co-operation; building and facilitating a nationwide information sharing system on cyberthreats; and strengthening the legal basis for cybersecurity.

• Create an innovative ecosystem for the cybersecurity industry to secure the competitiveness of technology, human resources and industries which are critical to national cybersecurity by: expanding investment in cybersecurity; strengthening the competitiveness of the security workforce and technology; fostering a growth environment for cybersecurity companies; and establishing a principle of fair competition in the cybersecurity market.

• Foster a cybersecurity culture by: raising cybersecurity awareness and strengthening cybersecurity practice; and balancing fundamental rights with cybersecurity.

• Becoming a leading country in cybersecurity by: strengthening international partnerships and guiding the formation of international rules.

The United Kingdom’s National Cyber Strategy aims to position the country as a leading responsible and democratic cyber power, able to protect and promote its interests in and through cyberspace in support of national goals. The strategy is based on five strategic goals:

• Strengthening the UK cyber ecosystem by investing in skills and deepening the partnership between government, academia and industry.

• Building a resilient and prosperous digital United Kingdom by reducing cyber risks so businesses can maximise the economic benefits of digital technology and citizens are secure on line and confident that their data are protected.

• Taking the lead in the technologies vital to cyber power by building the country’s industrial capability and developing frameworks to secure future technologies.

• Advancing the country’s global leadership and influence for a more secure, prosperous and open international order by working with government and industry partners and sharing the expertise that underpins UK cyber power.

• Detecting, disrupting and deterring the country’s adversaries from enhancing its security in and through cyberspace by making more integrated, creative and routine use of the country’s full spectrum of levers.

Source: National Security Office (2019[74]), National Cybersecurity Strategy, https://www.itu.int/en/ITU-D/Cybersecurity/Documents/National_Strategies_Repository/National%20Cybersecurity%20Strategy_South%20Korea.pdf; UK Government (2022[75]), National Cyber Strategy 2022 - Pioneering a Cyber Future with the Whole of the UK, https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/1053023/national-cyber-strategy-amend.pdf.

Ensuring cybersecurity capability is a top priority of national governments. For example, research suggests that until 2021 at least, Japan faced workforce shortages since Japanese end-user companies outsource the majority of their IT and cybersecurity work (Matsubara and Mochinaga, 2021[64]). Therefore, their cybersecurity teams tend to be smaller than in other major countries. Research suggests that while only 28% of IT professionals work in house in Japan, the ratio is 65.4% in the United States, 61.4% in Germany and 54% in the United Kingdom (Matsubara and Mochinaga, 2021[64]).

Countries are implementing initiatives to improve trust in digital technologies and their capacity. In Singapore, the national government has, through the Infocomm Media Development Authority, requested Nanyang Technological University, Singapore to establish the national Digital Trust Centre to strengthen the country’s capabilities in digital trust (Box 2.17). This is an example of how a city – in this case, a city‑state – could formalise partnerships for cybersecurity to grow cyber capabilities as different stakeholders need to work together as a city government alone will not be able to develop the capacity and capability required to face cyberthreats. It also shows that smart cities need to develop skills and competencies across various disciplines and ecosystem layers.

Box 2.17. Singapore’s Digital Trust Centre

Singapore is setting up a Digital Trust Centre (DTC) to drive the development of digital trust technologies, such as tools to ensure privacy in data exchange and assess the trustworthiness of digital systems, and support talent development. The DTC is an SDG 50 million investment from the Infocomm Media Development Authority and the National Research Foundation (NRF) under the Research, Innovation and Enterprise 2025 plan. It is hosted by the Nanyang Technological University, Singapore. It focuses on four areas of trust technologies:

• Trust technology research – to enable institutes of higher learning and research to pursue research in trust technologies and drive local and international collaborations.

• Trust technology innovations – to encourage academia and enterprises to form partnerships to develop and mature research ideas into market-ready solutions.

• New sandbox environment – to encourage and facilitate business to experiment with trust technologies to overcome challenges of data sharing.

• Deeper local capabilities – to support the development of talent in digital trust.

Source: Infocomm Media Development Authority (2022[76]), “Singapore grows trust in the digital environment”, https://www.imda.gov.sg/Content-and-News/Press-Releases-and-Speeches/Press-Releases/2022/Singapore-grows-trust-in-the-digital-environment.

Governments are also investing in revamping their cybersecurity capabilities as part of their data and cybersecurity strategies to create a specialised workforce on cyberattacks. Cities could establish a network of cities, with the support of regional or even national governments, including academia and the private sector, to strengthen cyber defences. Some countries have even set up a special body in charge of cybersecurity and recruiting professionals. For example:

• In Canada, the national government recruits cybersecurity professionals to work across the government due to the increase in cyber threats and ransomware attacks following the COVID-19 pandemic. These professionals are in charge of protecting infrastructure, systems and processes citizens rely on from cyber and ransomware attacks.27

• In the United Kingdom, the National Cyber Security Centre is the national authority on the cybersecurity environment by sharing knowledge, addressing systemic vulnerabilities and providing leadership on key national cybersecurity issues. This has helped the UK government to simplify its operational structures, transform its ability to respond to national-level cyber incidents and initiate the rollout of innovative digital services that have helped to make organisations and individuals automatically safer on line (UK Government, 2022[75]).

• In Japan, the Personal Information Protection Commission (PPC), a regulatory body established to monitor and supervise compliance with the Act on the Protection of Personal Information (APPI), has issued a number of guidelines to provide detailed guidance on the scope and meaning of the provisions of the APPI and examples of their application (Government of Japan, 2003[43]). Non‑compliance with the statements in the guidelines, which are expressed as obligations, may be considered a violation of the APPI. The guidelines cover a wide range of topics, including general rules, provision to third parties in foreign countries, pseudonymised and anonymised processed information, the obligation to confirm and record at the time of provision to a third party, administrative bodies and appropriate handling of specified personal information.

• In the United States, the Department of Homeland Security (DHS) operates enterprise-wide capabilities and offers tools and services to assist agencies in managing their cybersecurity risks. It has established baseline protective capabilities across federal enterprises through the deployment of perimeter security capabilities. The DHS works to deploy innovative cybersecurity capabilities and practices to protect information systems and adopt a more unified approach to securing our own information systems and, where appropriate, deploy standardised, cost-effective, and cutting-edge capabilities across high-value departmental information systems (US Government, 2018[77]).

• The Organisation of American States (OAS) has recommended its members invest in developing the workforce to provide people with education and skills development to bridge the cybersecurity workforce gaps. This could be done by, among other things: developing national strategies and action plans for cybersecurity workforce development; creating a governance model for the co‑ordination and harmonisation of the different stakeholders involved in the process; developing public-private partnerships for launching new training programmes and updating existing curricula; updating the regulatory framework to promote cybersecurity development; and promoting the ongoing assessment of the labour market and cybersecurity workforce data (OAS, 2022[71]).

Proving to citizens why their data matters and reporting on progress

Public data alone are not enough to develop innovative services; data from different stakeholders are sometimes required. Encouraging citizens to grant third parties (i.e. government and private enterprises) access to their data and use them calls for being transparent and honest with citizens and proving the benefits of sharing data. When people perceive there is a direct benefit to sharing their personal data and that their data are managed in an ethical manner, they would be more willing to share their data for decision making or the design of public services. It is a process of give and take: if people give their data, they should expect something in return in the form of information, services and products.

Governments need to ensure that citizens understand how their data are used to help improve their lives, which can range from proactively managing traffic flows to safer street lighting and smarter energy use. Governments failing to consider privacy and/or consent can create tensions and challenges. Governments need to do more to be transparent about the data they collect and demonstrate the value of the resulting products. For example, the city of Adelaide, in Australia, is based in the driest state (South Australia). The city council is trialling the use of smart sensors to collect data to manage its water more effectively. The main benefit of the smart network project is the utility’s increased ability to be more responsive to customer needs. Smart technology is being trialled in Adelaide because of the higher potential for customer impact from bursts and leaks (Cella, 2017[78]). The sensors, loggers and meters allow the water authority (SA Water) to detect water leaks before they become visible on the surface and help large businesses in the city track and manage their water use. Customers have reported an increased understanding of how they use their water. This detection and subsequent cost savings enable customers to pay back the investment on their smart metering equipment.

As governments seek to introduce more technology-enabled services, they will need more effective measures to reassure the public about their management of data and analytics. Neutrality and fairness are critical to avoid any bias and build trust. A data management platform must be operated jointly by public and private entities in adherence to the regulatory framework for data protection. This is because it may facilitate data sharing among public and private stakeholders, optimise costs and improve return on investment, improve data security, build on each other’s capacity for data management and have better access to data from different sources for decision making. However, the government should assess regulation as an instrument to ensure neutrality and fairness.

One way of proving to citizens why their data matters and how it is being used is by reporting on progress on the implementation of the smart city strategy. Such a report should include the steps taken since the adoption of the initiative, the barriers encountered for their implementation and point to the efforts the city will undertake in the time to come. Moreover, the progress report should not just highlight what has been done and which activities are completed or are in progress, but what matters to citizens is the change achieved so far. For example, in New York City, the Office of the Chief Technology Officer has produced a progress report on the implementation of the New York City Internet of Things Strategy (NYC Government, 2021[79]). The report has been seminal in showing commitment to transparency and accountability in the planning, use and governance of connected technologies. It describes the work conducted since the adoption of the strategy and the upcoming activities.

Another way of showing why data matters is by using data to optimise public action. Cities are currently experiencing a convergence of open data, digital mapping, geolocation and the co-creation of services. Through the use of data, cities are in a prime position to be catalysts of new services and economic models that create value, jobs and well-being. For this purpose, it is important that cities ensure that all data produced by the city and residents through the use of public services are made available to all relevant stakeholders. For example, the city of Paris, France, releases financial, social, urban planning, environmental and transportation data every six months; and holds a quarterly consultation meeting with end users to know about their data priorities (Mairie de Paris, 2020[80]). Furthermore, the city government has created a programme called DataCity as a data science study accelerator programme that allows local and international start-ups to work on challenges selected by the city and its industrial partners, using high‑quality data. The DataCity programme promotes the design of solutions tailored to the city, with a focus on sustainability, based on open data provided by the city and industrial partners (Box 2.18).

Box 2.18. DataCity Paris programme – Using big data and data analytics to tackle urban challenges

In 2016, the city of Paris and the start-up accelerator NUMA co-designed and co-developed the open innovation programme called DataCity Paris. Its aim is to identify urban challenges with major regional private partners to suggest possible start-up candidates and accelerate the development of solutions. The programme is based on challenges. The city authorities, citizens and industrial partners identify a series of challenges to make the city more intelligent and pleasant to live, to which start-ups can apply if their technology can help solve the challenge. The selected start-ups work on challenges put forward using data that is unprecedented in quality and quantity. A DataCity challenge is a problem that has not yet found its solution but for which collaborative work between start-ups, the city and NUMA experts will make it possible to develop a prototype viable solution.

Around ten challenges are identified each year in different fields, such as logistics, mobility, energy and many others. The start-ups receive a grant to develop and test their cutting-edge solutions and gain public exposure through the programme. The city and the industrial partners benefit from the solutions through new business opportunities, new services or quality improvement. The prototypes are tested for four months in situ in the Parisian urban space. During the first year (2015/16), the programme focused on improving energy performance in buildings and developing transportation in demand in one of Paris’ boroughs, for example.

Source: Mairie de Paris (2020[80]), Paris Smart and Sustainable. Looking Ahead to 2020 and Beyond, https://cdn.paris.fr/paris/2020/02/26/f7dc822a66de6000cd910a145c7fca39.ai; Mairie de Paris (2019[81]), “DataCity 2019 : les startups qui font la ville de demain”, https://www.paris.fr/pages/datacity-2019-decouvrez-les-startups-qui-font-la-ville-de-demain-6511#les-10-startups-selectionnees; ICC (n.d.[82]), DataCity Paris, https://www.intelligentcitieschallenge.eu/good-practices/datacity-paris

Data standards and open data for smart cities

Setting data standards improves quality and facilitates interoperability of smart city data

Data standards facilitate the integration of otherwise heterogeneous data collected from different sources and by different stakeholders (e.g. public and private organisations, academia etc). In general terms, “[d]ata standards are the predetermined merits that govern how data is managed, used, represented, formatted, defined, transmitted, structured, and tagged” (Satori, 2022[83]). They refer to technical specifications or recorded agreements that describe how data should be stored or exchanged across different systems so that they are understood and mean the same to all stakeholders. If data are going to be used, then they need to mean the same to every actor or user through common terminology and semantics.

Cities should work towards using a comprehensive, unified ontology (the representation and definition of concepts and their relationships) adopted across the board. Data should not be dependent on geographical location; they should be used in different places other than those where they originate from. Thus, a common terminology is essential to ensure data have the same meaning everywhere and rules to ensure their lawful use. Common data platforms are a key element to this goal but they require a non-disclosure agreement. Rules for data quality and standards are one of the components of Japan’s Smart City Reference Architecture (SCRA) issued by the national government. Japan is promoting a base registry initiative to ensure that core data held by government agencies meet quality and management quality standards and can be used by society (see Chapter 1).

Setting standards may be a way forward to encourage citizens to share their data and, in a way, build trust in government. For example, the Abu Dhabi (United Arab Emirates) government has created standards for data management, which also serve as an assessment framework, to promote informed and responsible data ownership and usage, protect government datasets, engender and maintain stakeholder confidence in the capability of the government to deliver sufficiently secure and reliable services to residents, and maximise the return on investment in information assets and systems (Box 2.19).

Box 2.19. Abu Dhabi Government Data Management Standards

The Abu Dhabi government has developed a government-wide data management programme to be implemented by all government entities acknowledging that data are a key asset for the government. The Abu Dhabi Government Data Management Programme aims to improve both the data management functions and the data stored within the government. Owning and using high-quality data is acknowledged as a strategic enabler for the government to achieve its goal of becoming a world-class administration and for government entities to identify and deliver new or enhanced services to stakeholders.

For this reason, the government developed a core set of standards for data management based on six principles:

• Data shall be owned: all information used to enable the government’s work must have a designated owner who is accountable for its proper custody.

• Data shall be described: all data must be appropriately described to allow their content and their purpose within the organisation to be properly understood.

• Data shall be of good quality: all data must be of the appropriate quality for their use within the organisation.

• Data shall be accessible: all data must be accessible to those who have a legitimate reason to use them and securely protected against loss, damage or misuse.

• Data shall be used and shared: all data must be available to share easily with any legitimate party, and their use must be appropriately managed.

• Data management shall be implemented: appropriate management of all data must be implemented through initiatives designed to introduce or strengthen particular data management capabilities.

Source: Abu Dhabi Government (n.d.[84]), Data Management Standards, https://addata.gov.ae/sites/default/files/AD-Gov-Data-Management-Standards-EN-v1.0.pdf.

Principles for data management that underpin data standards cover a wide range of data-related domains of both a management and a technical nature (Figure 2.6). Two messages from this experience are that it is not necessary to develop overly complex frameworks to build trust and manage data, and each government body or level of government should develop a programme that is suitable to meet the requirements for compliance with the standards while meeting their own requirements of data. The data management standards are intended to direct government entities and other stakeholders in areas requiring focus for the application of data management controls. Adherence to the control standards means data management controls are being consistently deployed across government entities. Authorities in Abu Dhabi developed control standards that represent the government’s expectations for data management. Those are expressed in 13 domains of data management that are interrelated and mutually supportive. Entities and business partners handling government data are responsible for understanding the control standards and applying them in the context of all data assets they own.

Figure 2.6. Abu Dhabi Government Data Management Model

Source: Abu Dhabi Government (n.d.[84]), Data Management Standards, https://addata.gov.ae/sites/default/files/AD-Gov-Data-Management-Standards-EN-v1.0.pdf.

Critically, implementing data standards contributes to ensuring data quality, which is also another factor that builds trust in government capability for data management. Data standards improve data quality for better and more insightful decision making and allow for the reuse of data elements, thus reducing redundancy and enhancing reliability while also bringing down the cost of data management. Determining data quality is highly linked to data management standards. For example, Statistics Canada has developed guidelines for data quality defined around six quality dimensions: relevance, accuracy, timeliness, accessibility, interpretability and coherence (Box 2.20). These guidelines constitute practical measures that government organisations, all levels of government and private stakeholders can adopt to ensure data quality. There are several common points between Canadian and Japanese practices. For example, Japan’s Public-Private Data Utilisation Act calls for the promotion of Open Data by Design in order to reflect user needs and ensure that the information published is kept up to date and published on a website in an easily searchable and usable form (Government of Japan, 2016[45]). A system of data quality assessment is critical to foster data accountability in the management of data.

Box 2.20. Statistics Canada: Guidelines for ensuring data quality

The Canadian statistical system defines data quality using six dimensions: relevance, accuracy, timeliness, accessibility, interpretability and coherence.

• Relevance: This refers to the degree to which data meet real user needs. To ensure relevance, organisations should create and maintain a list of current and potential users of all of the statistical organisation’s statistical products, maintain bilateral and multilateral contact with the key users and determine data use and user satisfaction, among others.

• Timeliness and punctuality: Timeliness refers to the delay between the information reference point (or the end of the reference period) and the date on which the information becomes available. Punctuality refers to the difference between planned and actual availability. Actions include planning and developing a schedule for each production phase, ensuring they are carried out with regular follow-up mechanisms, and agreeing with data providers on an availability calendar for their databases.

• Accuracy and reliability: Accuracy is the degree to which the information correctly describes the phenomena it was designed to measure. Reliability reflects the degree to which statistical information, consistently over time, correctly describes the phenomena it was designed to measure. Actions include using appropriate quality control methods and quality assurance processes to detect and control potential errors in the various phases of the production process and using new technologies to automate procedures as much as possible to minimise errors from manipulation and data inconsistency.

• Accessibility and clarity: This refers to the ease with which users can learn that the information (including metadata) exists, find it, view it and import it into their own work environment. It also refers to the cost users need to incur to access data. Actions include establishing a system for documenting and archiving statistical data, providing multiple access and extraction methods, and making data files accessible for future analytic activities.

• Interpretability: This refers to the availability of supplementary information and metadata needed to interpret and use statistical information appropriately (e.g. underlying concepts, variables and classifications used and the methodology of data collection and processing). Actions include consulting the organisation’s data interpretability policy, ensuring that the organisation’s metadata base is up to date and ensuring the availability of quality indicators.

• Coherence and comparability: It refers to the degree to which data can be reliably combined and compared with other statistical information within a broad analytical framework over time but does not necessarily imply full numerical consistency. Actions include keeping concepts, definitions, classifications and methodologies up to date, keeping an up-to-date document of methodologies and frameworks for acquiring administrative data and collecting data from field operations and using a common frame for all surveys of the same type.

Source: Statistics Canada (2019[85]), Guidelines for Ensuring Data Quality, https://www150.statcan.gc.ca/n1/pub/12-539-x/2019001/ensuring-assurer-eng.htm.

Valuable experience can be learnt from the scientific data management field on standardisation. The FAIR Guiding Principles for scientific data constitute a concise and measurable set of principles to enhance the reusability of data (Box 2.21). The FAIR principles (Findability, Accessibility, Interoperability and Reusability) guide producers and publishers to maximise the added value gained by contemporary, formal scholarly digital publishing, ensuring that all components of the research process are available, fostering transparency, reproducibility and reusability (Wilkinson et al., 2016[86]). These principles have been adopted by research institutions worldwide. These principles suggest that, to make data findable, it should have sufficiently detailed descriptive metadata as well as a unique and persistent identifier such as a digital object identifier (DOI). To be accessible, data should be understandable to both humans and machines and stored in a trusted repository. For data to be interoperable, metadata should use a formal, accessible, shared and broadly applicable language for knowledge representation, such as agreed-upon controlled vocabularies. Finally, the principles suggest that for data to be reusable, they should have a clear usage license and provide accurate information on provenance. Although the FAIR principles are aimed at the academic community, they could provide valuable input for data management in smart city projects, enhancing data standardisation and interoperability. The city of Vienna uses the FAIR principles as part of the data spectrum of the Open Data Institute (ODI).

Box 2.21. The FAIR Guiding Principles for scientific data management

For data to be Findable:

• (Meta)data are assigned a globally unique and persistent identifier.

• Data are described with rich metadata.

• Metadata clearly and explicitly include the identifier of the data they describe.

• (Meta)data are registered or indexed in a searchable resource.

For data to be Accessible:

• (Meta)data are retrievable by their identifier using a standardised communications protocol.

• The protocol is open, free and universally implementable.

• The protocol allows for an authentication and authorisation procedure, where necessary.

• (Meta)data are accessible, even when the data are no longer available.

For data to be Interoperable:

• (Meta)data use formal, accessible, shared and broadly applicable language for knowledge representation.

• (Meta)data use vocabularies that follow FAIR principles.

• (Meta)data include qualified references to other (meta)data.

For data to be Reusable:

• Meta(data) are richly described with a plurality of accurate and relevant attributes.

• (Meta)data are released with a clear and accessible data usage license.

• (Meta)data are associated with detailed provenance.

• (Meta)data meet domain-relevant community standards.

Source: Wilkinson, M. et.al. (2016[86]), “The FAIR Guiding Principles for scientific data management and stewardship”, https://doi.org/10.1038/sdata.2016.18.

Promoting open data should be part of a smart city data strategy

Promoting openness and transparency is a top priority for OECD countries. In particular, governments pursue opening up government data to empower citizens, foster innovation, create business opportunities and improve public services. Open government data are a core component of government-wide data strategies across OECD countries as they strengthen good governance due to the social and business value created by shared and public data (OECD, 2019[3]; 2020[87]). Open data enable the use of data as a platform for greater engagement and collaboration among stakeholders. Policies on open data focus on making data from public organisations available to everyone in open, free and accessible formats. The results of the OECD 2019 Open, Useful and Reusable Data (OURdata) Index revealed overall improvements in open government data policies and practices at the national level (OECD, 2020[87]) (Figure 2.7).

As Figure 2.7 shows, the results of the 2019 OURdata Index revealed an overall growing maturity in terms of open government data at the national level across OECD member countries. The improvements were driven by better data availability, increased data accessibility and stronger government support to open data policies. However, the OECD has found that while countries often include elements of data governance in their national digital government strategies, such as open data, data management and/or AI strategies, these elements are often fragmented (OECD, 2019[3]). This disconnection may be rooted in the governance arrangements, such as different organisations leading the open data policies, lack of clarity in the definition of responsibilities or even lack of leadership. These problems create a barrier to data sharing and integration, hindering smart cities’ development.

Some countries have introduced specific arrangements to facilitate access, share and reuse of policy or sector-specific datasets. These arrangements benefit a number of organisations that share common goals and mandates. For example:

• In Sweden, the National Geodata Strategy of the National Land Survey authority was developed to cover all strategic issues related to handling geodata in the country. Its aim to build up a national infrastructure for geodata and encourage increased co-operation within the geodata sector. Lantmäteriet, the Swedish mapping, cadastre and land registry authority, is responsible for implementing the strategy in co-operation with the Geodata Advisory Board and other stakeholders (Lundquist, Rannestig and Sandgren, 2010[88]). The strategy led to the creation of the National Geodata Platform to provide access to nationally standardised basic data in various processes in society.28

• In Japan, the central government has implemented an evidence-based and data-driven approach to improve the impact of policies since 2017. Japanese authorities are promoting the open data initiative, in which the government widely discloses public data in machine-readable formats and allows secondary use of the public data for profit making or other purposes (Box 2.22). This initiative has the goals of improving people’s lives and stimulating corporate activities and, in turn, contributing to the social and economic development of the country. The Public-Private Data Utilisation Act instructs both central and local governments to make their data easily accessible to the public to use and reuse (Government of Japan, 2016[45]).

Figure 2.7. Open Useful Re-Usable data (OURdata) Index, national level, 2017-19

Source: OECD Open Government Data Survey, published in OECD (2019[89]), Government at a Glance 2019, https://doi.org/10.1787/8ccf5c38-en.

Box 2.22. Japan’s policy framework on open data for the national level

Japan’s policy framework on open data is composed of:

• The 2013 Open Data Charter Action Plan sets the measures for using public data in the country. It states that the central government cannot require local governments to release data; they will do so at their own discretion. However, the central government should provide information on best practices to encourage local governments to share their data. The central government commits to the publication of key data sets (e.g. national statistics, national elections and national budgets) and high-value datasets (e.g. crime and justice, education, energy and environment, finance and contracts, geospatial, social mobility and welfare, and transport and infrastructure). Data are published on a national portal while promoting public engagement in open data activity.

• The 2017 Basic Principles on Open Data is the main policy document for open data in Japan and ensures the implementation of the Public-Private Data Utilisation Act. This document defines open data as public and private sector data held by the national government, local governments and companies, published in a form that is of easy access and use to all citizens via the Internet. It recommends that multiple organisations (i.e. local governments) jointly set up an open data portal site to facilitate access to standardised data across organisational boundaries.

Source: Government of Japan (2013[90]), Japan Open Data Charter Action Plan, https://japan.kantei.go.jp/policy/it/2013/1029_fulltext.pdf; Government of Japan (2017[91]), “Basic Principles on Open Data (provisional translation)”, https://cio.go.jp/sites/default/files/uploads/documents/data_shishin_en.pdf; Government of Japan (2016[45]), 官民データ活用推進基本法 [Basic Act on the Advancement of Public and Private Sector Data Utilisation], https://japan.kantei.go.jp/policy/it/data_basicact/data_basicact.html; OECD (2019[92]), OECD OURdata Index: 2019, www.oecd.org/gov/digital-government/ourdata-index-japan.pdf.

Other countries have implemented measures to facilitate data sharing across levels of government. The aim is to ensure that the central government has access to data owned and produced by local authorities. While central authorities can define overarching data quality standards, in practice, local governments are responsible for ensuring data quality. For example:

• In Mexico, the national government has developed the Open Mexico Network (Red México Abierto). It is a network that seeks to encourage the exchange of mechanisms to establish open data policies at the local level, engage local governments in the central open data policy and facilitate the publication of open government data produced by local authorities on the central open data portal datos.gob.mx. More than 700 open databases have been published across 32 states and 25 municipalities (Government of Mexico, 2018[93]).

• In Japan, the central government has realised that most interaction with citizens takes place at the local government level. It has therefore made considerable efforts to try to encourage the adoption of the “open by default” principle among local governments. To this end, it has organised seminars where it presented the benefits of open data and involved local governments in central-level working groups for open data initiatives across the country. Moreover, the central government has created the portal data.go.jp, which contains over 24 000 datasets from 22 public central government organisations and 17 groups (e.g. land and climate, mining and manufacturing, housing, estate and construction and administration and public finance). The portal features a developer’s page that provides a variety of information needed for developers of applications or new services using metadata from the portal.

At the local level, digital technologies have increased the amount of data produced by the city’s residents through different sensors located in the urban space (e.g. cameras, meters, motion detectors, among others). Data are also generated through crowdsourcing, such as peer-to-peer platforms, voluntary citizens’ feedback and data collected via smartphones and other connected devices. In France, for example, the city of Paris has made all structured data accessible by open license to promote their reuse and generate new applications since 2010. The city government also supports: i) big data analysis solutions, which are made more personalised and proactive through predictive and preventative approaches; and ii) open innovation with its partners through data exchanges that are kept secure and confidential, in line with the recommendations of the French data protection authority (Mairie de Paris, 2020[80]).

Data governance frameworks also make efforts to ensure access, sharing and collection of information and data across sectors. For instance, in the context of smart city projects, business-to-government reporting practices can benefit from the implementation of common data governance structures and tools across all layers of the governance model. For example, Seoul’s integrated public sector data dashboard serves to strengthen public sector accountability through the centralisation of cross-sectoral data (Box 2.23).

Box 2.23. Seoul’s integrated public sector data dashboard

In 2017, Seoul launched the Digital Mayor’s Office, an integrated public sector data dashboard that aggregates multisectoral urban data to visualise the overall city status and produce indicators in real time. The dashboard supports accurate and streamlined decision making by the mayoral office on a daily basis through effective and up-to-date displays of city status, main policies and main project information, as well as functionalities such as video conferencing. The Big Data Division and the City Planning Division have led the establishment of a standard data integration framework and identification/co-ordination of necessary inputs from other departments respectively.

The inputs to the dashboard include 32 million data items from over 300 different information systems, such as TOPSIS (Technique for Order of Preference by Similarity to Ideal Solution) and more than 2 800 real-time CCTV feeds. The dashboard is mainly built upon an existing open data platform called Seoul Open Data run by Seoul, which covers all sorts of data published by the public sector classified into 16 categories, including education, transportation, healthcare, weather, etc. Furthermore, the dashboard has an additional scope of data, including public opinion trends, civic complaints and information on major projects.

The dashboard has been disclosed to the public since April 2020 through a large screen at three major subway transfer stations and made accessible on a website (http://scpm.seoul.go.kr/) via computers and mobile devices. It helps enhance the accountability of administrative decision making by enabling monitoring and feedback by citizens, the reporting and processing status of which is also integrated into the dashboard.

While a large portion of data comes from other open data platforms run by the public sector that already incorporate appropriate anonymisation steps in stages of collection or sharing to protect privacy, the dashboard ensures that all contents are presented without privacy-related information.

Note: TOPSIS is a multi-criteria decision analysis method.

Source: SCPM (n.d.[94]), Whitepaper, http://scpm.seoul.go.kr/resources/whitepaper_EN.pdf; Development Asia (2021[95]), Digital Mayor's Office: An Integrated Smart City Data Platform, https://development.asia/case-study/digital-mayors-office-integrated-smart-city-data-platform; Seoul Metropolitan Government (2020[96]), “Seoul’s “Smart City Platform for Mayor” to lead global communication in the age of “untact”, https://english.seoul.go.kr/seouls-smart-city-platform-for-mayor-to-lead-global-communication-in-the-age-of-untact/.

Enhancing co-ordination for smart city data sharing

The development of smart cities has been accompanied by the installation of data-sharing platforms as part of the data strategy and data governance arrangements. Countries and cities have thus been working to ensure the existence of a data architecture that reflects data quality standards, semantics and interoperability for data processing and sharing. Interoperability is an essential element to contribute to digital transformation and is vital to put smart city initiatives in place to ensure a modern, efficient and effective administration. Until a decade ago, smart cities depended on the use of information and communication technologies and the Internet, but now data and their management make smart cities possible. The lack of adequate data governance arrangements can lead to duplication of data standards and technical solutions for data sharing, which would constitute a barrier for data interoperability across sectors, organisations, levels of government and across cities. Limited data flows hinder the development of new technologies and the development of better services to face challenges such as ageing and shrinking populations experienced in countries such as Italy, Japan, Korea, Poland and Spain, to name a few. This would be reflected in inefficiencies in service provision as citizens would be asked to provide the same information several times to the public administration.

Changing the mindset of city administrations is one of the critical challenges cities must face in improving data management and governance. The hierarchical and siloed organisation of cities is affecting their functionality and preventing them from benefitting from digitalisation. The experience of Helsinki, Finland, is that to make the most of the opportunities digitalisation provides, cities must offer digital services in a secure, personalised, user-friendly manner and provide them proactively and at the right time.29

A smart city data governance framework boosts the interoperability of heterogeneous data

The need for city administrations to interact with other public and private organisations and to exchange data or documents is increasing and becoming more important in the context of digitalisation and smart city building. These interactions, which are part of the digital transformation of countries and cities, are also becoming more complex as organisations are more interdependent. The ability of services to communicate and exchange information in an efficient, effective, quick and simple manner with other services across organisations and cities in order to achieve mutual development goals is not only demanded by political powers but expected by citizens.

Interoperability can be defined as “…the ability of different digital services to work together and communicate with one another. Digital platforms can develop application programming interfaces which enable these connections” (OECD, 2021, p. 13[97]). In 2021, the European Commission commissioned a proposal for an European Interoperability Framework for Smart Cities and Communities (EIF4SCC) where interoperability was defined as “[t]he ability of organisations and individuals to interact towards the delivery of services in cities and communities, through the exchange of data, information and knowledge, enabled by aligned processes and digital technologies, taking into account security and privacy issues” (EC, 2021[98]). Interoperability allows access and processing of data from multiple sources without losing meaning. It permits the integration of data for mapping, visualisation and other forms of representation and analysis. Interoperability enables people to find, explore and understand the structure and content of datasets to help create a contextual and holistic picture for analysis, better decision making and greater accountability.

National interoperability frameworks can guide interoperability at the local level

Some national governments guide the development or establishment of data governance arrangements through a national interoperability framework (NIF). A NIF generally aims to intensify and extend the collaboration and co-ordination among the concerned stakeholders by improving the practical aspects of the governance of interoperability. It provides a catalogue of interoperable services using the cartography of existing services. However, building national interoperability requires a behavioural change based on principles that constitute fundamental aspects of driving interoperability actions in every central and local government body:

• Openness and transparency regarding data, specifications and software used as well as procedures and services provided with the data.

• Emphasis on solving residents’ problems and generating benefits. Data provided by residents should be returned in the form of benefits (i.e. products or services) that improve their lives.

• Inclusion and accessibility. Access to data should be a possibility for everyone and data should even be provided in several languages spoken in the city or country.

• Building synergies through data linkage. This refers to the reuse, reusability and sharing of data. When using data from other entities, it is necessary to see if the initiatives created produce synergistic effects as open innovation. Careful consideration should be given to the minimum data required to create value with the minimum amount of data linkage.

• Fostering transparency in data management. Most of the data that circulates in smart cities originates from residents’ activities; thus, residents are the owners and should be able to exercise their rights regarding their use. It should be possible for individuals to verify how their data are being used based on appropriate consent and there should be appropriate opt-out procedures for that use if necessary.

The European Union is encouraging member states to focus on interoperability for digital services. The European Union’s internal market guarantees freedom of free movement of goods, capital, services and people among states. Interconnected, interoperable networks and systems guarantee these freedoms. People and businesses must interact electronically with member state public administrations when looking for work abroad or reallocating their business. Member states are modernising their public administrations by introducing digital public services to make these interactions efficient, effective, timely and of high quality and to help cut red tape and reduce the cost and effort involved (EC, 2017[99]). However, there is a risk of creating isolated digital environments and, consequently, electronic barriers that may prevent national public administrations from connecting with each other and citizens and businesses from identifying and using available digital public services in countries other than their own. To avoid that, the European Commission developed the European Interoperability Framework (EIF) to give guidance to member states through a set of principles and practical recommendations as part of an interoperability model applicable to all digital public services of the union (Box 2.24). The EIF was originally prepared in 2010 and revised in 2017 to push a more ambitious vision for the interoperability framework and to factor in the latest technical evolutions.

The experience of the EIF offers major lessons to consider. Interoperability governance is the key to a holistic approach to interoperability, as it brings together all the instruments needed to apply it. Co‑ordination, communication and monitoring are elements of the utmost importance for successful interoperability governance. Moreover, setting standards and specifications is fundamental to operationalise interoperability and ensuring data are the same for all users. A critical lesson is that when preparing legal instruments, organisation business processes, information exchange, services and components that support public service interoperability should be at the core of works. Interoperability is a continuous task, as it is regularly disrupted by changes to the environment, such as legislation, the needs of businesses or citizens, political priorities, etc. Similarly, this experience suggests that an information management strategy should be drafted and co-ordinated at the highest possible level of the organisation to avoid fragmentation and set priorities.

Box 2.24. The European Interoperability Framework

In 2017, the European Commission adopted the European Interoperability Framework (EIF) as a commonly agreed approach to the delivery of European public services in an interoperable manner. The EIF defines basic interoperability guidelines in the form of common principles, models and recommendations. It includes 12 underlying principles: subsidiarity and proportionality, openness, transparency, reusability, technological neutrality and data portability, user-centricity, inclusion and accessibility, security and privacy, multilingualism, administrative simplification, preservation of information and assessment of effectiveness and efficiency. The EIF also includes an interoperability model, which is applicable to all digital public services and may also be considered as an integral element of the interoperability by design paradigm. Figure 2.8 depicts the components of this model.

Figure 2.8. The European Interoperability model

• Interoperability governance is the background layer. It refers to decisions on interoperability frameworks, institutional arrangements, organisational structures, roles and responsibilities, policies, agreements and other aspects of ensuring and monitoring interoperability at the national and European Union (EU) levels.

• Integrated public service governance is a cross-cutting component of the four layers of interoperability. European public service provision often requires different public administrations to work together to meet end users’ needs and provide public services in an integrated way. When multiple organisations are involved, there is a need for co‑ordination and governance by the authorities with a mandate for planning, implementing and operating European public services.

• Legal interoperability is about ensuring that organisations operating under different legal frameworks, policies and strategies are able to work together. To ensure legal interoperability, member states have to perform “interoperability checks” by screening existing legislation to identify interoperability barriers: sectoral or geographical restrictions in the use and storage of data, different and vague data licence models, etc.

• Organisational interoperability refers to the way in which public administrations align their business processes, responsibilities and expectations to achieve commonly agreed and mutually beneficial goals. It also aims to meet the requirements of the user community by making services available, easily identifiable, accessible and user-focused.

• Semantic interoperability ensures that the precise format and meaning of exchanged data and information is preserved and understood throughout exchanges between parties. A starting point is to perceive data and information as a valuable public asset.

• Technical interoperability covers the applications and infrastructures linking systems and services. This includes interface specifications, interconnection services, data integration services, data presentation and exchange and secure communication protocols.

Acknowledging the importance of interoperability for the well-being of inhabitants, businesses, visitors and city/community administrators in the European Union, the European Commission commissioned a proposal for a European Interoperability Framework for Smart Cities and Communities (EIF4SCC). The aim is to provide EU local administration leaders with definitions, principles, recommendations, practical use cases and a common model to facilitate service delivery to the public across domains, cities, regions and borders. It is based on five principles that define the direction of the interoperability in smart cities and communities: i) a human-centric approach; ii) a city needs-led approach at the EU level; iii) the city as a participatory-driven and open innovation ecosystem; iv) ethical and socially responsible access, use, sharing and management of data and technology; and v) technologies as key enablers, not as the objective.

Source: EC (2017[99]), New European Interoperability Framework: Promoting Seamless Services and Data Flows for European Public Administrations, https://ec.europa.eu/isa2/sites/default/files/eif_brochure_final.pdf; EC (2021[98]), Proposal for a European Interoperability Framework for Smart Cities and Communities (EIF4SCC), https://op.europa.eu/en/publication-detail/-/publication/f69284c4-eacb-11eb-93a8-01aa75ed71a1/language-en.

Based on the renewed EIF, Luxembourg has developed a data governance framework in the context of the NIF (Box 2.25). This framework takes a progressive approach to interoperability as it includes principles such as digital first, once-only and transparency. The NIF covers levels of interoperability such as: legislation, organisation, semantics and technique. The experience of Luxembourg’s NIF is rather recent and it is not yet possible to analyse its impact or results. However, it suggests that adopting an NIF does not necessarily guarantee achieving its defined objectives and benefits per se, but rather marks the starting point for the long-term implementation of interoperability across government. The implementation of an NIF requires the participation of a wide number of stakeholders to produce tangible and concrete field measures. This requires setting an effective and efficient governance framework on all levels to implement the NIF and its principles.

In Argentina, national public sector organisations are mandated by law to exchange the public information they produce, obtain, work with or are responsible for with any other public body that requests it (Government of Argentina, 2016[100]). To this end, the Ministry of Modernisation is responsible for the creation of the exchange protocols, interoperability guidelines and complementary, explanatory, technical and operational standards necessary for data sharing. A key tool has been the creation of the interoperability module of the electronic management system called INTEROPER.AR. This module functions as an exchange node between the national public sector organisations’ different information systems and database (Government of Argentina, 2018[101]). The national government has invited provincial and municipal governments to enter into co-operation agreements with the national government to form a decentralised node network by which information and data are shared across different levels of government. Each public body is constituted in an interoperable services module (MSI) node that together make up a decentralised network. The information between nodes is shared through services and only those authorised areas can access the data exchange through validations, electronic authentication forms and the use of digital certificates.30 While in Argentina, there is a need for formalising a data governance structure at the strategic layer in the case of INTEROPER.AR illustrates the potential scalability of an interoperability tool. In this case, its application is being expanded to subnational levels of government.

Box 2.25. Luxembourg’s National Interoperability Framework

In March 2019, the government of Luxembourg adopted the NIF, building on the new EIF while taking into account the context and specific national needs. The implementation of the NIF is expected to: boost efficiency and effectiveness gains; reduce costs (financial and human resources) in service development; produce time savings in service provision; improve the quality of services (notably via standardisation, reuse and mutualisation of services); enhanced services security via standardisation and elimination of superfluous services; and lead to more transparency and openness for the end users and those in charge of service delivery.

The NIF aims to improve the practical governance of interoperability, intensify and extend the collaboration between the different concerned actors, complete and extend the mapping and the cartography of existing services and put interoperability at the centre of every project, action or decision (interoperability by design).

The NIF includes 48 recommendations at its core which provide a framework for the interoperability actions to be undertaken. The recommendations guide all concerned public sector stakeholders in integrating interoperability into any new service delivery project from the outset or how to adapt their existing services to be interoperable.

The government established the National Committee for Interoperability (CNI), composed of representatives of the various sectors concerned, to advance interoperability generally at the national and sectoral levels. The CNI oversees sectoral committees for interoperability. In every ministry, there is a Competence Centre for Interoperability responsible for the implementation of the NIF.

Source: Government of Luxembourg (2019[102]), National Interoperability Framework, http://digital.gouvernement.lu/en/dossiers/2019/NIF-2019.html.

Ensuring the interoperability of datasets is a critical step in building smart cities based on data. Interoperability frameworks ensure that subnational governments, in particular cities, have the necessary understanding of the standards to manage data, semantics and platforms to facilitate data sharing across cities. According to international experience, to achieve interoperability (i.e. how data are formatted allows diverse datasets to be exchanged and merged into meaningful ways), it is necessary to ensure data compatibility (i.e. data consistency across datasets). This would facilitate the use and exchange of data. For that purpose, a common understanding of the meaning of data needs to be agreed between the data provider and user. Continuous dialogue among different stakeholders (i.e. local governments, private companies, experts and individuals) is essential to maintain compatibility. Discussion on data meaning should be cross-sectoral so that data can be used and various services provided.

For example, in 2020, the Japanese central government adopted the Government Interoperability Framework (GIF) to use city data to create new value by structuring and ensuring high-quality data (Government of Japan, 2020[103]). This will enable services to be offered across cities, regions and even borders, not only in a single city. The GIF is a generic framework applicable to all entities of national and local governments. It lays out the basic conditions for achieving interoperability, acting as the common denominator for relevant initiatives across the country involving the public and private sectors and citizens. The GIF stresses the importance of receiving feedback from residents as users. The reason is that residents’ participation would allow the creation of more and new services tailored to their needs. The GIF acknowledges that innovation in service delivery is possible not only through government and private sector actions but by the active participation of citizens.

National guidelines and recommendations can facilitate interoperability within and across (smart) cities

To enable interoperability, countries generally enact legislation to define a set of rules to control access to and sharing of data. Regulations help in the definition of common data standards and their enforcement to promote greater data interoperability and streamlined data-sharing practices. In general, these regulations focus on the central/national-level government organisations but subnational governments are also encouraged to emulate those practices. This is seminal in the formation of smart cities as it would ensure a common understanding and semantics across levels of government on data features facilitating data flows across levels of government. Across OECD member and partner countries, examples of data-sharing regulatory instruments are vast (OECD, 2019[3]). In many cases, regulation is supported by softer legal and regulatory instruments such as guidelines, recommendations or codes of practice. For example:

• In Argentina, to help organisations to implement the Open Data Policy, the national government issued the Guide for the Identification and Use of Interoperable Entities. These are basic and fundamental data whose use is frequently repeated between datasets of different themes and sources. The guide provides public and private sector organisations with simple methods to generate, share and/or consume good-quality government-held data (OECD, 2019[3]). Interoperable entities are those that allow datasets to talk to each other but this cannot happen when two datasets name the same interoperable entity differently. In order for datasets to be interoperable, the guide establishes that all interoperable features present in a dataset must be identified and data about them followed by the same standard (Government of Argentina, n.d.[104]).

• In France, the national government issued the General Reference Framework for Interoperability (Référentiel général d’interopérabilité, RGI) in a quest to promote interoperability across information systems within the public sector. It is largely based on the EIF and sets standards for each level of interoperability (i.e. political, legal, organisational, semantic and technical). A critical element is that the RGI is open to adaptation to new technological developments, the evolution of standards and the need for interoperability. The RGI introduces the concept of interoperability profile (profil d’interopérabilité), which is a limited set of standards to use in a context and a determined use. The objective is to frame the use of the RGI and avoid the proliferation of standards and combinations of standards for a given use (Government of France, 2015[105]).

• In Italy, the Agency for Digital Italy published a White Paper on Artificial Intelligence at the Service of Citizens in 2018. It aims to improve the quality and usability of the data they provide to facilitate their use in refining AI systems (OECD, 2019[3]). The paper argues that the quality and interoperability of data are determining factors for the possibility of applying new technologies. It acknowledges that a challenge for digitalisation and interoperability is that data coming from a multitude of connected devices can be fragmented, heterogeneous and distributed irregularly in space and time. To face this situation, it recommends public administration aggregating data through the creation of an open platform for the collection, generation and management of certain types of data directly related to public administration (Agency for Digital Italy, 2018[106]).

For interoperability to enable a more efficient city administration, a citizen-oriented approach is required

National experiences in fostering interoperability suggest that enabling joined-up data is a way to improve decision-making processes and make service delivery more efficient and effective. Indeed, data-sharing frameworks should link desired policy outcomes (e.g. reduced congestion, building liveable cities, improved accessibility, etc.) to the regulatory and planning methods or use cases that may deliver those outcomes (e.g. congestion management, travel activity monitoring, data to support infrastructure interventions, etc.). Outcomes and methods should be linked to the specific data required to carry out those regulatory and planning actions. This includes rules relating to an appropriate level of aggregation, data handling, data retention period and auditability, as well as data destruction protocols (ITF, 2020[107]). For example:

• In Spain, all public administrations are connected to a central data exchange node called the “platform for data intermediation” (Box 2.26). One of its main achievements has been the reduction in the administrative burden of data sharing. Its message is that, as far as possible, under the legislation in force, cities/communities service users should be asked for once-only and relevant-only information, ensuring a fully transparent process on how data are used. The Spanish experience shows that data-sharing mandates on the part of public authorities should build on data minimisation concerns by default.

Box 2.26. Adopting a human-centric approach to interoperability – The case of Spain

The Spanish central government has set up a Technology Transfer Centre that publishes a general directory of applications and/or solutions whose objective is to favour the reuse of solutions by all public administrations. This portal informs about projects, services, semantic assets, regulations and solutions that are being developed in the field of electronic administration. As part of the digitalisation strategy, the government introduced the Data Intermediation Platform (Plataforma de Intermediación de Datos, PID), which connects all public administrations to a central data exchange node and reduces the administrative burden of data sharing. It is based on Law 39/2015 on Common Administrative Procedure, which states that citizens do not have to provide any data or document already held by the public administration. The exchange of data between public administrations is a fundamental task when it comes to providing advanced electronic administration services to citizens, improving the efficiency and effectiveness of organisations. Through the PID, all public administrations can consult any of the more than 130 certificates offered by more than 45 data providers, both from the General State Administration and autonomous communities, local entities, universities and other public entities. Among the data available are the identity and residence data of a citizen, data related to unemployment, official qualifications, cadastral data, etc. Citizens’ authorisation to consult the data is requested. The PID has proven to be effective and has been well received by organisations, processing more than 531 million data queries from its start-up to 2020, generating estimated savings to date of more than EUR 2 700 million since 2007.

Source: Government of Spain (n.d.[108]), La Plataforma de Intermediación de Datos, https://administracionelectronica.gob.es/pae_Home/pae_Estrategias/Racionaliza_y_Comparte/elementos_comunes/Intermediacion.

• In Japan, the central government is the largest data holder, player and platformer in the country. Thus, the central government, with the support of the private sector, launched a cross-domain data exchange and use platform called DATA-EX in 2020 (Figure 2.9). The data platform consists of the glossaries, code sets and data models needed for data flows. The platform is to serve as a data search engine (data available in Japan and abroad), allow users to access the data they require (download data, API acquisition, contracts, transactions) and connect the required data (data collaboration, interoperability and data cleansing). DATA-EX aims to link different platforms already in operation: national government open data, local government open data, data platform of Tokyo Metropolitan Government, personal data store, information bank, data trading, public transportation, agriculture, geography and academia. DATA-EX intends to create a large data trading community in Japan, spanning across industry, academia and government and contribute to the promotion of a cross-industry and cross-border data exchange environment. The platform is expected to serve the multinational trading corporation’s domestic and foreign network by enabling the sourcing, exchange, sharing and commercialisation of data products by leveraging the platform’s advanced features and capabilities. The information systems of smart cities collect data across many networks, such as the fifth-generation technology standard for broadband cellular networks 5G. The data that come from the electrical component of a smart building, the transport network or the state of the road traffic must interact to bring value. At the end of the chain, algorithms and AI provide insights allowing communities to explore new areas of development. The interconnection of networks and the crossing and correlation of data flows largely determine the success, efficiency and value of an information system.

Figure 2.9. Examples of priority areas of Japan’s DATA-EX platform

Source: Based on Government of Japan (2021[7]), National Data Strategy, https://www.digital.go.jp/assets/contents/node/basic_page/field_ref_resources/0f321c23-517f-439e-9076-5804f0a24b59/20210901_en_05.pdf.

Promoting interoperability requires the collaboration of a wide number of actors from different levels and policy domains

Open collaboration among cities as well as minimal digital interoperability based on open standards are crucial for the successful digital transformation of public administrations. Interoperability will only be possible if a governance framework facilitates collaboration and co-operation among different actors. The experiences of the Nantes Métropole in France and Takamatsu City in Japan show that collaboration among cities, regardless of their size, allows for better and more comprehensive data collection, economies of scale in terms of data collection and pulling resources towards a common platform.

Interoperability can be categorised as vertical and horizontal. The former refers to the ability of digital services to incorporate data of content from an upstream provider such as the central or regional government, while the latter refers to the possibility of digital services to communicate with other services, which could come from other cities, agencies, private sector and even citizens. For example, Japan’s GIF covers three types of interactions:

• City to city, which refers to interactions between local governments.

• City to business, which refers to interactions between local administrations and businesses.

• City to citizens, which refers to interactions between the local government and citizens.

At the horizontal level, interoperability is ensured through agreements among local governments and among local governments and private sector actors. Cities may organise fora for the exchange of ideas, get partners for new smart city-related projects and draw lessons from other experiences. The experiences of the cities of Takamatsu and Toyama suggest that collaboration among local governments is not enough to ensure interoperability and ensure the optimal use and operation of data-sharing platforms. Partnering with the private sector and academia is essential for sharing lessons, getting to know best practices and finding potential business partners (Box 2.27). Moreover, Toyama’s Sketch Lab and Takamatsu’s Promotion Council constitute fora where discussions on real problems, data needs and how to get and manage them should take into account the needs of a wide number of actors.

Box 2.27. Local fora for collaboration, co-creation and partnering – The case of Takamatsu and Toyama

The city of Toyama has organised the Sketch Lab, which provides an opportunity for private and public actors to take on the challenge of solving regional issues and creates new business opportunities by providing a forum for dialogue. In 2022, there were 202 participants registered in the Sketch Lab from private companies, individuals, corporations and the government. Participants must pay YPN 2 000 a month to be a member and access all sessions organised in the lab. One of the objectives of the Sketch Lab is to promote innovation and co-creation by working together with industry, academia, citizens and government to develop a vision for the future and implement it. Discussion in the lab must ensure that innovations meet the needs of society.

In 2017, the city of Takamatsu installed the Smart City Takamatsu Promotion Council with the aim of discussing ideas to solve regional issues (e.g. economic vitalisation and safety and security) by collecting and analysing public-private data through a common IoT platform. The council is composed of ICT vendors, administrative agencies, education and research institutes, social infrastructure providers, financial institutions, communication network operators, local service providers, technology businesses and members from other sectors. It had 136 members in May 2022 and consists of working groups created for specific regional challenges. The council is carrying out awareness-raising activities with the goal of becoming a smart city with citizen participation, for example holding symposia and offering training courses for citizens in human resource development. The council serves as a forum for partnering; when an actor has a project proposal comes to the forum to present it and discuss it with possible partners to join forces.

Source: Toyama City (2022[109]), “Smart city promotion business”, Presentation given to the OECD on 17 June 2022, Toyama; City of Takamatsu (2022[110]), “Takamatsu City’s Smart City Vision”, Presentation given to the OECD on 24 June 2022, Takamatsu.

In the United Kingdom, London provides another example of how to promote collaboration for data management and sharing. The London Office of Technology and Innovation (LOTI) helps the different boroughs work together by bringing the best digital technology and data to improve service delivery across the Greater London area.31 As of 2022, 23 out of 33 London boroughs were members of LOTI. One of the aims of LOTI is to unlock the value of public sector information by bringing together member boroughs to analyse and act upon their data together. All local public services from the smart city perspective depend on the local mayors of the boroughs. LOTI facilitates collaboration and knowledge sharing to facilitate the digital transformation journey. In the Seoul Metropolitan Area, there is no official operation and consultative body for data management with cities around Seoul, such as Gyeonggi-do and Incheon, but co‑operation takes place for data analysis that is needed jointly. An example is the analysis of commuting data in the metropolitan area, which is of interest to all cities around Seoul.

OECD (2019[3]) research suggests that interoperability requires a common data governance framework to ensure effective implementation of cross-sector data collection, sharing and/or accessing facilities. It is important to ensure seamless business-to-government communication due to the large role private sector companies play in the promotion of smart cities and data collection. Thus, implementing common data governance structures and tools across all layers of governance is essential to facilitate interoperability. This communication and data provision must be simple and avoid unnecessary procedures and red tape. The Netherlands offers a good example of how to reduce the burden imposed on businesses for the provision of information to local authorities and banks (OECD, 2019[3]). The Dutch government has introduced Standard Business Reporting (SBR) that defines a shared public-private data governance framework aimed at reducing the burden imposed on businesses for the provision of information to local authorities and banks. This experience provides an example of smart city initiatives on how to reduce unnecessary requirements and procedures and make data management more efficient, enhancing interoperability.32

Cities are building big data platforms for data management and interoperability

With the adoption of IoT devices and systems for service delivery, many IoT protocols and standards have been developed. IoT devices are generally constrained by their limited functionalities (e.g. memory space and processing capacity) or are closed proprietary systems dedicated to one single task (Ahlgren, Hidell and Ngai, 2016[111]). Sometimes, even market forces work against interoperability, in particular in the IoT domain. This is the case, for example, when smart lighting systems only work with light bulbs from the same vendor with limited possibilities for third parties to be part of the smart system (Fältström, 2016[112]). Ahlgren, Hidell and Ngai (2016[111]) have found that standardised IoT protocols may not be enough to ensure interoperability; systems must be designed with openness considerations (i.e. open data and open platforms) from the outset.

Indeed, across countries, city authorities need to upgrade their capacity and capability for data management. This generally involves a single data platform to manage all data collected through a wide array of IoT devices. The platform is the cornerstone of a system of systems as it will be tasked with linking different fragmented systems. The reason is that not all services are delivered by the same providers that may have their own management platforms for data management. Enabling the use of city data and external data through the platform is key to providing a comprehensive view of the state of the city and designing more tailored services based on the cities and their residents’ particular needs. The effectiveness of the city platform depends to a large extent on the trust the city can ensure in the reliability of the data quality, accuracy and security.

City platforms for data management enable a shift in the approach to data and policy making. Rather than focusing on a vertical siloed approach, data management platforms enable a more horizontal across-the-board approach that maximises the benefits of combining data from many different sources. It enables sharing data across administrative departments within the local administration, across different levels of government, among cities at different locations, not only neighbouring ones, and with private, voluntary and academic organisations. Using a platform to share open data is also a way of improving relations between local authorities and citizens, strengthening co-operation and co-ordination among local governments and across governments at different levels, enhancing efficiency in public administration and boosting innovation in public service delivery. For example, the use and governance of data in Barcelona in Spain, London in the United Kingdom, Nantes Métropole in France and Seoul Metropolitan Government in Korea provide important lessons on how the notion of a smart city can be reconceptualised to be responsible, citizen-centric and privacy-preserving.

• In France, three local authorities – the Loire-Atlantique department, Nantes Métropole and the Pays de la Loire region – have created a common platform for opening up public data. These authorities allow all reusers (citizens, associations, companies, local authorities, etc.) to access a wide range of open data from the same portal. Whether users connect to data.nantesmetropole.fr, data.loire-atlantique.fr or data.paysdelaloire.fr, they benefit from all of the data and features of this shared platform. To ensure an orderly approach to data sharing and consistency of the open data portals in form and substance, the three local authorities issue a charter of uses of the shared approach (Charte des usages de la plateforme Open Data mutualisée) (Nantes Métropole, 2022[113]). These rules of use as well as their evolutions are subject to validation by the co‑ordinators of the pooled approach in the steering committee composed by the three local authorities. In addition, Nantes Métropole participates in the national transport.data.gouv experiment led by the Inter-ministerial Directorate for Digital and State Information and Communication System (Direction interministérielle du numérique et du système d’information et de communication de l’État, DINSIC), the Ministry of Transport and Etalab. The transport.data.gouv platform constitutes the French National Access Point (Point d’Accès National, PAN) and aims to reference all transport data. It contributes to the improvement of the links between data producers and reusers and provides all of the tools and information necessary for their quality, interoperability and reuse.

• In Germany, the city of Hamburg adopted a comprehensive Digital Strategy for Hamburg that establishes the adoption of digital technologies to improve residents’ quality of life. Data are regarded as a key element in the building of digital cities. Thus, the strategy includes the Urban Data Platform Hamburg (UDP_HH) as the technological “data hub” of the city. Its goal is not to be a uniform central data resource but the standardised technical linking of the city’s many decentralised systems and databases (system of systems). Moreover, the Urban Data Hub (UD‑HUB) aims to co-ordinate the handling of urban data. The technical organisational unit is responsible for the strategic management of the common municipal data infrastructure. One of its main tasks is the operation and further development of the UDP_HH as well as the organisation and standardisation of the technical data and process interfaces (e.g. Xbau and Xplanung) and the facilitation of the integration of data from procedures of the urban actors to the UDP_HH (City of Hamburg, 2020[114]).

• In the United Kingdom, London authorities have concluded that cities need a simple well-known and trusted technical means to share data among departments and stakeholders. For that reason, they created the London Datastore, which is an open data-sharing portal where anyone can access data relating to the city. Citizens, business owners, researchers and developers can have access to data provided through more than 700 datasets. The datastore includes a High Streets Data Partnership, a Night Time Observatory, the Planning London Datahub and data on economic fairness. In June 2022, London announced an investment of GBP 500 000 to create a new platform to boost data innovation and establish a data governance body. The new Data for London platform will act as a “central library” for the vast amount of data held across the capital, enabling residents to access both public and private data more easily and in a more sophisticated manner.33

• In Spain, in 2011, the city of Barcelona set the Open Data BCN portal as part of the Barcelona Ciutat digital strategy to ensure and facilitate the access, storage and sharing of public information with the objective of maximising available public resources, exposing the information generated or guarded by public bodies, allowing data access and use for the common good and for the benefit of anyone and any entity interested.34 Public information can be of any type or subject: pictographic documents, statistical data, results of studies or analysis, information on public services, etc. A wide range of users (e.g. private companies, researchers, public institutions or citizens) may make use of information resources for any purpose, maximising the economic and social possibilities offered by this project: promotion of transparency in management, improvement of services to citizens, generation of business activities and social impact, in search of efficiency in governance. The Open Data BCN service is transversal to several of the pillars of the city’s digital strategy35 and is based on the principle that all public information managed by municipal public entities must be publicly exposed by default, allowing their reuse. The Open Data BCN service provides information in an automatically processable manner, enabling processing efficiency through the latest and most advanced technologies.

• In Korea, the Seoul Metropolitan Government (SMG) has created a system for data management to respond to future challenges pre-emptively and leverage advanced technology to build confidence in smart services. The system is known as the 6S model for a smart city-based infrastructure (Figure 2.10). It is a simple but comprehensive system for converging and linking high technology and data. Its first component is the Smart Seoul Network (S-Net), a smart city communication infrastructure that can provide smart city services throughout Seoul’s public living area. It is the foundation of the future smart city Seoul that guarantees citizens the right to communicate and solves numerous urban problems. Data are collected from the different IoT devices (Smart Seoul Data of Things, S-DoT). IoT sensors are installed throughout the city of Seoul to collect, distribute and analyse various urban phenomenon data such as fine dust, living population, noise and illumination at once, and use it to formulate data-based urban policies and discover services for citizen feeling, and to implement a safe city by collecting and utilising smart CCTV city safety data. Then, the S-Data integrates all data from Seoul Metropolitan Area to use in real time. It collects, shares and utilises all data from the city of Seoul to promote the data economy and play the role of smart city infrastructure to implement Data Sharing Seoul. The S-Brain analyses a wide range of data across municipalities, including administration, transportation and environment, to support AI-based decision making that creates new services. Data are also used in the S-Map, which is an advanced system that implements Seoul equally in three-dimensional (3D) virtual space and predicts changes related to urban planning, environment and safety, enabling evidence-based policy responses. In response to the increasing security threats of new smart city technologies, the S-Security provides safe public administration services through accident prevention and implements measures to ensure the safety of personal information.36 A key message from Seoul’s experience is that even if a city has the technology for building data management platforms, it is essential to have the necessary policies in place to make the process work.

Figure 2.10. Seoul’s smart city-based infrastructure – The 6S model

Source: Seoul Metropolitan Government (n.d.[115]), Seoul Smart City Platform, https://news.seoul.go.kr/gov/archives/529453.

Ensuring interoperability can start within the local public administration itself. According to the experience of Estonia and Korea, a key challenge for interoperability is to capture and share data across ministries. A digital administration must unify and centralise its citizens’ information. This would make a more cost-efficient and effective administration, as in many cases, citizens have multiple IDs issued by different government agencies. Each ministry or department’s dataset has its own characteristics and information. This profusion of data in different administrative bodies causes duplication, slows down government action and is detrimental to citizens’ well-being. To address this issue, in 2021, the Seoul Metropolitan Government (SMG) established the first stage of the Big Data Service Platform to store public data in one place (Box 2.28). The goal is to unify all public data collection and management, usually dispersed among different SMG institutions and departments, with the aim of producing, utilising and opening high-quality public data. The platform is composed of a unified, integrated management system for storing and utilising public data and a physical infrastructure (data lake) that stores huge amounts of source data in one place. To operate the platform, the SMG established an integrated data governance system to unify data access and collection authority management. By producing and distributing high-quality public data through metadata management, data standardisation and quality management, the SMG set the basis for public-private data analysis and utilisation convergence. The SMG operates other data platforms for more specific purposes: Open Data Plaza, Big Data Campus and Seoul Smart City Platform. A basic feature is that each of these platforms has a different target population and, thus, access rules, although, in principle, they are all accessible to citizens. The SMG’s experience in data governance and management suggests that to build more effective data management practices, it is necessary to: i) regard data as a public resource that can be used by public and private actors to create value and not as a by-product of social and economic activities; ii) strengthen the data ecosystem for a more dynamic flow of data production, distribution and utilisation; iii) specify the roles of each institution to co-ordinate data collection and management across policy fields avoiding data duplication; and iv) adopt a comprehensive national data strategy that guides the creation of value by collecting and analysing data nationally.

Box 2.28. Smart Seoul infrastructure – Big data platforms for data collection and analysis

The SMG operates big data platforms for data collection, analysis and storage.

The Big Data Service Platform (also known as the Big Data Lake) is a project to unify public data integrated management system and establish a large data infrastructure to collect, store and utilise data generated by various administrative information systems. This will include data on public transport, environment, safety and others, conveniently stored all in one place, including city data generated by IoT sensors throughout the city. In a later stage, the project will support administrative innovation through the combination and analysis of private and administrative data. It will establish an AI predictive administration system by applying AI technology to the administration of Seoul. The platform is accessible to all public officials, researchers and citizens in Seoul but access rights vary by data and service characteristics. The Big Data Lake consists of a “total collection interface” that performs the function of securing, retaining and processing city-related and administrative data, and a “three-stage storing process” to collect data (Figure 2.11). The data storage space pays particular attention to security as sensitive and personal information may be stored. A “sandbox” processes sensitive information to non-identifiable (aggregate and anonymous) data that do not get stored. The non‑identifiable data are then stored at the source.

The Open Data Plaza is a citizen-accessible platform that enhances public interest and transparency through the opening of public data and allows citizens to create new services directly by using public data to create economic and social values. Currently, it has datasets covering 12 fields, such as public health, general administration, cultural tourism, industrial economy, welfare, public transport and safety. Data are provided in six different formats: Open API, LOD, sheet, chart, file and link.

The Big Data Campus provides cloud-based big data analysis infrastructure using open source and data held by the public and private sectors. The SMG wants to share big data resources through the Big Data Campus and to solve various social problems by converging and analysing big data with citizens by sharing, converging and analysing big data resources through the Big Data Campus. The Big Data Campus provides 42 types of big data collected by the city since 2013, which includes information on credit card usage and public transportation usage that are difficult for individuals to access. The platform collects various civic proposals and opinions from civic groups and supports the sharing of innovative ideas through the organisation of different contests.

Figure 2.11. Big Data Lake composition and function

Source: Information provided by the Seoul Metropolitan Government to the OECD for the project on Smart City Data Governance of Japan.

The Seoul Smart City Platform (Digital Mayor’s Office) provides visual information on major policies and projects of the SMG in real time. It does this by integrating 32 million data managed by 300 systems from each department along with 2 800 CCTVs. Prior to its launch, administrative data were distributed by department and provided individually, making it difficult for citizens and the mayor to analyse all data comprehensively.

Source: Information provided by the Seoul Metropolitan Government to the OECD for the project on Smart City Data Governance of Japan.

Data governance is the underpinning of successful data analytics initiatives in smart cities

Interoperability should be pursued by governments at all levels

Although national governments are taking the lead to facilitate interoperability for data sharing across national-level organisations, subnational governments are also adapting interoperability frameworks to support their smart city initiatives. Some interoperability frameworks focus on specific sectors or policies. This helps organisations share common goals and mandate to access, reuse and share common datasets. As mentioned above, Sweden’s Geodata Strategy of the National Land Survey authority was key to bringing coherence and fostering the value of geodata for efficiency, innovation and competitiveness (Lundquist, Rannestig and Sandgren, 2010[88]). In the Netherlands, the Dutch Metropolitan Innovations (DMI) ecosystem aims to facilitate data sharing, not only among cities and across levels of government but also among public and private stakeholders. The DMI ecosystem also seeks to ensure better connections between various domains (e.g. mobility, urban planning and housing) and stakeholders to optimise the use of data (Box 2.29).

Box 2.29. Dutch Metropolitan Innovations – Leveraging data for mobility and urban planning

In February 2023, the Dutch national government approved the creation of the Dutch Metropolitan Innovations (DMI) ecosystem to leverage the use of data in different urban policy domains such as housing, mobility and urban planning. This initiative received financial support from the National Growth Fund – a governmental fund promoting sustainable economic development – for EUR 85 million. Public and private stakeholders have directed an additional combined fund of EUR 201 million towards the ecosystem.

Through the DMI, cities and their partners can leverage data and digital technologies for smart city development. Its current focus is the application of digital solutions in the physical domain: houses, offices, streets, parking, traffic, transport, air quality and public space. The DMI is designed to ensure better linkages with other (physical) domains such as energy, water and climate adaptation.

The DMI ecosystem is comprised of three layers: technical, knowledge and impact.

• In the technical layer, an innovative federated data-sharing infrastructure is built and maintained for ecosystem partners. By keeping data at the source, through the implementation of digital policies (e.g. smart automated contracts) and trust in data sharing (e.g. through mitigating risks in cybersecurity, privacy and commercial risk), the DMI allows for the development of a governed automated data marketplace. The technical layer also includes data and product catalogues, data quality management, data governance, transaction registering and automated payments.

• The knowledge layer includes building blocks that enable designing and running the technical infrastructure, as well as domain-specific knowledge on the impact layer (e.g. technical standardisation, functional requirements for applying digital access management to cities, smart traffic management, digital twin interoperability, etc.). The building blocks are created and disseminated through communities of practice, training, reports and implementation in educational programmes.

• In the impact layer, applications are built and maintained to solve specific problems: ingestion of sensor data at scale, data integration and blending, data visualisation (digital twins), smart access applications, mobility hub design and management, shared mobility management in areas with low parking facilities, yield management in public transport, optimised digital city service management, integrated planning, as well as optimised management of construction projects including ingoing and outgoing traffic of people, vehicles and materials, city logistics applications and others.

The DMI ecosystem is designed to comply with future EU legislation on data spaces, data sharing (commercial and non-commercial) and data privacy and governance. It enables integrated problem solving by liberating data from its silos to benefit policy makers and private stakeholders, facilitating and stimulating the collaboration between public and private parties across domains and organisational boundaries. Through the ecosystem, solutions can be rolled out at scale to achieve impact on a national level.

Source: Government of the Netherlands (2023[116]), DMI-ecosysteem voor mobiliteitsvernieuwing en slimme, duurzame verstedelijking, https://dutchmobilityinnovations.com/spaces/1216/dmi-ecosysteem/0ver-ecosysteem.

At the subnational level, interoperability also takes place within sectors and across cities. Cities take measures to ensure data sharing among organisations in the same sector, such as transport or the judiciary. Interoperability is also used to ensure data can be shared across cities to build and provide common public services.

The city of Buenos Aires, Argentina, and Los Angeles County in the United States exemplify the case of interoperability within a policy sector as both cities have used IT platforms for data sharing and make public services more efficient and effective.

• The case of judicial power in the city of Buenos Aires, Argentina, provides a clear example of the efforts cities are conducting to ensure interoperability within the same sector to enhance efficiency and effectiveness in service delivery. In 2014, the Judicial Council (Consejo de la Magistratura) decided to initiate a process of digital transformation of the judiciary of the city of Buenos Aires. At that time, the Judicial Council had a variety of systems to manage files in the criminal, misdemeanour jurisdictions, administrative and tax, chamber of appeals, etc. These systems were designed in different databases making administration complex. To make the judicial system of the city more modern and efficient, the city analysed the experiences of the province of San Luis and the city of Salta, which had already made a digital transition in their judicial systems. Based on these experiences, the city decided to use the IURIX application as it had been key in the design of a multi-organisation, multi-instance architecture based on a single database with embedded digital signature and processor. The city of Buenos Aires implemented a Judicial IT system platform (Servicios Informáticos Judiciales, SIJ) to be able to exchange information with internal and external bodies to the judiciary of the city of Buenos Aires, in such a way that when a system connects to the SIJ, it automatically establishes a connection with the rest of the systems that are part of the platform. The SIJ is a service-oriented architecture that enables interoperability among all systems of the judicial power of the city, maintains the independence of the different systems, and facilitates scalability; indeed, if one service is improved, improvements can be made in all other services (Ferrero, 2021[117]).

• In Los Angeles County, United States, the local government partnered with the Los Angeles Network for Enhanced Services (LANES) – a non-profit organisation responsible for operating a community-based health information exchange (HIE) for hospitals, health systems, clinics in Los Angeles County – to connect all healthcare databases in the county. Los Angeles County has nearly 10 million residents, accounting for approximately 27% of California’s population. In Southern California, healthcare is delivered locally as most patients typically seek care within their metropolitan area. Patients visit health facilities where data omissions could extend to duplicate, incomplete or inconsistent records missing recent medical encounters and demographic data such as laboratory or other diagnostic tests, medications, allergies and family medical histories. The lack of quality, relevant and reliable patient data and the inability to share them is a challenge for providers as patients switch across healthcare services. The county’s healthcare system is rather fragmented and requires connecting beyond electronic health records. Thus, the local government and LANES have partnered to aggregate medical records and put them to use for Los Angeles health service providers. The aim is to connect local providers across the care continuum to the most up-to-date patient data when needed and from various sources. In 2018, L.A. Care Health Plan teamed up with LANES to help to provide co‑ordinated healthcare. More recently, Health Net of California, UCLA Health, Emanate Health and Beverly Hospital and LANES joined forces to make robust clinical data available to HIE provider participants (Modaressi, 2020[118]).

Interoperability facilitates transnational data flows but requires specific governance arrangements

Data flows across borders in the context of globalisation and digitalisation is also increasing and is needed to ensure economic growth on a global scale. In this context, interoperability is becoming more relevant and cross-border data flows demand greater government action to ensure the protection and ethical use of data, particularly citizen data, when those are collected, processed and used by organisations from all sectors (OECD, 2019[3]). Stronger international data governance arrangements are needed to monitor the access, use and sharing of data produced in different countries.

Japan has been an international leader in the promotion of trust in data management for economic growth and social well-being. Since 2019, the Japanese government has been promoting an international order for Data Free Flow with Trust (DFFT) (Box 2.30). DFFT is a basic concept for the data-driven society the Japanese government is promoting. Since digital data are driving the economy forward, DFFT entails that countries and citizens must be able to put data embodying intellectual property, national security intelligence and so on under careful protection while enabling the free flow of medical, industrial, traffic and other most useful, non-personal, anonymous data across borders.

Box 2.30. Data Free Flow with Trust and the Osaka Track

In January 2019, the Japanese Prime Minister invited leaders at the World Economic Forum (WEF) to build an international order for DFFT, a call to draft international rules for the digital age that carefully protect sensitive data whilst allowing productive data to flow across borders. This is a vision where openness and trust exist in symbiosis.

In June 2019, trade and digital economy ministers at the Group of 20 (G20) Ministerial Meeting under Japan’s presidency stressed the importance of cross-border data flows for productivity, innovation and sustainable development. The meeting was an opportunity to discuss the barriers to data flow, such as security, data protection and intellectual property, that damage public trust in digital technologies. At the G20 Osaka Summit, leaders issued the Osaka Leaders’ Declaration, stating that legal domestic and international frameworks should be respected and, at the same time, the interoperability between each framework must be enhanced to allow data to flow more freely. The Osaka Track constitutes an invitation to discuss how stakeholders should co-operate across all regions and disciplines to achieve the vision of open and trusted data flows.

Source: Japanese Cabinet Office (2019[119]), “Toward a New Era of “Hope-Driven Economy“: The Prime Minister’s keynote speech at the World Economic Forum Annual Meeting”, https://japan.kantei.go.jp/98_abe/statement/201901/_00003.html on 2 August 2022; WEF (2020[120]), Data Free Flow with Trust (DFFT): Paths towards Free and Trusted Data Flows, https://www.weforum.org/whitepapers/data-free-flow-with-trust-dfft-paths-towards-free-and-trusted-data-flows/.

To achieve the goals of the DFFT vision, it is essential to promote rules (i.e. privacy, security and intellectual property issues), technologies (i.e. security technologies) and data quality (i.e. accuracy, updated and comprehensive datasets) to build trust in government and its stakeholders.

To further advance the Osaka Track – a collective term for the global governance processes needed to unleash the benefits of more open and trusted data flows – the WEF has issued a series of recommendations to implement the DFFT vision, such as:

• Governments should issue good privacy and security protections that empower users to control rights to their personal information in accordance with international guidelines and standards.

• Businesses should provide information on data treatment and enhance transparency.

• Governments and large industry actors should forge public-private partnerships to advise micro enterprises and SMEs on using digital technologies to drive growth and competitiveness.

• Governments should negotiate trade agreements that include obligations with respect to data while ensuring sufficient discretion to regulate in the public interest (WEF, 2020[120]).

A clear example of how to govern cross-border data flows is the agreement among Estonia, Finland and Iceland to reinforce data sharing to improve cross-border public service delivery. In 2013, Estonia and Finland signed a memorandum of understanding to initiate formal co-operation for the development and management of a software environment that enables secure connectivity, searches and data transfers among various public and private databases. This supported the implementation of cross-border digital services in areas such as tax, health and education, and enabled the deployment of Estonia’s X-Road data-sharing platform in Finland. The interconnection of Estonia’s and Finland’s X-Road platforms in 2018 facilitated greater, automated and secure cross-border data sharing and is considered seminal in the development of additional cross-border services in the region (OECD, 2019[3]). To deepen co-operation in a more formal yet flexible manner, the governments of Estonia and Finland decided to create a separate jointly managed special purpose organisation to administer the X-Road development called the Nordic Institute for Interoperability Solutions (NIIS) (Box 2.31). The success of the cross-border deployment of the X-Road between Estonia, Finland and their partners is due to technical reasons but, more importantly, to the shared data governance policy structures at the strategic level.

Box 2.31. The Nordic Institute for Interoperability Solutions and X-Road

In 2017, the governments of Estonia and Finland signed a memorandum of association to create the Nordic Institute for Interoperability Solutions (NIIS). In 2018, the NIIS took over the X-Road core development from Finland’s Population Register Centre and Estonia’s Information System Authority. Iceland and the Faroe Islands became partners of the NIIS in 2018 and 2019 respectively. X-Road is an open-source software and ecosystem solution that provides unified and secure data exchange between organisations. It is a standardised, cohesive, collaborative, interoperable and secure data exchange layer.

The NIIS aims to be a strong influencer in digital governance and a growing platform for cross-border co-operation and innovation. It contributes to digital developments and initiatives in the Nordic countries, Europe and globally, and welcomes new members.

Source: NIIS (2022[121]), Homepage, https://www.niis.org/ (accessed on 29 September 2022), X-Road (2022[122]), X-Road® Data Exchange Layer, https://x-road.global/ (accessed on 29 September 2022).

Data linkage platforms are essential to enable city-level data sharing

Cities and communities are confronted with complex challenges, ranging from an ageing population to energy efficiency and urban mobility. Thus, a large number of cities started making use of digital solutions to tackle those growing challenges; but the result, in many cases, has been a fragmented system for service delivery as every city has developed its own digital response. The lack of interoperability is a major obstacle to progress in digitalisation and innovation in cities. It prevents having a coherent national interoperable environment that facilitates the delivery of services that work together, within and across organisations or public and private domains, resulting in suboptimal public services and is a barrier to the integration of services provided at the local level and for effective communication among different data platforms and technologies. To use data more effectively in the framework of smart city initiatives, cities are building data linkage platforms that enable mutual linkage and sharing of data with relative ease.

Cities are also using IT platforms to share data across administrative departments and enhance data sharing with neighbouring cities in the framework of smart city initiatives. City governments generally implement a platform to collect, store and share data from multiple sources such as mobile phones, computers, cameras, sensors and others. The purpose is to collect data that can be used to provide better services, contributing to well-being and reducing costs for the city government. For example, since 2017, the city of Takamatsu in Japan has been building an IoT common platform using FIWARE as a cross-disciplinary linkage platform (Box 2.32). The platform can be used in any combination to suit the requirements of the users. Figure 2.12 shows that the platform includes a test environment where universities and private companies can run tests with the data collected. In 2020, the neighbouring municipalities of the town of Ayagawa and city of Kan’onji decided to use the common IoT platform of the city of Takamatsu by signing a collaboration agreement to form a wide-area disaster resilience initiative (FIWARE, 2020[123]). The basic idea was that utilising IoT data generated from a wider area provides more reliable and better insights. At the same time, such a wide-area collaboration also benefits residents who commute across municipality boundaries on a regular basis.

Box 2.32. The city of Takamatsu’s IoT Common Smart City Platform for data utilisation

The city of Takamatsu in the Kagawa prefecture is highly prone to natural disasters such as typhoons and flooding that have caused material damage and loss of life. Climate change is making such disasters even more severe, common and unpredictable. The city needs to innovate in its responses due to the growing number of elderly people needing assistance. Saving lives is a top priority for the local government, thus placing disaster management high on the list in its smart city initiative.

The city of Takamatsu is the first city in Japan to adopt the FIWARE platform as a cross-disciplinary data linkage platform. FIWARE is a collection of software modules that support the development and diffusion of the next generation of Internet technologies. It makes it possible for ordinary citizens, businesses, central government and municipal organisations to access and use public data freely. The accumulated data are stored on cloud servers where they can be shared, analysed and processed. The platform has 25 modules (e.g. data management, device management, big data analysis, authentication, event detection and open data linkage) organised in 5 chapters. Open source and license-free, each module can be used in any combination. Takamatsu has built a system that leverages the power of advanced IoT technology to collect, store, visualise and analyse data in the three particular fields considered a high priority for the local government, namely disaster management, tourism and welfare.

• Disaster prevention and management. Takamatsu is a city at risk of flooding of local rivers caused by localised torrential rain and typhoons, as well as by tsunamis and high tides along the coast, which have increased in recent years. The local governments need to assess the need for shelter quickly, should a large-scale disaster occur. For this, the city, with the support of digital technology corporation NEC, installed water and tide level sensors at the observation points designated in the city’s flood prevention plan. The sensors provide data on water and tide levels that, together with data regarding water, tide and rainfall levels provided on the prefecture of Kagawa’s disaster management website, allow the city to have a complete visualisation of the level of threat on the Takamatsu Wide Area Disaster Management Dashboard. The information also helps the city to determine whether or not more shelters need to be opened and the status of open shelters.

• Tourism. The government of Takamatsu wants to enhance its position as a tourist destination by making the most of its location and natural assets. To this aim, the local government built a system that tracks the usage of bicycles rented out to tourists (including foreign tourists). Its flat topography makes it easy for tourists to visit the different sights by bicycle, so rental bicycles are commonly used. The government installed a Global Positioning System (GPS) tracking unit on the rental bicycles. When a rented bicycle with a GPS is returned to a rental bicycle station, the GPS log data are automatically collected via Wi-Fi. By comparing these data with user information, such as nationality, gender, age, usage purpose, etc., collected beforehand (with user consent), this system is able to analyse the user’s movements. The results are stored in a common platform and visualised on the city’s dashboard, particularised as a point of departure, destination, duration of stay and travel routes.

• Welfare and well-being. To collect information on the health of senior citizens who live alone and provide timely responses to individual emergency cases, the city of Takamatsu implemented a programme that involved asking citizens to wear a wearable vital sensor and cardiac rate monitor. The sensors also provide information on whether individuals wearing the device are able to move and exercise as well as their location. The information is collected on the common platform and this avoids the need to have people on site at all times.

Source: Ishii, K. and A. Yamanaka (2018[124]), “Building a common Smart City platform utilising FIWARE (Case study of Takamatsu City)”, https://www.nec.com/en/global/techrep/journal/g18/n01/180106.html; City of Takamatsu (2022[110]), “Takamatsu City’s Smart City Vision”, Presentation given to the OECD on 24 June 2022, Takamatsu.

Figure 2.12. Overview of Takamatsu City IoT Common Platform (FIWARE)

Source: City of Takamatsu (2022[110]), “Takamatsu City’s Smart City Vision”, Presentation given to the OECD on 24 June 2022, Takamatsu.

Data interoperability enables the functioning of smart city services – The case of smart mobility

As a key component of smart city policies, smart mobility depends on managing and sharing vast amounts of heterogeneous data to ensure mobility benefits. By linking digital technologies and infrastructure, smart mobility projects seek to improve traffic management. It expands on the concept of intelligent transport systems to leverage communicative assets such as vehicles and infrastructure, mobility data platforms and shared mobility services. When all these components work in co-ordination, they have the potential to improve mobility in cities while reducing the negative aspects of public transport (ITF, 2020[107]).

Smart mobility requires taking advantage of (digital) technologies and data to deliver benefits. France, for example, has created a smart mobility platform to provide and operate a digital infrastructure to enable cities to regain power in mobility management.37 However, smart mobility requires an adapted regulatory framework that enables innovation without compromising other objectives such as efficiency, inclusiveness and safety. The International Transport Forum (ITF) and the OECD noted that governments do not need to regulate all aspects of smart mobility, although they need to ensure the overall regulatory framework is linked to other global public policies (ITF, 2020[107]). Voluntary agreements and contractual and concessionary agreements also have the potential to guide private sector action in smart mobility. Removing existing regulation that is no longer adapted to current needs is another task to be conducted while designing a smart mobility initiative. This could reduce excessive regulation that could prevent efficient service delivery.

Transport systems – and smart mobility projects in particular – generate an increasing amount of data. These data may be used to improve the performance of the transport system but also achieve other policy objectives such as housing and environmental protection. Certainly, data generated by transport systems cause tensions regarding which data are collected, by whom, for what purpose and how to balance individual and commercial value and public and social value (ITF, 2020[107]). The data governance arrangements need to enhance the capacity of stakeholders to follow data-sharing rules and address concerns about data collection and sharing. Smart mobility also calls for clear guidance or rules for data sharing, portability and reporting. These rules need to ensure the integrity of data to enable ticketing, payments and access rights and identification. Data should be shared with public authorities to monitor compliance with safety rules and use of public space, but also for planning purposes to improve efficiency and sustainability. The governance of data sharing should address these overlapping needs and enhance the capacity of stakeholders to abide by the data-sharing rules. Data sharing should be based on data minimisation by default.

Moreover, making the IT systems compatible is essential for interoperability. The case of the Suica card issued by the East Japan Railway Company (JR East) in Japan exemplifies this case (see Annex 2.B). To ensure service expansion, all actors must follow the same protocols, semantics and technical parameters. This is even more relevant in cases where, like the Suica card, this transport card is used for other purposes such as paying for consumer goods and increasing the need for more co-ordination with a wider number of stakeholders.

Mobility as a Service (MaaS) is a particular smart mobility initiative that exemplifies the use of data and the need for a clear data governance structure. MaaS builds on the idea of accessing via a single medium – for example, a smartphone – a large variety of mobility services, including public transport and shared mobility services (Crozet, 2020[125]). A large number of mobility service providers interact in a co-ordinated manner to give users the opportunity to access a wide range of mobility services. For MaaS to function, it needs to ensure data sharing and portability requirements among stakeholders and data reporting to public authorities to facilitate monitoring and planning while ensuring personal data protection (ITF, 2021[126]).

MaaS aims to facilitate travellers’ mobility through a customer-facing user interface supported by a back‑office exchange of usually sensitive information among different stakeholders (ITF, 2021[127]). Therefore, it requires a comprehensive and agile data governance framework that guides the management of data sharing and reporting. These governance arrangements need to achieve three goals: an efficient service for travellers, a remunerative business for MaaS providers and meet broader urban and social development objectives.

Several cities have introduced MaaS projects, such as: Helsinki, Finland, via the Whim system that offers multimodal packages;38 Hanover in Germany uses the Mobilitatsshop application to offer single public transport tickets;39 and Vienna, Austria, uses the WienMobil application through which users can buy a diverse range of public transport tickets and subscriptions.40 These experiences show that there are different organisational and governance models for setting up a MaaS system. Helsinki uses a commercial integrator model in which the MaaS operator signs bilateral agreements with the transport operators to finance and operate the system with minimum investment from the local government. Vienna uses a back‑end platform model by which the local authority sets up a platform to integrate data on different mobility services (e.g. timetables, booking, ticketing, routes). This platform is then used by MaaS operators to build their MaaS solution (Cerema, 2019[128]). Hanover uses transport as the integrator model, where the public transport network operator develops the service to attract other mobility service operators to take part in the MaaS solution (Cerema, 2019[128]).

Different factors allow the MaaS systems to operate, for example, having a diversified and efficient public transport network, good mobile phone network coverage and physical connections of the mobility services. However, one critical element is the open data and data exchange infrastructure. Cities require APIs for route calculation, booking, ticketing and price systems (ITF, 2021[126]). To enable MaaS, cities need to put into practice a data-sharing system by which all mobility operators and MaaS providers share certain data that allow them to keep their license to operate and the market to function. These data can be: informational, to allow MaaS providers to plan, create and communicate mobility services; operational (e.g. identity of the traveller, access to vehicles and services, the start of trips etc.) that can be shared with the consent of the user; and transactional to provide access to booking and payment to facilitate combining and paying for trip segments. Audit mechanisms are needed to monitor adherence to purpose specifications in processing and retaining data. It is also important that data reporting mechanisms are put in place to allow public authorities to access data from the MaaS ecosystem to plan, monitor and control market functions (Figure 2.13). Transport and city authorities need to ensure that technical mechanisms for data reporting are in place and aligned with those of data sharing, adopting security and data access protocols to guarantee the security of the sensitive data involved.

Figure 2.13. A suggested data architecture for a MaaS ecosystem

Source: Based on ITF (2021[127]), “Developing innovative mobility solutions in the Brussels-Capital Region”, https://doi.org/10.1787/37cc3a85-en.

To offer their services, operators normally use an application-enabled platform that may be operated by the operators themselves, the city or transport authority, or a dedicated third party. Although this also raises the question of the rules to access the platform, which serve as gatekeepers and how to prevent anti‑competitive behaviour. When the platform is developed and operated by the operators themselves, it may provide great value for consumers, as services are highly co-ordinated; it, however, is unclear how they contribute to broader public policy goals such as well-being, sustainability and inclusiveness. When the public authorities operate the platform, integration with other policy goals is generally ensured but it may be harder for new MaaS operators to enter into the market or may create concerns about favouritism by public authorities. When a third party operates the platform, the risks encountered with publicly operated platforms may be avoided but the platforms require transparent operating rules, auditability and accountability towards public authorities (ITF, 2020[107]). Adopting platform access standards may reduce the transaction costs associated with delivering platform-mediated MaaS services. The platforms enable easy and open integration of mobility services within the MaaS ecosystem.

Annex 2.A. Inter‑governmental collaboration, common standards and taxonomies for greater interoperability – The case of the city of Aizuwakamatsu

In Japan, in the Fukushima prefecture, the city of Aizuwakamatsu had a population of 116 171 inhabitants in 2021. Like the rest of the country, Aizuwakamatsu is experiencing a population decline of 6.3% between 2011 and 2021 (i.e. more than 1 000 per year); the birth rate has declined by 23% in the last decade. In particular, the working-age population (aged between 18 and 64 years) shrank 13.7% in the same period. However, the proportion of elderly residents (31% of the population) exceeds the national average (28.8%) and the amount of people requiring long-term care is close to 40% of the local population (Muroi, 2021[129]). The city is home to an important agglomeration of ICT-related industries represented by Smart City AiCT at the University of Aizu, the largest university in the country dedicated to advanced ICT software and hardware training and research, and to a semiconductor factory. After the 2011 earthquake, which affected large areas of the country, and the Fukushima nuclear plant disaster, the local government has been promoting a number of smart city initiatives to underpin recovery and tackle the main sociodemographic issues that affect the city.

To manage the situation, the city government has been promoting a number of smart city initiatives through the Smart City Aizuwakamatsu strategy and vision. The objective of the smart city strategy is to use ICT in fields such as healthcare, welfare, education, disaster prevention, energy, transport, agriculture, government, infrastructure and environmental protection. To design and implement the different smart city initiatives, the local government promotes the active participation of citizens to understand their needs better. It collaborates with private enterprises such as Accenture in the creation of different ICT-related projects for service delivery. The local government facilitates piloting private companies’ smart projects in the city, which will be upscaled to the rest of the country. There is a strong collaboration with the University of Aizu, which provides advice and technical co-operation, and takes the lead in the training and upskilling of the private and public workforce on ICT. In the local government, the city also is deploying staff with ICT skills to implement different smart city initiatives across the administrative departments.

Therefore, data collection and management are essential elements of the smart city strategy. Data are essential to design personalised services based on data provided by residents. The city introduced a management operating system with an information platform, Aizuwakamatsu Plus, with the support of Accenture. The platform provides tailored information on more than ten digital services such as transportation, medical care, childcare and tourism. Opt-in is the fundamental approach to the city smart city initiatives, allowing residents to choose if they want to provide personal information in exchange for digital services. Around 20% of the population have opted in to the platform.

The digital platform Aizuwakamatsu Plus is the city operating system (OS). It functions as an open data platform and links datasets to the city. It is fed by IoT sensor data, open data, data provided by citizens who have opted in and data held by private companies. The role of Aizuwakamatsu Plus as the city OS is fourfold:

• Functions as a one-stop service to citizens. Citizens can use their regional ID to access and manage digital services in a wide variety of fields. The portal consolidates city services in a single, streamlined interface for citizens to use.

• Connects services and functions. It supports service providers in the development of efficient services and creates a more user-friendly experience by providing the authentication, ID management function and the “opt-in” management function that all services use in common.

• Co‑ordinates data and asset management. By developing a standardised API based on the Smart City Reference Architecture established by the Cabinet Office, data and asset management functions can be provided to allow for flexible and diverse data co‑ordination.

• Facilitates co-operation with other cities (and their OS). Citizen data can be linked with other cities’ OS on an “opt-in” basis, allowing for the horizontal development of various new services intended for city OS systems (Annex Figure 2.A.1). This method allows interoperability and more efficient service delivery across different cities and regions.

Collaboration must be based on common data standards, taxonomies and platforms for data sharing that are able to communicate with each other. Annex Figure 2.A.1 shows that with an open and standardised architecture, different cities, towns and villages can share data and develop new services without depending on a specific vendor. Moreover, services developed in other settings (i.e. cities or villages) can be used quickly and at a lower cost. The experience of the city of Aizuwakamatsu shows that deploying the city OS horizontally contributes to a stronger regional community and that the more local governments work together on sharing a common platform for data management, the more sustainable it will be.

Annex Figure 2.A.1. Inter-municipal co-operation for interoperability – The case of the city of Aizuwakamatsu

Source: Based on Muroi, S. (2021[129]), “Initiatives and vision for Smart City Aizuwakamatsu”, Information provided to the OECD by the government of Aizuwakamatsu City, Aizuwakamatsu.

Different services have been linked to Aizuwakamatsu Plus. For example, in the tourism industry, the city operates Visit Aizu, an inbound tourism website that reflects preferences according to the nationality of the visitors and displays tourism content that varies depending on the selected language and the time of the visit, rather than simply making a multilingual tourist site. In addition, if the users select their nationality/city, planned date of visit and individual interests, the site presents a recommended plan according to these data. Another example is the Line Chat application, a service that uses the smartphone application LINE to answer citizens’ questions 24 hours a day, every day of the year. The services have been upgraded to include services such as finding doctors open on holidays, garbage disposal, snowplough location information and inquiries related to COVID-19, among others. In healthcare, through the Aizu Healthcare Demonstration Service, residents can access a number of services such as visualisation of medical check-up results, lifestyle disease risk analysis and visualisation of conducted physical activity according to wearable devices. These healthcare services have led to an improvement of 95% in health awareness and 89% of improvement in the adoption of healthy habits (Aizuwakamatsu City, n.d.[130]).

Annex 2.B. Interoperability for greater digital inclusion – The case of JR East Suica card

In Japan, railways have become integral to people’s daily lives (mass commuter transportation, real daily contact points). The East Japan Railway Company (JR East) is one of the six main railway companies that provides passenger rail services in the country. It focuses on the eastern part of the country, which includes the Tokyo Metropolitan Area. The company was created in 1987 through the privatisation of Japan National Railways. JR East has three business domains. The first is transportation services that include a 7 401 km passenger line network and1 676 stations that provide services to 12 million passengers daily. In fiscal year (FY) 2021, the company reported revenues of JPY 954.3 billion (approximately USD 7 billion) (JR East, 2021[131]). The second domain is what the company calls “lifestyle services” as it operates 193 shopping centres and 9 190 hotel guest rooms. Finally, the IT and Suica Services refers to a digital network centred on the Suica card. Through these domains, JR East aims to provide seamless services for information, purchases and payments in people’s mobility and daily lives through business development centred on railways.

Since customer satisfaction with having different train cards for different train operators was low, in 2001, JR East issued a prepaid e-money card for travelling and shopping, the Super Urban Intelligent Card (Suica). Though not an e-money card when launched, JR East was the first company in Japan to introduce the service.

The Suica card uses the pay-as-you-go method: travellers need to recharge the card, which gets debited every time it is used. There are four types of Suica cards: physical, digital (on mobile phones), employee and student ID, and credit, which is another functionality of Suica. The card can be used on JR East lines in the Tokyo Metropolitan Area as well as for subways, buses and the Tokyo Monorail that connects Haneda Airport with Tokyo. In addition to the Tokyo area, the Suica card can be used for certain transportation systems in the Hokkaido, Kyushu, Sendai and Niigata, Tokai and West Japan areas. Other uses include a key function for shared bicycles and cars.

JR East has other business activities besides rail passenger transport, such as hotel accommodation, retail and restaurants where the card can be used. The Suica card can also be used for paying in businesses affiliated with the card, as it has been linked to merchandise sales at stations, restaurants and hotels. Thus, the card can be used for purchases on board trains as well as from vending machines, to rent coin lockers and for spending at convenience stores and restaurants. JR East has agreements with Apple Pay and Google Pay to enable the card to be used for the services they provide.

The company wants to expand the Suica card nationwide. The aim is to make the card a replacement for train tickets. There are associations with other train companies throughout the country so that the card can be used in different areas. Suica is normally used for short-distance trains but, since 2018, the card can be used on high-speed train services. Nowadays, ten different transportation companies across the company accept the Suica card, facilitated by the use of JR East technology for their own cards. The ten transportation integrated circuit (IC) cards (including Suica) are not linked in terms of data but rather in terms of standardisation (so that they can be used mutually) and the data are owned by each rail company. In 2021, JR East was reported to have issued 86.63 million Suica cards, with 250 million monthly transactions for public transportation electronic money. The card is accepted in 1.15 million stores.41

JR East uses the big data collected both through the Suica card and the payment platform e-Money to generate a station chart or report providing information station by station and even sells the data to third parties. Before the introduction of the Suica card, there was no possibility of getting detailed information about who boarded from which station and alighted at which station: JR East only had information on the trains. The use of the Suica card has allowed the company to produce big data that can be utilised and traded. The data collected through the card help to improve passenger convenience as it allows them to be cashless and ticketless at the stations. It also helps the company reduce costs as the equipment and hardware are cheaper and security is improved. JR East’s main businesses are train passenger transport and retail businesses (i.e. hotels, restaurants) and the introduction of the Suica card has opened up a new business activity through the marketing of data.

Indeed, JR East collects two types of data. Data related to railway operations include operation information data, train congestion data (i.e. stress-weighted data), ticket gate open data, image data (i.e. inside stations and trains) and maintenance data (e.g. electricity, rails, station buildings, escalators, elevators, air conditioning, etc.). These data are used to provide timely information to passengers (e.g. train delays and cancellations), for operation management (e.g. to improve operation schedules and air conditioning) and for improving the design of facilities in stations and trains. The use of the Suica card allows JR East to collect information such as the profile of passengers (i.e. age bracket, gender, origin and destination, and the length of their visit to a station). These data are for JR East use but can also be considered marketing data from the perspective of understanding people’s movement. JR East receives requests from real estate companies and businesses located in the neighbourhood of the station for this kind of data. In fact, JR East started to provide data services in May 2022. Local governments have also begun to approach JR East, inquiring about statistics regarding the origin and destination of travellers, in view of using that data in their sales and marketing activities such as tourism.

Private data are protected as information such as names and addresses are not used for analysis. However, some of the cards are for students and office workers and that characteristic provides JR East with a clearer profile of the customers. The other type of data refers to customer usage, which includes Suica settlement data,VIEW credit card data (i.e. customer data, settlement data), ticket sales data and point of sales data. This type of data is used to guide users and improve services, as well as management data for a variety of measures.

Nowadays, other train operators accept Suica cards. Every train operator has its own card. The cars are not linked by data but by standards, making interoperability possible while protecting data privacy and ownership. When data are aggregated, the rail companies carry out the aggregation use the same specifications for each company’s data. The JR East card system is very different from that used in other regions, even if the Suica card can be used there. To allow this aggregation, instead of asking other companies to use the JR East system, the company provides the specification so that the card can be used in other systems. It is a combination of two or three different systems. JR East and other train companies focus more on unifying data standards rather than linking their datasets. Therefore, it is possible to see the use of different cards in different systems. A similar situation can be observed in cities, as interoperability is ensured by having the same standards as linked data.

The card system of the JR East Suica card has also been used in some smart city initiatives. JR East and the city of Maebashi in the Gunma prefecture have linked My Number Card (the social security card in Japan) to Suica. This entails that some information stored in the My Number Card is identified by Suica’s IC chip and retained. This facilitates the provision of some services, such as applying discounts on buses to residents of the city of Maebashi. This experience suggests that, in the future, it will be possible to mix administrative information with transport data for better service provision and even use Suica cards to access health services.

In 2014, JR East launched an application to provide information about routes and trains, and eventually expanded it to provide other services. The application has a real-time route function that gives the best route from Stations A to B by combining direct train information. The application includes information on train delays. JR East has been working with different transport providers, such as other train, bus and subway companies, to provide more real-time information regarding all transport providers. The application includes train congestion information and, thanks to the installation of cameras in each train coach, passenger numbers and crowding statistics. This information is provided to application users as there was a demand for this kind of information during the COVID-19 pandemic.

References

[84] Abu Dhabi Government (n.d.), Data Management Standards, Systems and Information Centre, Abu Dhabi, https://addata.gov.ae/sites/default/files/AD-Gov-Data-Management-Standards-EN-v1.0.pdf (accessed on 2 August 2022).

[106] Agency for Digital Italy (2018), White Paper on Artificial Intelligence at the Service of Citizens, https://www.agid.gov.it/en/agenzia/stampa-e-comunicazione/notizie/2018/04/19/english-version-white-paper-artificial-intelligence-service-citizen-its-now-online (accessed on 29 September 2022).

[28] Aguiar, M., V. Boutenko and S. Lacanna (2021), “Vibrant cities are built on trust”, Cities of the Future, BCG, https://www.bcg.com/publications/2021/vibrant-cities-are-built-on-trust (accessed on 19 January 2023).

[111] Ahlgren, B., M. Hidell and E. Ngai (2016), “Internet of Things for Smart Cities: Interoperability and open data”, IEEE Internet Computing, Vol. 20/6, pp. 52-56, https://doi.org/10.1109/MIC.2016.124.

[130] Aizuwakamatsu City (n.d.), “Initiatives and vision for “Smart City Aizuwakamatsu” - Examples of Smart City initiatives”, Information provided to the OECD by the government of Aizuwakamatsu, Aizuwakamatsu.

[4] Algmin, A. and J. Zaino (2018), Trends in Data Governance and Data Stewardship: A 2018 DATAVERSITY® Report, http://content.dataversity.net/rs/656-WMW-918/images/Trends%20in%20Data%20Governance%20and%20Stewardship_FinalRP-Graphs.pdf (accessed on 22 September 2022).

[46] ARDC (2022), About the ARDC, Australian Research Data Commons, https://ardc.edu.au/about_us/ (accessed on 23 September 2022).

[27] Arrighi, J. et al. (2022), The Scale of Trust: Local, Regional, National and European Politics in Perspective, Groupe d’études géopolitiques, https://geopolitique.eu/en/2022/07/13/the-scale-of-trust-local-regional-national-and-european-politics-in-perspective/ (accessed on 19 January 2023).

[133] At Internet (n.d.), Privacy by Design (PbD), https://www.atinternet.com/en/glossary/privacy-by-design-pbd/ (accessed on 19 September 2023).

[54] Ayuntamiento de Bilbao (2022), Bilbao Data Manifesto, Ayuntamiento de Bilbao, Bilbao, https://kopuru.com/bilbao-data-manifesto-los-10-principios-eticos-que-regiran-el-uso-de-datos/ (accessed on 27 July 2022).

[9] BBSR (2021), Data Strategies for Common Good-oriented Urban Development, Federal Institute for Research on Building, Urban Affairs and Spatial Development, https://www.smart-city-dialog.de/wp-content/uploads/2021/12/data-strategies-common-urban-development-dl-1.pdf (accessed on 9 May 2023).

[36] Bella, K. (2021), “How to overcome mistrust of data”, World Economic Forum, https://www.weforum.org/agenda/2021/12/how-to-overcome-mistrust-of-data/ (accessed on 1 August 2022).

[52] Berman, G. et al. (2018), “Ethical considerations When using geospatial technologies for evidence generation ethical considerations”, Innocenti Discussion Paper, No. DP-2018-02, UNICEF Office of Research, http://www.unicef-irc.org (accessed on 4 October 2022).

[34] Bischoff, P. (2022), “Surveillance camera statistics: Which city has the most CCTV cameras?”, Comparitech, https://www.comparitech.com/vpn-privacy/the-worlds-most-surveilled-cities/ (accessed on 6 February 2023).

[66] Business Insider (2020), “8 cities that have been crippled by cyberattacks — and what they did to fight them”, https://www.businessinsider.com/cyberattacks-on-american-cities-responses-2020-1?r=US&IR=T#st-lucie-florida-3.

[65] Business Insider (2018), “Atlanta has shut down courts and people there can’t pay their bills online because of a crippling cyberattack the mayor has called ’a hostage situation”, https://www.businessinsider.com/atlanta-cyberattack-cripples-city-operations-2018-3?r=US&IR=T.

[78] Cella, L. (2017), “Managing water supply with smart technology”, Utility Magazine, https://utilitymagazine.com.au/managing-water-supply-with-smart-technology/ (accessed on 1 August 2022).

[128] Cerema (2019), MaaS in Europe: Lessons from the Helsinki, Vienna and Hanover Experiments, https://www.cerema.fr/system/files/documents/2020/04/cerema_parangonnage_maas_rapport_complet_eng.pdf (accessed on 6 March 2023).

[58] Cerrudo, C. (2015), An Emerging US (and World) Threat: Cities Wide Open to Cyber Attacks, IOActive Labs, https://ioactive.com/pdfs/IOActive_HackingCitiesPaper_CesarCerrudo.pdf (accessed on 8 February 2023).

[33] Chandran, R. (2023), “Police in India are expanding their surveillance reach by tapping into private security systems”, Scroll.in, https://scroll.in/article/1041633/police-in-india-are-expanding-their-surveillance-reach-by-tapping-into-private-security-systems (accessed on 6 February 2023).

[73] City of Chicago (n.d.), Information Security Office, https://www.chicago.gov/city/en/depts/dgs/supp_info/information-security-office.html.

[20] City of Columbus (2021), Smart Columbus Program Summary, https://d2rfd3nxvhnf29.cloudfront.net/2021-06/20210615-smart-columbus-program-summary-FINAL_0.pdf (accessed on 7 October 2022).

[21] City of Columbus (2020), Data Management Plan for the Smart Columbus Demonstration Program, https://d2rfd3nxvhnf29.cloudfront.net/2020-08/SCC-E-DataManagementPlan-Update-v1.pdf (accessed on 7 October 2022).

[23] City of Columbus (2020), Data Privacy Plan for the Smart Columbus Demonstration Program, https://d2rfd3nxvhnf29.cloudfront.net/2020-09/SCC-D-DataPrivacyPlan-AnnualUpdate-V2_0.pdf (accessed on 7 October 2022).

[22] City of Columbus (2019), Project Management Plan for the Smart Columbus Demonstration Program, https://d2rfd3nxvhnf29.cloudfront.net/2019-08/Smart%20Columbus%20Smart%20City%20Challenge%20Project%20Management%20Plan.pdf (accessed on 7 October 2022).

[114] City of Hamburg (2020), Digital Strategy for Hamburg, Senate Chancellery, Hamburg, https://www.hamburg.de/contentblob/14924946/e80007b350f1abdc455cfaea7e8cd76c/data/download-digitalstrategie-englisch.pdf (accessed on 5 May 2023).

[51] City of Seattle (2023), Privacy & Cybersecurity Committee - Community Technology Advisory Board, https://www.seattle.gov/community-technology-advisory-board/what-we-do/committees/privacy-and-cybersecurity (accessed on 7 February 2023).

[110] City of Takamatsu (2022), “Takamatsu City’s Smart City Vision”, Presentation given to the OECD on 24 June 2022, Takamatsu.

[69] Computer Weekly (2023), “Suspected LockBit ransomware attack causes havoc in City of London”, https://www.computerweekly.com/news/365530214/Suspected-LockBit-ransomware-attack-causes-havoc-in-City-of-London.

[30] Cró, I. and T. Castro Roegiers (2021), Data Protection in the Smart City of Lisbon, Flanders Investment & Trade, Lisbon, https://www.flandersinvestmentandtrade.com/export/sites/trade/files/market_studies/2021-Portugal-Data%20protection%20in%20the%20smart%20city%20of%20Lisbon-Website_2.pdf (accessed on 3 February 2023).

[125] Crozet, Y. (2020), “Mobility as a Service: A New Ambition for Public Transport Authorities”, International Transport Forum Discussion Papers, No. 2020/16, OECD Publishing, Paris, https://doi.org/10.1787/3de9adb3-en (accessed on 5 March 2023).

[38] Curzon, J., A. Almehmadi and K. El-Khatib (2019), “A survey of privacy enhancing technologies for smart cities”, Pervasive and Mobile Computing, Vol. 55, pp. 76-95, https://doi.org/10.1016/J.PMCJ.2019.03.001.

[95] Development Asia (2021), Digital Mayor’s Office: An Integrated Smart City Data Platform, https://development.asia/case-study/digital-mayors-office-integrated-smart-city-data-platform.

[37] Dilmegani, C. (2022), Top 10 Privacy Enhancing Technologies & Use Cases in 2023, AI Multiple, https://research.aimultiple.com/privacy-enhancing-technologies/ (accessed on 6 February 2023).

[55] Dodge, M. and R. Kitchin (2017), “The challenges for cybersecurity for smart cities”, Journal of Urban Technologies, pp. 205-216, https://personalpages.manchester.ac.uk/staff/m.dodge/Dodge_Kitchin_Challenges_of_Cybersecurity_for_Smart_Cities.pdf (accessed on 8 February 2023).

[48] DPC (2022), Homepage, Data Protection Commission, https://www.dataprotection.ie/ (accessed on 23 September 2022).

[47] DSCI (2023), About DSCI - Data Protection, Thought Leadership, Policy Advocacy, Data Security Council of India, https://www.dsci.in/content/about-us#about_section (accessed on 7 February 2023).

[60] Ebrahimian, H. et al. (2018), “The price prediction for the energy market based on a new method”, Economic Research, Vol. 31/1, pp. 313-337, https://doi.org/10.1080/1331677X.2018.1429291.

[98] EC (2021), Proposal for a European Interoperability Framework for Smart Cities and Communities (EIF4SCC), European Commission, https://op.europa.eu/en/publication-detail/-/publication/f69284c4-eacb-11eb-93a8-01aa75ed71a1/language-en (accessed on 4 August 2022).

[99] EC (2017), New European Interoperability Framework: Promoting Seamless Services and Data Flows for European Public Administrations, European Commission, https://ec.europa.eu/isa2/sites/default/files/eif_brochure_final.pdf (accessed on 4 August 2022).

[29] Edelman (2022), Edelman Trust Barometer 2022, https://www.edelman.com/sites/g/files/aatuss191/files/2022-01/2022%20Edelman%20Trust%20Barometer%20FINAL_Jan25.pdf (accessed on 19 January 2023).

[32] EU (2022), General Data Protection Regulation (GDPR) Compliance Guidelines, European Union, https://gdpr.eu/ (accessed on 26 September 2022).

[112] Fältström, P. (2016), “Market-driven challenges to open internet standards”, Global Commission on Internet Governance Paper Series, No. 33, Global Commission on Internet Governance, https://www.cigionline.org/publications/market-driven-challenges-open-internet-standards/ (accessed on 5 October 2022).

[117] Ferrero, M. (2021), “Interoperabilidad en sistemas”, Sistemas Judiciales, Vol. 24, https://inecip.org/wp-content/uploads/2021/12/Sistemas-Judiciales-N%C2%B024-Genoveva-Ferrero.pdf (accessed on 30 September 2022).

[123] FIWARE (2020), “Collaborating municipalities for disaster resiliency and sustainable growth”, Smart Cities and Logistics, http://www.fiware.org (accessed on 8 August 2022).

[56] Fortinet (2022), “Fortinet registró 137 mil millones de intentos de ciberataques en América Latina en la primera mitad del año”, https://www.fortinet.com/lat/corporate/about-us/newsroom/press-releases/2022/fortinet-registro-137-mil-millones-de-intentos-de-ciberataques-e (accessed on 23 February 2023).

[5] Franke, J. and P. Gailhofer (2021), “Data governance and regulation for sustainable Smart Cities”, Frontiers in Sustainable Cities, Vol. 3, p. 148, https://doi.org/10.3389/FRSC.2021.763788/BIBTEX.

[101] Government of Argentina (2018), Resolución 19/2018, Ministerio de Justicia y Derechos Humanos, Argentina, http://servicios.infoleg.gob.ar/infolegInternet/anexos/305000-309999/307439/norma.htm (accessed on 28 September 2022).

[100] Government of Argentina (2016), Decreto 1273/2016 Simplificación Registral, https://www.argentina.gob.ar/normativa/nacional/decreto-1273-2016-269242/texto (accessed on 28 September 2022).

[104] Government of Argentina (n.d.), Guía para la identificación y uso de entidades interoperables, Paquete de Apertura de Datos de la República Argentina, https://datosgobar.github.io/paquete-apertura-datos/guia-interoperables/#objetivo-de-esta-guia (accessed on 29 September 2022).

[24] Government of Colombia (2022), Plan Nacional de Infraestructura de Datos, Ministrio de Tecnologías de la Información y las Comunicaciones, Bogotá, https://www.mintic.gov.co/portal/715/articles-198952_resolucion_00460_2022.pdf (accessed on 31 July 2022).

[105] Government of France (2015), Référentiel Général d’Interopérabilité Standardiser, s’aligner et se focaliser pour échanger efficacement, Direction Interministérielle du Numérique et du Système d’Information et de Communication de l’Etat, Paris, https://www.numerique.gouv.fr/uploads/Referentiel_General_Interoperabilite_V2.pdf (accessed on 29 September 2022).

[16] Government of India (n.d.), DataSmart Cities: Empowering Cities Through Data, Ministry of Housing and Urban Affairs, https://smartcities.data.gov.in/sites/default/files/DataSmart_Cities_Strategy_Print.pdf (accessed on 29 July 2022).

[17] Government of India (n.d.), Open Data Platform: India Smart Cities, https://smartcities.data.gov.in/.

[7] Government of Japan (2021), National Data Strategy, Digital Agency, Tokyo, https://www.digital.go.jp/assets/contents/node/basic_page/field_ref_resources/0f321c23-517f-439e-9076-5804f0a24b59/20210901_en_05.pdf.

[103] Government of Japan (2020), スーパーシティ／スマートシティの相互運⽤性 の確保等に関する検討会 最終報告書 令和2年 9⽉ スーパーシティ／スマートシティの相互運⽤性の確保等に関する検討会 (Interoperability for smart city), Digital Agency, Tokyo, https://www.chisou.go.jp/tiiki/kokusentoc/supercity/pdf/sogowg_houkokusyo.pdf (accessed on 4 August 2022).

[91] Government of Japan (2017), “Basic Principles on Open Data (provisional translation)”, https://cio.go.jp/sites/default/files/uploads/documents/data_shishin_en.pdf (accessed on 11 July 2022).

[45] Government of Japan (2016), 官民データ活用推進基本法 [Basic Act on the Advancement of Public and Private Sector Data Utilization], https://japan.kantei.go.jp/policy/it/data_basicact/data_basicact.html (accessed on 11 July 2022).

[44] Government of Japan (2013), Act on the Use of Numbers to Identify a Specific Individual in the Administrative Procedure (Act No. 27 of 2013 as Amended), https://www.dataguidance.com/legal-research/act-use-numbers-identify-specific-individual (accessed on 1 August 2022).

[90] Government of Japan (2013), Japan Open Data Charter Action Plan, https://japan.kantei.go.jp/policy/it/2013/1029_fulltext.pdf (accessed on 23 June 2022).

[43] Government of Japan (2003), Act on the Protection of Personal Information, https://www.japaneselawtranslation.go.jp/en/laws/view/4241/en (accessed on 1 August 2022).

[14] Government of Japan (n.d.), About Digital Agency, Digital Agency, https://www.digital.go.jp/en/about-en/#mvv.

[13] Government of Japan (n.d.), About the Cabinet Office, Cabinet Office, https://www.cao.go.jp/en/about.html.

[40] Government of Korea (2022), 개인정보보호위원회 [Personal Information Protection Commission], https://www.pipc.go.kr/eng/index.do (accessed on 22 September 2022).

[102] Government of Luxembourg (2019), National Interoperability Framework, http://digital.gouvernement.lu/en/dossiers/2019/NIF-2019.html (accessed on 28 September 2022).

[93] Government of Mexico (2018), Red México Abierto, https://www.gob.mx/epn/articulos/red-mexico-abierto?idiom=es (accessed on 26 September 2022).

[11] Government of New Zealand (n.d.), Government Chief Data Steward (GCDS), https://www.data.govt.nz/leadership/gcds/.

[108] Government of Spain (n.d.), La Plataforma de Intermediación de Datos, https://administracionelectronica.gob.es/pae_Home/pae_Estrategias/Racionaliza_y_Comparte/elementos_comunes/Intermediacion_de_datos.html.

[116] Government of the Netherlands (2023), DMI-ecosysteem voor mobiliteitsvernieuwing en slimme, duurzame verstedelijking, Dutch Metropolitan Innovations, https://dutchmobilityinnovations.com/spaces/1216/dmi-ecosysteem/0ver-ecosysteem (accessed on 27 April 2023).

[8] Hiramoto, K. (2022), “Smart cities in Japan”, PowerPoint presentation given to the OECD team, Tokyo.

[132] IBM (n.d.), What is a digital twin?, https://www.ibm.com/topics/what-is-a-digital-twin.

[82] ICC (n.d.), DataCity Paris, European Commission’s Intelligent Cities Challenge, https://www.intelligentcitieschallenge.eu/good-practices/datacity-paris.

[49] INAI (2022), Acceso a la Información y Protección de Datos Personales, Instituto Nacional de Transparencia, https://home.inai.org.mx/ (accessed on 23 September 2022).

[76] Infocomm Media Development Authority (2022), “Singapore grows trust in the digital environment”, https://www.imda.gov.sg/Content-and-News/Press-Releases-and-Speeches/Press-Releases/2022/Singapore-grows-trust-in-the-digital-environment (accessed on 18 January 2023).

[70] ISC2 (2022), “Cybersecurity workforce study. A critical need for cybersecurity professionals persists amidst a year of cultural and workplace evolution”, https://www.isc2.org/ (accessed on 23 February 2023).

[124] Ishii, K. and A. Yamanaka (2018), “Building a common Smart City platform utilizing FIWARE (Case study of Takamatsu City)”, NEC Technical Journal, https://www.nec.com/en/global/techrep/journal/g18/n01/180106.html (accessed on 8 August 2022).

[126] ITF (2021), “Developing innovative mobility solutions in the Brussels-Capital Region”, International Transport Forum Policy Papers, No. 97, OECD Publishing, Paris, https://doi.org/10.1787/37cc3a85-en.

[127] ITF (2021), “Developing Innovative Mobility Solutions in the Brussels-Capital Region”, International Transport Forum Policy Papers, No. 97, OECD Publishing, Paris, https://doi.org/10.1787/37cc3a85-en (accessed on 28 February 2023).

[107] ITF (2020), Leveraging Digital Technology and Data for Human-centric Smart Cities: The Case of Smart Mobility, OECD, Paris, https://www.itf-oecd.org/sites/default/files/docs/data-human-centric-cities-mobility-g20.pdf (accessed on 29 July 2020).

[119] Japanese Cabinet Office (2019), “Toward a New Era of “Hope-Driven Economy“: The Prime Minister’s keynote speech at the World Economic Forum Annual Meeting”, https://japan.kantei.go.jp/98_abe/statement/201901/_00003.html (accessed on 2 August 2022).

[2] Johnson, J. et al. (2022), “Data governance frameworks for Smart Cities: Key considerations for data management and use”, Journal of Law and Mobility, Vol. 2022/1, https://repository.law.umich.edu/jlm/vol2022/iss1/1 (accessed on 7 October 2022).

[131] JR East (2021), JR East Group Integrated Report 2021, JR East, Tokyo, https://www.jreast.co.jp/e/environment/pdf_2021/all.pdf (accessed on 9 August 2022).

[35] Kitchin, R. (2016), Getting Smarter about Smart Cities: Improving Data Privacy and Data Security, Department of the Taoiseach, Dublin, https://www.researchgate.net/publication/293755608_Getting_smarter_about_smart_cities_Improving_data_privacy_and_data_security (accessed on 3 February 2023).

[19] LOTI (n.d.), LOTI Outcomes-based Methodology for Data Projects, London Office of Technology and Information, https://loti.london/resources/data-methodology/.

[88] Lundquist, A., E. Rannestig and U. Sandgren (2010), “The Swedish National Geodata Strategy and its implementation”, https://www.fig.net/resources/proceedings/fig_proceedings/fig2010/papers/ts04b/ts04b_lundquist_rannestig_et_al_3796.pdf (accessed on 26 September 2022).

[57] Ma, C. (2021), “Smart city and cyber-security: Technologies used, leading challenges and future recommendations”, Energy Reports, Vol. 7, pp. 7999-8012, https://doi.org/10.1016/J.EGYR.2021.08.124.

[80] Mairie de Paris (2020), Paris Smart and Sustainable. Looking Ahead to 2020 and Beyond, https://cdn.paris.fr/paris/2020/02/26/f7dc822a66de6000cd910a145c7fca39.ai (accessed on 19 October 2022).

[81] Mairie de Paris (2019), “DataCity 2019 : les startups qui font la ville de demain”, https://www.paris.fr/pages/datacity-2019-decouvrez-les-startups-qui-font-la-ville-de-demain-6511#les-10-startups-selectionnees.

[59] Marahatta, A. et al. (2021), “Priority-based low voltage DC microgrid system for rural electrification”, Energy Reports, Vol. 7, pp. 43-51, https://doi.org/10.1016/J.EGYR.2020.11.030.

[6] Marks, A. (2022), “Learning from city-level chief data officers”, Thematic Research Networks on Data and Statistics, https://www.sdsntrends.org/blog/2022/learning-from-city-level-chief-data-officers-insights-for-national-statistics-offices-on-advancing-data-stewardship (accessed on 19 January 2023).

[64] Matsubara, M. and D. Mochinaga (2021), “Japan’s cybersecurity strategy - From the Olympics to the Indo-Pacific”, Asie Visions 119, https://www.ifri.org/sites/default/files/atoms/files/matsubara_mochinaga_japan_cybersecurity_strategy_2021.pdf (accessed on 16 August 2022).

[50] Mayor of London (2023), Data for London Advisory Board, https://www.london.gov.uk/programmes-strategies/business-and-economy/supporting-londons-sectors/supporting-tech-and-digital-sectors/data-london-advisory-board?ac-157819=157818 (accessed on 7 February 2023).

[15] MLIT (n.d.), Homepage, Ministry of Land, Infrastructure, Transport and Tourism, Government of Japan, https://www.mlit.go.jp/en/ (accessed on 27 September 2022).

[118] Modaressi, A. (2020), “Connecting Los Angeles: LANES drives interoperability across LA County”, https://lanesla.org/connecting-los-angeles-lanes-drives-interoperability-across-la-county/ (accessed on 30 September 2022).

[129] Muroi, S. (2021), “Initiatives and vision for Smart City Aizuwakamatsu”, Information provided to the OECD by the government of Aizuwakamatsu City, Aizuwakamatsu.

[113] Nantes Métropole (2022), Charte des usages de la plateforme Open Data mutualisée, Nantes Métropole, Loire Atlantique Department and Pays de la Loire Region, https://fr.ftp.opendatasoft.com/nantesmetropole/CharteUsagesPortailODS-v1-3.pdf (accessed on 3 October 2022).

[74] National Security Office (2019), National Cybersecurity Strategy, National Security Office, Seoul, https://www.itu.int/en/ITU-D/Cybersecurity/Documents/National_Strategies_Repository/National%20Cybersecurity%20Strategy_South%20Korea.pdf (accessed on 26 September 2022).

[121] NIIS (2022), Homepage, Nordic Institute for Interoperability Solutions, https://www.niis.org/ (accessed on 29 September 2022).

[18] NSW Government (2021), NSW Government Data Strategy, New South Wales, Sydney, https://data.nsw.gov.au/sites/default/files/inline-files/NSW%20Government%20Data%20Strategy_0.pdf (accessed on 27 July 2022).

[72] NYC Government (2021), IoT Strategy - The New York City Internet of Things Strategy, Mayor’s Office of the Chief Technology Officer, New York, https://www1.nyc.gov/assets/cto/downloads/iot-strategy/nyc_iot_strategy.pdf (accessed on 16 August 2022).

[79] NYC Government (2021), The New York City Internet of Things: Progress Report, Office of the Chief Technology Officer, New York, https://on.nyc.gov/iot-progress-report (accessed on 7 October 2022).

[71] OAS (2022), Cybersecurity Workforce Development in an Era of Talen and Skills Shortages, Cybersecurity Program of the Inter-American Committee against Terrorism, Organization of American States, https://www.oas.org/en/sms/cicte/docs/Report_Cyber_WorkForce_Development_in_an_Era_of_Talent_and_Skills_Shortages.pdf (accessed on 23 February 2023).

[31] OECD (2022), Building Trust to Reinforce Democracy: Main Findings from the 2021 OECD Survey on Drivers of Trust in Public Institutions, Building Trust in Public Institutions, OECD Publishing, Paris, https://doi.org/10.1787/b407f99c-en.

[1] OECD (2022), Going Digital to Advance Data Governance for Growth and Well-being, OECD Publishing, Paris, https://doi.org/10.1787/e3d783b0-en.

[97] OECD (2021), “Data portability, interoperability and digital platform competition”, OECD Competition Committee Discussion Paper, OECD, Paris, http://oe.cd/dpic (accessed on 4 August 2022).

[26] OECD (2021), Government at a Glance 2021, OECD Publishing, Paris, https://doi.org/10.1787/1c258f55-en.

[87] OECD (2020), OECD Open, Useful and Re-usable Data (OURdata) Index: 2019, OECD, Paris, https://www.oecd.org/governance/digital-government/ourdata-index-policy-paper-2020.pdf (accessed on 23 June 2022).

[89] OECD (2019), Government at a Glance 2019, OECD Publishing, Paris, https://doi.org/10.1787/8ccf5c38-en.

[92] OECD (2019), OECD OURdata Index: 2019, OECD, Paris, http://www.oecd.org/gov/digital-government/ourdata-index-japan.pdf.

[3] OECD (2019), The Path to Becoming a Data-Driven Public Sector, OECD Digital Government Studies, OECD Publishing, Paris, https://doi.org/10.1787/059814a7-en.

[25] OECD (2017), Government at a Glance 2017, OECD Publishing, Paris, https://doi.org/10.1787/gov_glance-2017-en.

[42] OECD (2013), The OECD Privacy Framework, OECD, Paris, https://www.oecd.org/sti/ieconomy/oecd_privacy_framework.pdf (accessed on 7 February 2023).

[41] One Trust Data Guidance (2022), Portugal - Data Protection Overview, https://www.dataguidance.com/notes/portugal-data-protection-overview-0 (accessed on 22 September 2022).

[61] Parasol, M. (2018), “The impact of China’s 2016 Cyber Security Law on foreign technology firms, and on China’s big data and Smart City dreams”, Computer Law & Security Review, Vol. 34/1, pp. 67-98, https://doi.org/10.1016/J.CLSR.2017.05.022.

[68] RFI (2022), “Paralysed French hospital fights cyber attack as hackers lower ransom”, https://www.rfi.fr/en/france/20220902-paralysed-french-hospital-fights-cyber-attack-as-hackers-lower-ransom-demand.

[83] Satori (2022), What are Data Standards and Why Do You Need Them?, https://satoricyber.com/data-management/what-are-data-standards-and-why-do-you-need-them/ (accessed on 2 August 2022).

[94] SCPM (n.d.), Whitepaper, Seoul Smart City Platform, http://scpm.seoul.go.kr/resources/whitepaper_EN.pdf.

[96] Seoul Metropolitan Government (2020), “Seoul’s “Smart City Platform for Mayor” to lead global communication in the age of “untact””, https://english.seoul.go.kr/seouls-smart-city-platform-for-mayor-to-lead-global-communication-in-the-age-of-untact/.

[115] Seoul Metropolitan Government (n.d.), Seoul Smart City Platform, https://news.seoul.go.kr/gov/archives/529453.

[85] Statistics Canada (2019), Guidelines for Ensuring Data Quality, Statistics Canada Quality Guidelines, https://www150.statcan.gc.ca/n1/pub/12-539-x/2019001/ensuring-assurer-eng.htm (accessed on 2 August 2022).

[109] Toyama City (2022), “Smart city promotion business”, Presentation given to the OECD on 17 June 2022, Toyama.

[75] UK Government (2022), National Cyber Strategy 2022 - Pioneering a Cyber Future with the Whole of the UK, https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/1053023/national-cyber-strategy-amend.pdf (accessed on 26 September 2022).

[53] UK Government (2020), Data Ethics Framework, Government Digital Service, London, https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/923108/Data_Ethics_Framework_2020.pdf (accessed on 23 September 2022).

[10] UK Government (2020), National Data Strategy, Department for Digital, Media, Culture & Sport, https://www.gov.uk/government/publications/uk-national-data-strategy/national-data-strategy#data-1-2 (accessed on 1 August 2022).

[12] United States Congress (2017), H.R.4174 - Foundations for Evidence-Based Policymaking Act of 2018, https://www.congress.gov/bill/115th-congress/house-bill/4174/text.

[77] US Government (2018), U.S. Department of Homeland Security - Cybersecurity Strategy, Department of Homeland Security, Washington, https://www.dhs.gov/sites/default/files/publications/DHS-Cybersecurity-Strategy_1.pdf (accessed on 27 September 2022).

[39] van Ooijen, C., B. Ubaldi and B. Welby (2019), “A data-driven public sector: Enabling the strategic use of data for productive, inclusive and trustworthy governance”, OECD Working Papers on Public Governance, No. 33, OECD Publishing, Paris, https://doi.org/10.1787/09ab162c-en.

[120] WEF (2020), Data Free Flow with Trust (DFFT): Paths towards Free and Trusted Data Flows, World Economic Forum, Geneva, https://www.weforum.org/whitepapers/data-free-flow-with-trust-dfft-paths-towards-free-and-trusted-data-flows/ (accessed on 13 July 2022).

[86] Wilkinson, M. et al. (2016), “The FAIR Guiding Principles for scientific data management and stewardship”, Scientific Data, Vol. 3/1, pp. 1-9, https://doi.org/10.1038/sdata.2016.18.

[67] Wired (2008), “Polish teen hacks his city’s trams, chaos ensues”, https://www.wired.com/2008/01/polish-teen-hac/.

[62] Xie, S. et al. (2020), “The optimal planning of smart multi-energy systems incorporating transportation, natural gas and active distribution networks”, Applied Energy, Vol. 269, https://doi.org/10.1016/J.APENERGY.2020.115006.

[122] X-Road (2022), X-Road® Data Exchange Layer, https://x-road.global/ (accessed on 29 September 2022).

[63] Yan, J., J. Liu and F. Tseng (2020), “An evaluation system based on the self-organizing system framework of smart cities: A case study of smart transportation systems in China”, Technological Forecasting and Social Change, Vol. 153, https://doi.org/10.1016/J.TECHFORE.2018.07.009.

Notes

← 1.  Japan defines Society 5.0 as “[a] human-centered society that balances economic advancement with the resolution of social problems by a system that highly integrates cyberspace and physical space”. For further information see: https://www8.cao.go.jp/cstp/english/society5_0/index.html

← 2.  For further information, see: https://www.mlit.go.jp/common/000026153.pdf.

← 3.  Ibid.

← 4.  A digital twin can be defined as ‘…a virtual representation of an object or system that spans its lifecycle, is updated from real-time data, and uses simulation, machine learning and reasoning to help decision making” IBM ( (n.d.[132]), What is a digital twin?, at: https://www.ibm.com/topics/what-is-a-digital-twin, 19 September 2023.

← 5.  For further information, see: https://www.itnews.com.au/news/nsw-data-analytics-centre-to-get-legislative-teeth-410073.

← 6.  See: https://www.guru99.com/what-is-mac-address.html.

← 7.  For an example of anonymisation technology see: https://brighter.ai/product/#demo

← 8.  For further information, see HealthHub, National Steps Challenge: https://www.healthhub.sg/programmes/37/nsc#:~:text=Those%20who%20are%20just%20starting,30%20minutes%20of%20MVPA%20daily.

← 9.  Privacy by Design (PbD) could be defined as “… an approach to protecting Privacy by embedding it into the design specifications of technologies, business practices, and physical infrastructures” At Internet (n.d.[133]), Privacy by Design (PbD), at: https://www.atinternet.com/en/glossary/privacy-by-design-pbd/ 19 September 2023.

← 10.  The Privacy by Design principles were formulated by Ann Cavoukian in 1995; for further information, see: https://en.wikipedia.org/wiki/Privacy_by_design.

← 11.  For further information, see https://www.chileatiende.gob.cl/fichas/101961-ley-pro-consumidor#:~:text=El%2024%20de%20diciembre%20de,materia%20de%20protecci%C3%B3n%20al%20consumidor.&text=Los%20consumidores%20tienen%20derecho%20a,productos%20nuevos%20que%20salen%20malos; and https://www.sernac.cl/portal/617/w3-channel.html.

← 12.  For further information on the London Datastore, see: https://data.london.gov.uk/.

← 13.  For further information see: https://obamawhitehouse.archives.gov/the-press-office/2012/02/23/we-can-t-wait-obama-administration-unveils-blueprint-privacy-bill-rights; and https://archive.epic.org/privacy/white_house_consumer_privacy_.html.

← 14.  Interview with Eddie Copeland, Director of the LOTI, on 4th May 2022.

← 15.  See: https://www.unicef-irc.org/publications/pdf/DP%202018%2002.pdf.

← 16.  See: https://ethicalgeo.org/locus-charter/.

← 17.  See: https://grantmckenzie.com/academics/GeoprivacyManifesto2017.pdf.

← 18.  See: https://uksa.statisticsauthority.gov.uk/publication/ethical-considerations-in-the-use-of-geospatial-data-for-research-and-statistics/.

← 19.  See: https://www.w3.org/TR/responsible-use-spatial/.

← 20.  See: https://www.urisa.org/about-us/gis-code-of-ethics.

← 21.  See: https://www.geonovum.nl/uploads/documents/20200529%20Consultation%20Ethical%20framework%20personal%20location%20data.pdf.

← 22.  For further information, see: https://hub.beesmart.city/en/strategy/the-importance-of-cyber-security-and-data-protection-for-smart-cities.

← 23.  For further information, see: https://cso.computerworld.es/tendencias/el-ayuntamiento-de-madrid-crea-un-centro-de-operaciones-de-seguridad.

← 24.  For further information, see: https://www.eldebate.com/espana/madrid/20220630/ola-de-ataques-informaticos-en-la-comunidad-de-madrid.html.

← 25.  For further information, see: https://digital-strategy.ec.europa.eu/en/news/commission-invest-eu292-million-digital-technologies-and-cybersecurity.

← 26.  For further details, see: https://about.crunchbase.com/cybersecurity-research-report-2021/.

← 27.  For further information, see Public Safety Canada: https://www.publicsafety.gc.ca/cnt/ntnl-scrt/cbr-scrt/cbr-crr-wrnss/index-en.aspx#s1.

← 28.  For further information, see: https://www.lantmateriet.se/en/national-geodata-platform/.

← 29.  See: https://oascities.org/digital-interoperability-big-in-japan/.

← 30.  For further information, see: https://www.argentina.gob.ar/jefatura/innovacion-publica/innovacion-administrativa/interoperar.

← 31.  For further information, see: https://loti.london/.

← 32.  For further information, see Standard Business Reporting: https://business.gov.nl/regulation/standard-business-reporting/ and https://www.sbr-nl.nl/english/what-is-sbr.

← 33.  For further information, see: https://cities-today.com/london-outlines-plans-for-advanced-data-platform/.

← 34.  For further information, see: https://opendata-ajuntament.barcelona.cat/en/open-data-bcn.

← 35.  For further information, see: https://ajuntament.barcelona.cat/digital/en/blog/presentation-of-the-global-observatory-of-urban-artificial-intelligence.

← 36.  For further information, see Smart Seoul Platform: https://news.seoul.go.kr/gov/archives/529453.

← 37.  See France Mobilités, Smart Mobility Platform: https://www.francemobilites.fr/solutions/smart-mobility-platform.

← 38.  For further information, see: https://whimapp.com/.

← 39.  For further information, see https://www.vcd.org/themen/multimodalitaet/beispiele/mobilitaetsshop-hannover.

← 40.  For further information, see: https://www.wienerlinien.at/web/wl-en/wienmobil-app.

← 41.  For further information, see: https://www.jreast.co.jp/e/pass/suica.html and https://www.jreast.co.jp/e/environment/pdf_2021/p002-007.pdf.