Data Protection by Design in the Context of Smart Cities: A Consent and Access Control Proposal

Abstract

The growing availability of mobile devices has lead to an arising development of smart cities services that share a huge amount of (personal) information and data. Without accurate and verified management, they could become severe back-doors for security and privacy. In this paper, we propose a smart city infrastructure able to integrate a distributed privacy-preserving identity management solution based on attribute-based credentials (p-ABC), a user-centric Consent Manager, and a GDPR-based Access Control mechanism so as to guarantee the enforcement of the GDPR’s provisions. Thus, the infrastructure supports the definition of specific purpose, collection of data, regulation of access to personal data, and users’ consents, while ensuring selective and minimal disclosure of personal information as well as user’s unlinkability across service and identity providers. The proposal has been implemented, integrated, and evaluated in a fully-fledged environment consisting of MiMurcia, the Smart City project for the city of Murcia, CaPe, an industrial consent management system, and GENERAL_D, an academic GDPR-based access control system, showing the feasibility.

Data Protection by Design Tool for Automated GDPR Compliance Verification Based on Semantically Modeled Informed Consent

“…Similarly to our work, Daoudagh et al [ 53 ] also focus on data sharing in smart cities and propose a privacy-by-design platform for compliance. The implemented solution preserves individuals’ privacy by utilizing various authentication mechanisms, such as zero-knowledge proofs, it can support data management and traceability, and it is compliant with GDPR principles such as data minimization and purpose limitation.…”

Constructing smart cities through the use of public-private partnerships: The case of Dubai in the United Arab Emirates

“…This discourse draws upon scholarly insights to elucidate the multifaceted significance of smart cities in the realms of environmental sustainability, economic development, social inclusivity, and urban resilience. Defining the "smart city" concept has been problematic (Daoudagh et al, 2021). There is no consensus among scholars about what precisely the concept means (Kitchin, 2022), thus creating vagueness and ambiguity around the debates surrounding smart city discussion in academia (Hollands, 2008).…”

“…Moreover, Nam and Pardo (2011) further narrowed down the dimensions of a smart city to only three: technology, people, and community. They discussed each of these dimensions and tried to address the sources of confusion and ambiguity in defining a smart city within these three domains in the literature (Daoudagh et al, 2021). The definition that best captures what is a smart city in the context of Dubai, the empirical focus of this article, can be summed up as "the use of Smart Computing technologies to make critical infrastructure components and services of a city-which includes city administration, education, healthcare, public safety, real estate, transportation, and utilities-more intelligent, interconnected, and efficient" (Washburn et al 2010).…”

Prospects of Cybersecurity in Smart Cities

“…The importance of data minimization and anonymization is associated with the appearance of data encryption. Daoudagh et al [60] recommend that smart cities should practice data minimization, collecting only the necessary data to fulfill their functions and reducing the risk associated with storing excessive personal information. Furthermore, smart cities must implement robust access controls to restrict access to sensitive systems and data.…”