**SpringerBriefs in Geography**

**Thanh Phan · Daniela Damian Editors**

# **Smart Cities in Asia** Regulations, Problems, and Development

**SpringerBriefs in Geography**

SpringerBriefs in Geography presents concise summaries of cutting-edge research and practical applications across the fields of physical, environmental and human geography. It publishes compact refereed monographs under the editorial supervision of an international advisory board with the aim to publish 8 to 12 weeks after acceptance. Volumes are compact, 50 to 125 pages, with a clear focus. The series covers a range of content from professional to academic such as: timely reports of state-of-the art analytical techniques, bridges between new research results, snapshots of hot and/or emerging topics, elaborated thesis, literature reviews, and in-depth case studies.

The scope of the series spans the entire field of geography, with a view to significantly advance research. The character of the series is international and multidisciplinary and will include research areas such as: GIS/cartography, remote sensing, geographical education, geospatial analysis, techniques and modeling, landscape/regional and urban planning, economic geography, housing and the built environment, and quantitative geography. Volumes in this series may analyze past, present and/or future trends, as well as their determinants and consequences. Both solicited and unsolicited manuscripts are considered for publication in this series.

SpringerBriefs in Geography will be of interest to a wide range of individuals with interests in physical, environmental and human geography as well as for researchers from allied disciplines.

More information about this series at https://link.springer.com/bookseries/10050

Thanh Phan · Daniela Damian Editors

# Smart Cities in Asia

Regulations, Problems, and Development

*Editors* Thanh Phan Faculty of Engineering University of Victoria Victoria, BC, Canada

Daniela Damian Faculty of Engineering University of Victoria Victoria, BC, Canada

ISSN 2211-4165 ISSN 2211-4173 (electronic) SpringerBriefs in Geography ISBN 978-981-19-1700-4 ISBN 978-981-19-1701-1 (eBook) https://doi.org/10.1007/978-981-19-1701-1

© The Editor(s) (if applicable) and The Author(s) 2022. This book is an open access publication.

**Open Access** This book is licensed under the terms of the Creative Commons Attribution 4.0 International License (http://creativecommons.org/licenses/by/4.0/), which permits use, sharing, adaptation, distribution and reproduction in any medium or format, as long as you give appropriate credit to the original author(s) and the source, provide a link to the Creative Commons license and indicate if changes were made.

The images or other third party material in this book are included in the book's Creative Commons license, unless indicated otherwise in a credit line to the material. If material is not included in the book's Creative Commons license and your intended use is not permitted by statutory regulation or exceeds the permitted use, you will need to obtain permission directly from the copyright holder.

The use of general descriptive names, registered names, trademarks, service marks, etc. in this publication does not imply, even in the absence of a specific statement, that such names are exempt from the relevant protective laws and regulations and therefore free for general use.

The publisher, the authors and the editors are safe to assume that the advice and information in this book are believed to be true and accurate at the date of publication. Neither the publisher nor the authors or the editors give a warranty, expressed or implied, with respect to the material contained herein or for any errors or omissions that may have been made. The publisher remains neutral with regard to jurisdictional claims in published maps and institutional affiliations.

This Springer imprint is published by the registered company Springer Nature Singapore Pte Ltd. The registered company address is: 152 Beach Road, #21-01/04 Gateway East, Singapore 189721, Singapore

## **Acknowledgements**

We would like to send our sincere thanks to Prof. Victor V. Ramraj, Director of the Centre for Asia-Pacific Initiatives, University of Victoria; the Canadian Queen Elizabeth II Diamond Jubilee Scholarships-Advanced Scholars program and the Natural Sciences and Engineering Research Council of Canada for sponsoring our book project.

We are also grateful to Madeline Walker for assisting us with editing this book. Finally, we would like to thank Robyn Fila and Katie Dey at the Centre for Asia-Pacific Initiatives, University of Victoria, for their tireless support.

# **Contents**

# **Contributors**

**Hoa Chu** Deputy Director General, Institute of Legal Studies, Ministry of Justice, Hanoi, Vietnam

**B. Courtney Doagoo** Centre for Law, Technology, and Society, University of Ottawa, Ottawa, Canada

**Daniela Damian** Faculty of Engineering, University of Victoria, Victoria, BC, Canada

**Minh Son Ha** Department Deputy, Academy of Finance, Hanoi, Vietnam

**Ze Shi Li** Faculty of Engineering, University of Victoria, Victoria, BC, Canada

**Melinda Martinus** ISEAS—Yusof Ishak Institute, Singapore, Singapore

**Bryan Mercurio** Faculty of Law, The Chinese University of Hong Kong, Shatin, New Territories, Hong Kong

**Nguyen Thi Bich Ngoc** Academy of Policy and Development, Hanoi, Vietnam

**Thuy Linh Nguyen** Academy of Finance, Hanoi, Vietnam

**Thanh Phan** Faculty of Engineering, University of Victoria, Victoria, BC, Canada

**Visakha Phusamruat** Graduate School of Law, National Institute of Development Administration, Bangkok, Thailand

**Nguyen Van Cuong** General Director, Institute of Legal Studies,Ministry of Justice of Vietnam, Hanoi, Vietnam

**Colin Werner** Faculty of Engineering, University of Victoria, Victoria, BC, Canada

**Ronald Ker-Wei Yu** Faculty of Law, The Chinese University of Hong Kong, Shatin, Hong Kong

# **Chapter 1 Introduction to Smart Cities in Asia: Regulations, Problems, and Development**

**Daniela Damian and Thanh Phan**

**Abstract** Asia Pacific, which makes up 60% of the world's population, is emerging as a dynamic region in the world in terms of economic and technological growth. It is no surprise that Asian cities are also recognized as leaders in designing smart cities that harness digital information to improve operational efficiency. This chapter provides an overview of the subjects and jurisdictions that this book will cover, outlining its structure as well as the flow of the discussion. This book aims to provide audiences with an overview of smart cities in Asia from different perspectives. While the topic of Smart Cities in Asia: Regulations, Problems, and Development does not address all concerns and questions about smart cities in Asia, the discussions outline regulatory frameworks of some countries, addresses certain problems, and projects the development of smart cities in the region. The book also establishes a network of scholars and practitioners who are interested in researching smart cities. The editors and authors welcome all comments, suggestions, and initiatives promoting scholarship in this area.

Asia Pacific, which makes up 60% of the world's population, is emerging as a dynamic region in the world in terms of economic and technological growth (UNFPA, nd). Some countries in the region are leading performers in information and communication technology (ICT) indicators (UN ESCAP 2016). Also, East and North-East Asian countries contribute three-quarters of fixed broadband subscriptions in Asia (UN ESCAP 2016, p. 9).

It is no surprise that Asian cities are also recognized as leaders in designing smart cities that harness digital information to improve operational efficiency, and this book attempts to provide an introduction to some of the context, challenges

© The Author(s) 2022 T. Phan and D. Damian (eds.), *Smart Cities in Asia*, SpringerBriefs in Geography, https://doi.org/10.1007/978-981-19-1701-1\_1

D. Damian · T. Phan (B)

Faculty of Engineering, University of Victoria, 3800 Finnerty Road (Ring Road), Victoria, BC V8P 5C2, Canada

e-mail<EMAIL_ADDRESS>
D. Damian e-mail<EMAIL_ADDRESS>
and developments around smart cities in a number of countries in the region. Singapore, for example, is a city that consistently is ranked as 'one of the smartest cities' around, with a unique approach to centrally housing massive amounts of information collected from its citizens with the government instead of with an individual company. Other countries, such as Indonesia, Thailand and Vietnam or Korea, have developed smart cities at different levels and overcame challenges related to creating smart cities in traditional urban settings. Vietnam, for example, applied the smart city concept to governing a historical center in an ancient capital while Thailand is building a smart tourist city on an island.

## **1.1 Smart Cities: An Overview and General Issues**

The concept of smart cities is not new, although it seems like a modern urbanism and sustainability-driven trend. The use of information technology and data for more efficient cities governance has become promising as early as 1970 when Los Angeles became known for its first urban big data project that used computer databases, cluster analysis, and infrared aerial photography to "gather data, produce reports on neighborhood demographics and housing quality, and help direct resources to ward off blight and tackle poverty" (Vallianatos 2015). Arguably the first smart city was Amsterdam in 1994 when it created a virtual digital city to promote Internet usage; the trend solidified in the 2000s with large corporations such as IBM and Cisco invested significantly in research and development of projects that used sensors, networks and analytics to help cities run more efficiently (Woetzel et al. 2021). Continued government and industry investment span off a growing number of smart cities initiatives in Japan (2010), Barcelona (2011), China (2013), and later other cities in Europe, Singapore and Vietnam, just to name a few.

As cities got smarter, the vision is that they are becoming more livable and more responsive as a result of leveraging technologies in urban environments. The last decade has seen an important shift from smart technologies being regarded as tools to improve efficiency to feasible enablers of a better quality of life. Technology and data used purposefully have become a powerful mechanism to make better decisions for a more livable future and sustainability has emerged as an aim of smart cities, as important as resource efficiency and governance (Woetzel et al. 2021). With the help of the Internet of Things (IoT) Technology to collect and analyze large, heterogenous amounts of data, sustainable smart cities are today's vision in bridging the gap between sustainability targets and urban development strategies. Rankings of most sustainable smart cities being topped by many European cities but also Asian cities like Singapore (Woetzel et al. 2021). While smart cities are now touted as imperative for a sustainable future, the approach is not without challenges: working with existing infrastructures in traditional cities when applying new technologies may be costly and unsuitable for cities with a long history, as described in some chapters in this book.

This book provides a discussion of the opportunities, developments and some of the challenges specific to smart cities in Asia. It starts in Chap. 2 with an overview and some definitions of smart cities, alongside perspectives from scholars and practitioners on problems with these cities from both legal and technical perspectives. Chapter 2 introduces a framework to conceptualize a few common topics related to smart city governance. Doagoo reviews the concept of smart cities discussed by scholars and international institutions such as the UN Economist Network, the UN Sustainable Development Goals, and the World Economic Forum 2019. The chapter also highlights some smart city initiatives in the world, sketches an overview of the smart city movements in Asian countries, and analyzes the various mechanics and concepts of smart cities to demonstrate that smart cities are not a one-size-fitsall approach. Finally, the author illustrates several common concerns and challenges relating to smart city governance, which include privacy, security, and public–private partnerships.

The concept of smart cities heavily relies on collecting large amounts of citizens' data and, as several chapters in the book highlight, can raise concerns as to what data is being used for. Because the processing of big data is an essential element as much as is the technological innovation in smart cities, the protection of privacy and personal data becomes pivotal to the sustainability and success of smart cities. While the internet and advanced technologies can help to optimize governance, they can also make people prone to cyberattacks. Chapter 3 starts this discussion by examining the ongoing challenges and solutions of managing data privacy for smart cities where data is collected from countless sensors and devices. By focusing on the technical aspects of data privacy, the authors show that while smart cities provide new business opportunities for software organizations to process, manage, utilize, examine, and generate data, they also create many privacy challenges. These challenges include obtaining a shared understanding of privacy and achieving compliance with privacy regulations. Li and Werner recognize that while smart cities support people's ability to make rational and prudent decisions based on real data, the privacy of that data should not be overlooked.

## **1.2 Legal Frameworks and Problems with Smart Cities in Asia: A Country Analysis**

The following chapters focus the discussion of issues around privacy protection in specific regions, countries, and cities, using selected industries or case studies of smart city projects to illustrate benefits and challenges. In Chap. 4, Martinus explores the privacy concern of smart cities in the context of the COVID-19 pandemic in three active members of the Association of Southeast Asian Nations: Singapore, Malaysia, and Indonesia. The discussion starts with the concern of citizens, experts, and policymakers in the region about smart cities' data protection and security. Smart technologies, such as big data, artificial intelligence, and the Internet of Things, are perceived as enablers for cities to control air pollution, reduce traffic, streamline public services, and make energy use more efficient. Experts, however, underline that personal and behavioral data collected by smart technologies have not been adequately protected, thus bringing significant risk to individual privacy. The COVID-19 pandemic has also further intensified the dialogue to address privacy concerns in the digital sphere. Drawing from the experience of COVID-19 tracing applications in Singapore, Malaysia, and Indonesia, the author finds that despite concerns about technical issues and accessibility, the practice of surveillance and the effectiveness of such technology adoption to fight COVID-19 remain in debate. The dialogue on data protection in the digital sphere has become more complex as there are contesting interests between the need to ensure public safety and the need to protect individual privacy.

Chapter 5 continues the thread of data and privacy in smart cities by discussing the need for a coherent policy on cross-border data flows to make the city of Hong Kong smart. Yu and Mercurio observe that to remain relevant and competitive, a smart city must rely on external data not only for short-term commercial needs, such as international payment transactions, but also for long-term innovation, content creation, product development, business viability, and support and updates for smart devices and vehicles. This requirement concurrently involves legal issues connected with privacy, trade, e-commerce, finance and cybersecurity, and intellectual property, which, in turn, is further complicated by the need to protect data, enforce laws, and access tools for the creation of new content or innovations. This chapter takes Hong Kong as a case study to examine the conflicting legal and other issues facing smart cities, including how to provide access to tools and data to enable the creation of apps, content, or products and adapt products for local and global needs; how to encourage use and deployment of data-dependent systems such as artificial intelligence; and how to allow companies to fulfill obligations to provide customer support, enable commercial transactions, or enable the flow of digital currencies. The authors advocate for the establishment of a coordinated framework and policy for managing cross-border data flows with respect to the governance of smart cities.

Moving to Thailand, Chap. 6 focuses on a specific smart city project in the tourist island of Phuket to highlight privacy and personal data-related issues arising from the development of smart cities. Based on recent smart city campaigns in Phuket involving closed-circuit television installation and digitally-tracking wristbands, Phusamruat finds that local actors' privacy perceptions and data processing practices substantially deviate from the privacy views and practices required by the Thai *Personal Data Protection Act*. This deviation may result in a lack of implementation of the *Act* or force inevitable changes to local community life to meet a new legal standard. The global–local tension between norms brought by visitors from various cultural backgrounds and the local tradition makes finding common ground far more difficult. This case demonstrates the limitations of current legal approaches to embracing diverse societal views and interests, while also paving a new way to understand privacy in smart cities and integrate this knowledge into their universal design.

Smart Cities require new strategies and regulatory frameworks to account for the renewed relationship between technology, government and society. The challenge is in establishing legal mechanisms that control the potential harm from technological advances and new services while enabling innovation (Gasiola 2022). Chapters 7 and 8 provide an overview of the legal framework for smart cities in Vietnam in recent years and the driving forces behind this evolution.

In Chap. 7, Nguyen (Cuong) highlights that the Vietnamese legal framework for smart city projects is still in an early stage of development with room for improvement, especially in the areas of legal rules for ICT application, urban governance of infrastructure, construction and engineering laws, intellectual property rights, and protection of personal data. This chapter shows that the promotion of smart city projects requires a huge effort from both central and local governments. The author believes that some local governments are active and interested in experimenting with smart city projects, but the lack of a sound legal framework could be a hindrance for realizing this ambition. This chapter also suggests that the central government should play a bigger role in constructing a legal framework that is more favorable to the implementation of smart city projects in local governments.

Further, Chu in Chap. 8 continues the discussion about the legal framework of Vietnam with a focus on personal data protection. Similar to other jurisdictions including Indonesia, Malaysia, Singapore, and Thailand, Vietnam has been revising its legal framework to address the need for personal data protection. The development of smart cities in Vietnam raises concerns among city residents about transparency in data collection and how to ensure that such data is not misused, disclosed, leaked, or exploited for the wrong purposes. This chapter reviews the Vietnamese legal framework for data protection to highlight that data protection law in Vietnam should be reformed for the development of smart cities.

Chapter 9 switches to the financial and banking aspect of smart cities in Vietnam. In cities where payments are expected to be digital, banking plays an important role. This chapter first reviews the literature on digital transformation in the banking sectors and the current commercial banks' digital transformation landscape in Vietnam. It provides examples of some local commercial banks to show that digital banking should be considered an integral part of smart cities. Ha and Nguyen (Linh) also analyze the challenges facing Vietnamese banks in their digitalization process to become smarter banks and puts forward some recommendations about how to leverage this process in the Vietnamese banking system. The authors assert that digital transformation is key to the banking industry creating value for the customer and keeping pace with innovation in smart cities where people expect real-time instant gratification.

Chapter 10 closes the discussion about smart cities in Vietnam by examining a case of the Intelligent Operations Center (IOC) in Thua Thien Hue province and analyzing its smart city implementation inside a historical and cultural city. The IOC, which was designed and implemented to lay a sound foundation for smart city technologies, helps the local government supervise and control citizens' social activities and predict social trends. The IOC also encourages the participation of citizens in managing the city. Nguyen (Ngoc) believes that the future of urban tourism belongs to smart cities and makes several recommendations to boost tourism and increase the participation of inhabitants in co-creating more value for the province in the smart city project.

## **1.3 Final Notes**

This book aims to provide audiences with an overview of smart cities in Asia from different perspectives.While the topic of Smart Cities in Asia: Regulations, Problems, and Development does not address all concerns and questions about smart cities in Asia, the discussions outline regulatory frameworks of some countries, addresses certain problems, and projects the development of smart cities in the region. The book also establishes a network of scholars and practitioners who are interested in researching smart cities. The editors and authors welcome all comments, suggestions, and initiatives promoting scholarship in this area.

## **References**

**Open Access** This chapter is licensed under the terms of the Creative Commons Attribution 4.0 International License (http://creativecommons.org/licenses/by/4.0/), which permits use, sharing, adaptation, distribution and reproduction in any medium or format, as long as you give appropriate credit to the original author(s) and the source, provide a link to the Creative Commons license and indicate if changes were made.

The images or other third party material in this chapter are included in the chapter's Creative Commons license, unless indicated otherwise in a credit line to the material. If material is not included in the chapter's Creative Commons license and your intended use is not permitted by statutory regulation or exceeds the permitted use, you will need to obtain permission directly from the copyright holder.

# **Chapter 2 Smart Cities in Asia: An Introductory Note**

#### **B. Courtney Doagoo**

**Abstract** This chapter provides a framework to conceptualize a few common topics related to smart city governance. It provides a high-level overview of smart cities movement in Asian countries, followed by the various mechanics and concepts of smart cities to demonstrate that there is no one-size-fits-all approach to create smart cities. It will then highlight several common concerns and challenges relating to smart city governance, which include privacy, security, and public–private partnerships.

## **2.1 Introduction**

According to the World Bank, cities are home to roughly 55% of the world's population and account for more than 80% of its Gross Domestic Product (2020). It is projected that by 2030, about "752 million people will live in cities with at least 10 million inhabitants" (United Nations 2017, p. 3). Cities are therefore not only of central importance to the economy, but also have a critical impact on the environmental, political, and social lives of the individuals who inhabit them (World Bank 2020). Realizing the potential to improve people's lives along these axes, governments around the world have, for the last couple of decades, been looking to leverage various "smart city" initiatives to meet these goals. (IMD World Competitiveness 2020; People's Republic of China, nd).

Smart city initiatives are diverse and span across various industries. These initiatives can include opportunities to increase food security with urban community farming. Cities can target climate change through the implementation of smart mobility and smart grids, expansion of green spaces, and through the creation of 15-min city neighbourhoods. Smart city initiatives can also aim to increase access to services for citizens and civic participation (UN Economist Network 2020, pp. 12, 89). In addition to helping municipalities, provinces, and states benefit citizens, it has been suggested that smart cities can help countries work toward achieving the UN Sustainable Development Goals (SDGs) (Alisjahbana 2019). Smart cities have been

B. Courtney Doagoo (B)

Centre for Law, Technology, and Society, University of Ottawa, Ottawa, Canada e-mail<EMAIL_ADDRESS>
<sup>©</sup> The Author(s) 2022

T. Phan and D. Damian (eds.), *Smart Cities in Asia*, SpringerBriefs in Geography, https://doi.org/10.1007/978-981-19-1701-1\_2

identified as an opportunity to work toward attaining SDG 11, making "cities and human settlements inclusive, safe, resilient and sustainable" (IISD 2018) in addition to contributing to other SDGs.<sup>1</sup>

Smart city governance is a vast topic that encompasses numerous facets and elements. Given that in many cases, technology has been seen as the main enabler of smart city development, policymakers have been grappling with issues around governance within this environment (UN Report 2020, p. 89). While there are practical reasons for governments and citizens to encourage the development of smart cities, there are also regulatory, legal, policy, and ethical challenges that may limit these benefits or prevent them from being realized at all. (World Economic Forum 2020).<sup>2</sup> Recognizing the opportunities to leverage smart city initiatives, stakeholders have been keen to help smart cities realize their fullest potential while navigating these challenges (World Economic Forum 2019).<sup>3</sup> One such initiative is the G20 Global Smart Cities Alliance, which aims to "lead a new global effort to establish universal norms and guidelines for implementation of smart city technology" and to create a roadmap for cities to leverage policy and regulatory toolboxes for smart cities (World Economic Forum 2019).

It is difficult to know how many smart cities currently exist or are in development, as there are initiatives stemming across all continents (IMDWCC 2020). The earliest examples of smart cities have been said to include those in Europe, including Amsterdam and Barcelona. However, there has also been an increase in the growth and planning of smart cities in Asia. The key focus of this special series is smart cities in Asian countries, and while specific examples will be discussed throughout, many of the concepts, contentions, and challenges are universal and can apply to smart city initiatives across the world.

Given the vastness of this topic, this introductory note will provide an overview of the importance, approaches, and governance challenges associated with smart cities for the purpose of setting the stage for the chapters that follow. It is meant to provide a framework to conceptualize some of the issues and topics related to smart cities' governance. Part 2 provides a brief overview of the uptake of smart cities across Asian countries. Part 3 describes the various approaches in defining smart cities, developing them, and qualifying them to demonstrate that development and governance are not a one-size-fits-all approach (van Eerd 2020). Part 4 will

<sup>1</sup> The 2015 Resolution *A/RES/70/1 Transforming Our World: The 2030 Agenda for Sustainable Development* was adopted by the General Assembly with the aim of motivating member states to work together to achieve common goals towards a path of sustainable growth. The three underlying dimensions of the 17 goals are economic, social, and environmental. See https://www.un.org/ga/ search/view\_doc.asp?symbol=A/RES/70/1&Lang=E.

<sup>2</sup> In order to address the regulatory and policy framework, a roadmap is being developed to help participant cities navigate issues including "privacy protection, better broadband coverage, accountability for cyber security, increased openness of city data, and better accessibility to digital city services for disabled and elderly people".

<sup>3</sup> For example, in 2019, the World Economic Forum announced that it was going to lead the G20 Smart Cities Alliance on Technology.

then illustrate several common considerations and challenges relating to smart city governance, which include privacy, security, and public–private partnerships.

## **2.2 Adoption of Smart Cities: Focus on Asia**

Smart cities play a significant role in Asia, as urbanization continues to increase rapidly. According to UN Habitat's *World Cities Report 2020*, it is estimated that, "[n]inety-six per cent of urban growth will occur in the less developed regions of East Asia, South Asia and Africa with three countries—India, China and Nigeria accounting for 35 per cent of the total increase in global urban population from 2018 to 2050" (2020, p. 11). It is expected that during this time, India and China will increase by 416 and 255 million people respectively (UN Habitat 2020, p. 11) and that in China, there will be "221 cities with more than 1 million inhabitants" by 2025 (van Eerd 2020, p. 14).

Based on this anticipated increase and growth, it is unsurprising that smart cities are being embraced as a strategic opportunity for countries in this region. (Ludher et al. 2018).<sup>4</sup> New cities in China, India, and Korea are already being developed with networks that "interweave electricity, water, waste and gas systems," enhancing data generation and collection, which in turn helps monitor resources (OECD 2020a, b, p. 14). In 2020 it was revealed that there were over 500 smart cities being developed in China alone (Chandran 2020).

The Organisation for Economic Coordination and Development (OECD) reported that countries across Asia have developed their own "smart city strategy" (van Eerd 2020, p. 14). This is important to note, because it has been suggested that until now, much of the literature and research about smart city initiatives have been conducted through the lens of Western narratives, where there is greater participation by citizens and local governments. In the context of Asia, national governments play an important role and can often be seen as "the main actor, actively promoting and planning smart cities in many cases" (Joo and Tan 2020, p. 6). This can be seen in several jurisdictions such as in China (People's Republic of China 2016), Korea (Hwang 2020, p. 86), and Japan (Yarime 2020).

In the context of emerging Asian cities (Matsumoto et al. 2019, p. 4),5 reportedly six out of 12 countries, including China, Singapore, and Thailand, have a national level smart city strategy (Matsumoto et al. 2019, p. 4). While engagement at the national level is positive as it signals commitment, collaboration and partnerships with regional and local governments is not always clear (Matsumoto et al. 2019, p. 8). This lack of clarity can lead to uncertainty in issues of governance and application.

<sup>4</sup> For example, recognizing the opportunities for collaboration, the Association of Southeast Asian Nations established their Smart Cities Network (ASCN) in 2018 and developed a smart city framework to help "sustainable urbanisation" to improve lives.

<sup>5</sup> This includes Southeast Asia, China, and India.

The following two sections will describe some of the common challenges related to developing, defining, and governing smart cities.

## **2.3 What Are Smart Cities? Defining Features**

Defining smart cities is a useful exercise as it provides a starting point to conceptualize the various parameters of the term and to measure success. Despite smart cities being a widely used concept,6 "smart" or "intelligent" cities have been defined in many ways. As highlighted by the United Nations Economic and Social Council in 2016, "[t]here is no standardized commonly accepted definition or set of terminologies for a smart city" (United Nations Economic and Social Council 2016, p. 3).

In 2020, the OECD defined smart cities as "initiatives or approaches that effectively leverage digitalisation to boost citizen well-being and deliver more efficient, sustainable and inclusive urban services and environments as part of a collaborative, multi-stakeholder process" ("Smart cities and inclusive growth" 2020, p. 8). Prior to this definition, in 2016 the International Telecommunications Union (ITU) and the United Nations Economic Commission for Europe (UNECE) developed a definition that highlighted similar themes: "[a] smart sustainable city is an innovative city that uses ICTs and other means to improve quality of life, efficiency of urban operation and services, and competitiveness, while ensuring that it meets the needs of present and future generations with respect to economic, social, environmental as well as cultural aspects" (2015, p. 3); United Nations Economic and Social Council (2016, p. 3).

In addition to these definitions, there are various qualifiers or "conceptual cousins" that have been used in the literature to further distinguish the goals or ambitions related to smart cities (Nam and Pardo 2011, p. 282). For example, smart cities have been qualified as "sustainable" (UNECE 2021) "ethical," (Global Smart Cities Alliance 2021) or "people-centered" (UN Habitat 2021) and can also be qualified as "digital," "intelligent," or "humane" cities (Nam and Pardo 2011, p. 284). Nam and Pardo categorize these concepts into three main dimensions of "*technology*, *people*, and *institutions"*–noting that they are all "core factors" and "key conceptual components" of smart cities (2011, pp. 284–285). These factors seem to exist in all smart cities in varying degrees, depending on the city (Nam and Pardo 2011, pp. 286– 287). The general goals of smart cities are efficiency, inclusivity, and economic and sustainable growth, with a focus on helping improve the quality and well-being

<sup>6</sup> For example, the report of the United Nations Economic and Social Council, "The UNECE-ITU Smart Sustainable Cities Indicators" Committee on Housing and Land Management Seventy-Sixth session 2015 ECE/HBP/2015/4 at 2 stated that as far back as 2012, the UNECE Committee on Housing and Land Management had identified "sustainable smart cities" as one of its priorities.

of its inhabitants' lives (UN Report 2020, p. 12). Two of the three factors, technology and institutional, will be highlighted briefly as they are directly related to the considerations discussed in the following section (Nam and Pardo 2011, p. 285).7

Technology can be seen as an enabler of the outcomes that smart city initiatives attempt to achieve. (Fleming 2020).<sup>8</sup> Smart city enabling technologies rely on the collection and use of data from numerous devices, Internet of Things (IoT), and sensors. Additionally, there is an ever-growing array of technologies that may greatly contribute to this environment–these include artificial intelligence (European Commission 2020), 5G networks (Huang 2021), blockchain (Hori 2021), and quantum computing technologies. (Shipilov 2019). These technologies are often developed and operated by private sector third party organizations.<sup>9</sup>

Various technologies can be implemented to enhance access to government services (e.g., digital identification, health) (Thales Group 2020), improve efficiencies (e.g., electricity, water management, traffic), help reduce impact on the environment (Carter and Boukerche 2020), and provide accessibility to transportation systems by reducing traffic and encouraging alternative mobility (OECD 2020a). There are several categories of smart city technologies, including "transportation," "water and electricity," "environmental monitoring," and "infrastructure and architecture" (Landry et al. 2018).

Smart cities rely on strategic vision and governance, in other words, the institutional factor. (Nam and Pardo 2011, pp. 286–287) As Nam and Pardo describe it, this factor considers how various communities and actors align to design and develop their smart city ambitions, and governance (2011, pp. 286–287). Smart cities can emerge in various ways. Conceptually, they can be top-down, bottom-up, or mixed. Top-down cities are those that are heavily planned and controlled. The vision of this smart city is one where everything is connected and managed through the "control room" (Breuer et al. 2014, p. 156). The top-down city is built from the ground up with all things designed and planned (Breuer et al. 2014, p. 156; Centre for Smart Cities, nd), where the emphasis is on driving and enhancing efficiencies and having a city run like clockwork. The bottom-up city relies on citizen engagement (Breuer et al. 2014, p. 157). Organic engagement and participation by individuals, local businesses, and communities are key. There are also variations of mixed initiatives, layers, and elements of smart cities that don't necessarily fall under either category (Capdevila and Zarlenga 2015).

The institutional dimension also covers public–private–people partnerships between one or several levels of government, the private sector, and individuals (Nam and Pardo 2011, pp. 286–287). Partnerships can contribute to the challenges that cities face when trying to adopt new "processes, practices and approaches"

<sup>7</sup> Finally, the *human* or people factor, perhaps the most important, centers on improving the lives of those who inhabit the smart city. As Nam and Pardo suggest, "[s]ocial infrastructure (intellectual capital and social capital) is indispensable endowment to smart cities".

<sup>8</sup> It is important to note that there are also low or non-technological solutions that can contribute to facilitating these outcomes; however, the risks associated with these will not be covered in this overview.

<sup>9</sup> More discussion about private–public partnerships below.

(OECD "Enhancing the contribution of smart cities" 2019, p. 21). Leveraging the private sector, for example, could be extremely beneficial for service delivery and access. The role or governance of partnerships will be discussed in the next section.

## **2.4 Smart City Technology Governance: Highlighting Challenges**

The last decade has brought a significant shift in the way policymakers have been grappling with smart city governance. Organizations and policymakers have recognized and acknowledged the fact that emerging technology and its potential impacts have outpaced the regulatory frameworks that exist to protect individuals who interact with these technologies. This awareness was heightened as data—the foundational requirement for many technology-based smart city solutions—was declared the "new oil" in 2017 (Economist 2017).

Despite the various concepts or types of smart cities, for example, "sustainable" (UNECE 2021), "ethical" (Global Smart Cities Alliance, nd), or "people-centered" (UN Habitat, nd), there are cross-cutting challenges, especially as governments around the world are coming to terms with the far-reaching societal and ethical impacts of data and emerging technologies. In 2019, the World Economic Forum announced that it had been selected to lead a global forum to "establish universal norms and guidelines for implementation of smart city technology" in collaboration with the G20 presidency. At the time of writing this note, the "global policy roadmap" had developed "good practice" on several of the identified considerations, including information and communications technology (ICT) accessibility, open data, privacy impact assessment, and the cyber accountability model (World Economic Forum 2019). In the same year, 36 cities from around the world were selected as the inaugural participants in this program including selections in India, South Korea, Japan, and the Philippines (World Economic Forum 2020).

How these challenges are practically addressed will vary based on the jurisdiction and, as a result, the regulatory frameworks present within those jurisdictions. For example, in the context of data collection and use, what might be deemed appropriate based on the regulatory framework in one jurisdiction will be vastly different in another (e.g., the *General Data Protection Regulation*<sup>10</sup> versus other jurisdictions). For this reason, the examples provided in this section are general and are meant to illustrate the universal considerations associated with smart cities. Even where they do not breach laws or regulations within the jurisdiction they occur, the possible outcome, that is the potential harm or impact on an individual, remains the same.

<sup>10</sup> Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC.

## *2.4.1 Privacy*

In the context of smart cities, technology-enabled solutions rely on the collection and use of vast amounts of data, including personal data, from numerous sources. These can include the collection and use of biometric, behavioral, and other types of information from IoT connected devices such as sensors, meters, and cellphones. How this data is used and for what purpose is an important question. As we rely more heavily on artificial intelligence and automation, there are additional risks of harm in some contexts.

Public trust is central to uptake and to civic participation. As pointed out by the OECD, in addition to considering governance issues related to competition and the economy, the "shift from an economy of infrastructure to an economy of applications will only work if data is perceived as being in safe hands" (OECD 2020b, p. 45). The TraceTogether contact tracing app, developed (Singapore Government Developer Portal 2021) and launched by the government of Singapore, while not a direct example of a smart city technology, received backlash as the government revealed that the information they confirmed would be collected for the purpose of contact tracing, could also be used in criminal and other inquiries (Illmer 2021). The public reaction prompted new legislation to be tabled in parliament (Yi-Ling and Abdul Rahman 2021).

The use of facial recognition and surveillance technology is also a legitimate concern as the extent and impact of the information being collected and used is often unknown to the individual. In 2019, TechCrunch revealed that a database containing data including "facial recognition scans on hundreds of people over several months" was accessed on a web browser that was not password secured (Whittaker 2021). The information revealed the movement of a subsection of individuals residing in a neighborhood including "where people went, when and for how long, allowing anyone with access to the data—including police—to build up a picture of a person's day-to-day life" (Whittaker 2021).While there may be regulatory implications for the ubiquitous collection and use of data in some jurisdictions, there are also interesting ethical considerations, including profiling.

Some jurisdictions are looking at creative opportunities to overcome concerns about privacy and consent The city of Aizuwakamatsu in Japan, adopted an "opt-in" approach for smartphone disaster alerts and various digital services in "mobility, education, healthcare, and energy consumption" which provides citizens with some level of control over the use of their data (Chandran 2021).

## *2.4.2 Security*

Security is a particularly interesting aspect of smart cities because the potential vulnerabilities do not apply only to individuals, but also to infrastructures and services (Kitchin 2019; Muggah and Goodman 2019). For example, in 2018, it was reported that IBM and Threatcare identified 17 vulnerabilities in smart cities around the world, which would have impacted traffic light and flood warning systems (Ng 2018). There are a wide range of actors who might benefit from breaching or disrupting cities. These may include state actors, organized crime, terrorist groups, individuals, or businesses (CPAC 2019, p. 11). There is also the possibility of (information technology and IoT) systems being vulnerable to disasters (CPAC 2019, p. 11).

In 2021, the United Kingdom's National Cyber Security Centre issued guidance, suggesting that smart cities, due to the need to collect, process, and store sensitive data, could be "an attractive target for a range of threat actors" (Corera 2021; National Cyber Security Centre 2021). The Government of Canada also noted the potential threat to the safety of Canadians because of connected smart devices and smart cities (Communications Security Establishment 2020, p. 12). Additionally, it was reported that in the United States, "a quarter of local governments were facing attempted cyberattacks every hour" in 2016 (G20 Global Cities Alliance; Pandey et al. 2020).

The challenges with security stem from various issues. One of these issues is that given many cities have legacy systems intermixed with new applications, the level of security might not be standard across the board (Nussbaum 2016). Another security issue is the sheer number of sensors and connected devices gathering information for difference purposes. For example, a single neighborhood could collect data about energy, electricity and hydro, traffic, cars, front doors, and mobile devices. The implications of geographically concentrated information gathering can be far-reaching for individuals and systems (Nussbaum 2016).

## *2.4.3 Private–Public Partnership*

Smart cities rely heavily on public–private partnerships (including partnerships with universities and non-governmental organizations) (McKinsey Global Institute 2019) across various industries, including telecommunications, energy, digital health, and agriculture. In 2019, the OECD highlighted the fact that the private sector has played a significant role as "advocate, investor and gamechanger in the use of technologies to define and address a range of problems in selected sectors; it is now confronted with the challenge of considering new forms of public–private collaborations to facilitate the uptake of these initiatives in the face of megatrends, regulatory change and infrastructure needs" (OECD 2019, p. 11).

In 2017, the World Economic Forum highlighted the benefits of private sector involvement in urban development and transformation, including the advantages of investment, innovation, management, and risk management (World Economic Forum 2017, p. 26) in the context of the UN New Urban Agenda, stating that, "a concise, focused, forward-looking and action-oriented plan … provides a new global strategy on urbanization for the next two decades" (World Economic Forum 2017, p. 6). There are numerous examples of public–private partnerships across smart cities in Asia. For example, Alibaba developed an intelligence system called ET City Brain and deployed it across 23 Asian cities (Alibaba Clouder 2019). ET City Brain has contributed to vast improvements in various areas. For example, in Hangzhou this program has assisted in traffic reduction, the purchase of parking passes, and vehicle licensing, and even checking into hotels (Alibaba Clouder 2019).

In 2019, Japan created a "Smart City Public–Private Partnership Platform" where over 100 cities and 300 companies have signed up to promote "knowledge exchange, business matching, and closer ties between public, private and academia" (Japan BrandVoice 2019). Furthermore, at the national level, Japan enacted a law in 2020 to "improve the collaboration between the public and private sectors for the digital transformation of cities" (Hirayama and Rama 2021), while at the local level, cities have been driving collaboration with the private sector to enhance digital transformation and data sharing (Hirayama and Rama 2021).

As stated by the OECD,

shifting from a government-led approach to public–private collaboration is an important priority. Smart city projects can only be successful if they engage a variety of stakeholders, such as technology developers and service providers (who make technology); city developers (who add technology); city administrators (who use technology); residents and local companies (who purchase technology). (van Eerd 2020, p. 9)

Despite the benefits, important challenges can arise from these partnerships. These challenges relate to data governance and questions of "ownership" (Scassa 2020). They can also relate to privacy and security. Teresa Scassa highlights the complexity of smart city data governance given the various actors and sources,

Public sector access to information and protection of privacy legislation provides some sort of framework for transparency and privacy when it comes to public sector data, but clearly such legislation is not well adapted to the diversity of smart cities data. While some data will be clearly owned and controlled by the municipality, other data will not be. Further the increasingly complex relationship between public and private sectors around input data and data analytics means that there will be a growing number of conflicts between rights of access and transparency on the one hand, and the protection of confidential commercial information on the other. (Scassa 2018)

As she points out, there can be important differences between the regulatory requirements and the objectives of the private and public sectors. These differences can result in an erosion of trust between the public and government efforts to encourage adoption and processes. The importance of partnerships cannot be overstated, as there are clear boundaries in the capacity of governments to fulfill the mandate of smart cities on their own.

## **2.5 Conclusion**

Asian cities are poised to be impacted by high urban growth in upcoming decades. Given the potential density in urban areas, governments are looking ahead to develop smart cities to alleviate congestion and pollution, reduce the impact of climate change, and enhance civic engagement and mobility.

Smart cities do not follow a one-size-fits-all approach: no two smart cities are alike. They are a product of many considerations, including whether they are a result of a national or regional strategy, the objectives they are attempting to achieve, and the regulatory and social framework within which they operate. They are also the product of the degree to which levers of institutional, technology, and human factors are at play. Despite the differences between smart cities, they share several commonalities related to challenges and risks related to privacy, security, and public–private partnerships. In addition to questions of governance, public–private partnerships can play an important role in shaping the public's uptake of trust in the adoption and acceptance of smart city initiatives.

## **References**

**Open Access** This chapter is licensed under the terms of the Creative Commons Attribution 4.0 International License (http://creativecommons.org/licenses/by/4.0/), which permits use, sharing, adaptation, distribution and reproduction in any medium or format, as long as you give appropriate credit to the original author(s) and the source, provide a link to the Creative Commons license and indicate if changes were made.

The images or other third party material in this chapter are included in the chapter's Creative Commons license, unless indicated otherwise in a credit line to the material. If material is not included in the chapter's Creative Commons license and your intended use is not permitted by statutory regulation or exceeds the permitted use, you will need to obtain permission directly from the copyright holder.

# **Chapter 3 Ongoing Challenges and Solutions of Managing Data Privacy for Smart Cities**

#### **Ze Shi Li and Colin Werner**

**Abstract** Smart cities represent the epitome of utilizing data sourced from sensors and devices in a city to make informed decisions. Facilitating the massive breadth of data are millions and billions of "smart" devices interconnected through high-speed telecommunication networks, so naturally software organizations began specializing in various parts of the smart city data spectrum. In a smart city, new business opportunities are created for software organizations to process, manage, utilize, examine, and generate data. While smart cities support the ability to make rational and prudent decisions based on real data, the privacy of the data cannot be overlooked. In particular, there are privacy challenges regarding the collection, analysis, and dissemination of data. More precisely, we recognize that there are a multitude of challenges facing software organizations, which include obtaining a shared understanding of privacy and achieving compliance with privacy regulations.

## **3.1 Introduction**

Smart cities are increasingly receiving attention and praise as the future model of future living and working. Smart cities promise an improved quality of life and more informed decision-making, so it is no surprise that major headlines follow whenever a new smart city project is announced. Major cities around the world believe in the potential of smart cities and are buying in, hoping to become one of the premier and trailblazing cities that establish a leadership position in becoming a "smart" city (Earth.Org 2021).

According to McKinsey and Company (Woetzel et al. 2021), there are three layers of smartness that work together to produce an effective smart city, namely bottom, middle, and upper layer. The bottom layer consists of any device that has sensors

Z. S. Li (B) · C. Werner

Faculty of Engineering, University of Victoria, 3800 Finnerty Road (Ring Road), Victoria, BC V8P 5C2, Canada e-mail<EMAIL_ADDRESS>
C. Werner e-mail<EMAIL_ADDRESS>
and can interconnect with other devices via high-speed internet. Hence, any device that can collect data such as microwaves, traffic lights, digital doorbells, ovens, and buses are categorized as the bottom layer. The middle layer consists of applications that convert raw data collected from smartphones and sensors into metrics. These metrics are further analyzed into meaningful insights. Any software organization that develops or maintains software that aggregates and/or processes the data for analytical purposes is also part of the middle layer. After all, the focal point of the middle layer is deducing logical conclusions from the data collected in the bottom layer. Finally, the upper layer consists of organizations, municipal bodies, and the public as a whole. The first two layers set the groundwork to inform and help the third layer make rational decisions. For example, data about the capacity of buses would allow commuters to decide on the best route to take and avoid overcrowding or extended waits. Similarly, data about water consumption could help inform dwellers about their water usage and prompt them to repair broken or leaky pipes that unnecessarily waste water.

Ultimately, the crucial component to a successful smart city revolves around the robust integration of data and technology (Tuerk 2019), in particular, the linkage of data and technology to facilitate key decision-making. This linkage of data and technology creates new opportunities and benefits for software organizations, whether an organization creates sensors or devices to collect data or develops software that seeks to analyze metrics or data collected from individual devices. A new age of innovation is upon us, where an organization can specialize in aggregating and conducting large-scale comprehensive analysis on real-life data and produce useful results that are later used by other organizations. A significant range of business opportunities now exists for organizations that help process and understand the raw data.

Based on current levels of data and device interconnectivity, cities still have a long way to go before they reach the pinnacle of "smart" cities (Tuerk 2019). Yet, the battle for the top "smart" city is ever so fierce as cities around the globe engage in new infrastructure and technological projects often with the support of their national governments. Some of the more pronounced proposed smart city projects at one point included Hudson's Yards in New York, Sidewalk Labs in Toronto, and Xiong'an New Area near Beijing. Each project involves massive amounts of investment in people, property, and technology. For instance, the Hudson's Yards project was proclaimed as one of the most expensive private real estate projects in the history of the United States. Likewise, the Sidewalk Toronto project was supposed to develop one of the largest areas of underdeveloped urban lands in Canada and build a testbed neighbourhood for groundbreaking technologies. When completed, the proposed "neighbourhood" will have the highest levels of sustainability, economic opportunity, housing affordability, and new mobility.

Smart city projects are not without risks. Specifically, the Sidewalk Labs project was marred with controversy from its inception before ultimately terminating in 2020 due to economic uncertainty stemming from COVID-19. Critics of the project fiercely opposed the planned development due to the lack of transparency regarding data privacy and the potential for personal data infringement once the project is completed. Moreover, the project did not adequately disclose how or where data would be stored. While the project organizers assured Toronto residents that data would be anonymized before disclosing to the public, previous studies have shown that anonymized data can still be combined with other datasets to de-anonymize the protected data.

Ultimately, Sidewalk Toronto failed, but similar projects are in preparation or under development in other cities. The data privacy challenges highlighted by critics of the project represent a legitimate concern about smart cities. In this chapter, we discuss the difficulty of managing data privacy for software organizations that may develop software for processing, managing, or generating data. In particular, we describe the difficulty for software organizations in achieving a shared understanding of privacy and complying with privacy regulations.

## **3.2 Managing Privacy**

As previously mentioned, the collection and analysis of data are critical to the success of a smart city. Correspondingly, the safeguarding and adequate handling of any private data are also vital to the privacy interests of the local population whose data is collected. Yet, when we take a deeper look at modern, agile organizations that develop software, we notice that they often have to make difficult trade-offs when dealing with software attributes, such as privacy. A previous study found that small, agile software organizations using continuous practices (i.e., a software development methodology emphasizing automation and rapid feedback that is ubiquitous in modern software developing organizations) manage software attributes, like privacy, via four main practices: (1) put a number on the attribute, (2) let someone else manage the attribute, (3) write your own tool to check the attribute, or (4) put the attribute in source control (Werner et al. 2021).

For the studied organizations, to deal with attributes of their software, the first step is assigning a number (i.e., metric) to the attribute. Assigning a metric to the privacy attribute may seem rudimentary or trivial; however, it is critical to reliably test whether the attribute was achieved or not. For example, a privacy attribute may prescribe that personal data may not stay on record for any longer than 90 days. Identifying the specifics regarding the legal limits for the data storage is at the crux of satisfying the privacy attribute. Imagine if the privacy attribute instead prescribed that "personal data may not stay on record for a lengthy period." In this scenario, a developer or team in charge of carrying out the privacy attribute would have the onerous task of trying to discern what means "lengthy period" means. The use of "lengthy" becomes a precarious problem, as either 30 or 180 days could be considered lengthy depending on who is asked to make the determination. Moreover, such ambiguous privacy attributes make communication to customers and users a difficult problem for the software organization. As previously noted, a primary concern on the part of smart city residents involves the handling of the privacy of the data collected within the boundaries of the smart city. Hence, transparency and communication of how privacy is handled are paramount to satisfy the concerns of residents. Providing clear measurements regarding how or what data is collected is more convincing than ambiguous alternatives.

The second practice of letting someone else manage the attribute is also known as "offloading" or "outsourcing" and commonly occurs when software organizations offload services or software to third-party providers. For example, a software organization making use of Amazon Web Services (AWS) to host applications or store data would fall under the classification of offloading to a third party. Such offloading is ubiquitous in the software community as third-party services offer convenience at competitive prices. An alternative to third-party services is conducting the service inhouse, which could cost more and create significantly more hassle. Another consideration that encourages software organizations to offload is that any third-party services help alleviate some responsibility regarding privacy and security. For instance, a software organization that collects residents' movement data in a smart city would need to ensure that the data is securely stored in databases on the premises. However, if the organization is instead using a third-party database provider to manage data storage, the organization has much less responsibility. While the organization retains the responsibility to ensure that the databases in the cloud are finely tuned to not leak personal data, the organization is cleared from the day-to-day management of the privacy and security of the databases. The caveat with offloading is that a software organization most likely needs to pre-plan the location of the data storage. Many national and local governments have stringent restrictions on the physical location of data that require organizations to store data in specific jurisdictions. For example, universities in the province of British Columbia must abide by the Freedom of Information and Protection of Privacy Act (FIPPA), which requires that personal and personally identifiable data must be physically stored within Canada.

The third practice of writing your own tool to check the attribute is similar to the second practice. The main difference is that the organization develops its own tool instead of relying on a third-party service. Nonetheless, considering the cost of developing one's own tool, writing your own tool is often seen as a last resort for small, resource-constrained organizations. While it is much more economically feasible for an organization to sign up for a third-party service, the organization may be forced to customize. For example, an organization may develop its own monitoring system to ensure that data is collected as expected.

Finally, the last practice involves writing down an attribute in the software. As we will later discuss in this chapter, reaching an adequate level of shared understanding of privacy is difficult and so documenting and writing down necessary details as frequently as possible is beneficial to managing a privacy attribute. In the study by Werner et al. (2021), it was observed that developers often opted to record knowledge about a software attribute through codification or related artifacts. This approach is viewed positively, as developers perceive that they themselves and other developers can easily find the knowledge in the code base of the software.

## **3.3 Challenges with Managing Privacy Compliance**

While the aforementioned practices can assist in managing privacy, several noteworthy challenges were found in the study regarding managing privacy. In particular, automation and shared understanding of software attributes are viewed as significant challenges.

## *3.3.1 Automation*

Automation is a challenge, as not all privacy attributes are suitable for automated tests. Some attributes may be naturally difficult to test, leading to hindrances on the part of the developer to implement an automated framework to verify the attributes. For example, one area of concern regarding data collection is that a person's personal data should be accurate. However, verifying the accuracy of the data collected on the part of a data-gathering organization may be onerous, with some form of manual intervention. While it may be in a software organization's best interests to develop a tool to conduct automated testing of the important privacy attributes, the ease of developing clear testable metrics of the privacy attributes may be arduous. If the organization's developers also lack knowledge of privacy regulations, defining metrics of the privacy attributes may be further limited.

## *3.3.2 Shared Understanding of Privacy*

One associated problem with any requirement, especially privacy, is that there is not an equal level of understanding amongst a group of people. That group of people may include developers, project managers, managers, or any other stakeholders. If we think about the term privacy on its own, it would be difficult to form the same definition amongst a group of people, as everyone has their own definition. Unfortunately, most software requirements focus on the functional aspects; for example, the user clicks X and Y is shown. Furthermore, writing privacy requirements is a difficult task, and the requirements may be hard to test. So, what ends up happening is that a data collecting software organization claims they are a privacy-compliant solution, but no one can point somewhere in the code to say, "there we have privacy," and no one can really test it, since the definition may be ambiguous.

One problem a data collecting software organization may face when dealing with privacy is how to interpret any existing privacy legislation, as this usually requires a lawyer to understand the language in the legislation. Unfortunately, not many software developers are lawyers—and not many lawyers are software developers. The language in which legislation is written is likely to further contribute to a lack of shared understanding.

A privacy requirement may be dictated by some legislation, a project manager might write their own interpretation of that requirement in some development task management tool, a developer might read that requirement and develop software that conforms to their own interpretation, and finally, a tester might read the requirement and look at the product to assess that the privacy requirement was completed. However, not every privacy requirement will suffer, as some privacy requirements might be easier to interpret, implement, and test; for example, a database must be encrypted using AES-256 encryption.

Continuous software engineering (CSE) focuses on a succession of rapid cycles whereby software is released frequently, often as multiple short releases per hour or even in minutes. CSE induces and encourages an environment that requires software organizations to be able to handle a fast-paced environment. Research in practice has shown that CSE typically favors the release of features that users can actually use (perhaps new features or correcting buggy previously released features). Aspects of software, such as privacy, that do not necessarily impact or affect a feature visible or accessible to a user ultimately fall to the wayside. Research has indicated a correlation between CSE and a decreased level of shared understanding amongst requirements that do not exhibit direct functionality to users, such as privacy (Werner et al. 2020).

A side effect of CSE (and the associated environment experiencing a fast pace of change) is a lowered level of domain knowledge and inadequate communication. Domain knowledge is the business-specific context required to compete in a particular domain. Lack of domain knowledge can cause a lack of shared understanding of software attributes if a data collecting software organization is entering a new, unfamiliar market where even a basic understanding would be beneficial. Reaching consensus on the priority of an obscure requirement, such as privacy, may be difficult due to a discrepancy in perceived importance between different units within the organization. Additionally, the importance of a privacy requirement might be lowered until privacy is demanded by a particular customer.

CSE may also limit the ability of employees to communicate. Often developers may be isolated from one another, even if they are working on the same solution. The lack of communication may be a systemic problem related to the lack of domain knowledge, or simply an oversight on the part of a developer or a software organization. Alternatively, a developer may make false assumptions about privacy and just assume that privacy has already been handled elsewhere and is not within their current scope. Finally, privacy could be such an all-encompassing requirement that everyone assumes somebody else would handle such an important requirement, despite a lack of any documentation or notice. Ultimately, a communication breakdown about privacy can be disastrous, especially if privacy is supposed to be a key component of such a project.

## **3.4 Solutions**

We discussed at length the difficulties and challenges with managing privacy in software organizations that are involved in collecting or analyzing data for smart city projects but have not yet described possible solutions.

## *3.4.1 Developing a Shared Understanding*

Before embarking on actually achieving privacy compliance, it is wise for a smart city developer to invest in building a shared understanding of privacy. The shared understanding should encompass a variety of stakeholders invested in building the smart city. In particular (and at the very least), project management, development, and legal teams should build an equal, shared understanding with respect to privacy.

The first stage would involve a number of lawyers: lawyers that are familiar with the local laws where the smart city will be located, lawyers who are experts in privacy compliance, lawyers with experience in software, and additional lawyers lacking domain knowledge to help uncover tacit knowledge (Niknafs and Berry 2013). These lawyers should start building a shared understanding of the local laws and privacy compliance amongst themselves, likely bringing in project management and development teams as the level of shared understanding is substantial. However, we must also recognize the difficulty in discerning some new privacy laws, even for seasoned lawyers. Some privacy laws, such as the General Data Protection Regulation (GDPR) enacted in the European Union, were purposefully written in a broad and ambiguous manner to account for potential future technological advances and to provide legal guidance for a multitude of industries. Notwithstanding the reasoning for the ambiguity existing in the GDPR, some software organizations adopt a rather pragmatic wait-and-see approach to new privacy regulations as they want to see the degree of penalties that privacy regulators inflict on violators before deciding the level of compliance preparedness they should adopt. Further complicating the ease of uncovering knowledge and awareness about privacy regulations is that developers are ultimately the employees who implement privacy attributes in software. Even if lawyers have an abundance of privacy knowledge to share with developers, the transfer of knowledge is not trivial. Lawyers typically have little technical training, and developers rarely have a background in law, which can inhibit communication between the two parties.

Next, there should be a large effort to purposefully disseminate privacy compliance information, using both formal and informal techniques. Unsurprisingly, these techniques require adequate communication and documentation to succeed. Achieving a high level of communication and documentation might seem trivial to accomplish but is often harder than anticipated, thus requiring special focus to ensure that the communication and documentation are effective in disseminating information.

Once development teams have built and are able to maintain a shared understanding then a set of shared development standards should be designed and implemented to capture how privacy compliance will be documented, implemented, and met. The task of developing and sharing these standards requires a shared understanding to be built and maintained before development.

At this point, and only at this point, should actual development begin–incorporating the standards to achieve privacy compliance. The reason that development cannot begin prior to developing a shared understanding of how to achieve privacy compliance is that privacy attributes are not able to be shoehorned in after the fact, especially with software. Software that meets high levels of privacy compliance must be designed with privacy compliance in mind from the get-go (Cavoukian 2009).

## *3.4.2 Achieving Privacy Compliance*

At this point, a software organization can move towards realizing privacy compliance in the software. There are two critical components to any software organization building and maintaining a shared understanding of privacy compliance: documentation and communication. While documentation and communication are two innocuous and recurrent terms repeated ad nauseam by any software organization aiming for success, achieving these tenets is not necessarily trivial. Documentation is often the crucial first step, but documentation is notoriously costly and expensive, especially for small organizations that may not have massive resources. Instead, there is a minimum level of privacy documentation that organizations may find more suitable for their situation. How much privacy documentation is needed depends on the organization and the situation, which makes discerning the level of documentation required such a challenging task. The likely prudent approach that an organization can take is identifying and recording the specific criteria of a privacy attribute as well as the test case for verifying the completion of the attribute. To maximize the usefulness of documentation, a software organization should aim to document the attributes deemed most valuable to the organization or otherwise most mission-critical to the organization's business.

Another aspect that closely relates to documentation is communication. Once documentation is created, it is essential to share the documentation with all relevant stakeholders. At this point, communication is vital for disseminating documentation and relevant information to stakeholders. There are numerous mediums to facilitate communication including video conferencing, face-to-face meetings, texting, phone calls, or even emails. Regardless of the medium of communication, one key component is support from management in guiding employees to disseminate knowledge. Additionally, management and other stakeholders should help prioritize the important privacy attributes that highly impact the organization. If communication only flows in a unilateral direction (i.e., top to bottom) where experienced employees offer important information to junior employees, but the reverse flow of information does not occur, the organization risks developing tacit knowledge that only a select few individuals become aware of and increasing the organization's "bus" factor, a measurement for how many team members need to suddenly disappear for a project to fail or suffer significant setbacks due to a lack of knowledge.

Once sufficient privacy documentation and communication is achieved in a software organization, the next step involves developing tool(s) to verify that the privacy attributes the organization documented and prioritized are realized. Closely related to the aforementioned third practice to help manage privacy, writing your own tool or using an existing tool, if such tool exists, is meant to help an organization check to see if privacy attributes are achieved on a continual basis. The logic for continual verification is simple. It is of little use to a software organization if a privacy attribute (e.g., personal data must be deleted after 30 days) deemed significant is only achieved for a brief period of time. A prioritized privacy attribute most likely fits the longterm interests of an organization, so it is in the software organization's best interests to effectively treat the privacy attribute long term. Therefore, a privacy compliance check that an organization conducts on a semi-annual or annual basis is not effective for achieving privacy compliance, as the organization has little insight into the state of compliance during the interval between compliance checks. Instead, the auspicious approach that an organization should adhere to is one where it continually checks to see that its software satisfies the privacy attributes clearly documented and communicated to all relevant stakeholders.

The type of tool to check for privacy compliance varies by the organization, as each organization may have a different list of prioritized privacy attributes and associated software. For example, an organization may develop a tool to automatically verify that the cloud infrastructure it deploys on third-party services complies with privacy attributes. However, developing a tool is only one step of continuous privacy compliance. The other critical element that an organization must not omit is deploying the tool to its production system so that the tool is automatically executed on a continual basis. To quote Martin Fowler, a pioneer in the continuous integration movement, "imperfect tests, run frequently, are much better than perfect tests that are never written at all" (Fowler 2006). If an organization develops a tool to check for privacy, but rarely executes the tool, then the tool contributes little to the organization's compliance. While the frequency of test execution is up to each organization to determine the best interval for its situation, weekly test executions seem reasonable in the general case.

## **3.5 Conclusion**

Treatment of privacy is a vital issue for smart cities. It is necessary to have a clear plan for managing privacy attributes, especially if proponents of a smart city project want to assuage critics who worry about risks to privacy. More importantly, each software organization that plays a role in the smart city project, whether it assists in data collection or analysis, must adequately manage privacy. After all, the amount of data generated and analyzed in smart cities is unprecedented, thus a heightened focus must be placed on protecting personal privacy.

In this chapter, we discuss a few challenges that a software organization working on a smart city project may encounter when trying to manage privacy, but we also describe several practices that an organization can adopt to effectively manage privacy. Ultimately, such an organization must make privacy a high-priority initiative, as—without clear motivation and willpower—attention to privacy may not reach a sufficient level.

## **References**

**Open Access** This chapter is licensed under the terms of the Creative Commons Attribution 4.0 International License (http://creativecommons.org/licenses/by/4.0/), which permits use, sharing, adaptation, distribution and reproduction in any medium or format, as long as you give appropriate credit to the original author(s) and the source, provide a link to the Creative Commons license and indicate if changes were made.

The images or other third party material in this chapter are included in the chapter's Creative Commons license, unless indicated otherwise in a credit line to the material. If material is not included in the chapter's Creative Commons license and your intended use is not permitted by statutory regulation or exceeds the permitted use, you will need to obtain permission directly from the copyright holder.

# **Chapter 4 Smart City and Privacy Concerns During COVID-19: Lessons from Singapore, Malaysia, and Indonesia**

#### **Melinda Martinus**

**Abstract** Although smart technologies for managing urban problems have gained traction in Southeast Asia, citizens, experts, and policymakers continue to express concerns over data protection and security. Smart technologies, such as big data, artificial intelligence, and the Internet of Things (IoT), are perceived as enablers for cities to control air pollution, reduce traffic, streamline public services, and make energy use more efficient. Yet experts underline that smart technologies' personal and behavioral data have not been adequately protected, thus bringing significant risk to individual privacy. However, the COVID-19 pandemic has further intensified the dialogue to address privacy concerns in the digital sphere. Drawing from the experience of COVID-19 tracing applications in Singapore, Malaysia, and Indonesia, this chapter finds that despite concerns about technical issues and accessibility, the practice of surveillance and the effectiveness of such technology adoption to fight COVID-19 remain in debate. The dialogue on data protection in the digital sphere has been more complex as there are contesting interests between the need to ensure public safety and the need to protect individual privacy.

## **4.1 Introduction**

In recent years, the concept of the smart city has been gaining traction across cities around the globe. With many projections indicating that population growth in urban areas will only increase and cause further environmental-related challenges, many planners have proposed smart technology as a solution. Cities increasingly develop or adopt technology-led interventions such as big data, artificial intelligence, and the IoT to control urban problems, such as reducing air pollution and traffic, streamlining public services, and making energy use more efficient.

As a consequence of those interventions, urban citizens increasingly participate in those various digital platforms that further enable them to share their personal data

M. Martinus (B)

ISEAS—Yusof Ishak Institute, 30 Heng Mui Keng Terrace, Singapore 119614, Singapore e-mail<EMAIL_ADDRESS>
<sup>©</sup> The Author(s) 2022

T. Phan and D. Damian (eds.), *Smart Cities in Asia*, SpringerBriefs in Geography, https://doi.org/10.1007/978-981-19-1701-1\_4

and behavior to technology providers. This intensive use of technology has exposed them to data breaches, cyberattacks, and possibly the threat of public surveillance.

This paper seeks to understand the risk of smart city adoption intruding on individual privacy. Using various cases of data breaches, cyberattacks, and the threat of public surveillance in Southeast Asia, this chapter highlights the nexus of development policy, politics, and dynamic risks coming from smart city adoption. This chapter further analyzes the issue of digital privacy concerns during the COVID-19 pandemic by looking specifically at the adoption of digital tracing applications' challenges and opportunities in Singapore, Indonesia, and Malaysia.

## **4.2 Smart Cities Development Context in Southeast Asia**

Southeast Asia will undoubtedly soon be the fastest growing market for smart cities. Today almost 50% of the region's population lives in cities. It is estimated that the region will achieve 56% urbanization by 2030 (United Nations 2018).

The region is home to youthful, digitally savvy, and upwardly mobile populations (Sheng 2019). It has seen a dramatic increase in internet usage in the past years. Currently, 60% of the population has access to the internet, and this rate is higher in countries such as Brunei (95%), Singapore (89%), Malaysia (84%), Vietnam (59%), and Thailand (67%) (Ingram 2020). Digital sectors, mainly e-commerce, transport and food, online travel, digital media, and financial services, are predicted to unleash the region's maximum growth. Google, Singapore wealth fund Temasek, and consultancy firm Bain & Co (2020) highlight that six countries of the region, Singapore, Indonesia, Malaysia, the Philippines, Thailand, and Vietnam, are on track to unlock a \$300 billion internet economy by 2025.

In light of urbanization and economic opportunities from the digital sector, the region has been increasingly pursuing smart city aspirations as a national development premise. Singapore, the pioneer of the smart city movement in the region, spearheaded the Smart Nation initiative in 2014, a program to harness digital technologies to empower the economy and improve public services that respond to Singapore's citizens' different and changing needs (Smart Nation Singapore nd).

Other countries in the region, particularly Indonesia and Malaysia, have also mobilized smart city strategies as a national plan. In 2017, Indonesia'sMinistry of Communication and Information Technology Indonesia launched the 100 Smart Cities Movement to address urbanization issues and improve the quality of life of urban citizens. The program aims to work on six key areas: governance, people, economy, mobility, living, and environment. Similarly, Malaysia's government recently spearheaded the Malaysia Smart City Framework (MSCF) to present a national document to guide Malaysia's innovative city development across states and regions. The MSCF is strategically aligned with other domestic plans such as an urbanization policy, a physical plan, green technology, low-carbon cities, and Malaysia's global commitment to the New Urban Agenda (the UN-Habitat) and the Sustainable Development Goals (SDG) (Lim et al. 2020).

The Philippines introduced New Manila Bay, a 407-ha city and a new integrated central business district (CBD) enhanced by artificial intelligence. New Manila Bay is the biggest Belt and Road project between the Philippines and China to date and is estimated to be completed in 2030 (Seow 2017). Another new development, New Clark City, is the country's first new town development that integrates smart, green, and resilient solutions to address climate change and natural disasters.

Thailand's government plans to adopt a smart city approach to enhance investment in cities along the Eastern Economic Corridor (EEC), a special economic zone with a solid manufacturing base (Dunseith 2018). As the government of Thailand expects to generate US\$43 billion for the realization of the EEC, the government has been enhancing four investment areas: improved infrastructure, business and industrial clustering, tourism, and new town development through smart urban planning.

The push for the adoption of smart cities for urban development has also become a regional movement in Southeast Asia. Initiated by Singapore during its Association of Southeast Asian Nations (ASEAN) chairmanship in 2018, the ASEAN Smart City Network (ASCN) was launched as a network of 26 pilot cities from all 10 ASEAN member states to work towards the common goal of smart and sustainable urban development. The network facilitates knowledge exchange and capacity building among the pilot cities and pairs them up with donors, solution providers, and the private sector. The network works on six service domains: civic and social, health and wellbeing, safety and security, quality environment, built infrastructure, and industry and innovation (Centre for Liveable Cities 2018). Some of the projects proposed by the pilot cities are e-health and telemedicine services for rural areas in Makassar, Indonesia; an integrated e-payment system in Singapore; converged command and control services for enhancing public safety in Davao, Philippines; and smart manufacturing and logistics in Chonburi, Thailand.

## **4.3 Smart City and Privacy Concerns**

As smart cities have undoubtedly gained traction in the region, one concern emerging from their implementation is privacy, especially how service providers maintain integrity by protecting users' data. As the smart city facilitates interconnectivity between users and providers, data will be transferred and utilized through various processes, which often involves multiple parties communicating and gaining access to data (Braun et al. 2018). This complex interaction will certainly endanger users' privacy. The way information is managed and stored by authorities could also bring security threats, as it simultaneously links data with new sensors and systems of the latest smart technologies (van Zoonen 2016). Furthermore, data is stored and distributed across multiple devices, locations, and service providers, and this could, in turn, add complexities in managing an increased amount of personal data generated from smart applications (Rosadi et al. 2017). In Southeast Asia, data breaching concerns involving public services and smart technologies have appeared in several instances.

One landmark case is the data breach of the MyKad project in Malaysia. In 2001, the government of Malaysia launched a multipurpose national digital identity card as a validation tool and proof of citizenship other than the birth certificate. MyKad was projected to replace the old identity card—*Kad Pengenalan Bermutu Tinggi––*as a valid identity card for Malaysian citizens and permanent residents over 12 years old. As digitalization became a flagship national project and was predicted to help Malaysia achieve developed nation status, the MyKad project had become a critical national program (Thomas 2004).

When the government introduced the project, the people of Malaysia generally gave substantial support and showed enthusiasm for the program, as MyKad was intended to simplify four types of personal identity: the national identity card, driving license, passport application, and health information. The government of Malaysia set aside a RM 276 million budget (US\$67 million) and selected the National Registration Department (NRD) as the lead government agency and several companies to expedite the implementation (Thomas 2004).

MyKad was developed as a converged identity card, where authorized Government Service Centres (GSCs) such as the NRD, the Road Transport Department, the Immigration Department, and the Royal Transport Department can read, write, print, and utilize specific information on the MyKad. The card is equipped with an intelligent chip and up-to-date biometric technology, such as a colored digital photograph and a digital scan of the cardholder's thumbprint in the chip. GSCs's mandate then includes front-to-end data management, which handles the application process, data storage, and communication with the database centers, which the NRD hosts.

As a result of this digital feature, the personal information in MyKad can be accessed by certain government agencies or selected third parties who have the appropriate access rights. Also, any grant of access rights to the various authorities and third parties have thus far been done administratively and without transparency or public disclosure (Thomas 2004). Another hurdle is that the *National Registration Act* 1959 and *National Registration Regulation* 1990 do not indicate explicitly what types of information or database access are restricted (Thomas 2004).

The issue of privacy in the MyKad case continued to attract public attention when the Malaysian government indicated that in the future, the card could facilitate online transactions such as the digital wallet, ATM access, and transit applications. Consequently, MyKad would not serve solely as a digital identity card but as a multipurpose card with considerable capacity for expansion to other domains (Thomas 2004). As such, data and privacy protection must be seriously addressed and standardized by regulations.

Another privacy issue in the smart city domain involves concerns over cyberattacks. Vendors of service providers usually deploy software and complex infrastructure for smart cities without sufficient cybersecurity standards; thus, when interacting with such equipment, users may be exposed to several hacks and malicious software variants (AlDairi and Tawalbeh 2017). The most common type of cybersecurity threats in smart cities are denial of service attacks, unauthorized network access, theft of personal information, online financial fraud, website defacement, applicationlayer attacks such as cross-site scripting, and penetration attacks (Bélanger and Carter 2008).

Cases of cyberattack and data breach appeared in the recent attack involving Indonesia's super app, Tokopedia. Tokopedia has been considered a champion of "shared economy" in the smart city era—along with the giant ride-hailing companies of Gojek and Grab—because its business model provides an e-commerce platform for small and medium enterprises (SMEs). With such a platform, individuals can now sell their goods and services by utilizing the internet and electronic devices. Tokopedia collaborates with various government services such as the State Electricity Company (PLN), the Municipal Waterworks (PDAM), and the National Gas Company to facilitate municipal services and payment subscriptions. Tokopedia's platform indeed revolutionizes municipal services as the super app helps increase accessibility and efficiency of government services in dealing with customers.

Currently, Tokopedia has more than 10 million sellers and 100 million active transactions every month. According to Tokopedia's website, 90% of the sellers enjoy the digital transactions provided by the super app. In order to participate in Tokopedia, customers must register using their mobile phone number or email address. Customers are invited to provide their valid address, date of birth, bank account, credit or debit card, or any information about their preferred payment. Customers also need to provide an identity card for verification. Consequently, they are releasing their essential personal data and financial information to enjoy services provided by Tokopedia.

In May 2020, Tokopedia confirmed that it experienced a single cyberattack that attempted to steal 15 million users' data from its super app (Eloksari 2020). The case had become the first and largest data leak involving the e-commerce sector in the country. In a statement to the Jakarta Post, a cybersecurity research group asserted that this cyberattack happened because Tokopedia has too many employees with access to the company's internal system (Eloksari 2020). Besides, many tech-companies that provide super apps like Tokopedia often rely heavily on third-party companies that integrate with their systems, which increases the vulnerability to hacking.

In response to customers' concerns, Tokopedia claimed that the cyberattack only attempted to steal data from its servers but assured customers that their passwords were still protected and no payment information had been leaked (Fachriansyah 2020). Customers were encouraged to change their password to ensure safety. However, some experts argued that although hackers did not steal password and payment information, some primary data that were hacked, such as phone numbers and email addresses, are also sensitive to cybercrime (Fachriansyah 2020). That information can further facilitate spam and phishing. Customers have the rights to data protection, and service providers must ensure that they are accountable.

In a similar sense, privacy and smart city issues also include concerns over freedom of personal space and threats of surveillance as the result of technology adoption. Unlike data breach threats and cyberattacks that threaten personal data, the threats of surveillance interface with people in public spaces in a direct way. People's privacy is exposed to an increasing degree as many cities have increasingly deployed hardware such as public cameras, traffic control, and facial-recognition tools to increase the city's responsiveness to crimes, vandalism, accidents, and many types of disruptions in public spaces.

Such technology deployment would not only perpetuate surveillance by authority but dramatically change the normative assumptions about society's conception of human behavior in public spaces (Graham2002). It would be more common to embed opaque codes in computer systems in calculating exposure of risk of an individual. Further, surveillance technology would normalize certain behavior because governments, through their matrix calculation, now can draw a line between "acceptable" and "unacceptable" behavior (Graham 2002).

In the Philippines, the issue over privacy and public surveillance emerged when the Philippines' government introduced the Safe Philippines Project or the Safe PH Project—a flagship program led by the Department of the Interior and Local Government (DILG). The program aims to provide crime prevention measures by utilizing high-definition and advanced closed-circuit television (CCTV) to help authorities monitor the occurrence of crimes, identify perpetrators, and improve emergency response time (Caliwan 2019).

The project received unwavering support as crime has been touted as a critical problem in many cities in the Philippines. A government official claimed that the country could attain peace and order in the community and invite more investors to do businesses by improving safety and security in the public space. In one sense, this program will indeed sustain economic growth and jobs in the Philippines (Caliwan 2019).

However, the project was received with much resistance when President Duterte and President Xi Jinping of China called for a collaboration between Chinese technology providers (potentially Huawei) and local authorities in the Philippines (Mandhana 2019). The agreement confirmed a plan to provide 12,000 closed-circuit televisions and facial-recognition technology in Manila and Davao (Mandhana 2019). It remained unclear which Chinese technology provider would provide such hardware. However congressional opponents in the Philippines expressed concerns over the involvement of a third-party service provider from China, notably Huawei.

Huawei is best known to provide cutting-edge telecommunication technologies, especially mobile phones, 5G network equipment, and the IoT across the region. Their technology and low cost unarguably help many developing countries in achieving smart city aspirations. Nonetheless, over the years, Huawei's reputation got tarnished as many lawmakers and security-threat experts from Western countries increasingly conveyed concerns over its technology that could be exploited by the Chinese government, presenting a potentially grave national security risk (Lecher and Brandom 2019). Moreover, the Philippines and China's relationship is often troubled when it comes to strategic and political affairs. The two countries have long been in dispute over maritime boundaries in the South China Sea.

When asked about the concerns about Chinese technology, a senator from the Philippines asserted that if the Philippines' government wants to select vendors for critical infrastructure like closed-circuit television and facial-recognition technologies, it must not select Chinese vendors (Mandhana 2019). The case of concerns over third-party intrusions in the Philippines' surveillance system has underlined the importance of having standardized guidelines for selecting service vendors. As surveillance systems require high integrity in analyzing data gathered from hardware and potentially expose individuals' identity and behaviors in the public domain, the third-party vendors who provide the service must comply with regulations, particularly compliance with ethical procedures.

There is no doubt that the adoption of smart technology will bring with it risks to privacy. The cases of digital privacy intrusion in the form of data breaches, cyberattacks, and digital surveillance across Southeast Asia have become a public concern.

While policies to create a safety ecosystem are still being developed, the COVID-19 pandemic has completely altered the debate over this issue. To help to limit the spread of the coronavirus, policymakers suggest or even mandate the use of technology, for instance contact tracing applications. Users' participation in such technology use is encouraged despite there still being limited frameworks to shield privacy.

## **4.4 Public Safety and Privacy During COVID-19**

The increasing adoption of various smart city technologies has undoubtedly brought personal data infringement concerns into the digital sphere. However, it was not until the COVID-19 pandemic loomed in the region that policymakers have given more attention to public safety and privacy, facilitated more dialogue, and intensified various efforts to improve laws and regulations in managing such challenges.

COVID-19 was declared a global pandemic by the World Health Organization (WHO) on 11 March 2020. As a measure to curb the spread of the virus, policymakers have utilized numerous digital technology measures, namely data monitoring systems, contact tracing, and health screening. Contract tracing, which has been widely deployed across the region, works to help health officials identify and track individuals who might have come into contact with an infected person. To do so, users must install the application on their mobile phones or wearables. The tracing application utilizes global positioning systems or Bluetooth devices on users' mobile phones, thus facilitating signal exchanges between phones.

The adoption of such measures requires voluntary participation from users. From the perspective of public safety, adopting such a technology helps health officials to act promptly. Users who are in close contact with people infected with COVID-19 will receive notification via the app, messages, and emails that they need to monitor their health condition. Other information such as quarantine guidelines, supportive services, testing, and clinical care services are also provided to assist users further to minimize the risk of transmission. Such measures are considered necessary as the COVID-19 vaccine has not yet been widely distributed at the time of writing this chapter.

However, the adoption of contact tracing is not without risks. To participate in the application, users must reveal their identity, such as an address, phone number, and household information, and also exchange their travel patterns, thus increasing personal data breach exposure. This issue has become a concern in the case of TraceTogether (Singapore), MySejahtera (Malaysia), and Peduli Lindungi (Indonesia).

## *4.4.1 Singapore: TraceTogether*

On 20 March 2020, Singapore's government released the TraceTogether application as a measure to enhance Singapore's contact tracing efforts. The app helps to more efficiently identify people who are in proximity to an infected person using the proximity data collected. Using Bluetooth technology, TraceTogether works by approximating the distance between users by measuring the strength of the signals received from other Bluetooth devices (tracetogether.gov.sg nd). This approximation further allows the application to calculate the length of communication between devices.

Although digital access is ubiquitous in Singapore, approximately 20% of its population is still underserved (Eigen and Gasser 2020). Hence, when the app was launched, it received criticism for not being accessible to those who do not possess a smartphone, especially the poor, the elderly, and children. These groups are also the ones who are the most susceptible to the virus. To make this application more accessible, the government introduced the TraceTogether token on 28 June and distributed it to 10,000 seniors (Eigen and Gasser 2020).

As of June 2020, three months after the app was introduced, the program received low participation from citizens. Less than a quarter of Singapore's population or only 1,800,000 people downloaded the application (Baharudin and Yip 2020). Meanwhile, to work properly, the application needs at least 75% of the population to use the app to increase density and allow more information exchange between mobile phones. When asked about this issue, Singapore's minister in charge of the Smart Nation Initiative pointed out that low participation was due to technical difficulties on iPhone or Apple devices (Baharudin 2020).

There was also a changing policy on ensuring compliance. When the application was introduced, participation was entirely voluntary. As an effort to increase participation among Singapore's residents, the government mandated the TraceTogether app or token be used at popular venues such as cinemas, workplaces, schools, and shopping malls. The government had also increased the number of tokens distributed to residents to encourage more participation (Wong 2020a).

In a statement, Singapore's education minister asserted that 70% adoption could help Singapore reach its next reopening level (Wong 2020a). However, this percentage of adoption can be achieved only through legal compulsion. The government will only get data from people who consent; however, if users do not consent, they could be prosecuted under Singapore's Infectious Disease Act (Ng 2020). The act mandates the public authorities in charge with the responsibility for regulation of diseases and disease control. Any action that could hinder or obstruct the public authority to do so could be an offense according to the Infectious Disease Act (Global-is-asian 2020).

The issue of privacy first appeared when nearly 40,000 people signed a petition highlighting the poor interoperability of the existing TraceTogether smartphone app across various brands of smartphones (Low, nd). Most importantly, the petition underlined concerns over the wearable device's (token) 24/7 surveillance. However, government officials responded to this false suspicion. TraceTogether would not allow contact tracers to locate a person's location based on their proximity to other users' devices because the token does not have GPS or internet connectivity (Global-is-asian 2020).

The government of Singapore stated that TraceTogether is different from a tracking device or an electronic tag. The government improved TraceTogether's privacy safeguards, such as storing data limited to mobile phone number, identification details, and user ID only. A user's personal information is stored on a secure server and never shown to the public. Users are allowed to request to delete data from the server. The government also ensured that third-party services would not access users' data. The tracking data stored in the personal devices will be stored no longer than 25 days according to the TraceTogether privacy safeguards. The evolution of Trace-Together's privacy safeguards shows that the Singaporean government acknowledged the strength of public attitudes and the importance of privacy and data protection concerns and sought to anticipate debates by building in some level of privacy protection (Goggin 2020).

The privacy safeguard design of TraceTogether was "fairly elegant" and "preserves a fair degree of privacy" (Goggin 2020). In several interviews, Singaporean government officials ensured that when the pandemic is over, people will get instructions to destroy their data to ensure safety. It is not surprising that TraceTogether received much praise for its innovation. Gartner, a market research firm, made TraceTogether the Asia–Pacific winner for its 2020 Government Eye on Innovation award based on a poll of government organizations worldwide (Wong 2020b). TraceTogether is not a silver bullet to curb the spread of the coronavirus, yet its ability to widely reach and consistently track possible close contacts should augment human contact-tracers' efforts (Asher 2020).

All the praise received by TraceTogether is not without challenges. Recently, TraceTogether came under fire after authorities disclosed that police used the data for a murder investigation—after the government released a statement that the application will only be used for COVID-19 containment (Tarabay 2021). After a public outcry, Singapore's parliament passed a bill restricting the use of personal contact tracing data to serious criminal investigations only (Chee 2021). Singapore's minister in charge of the Smart Nation Initiative stated that limiting the use of contact tracing data within the proposed law is "a result of a delicate balance between the right to public health, the right to public security, and respecting the sensitivity of personal data during this extraordinary time" (Chee 2021).

## *4.4.2 Malaysia: MySejahtera*

In order to eliminate the spread of COVID-19, the Malaysian government launched MySejahtera, a centralized portal that allows residents to monitor their health and share it with the Ministry of Health. It consists of several features that include selfassessment, a COVID-19 hotspot map, statistics of COVID-19 cases, information on health facilities, and a QR code scan for checking in at the premises. Recently, the government also announced that the application can be used for vaccine registration (Yeoh 2021).

Although MySejahtera is developed by federal government agencies and is mandatory for all businesses in Malaysia, several states also developed their own QRbased contact tracing. These applications include those developed by SELangkah (Selangor), SabahTrace (Sabah), CovidIDtrace (Sarawak), and PgCare (Penang) (Said 2020). The contact tracing application in Malaysia is rather non-homogeneous, and several states demonstrated strong governance in their localities (Said 2020).

MySejahtera faced various technical difficulties. First, as the cases of COVID-19 reached four-figure increases daily in early 2021, the health officials became overwhelmed in facilitating help for suspected cases. Many people claimed they had not received assistance, although they had already filed a report to health officials. Although the app was supported widely by the federal government, the government still needed thousands of physical contact traces. At least 30 tracers per 100,000 were still required to free up existing health professionals (Sukumaran 2021). These physical contact tracers could consist of professional personnel or volunteers.

Second, there was a concern about external parties' involvement when the application was launched. According to its website, MySejahtera was developed by strategic cooperation between the National Security Council (NSC), the Ministry of Health (MOH), the Malaysian Administrative Modernization and Management Planning Unit (MAPU), the Malaysian Communications and Multimedia Commission (MCMC), and the Ministry of Science, Technology and Innovation (MOSTI). However, there is no clear information on whether the app was developed internally by the government agencies or whether any external vendor was involved in the development. MySejahtera failed to provide more details regarding this concern (FocusM 2020).

Among the concerns raised, the issue of privacy seems to be the most prominent one. To register in MySejahtera, users need to provide a great deal of personal information, such as contact number, email address, full name, identity card, age, gender, ethnicity, and home address. To operate fully, the application requires access to smartphones' cameras, Bluetooth, flashlight, and full internet network access. Personal data privacy has always been a big issue in Malaysia, as the country experienced several data breach cases in the digital sphere. One of the most recent ones was the leak of 46 million mobile phone numbers from mobile operators and various professional associations, affecting the entire country (BBC 2017).

A research report from the Asia Pacific Training Centre for Information and Communication Technology for Development (APCICT/ESCAP) also highlights that MySejatera has not yet stated how personal data is processed and offers little explanation on how permissions are being used in the app (APCICT/ESCAP 2020).

Digital security experts also raised a concern about the power balance between government control and citizens' rights to personal privacy. Although the application must adhere to the Personal Data Protection Act (PDPA) 2010—the national act that regulates the procession of personal data to comply with certain obligations—the government is not subject to the law. Under PPDPA 2010, the government is not accountable for any data leaks, cyberattacks, or other breaches due to negligence (OneTrust Data Guidance 2020).

Experts also raised concerns about the efficacy of MySejahtera if it is balanced against concerns of privacy and personal choice. For instance, although the government periodically stated that the application had helped the government to identify COVID-19 cases, the government did not clarify whether the cases were from people who were mandated to download the app from the voluntary download.

## *4.4.3 Indonesia: PeduliLindungi*

Like TraceTogether and MySejahtera, Indonesia launched PeduliLindungi in late March, 2020 to curb the spread of the coronavirus. The application, developed by the Ministry of Communications and Information and the Ministry of State-Owned Enterprises (SOEs), utilizes a Bluetooth connection to detect another user whose data has been uploaded to PerduliLindungi's servers. This detection could help enable the exchange of data. If a user is found near confirmed suspected cases, the application will prompt a notification.

There were some technical issues when the program was introduced. As of April 2020, the application was installed by a couple of million people, although Indonesia has more than 100 million smartphone users (Florene 2020). Meanwhile, to work properly, contact tracing apps need approximately three-quarters of the population to install the application. Experts indicate that this requirement is due to the application not providing much information (Florene 2020). The application only points out a risky zone without details about the risk and the number of cases in each area.

When the application was introduced, the privacy concern also quickly gained ground. A group of human rights organizations addressed an open letter to the Indonesian minister of communication and information technology, demanding more privacy safeguards. When the application was launched, no application privacy safeguard was stated under the App Store or Google Play. The experts also requested the government release the white paper and source code for the PeduliLindungi application, provide a clear privacy policy, issue data privacy regulations, provide information about a recent data breach, and take steps to protect the right to privacy (Jakarta Post 2020).

There is also a concern over the risk of malware in the use of the PeduliLindungi application. As the application requires users to keep activating their Bluetooth, there is a risk of a malware attack for those who do not regularly update their Bluetooth application (Wira 2020). In general, when users start their Bluetooth and pair their phone to another phone, they must receive a notification. However, there is no such feature for users who do not have the latest version of Bluetooth. Malware can steal confidential information stored in a phone, such as password and credit card details.

Constant surveillance by the government was also another concern, as the application constantly notifies users if they are in crowded areas or zones with many cases (APCICT/ESCAP 2020). There are no detailed explanations of the technicalities of data acquisition in the application, as it seemed to utilize both Bluetooth and geolocation at the same time. Unlike Singapore's TraceTogether application that uses a single Bluetooth tracing method without acquiring geolocation data, PeduliLindungi's application seems to be much riskier.

A report from the Citizen Lab, Munk School of Global Affairs, shows that Indonesia's PeduliLindungi might acquire too much unnecessary data, risking more personal privacy while having less effectivity in minimizing the spread of the virus (Lin et al. 2020). According to the report, the application collected a great deal of data, such as geolocation, permission to take photos and video, and permission to access users' storage to allow the application to read users' photos and files. These are unnecessary data as tracing applications need only to communicate with other devices when in proximity.

However, the biggest concern is the way geolocation data is collected and managed, according to the report. The government selected Telkom Indonesia's server to store the end-point data. Appointing a third-party provider to oversee data will only increase the risk of a data breach. Data such as users' geolocations, Wi-Fi Mac addresses, users' phone numbers, and users' full names are stored in the thirdparty server, although none of these is necessary for contact tracing (Lin et al. 2020). TraceTogether, instead, can maximize the use of Bluetooth to detect nearby devices, especially those who are COVID-19 positive and to identify crowded areas.

Although the Indonesian government specifically regulated the use of TraceTogether through two decrees, Indonesia, in general, is still lacking comprehensive privacy laws in the digital sphere. For instance, there is no specific law that regulates punitive measures for parties who initiate a data breach. The current regulation only contains administrative sanctions such as oral and written warnings, temporary suspensions, and mandated announcements on the mass media (Florene 2020).

The COVID-19 pandemic has indeed further intensified the dialogue to address privacy concerns in the digital sphere. How this issue continues to evolve and what kind of interventions will be developed are still too early to predict. But the pandemic raises the question of whether protecting privacy must be absolute or whether it can be flexible in a time of crisis. If it can be flexible, to what extent should governments or the appointed authorities gather and use public data for the public interest, for example, monitoring the spread of disease, protecting citizens' health, and keeping the social order? And most importantly, how can we balance the urgency of maintaining public safety with the needs of protecting individual privacy?

## **4.5 Conclusion**

There are indeed contested interests between the need to ensure public safety from the pandemic and privacy infringement concerns. However, some governments across the region have realized that there are increasing public concerns about privacy protection in the digital sphere. Most importantly, the case of contact tracing adoption across the region has indicated that many governments are demonstrating some efforts in building trust, namely improving written privacy safeguards and more transparency on the way users' data is managed, accessed, and stored. There are few things to take note of.

First, lawmakers must be clear in defining to what extent the law on privacy protection prevails above other laws. In Singapore's case, for instance, the law on privacy protection was adjusted in order to comply with any legal obligations, such as criminal law and laws on infectious disease. This adjustment will help the regulators and the public be better informed when there is a need to compromise the risk of privacy for public safety.

Second, there must be clear punitive measures for every stakeholder involved in data breaches. Privacy protection law must better state punishments for those who breach the laws without exception. As a preventive measure, if possible, law must limit the stakeholders involved in data processing and storing.

Third, as smart city adoption is becoming more complex and will involve many stakeholders in the future, there is a need to build more complex data protection layering. Regulators could oblige service providers by designing multiple components of data processing, so that there is a better opportunity to break attempts to breach data.

## **References**

**Open Access** This chapter is licensed under the terms of the Creative Commons Attribution 4.0 International License (http://creativecommons.org/licenses/by/4.0/), which permits use, sharing, adaptation, distribution and reproduction in any medium or format, as long as you give appropriate credit to the original author(s) and the source, provide a link to the Creative Commons license and indicate if changes were made.

The images or other third party material in this chapter are included in the chapter's Creative Commons license, unless indicated otherwise in a credit line to the material. If material is not included in the chapter's Creative Commons license and your intended use is not permitted by statutory regulation or exceeds the permitted use, you will need to obtain permission directly from the copyright holder.

# **Chapter 5 Does Hong Kong Need a Coherent Policy on Cross Border Data Flows to Really Be Smart?**

**Ronald Ker-Wei Yu and Bryan Mercurio**

**Abstract** Data flows are becoming ever more important to smart cities. Owing to the plethora of interconnections, an action in one area can result in unintended consequences elsewhere–and while a holistic approach to managing data and data flows sounds desirable, it remains to be seen whether such an approach is achievable. This chapter will explore the conflicting legal and other issues smart cities face, including how to provide access to tools and data to enable creation of apps, content, or products and adapt products for local and global needs; how to encourage use and deployment of data-dependent systems such as artificial intelligence (AI); and how to allow companies to fulfil obligations to provide customer support, enable commercial transactions or the flow of digital currencies. Using Hong Kong as a case study, the chapter overviews Hong Kong's quest to be a smart city, measures its progress against an objective, then evaluates the potential downsides of Hong Kong's laissez-faire approach to regulation before advocating for the establishment of a coordinated framework and policy for managing cross-border data flows.

## **5.1 Introduction**

As smart cities complete the build-up of information technology (IT) infrastructure and as more smart devices are connected, data flows will become more important not just intra-city flows but also external flows. To remain relevant and competitive, a smart city must rely on external data not only for short-term commercial needs, such as international payment transactions, but also for support and updates for smart devices and vehicles, long-term innovation, content creation, product development,

R. K.-W. Yu (B)

e-mail<EMAIL_ADDRESS>
Faculty of Law, The Chinese University of Hong Kong, 41 Ha Shan Kai Wat Fanling NT, Shatin, Hong Kong

B. Mercurio Faculty of Law, The Chinese University of Hong Kong, Room 638, Lee Shau Kee Building, Shatin, New Territories, Hong Kong e-mail<EMAIL_ADDRESS>
and business viability. This requirement concurrently involves legal issues connected with privacy, trade, e-commerce, finance and cybersecurity, and intellectual property, which, in turn, is further complicated by the need to protect data, enforce laws, and access tools for the creation of new content or innovations.

Data today is so ubiquitous, and systems are so interconnected, parties' actions in one digital domain can derail initiatives in another area. For instance, Facebook's cryptocurrency Libra largely failed because of distrust of Facebook's social media activities, notably with regards to its lack of protection of users' privacy (Mendoza 2020). What is now clear is that actions in one area can result in unintended consequences elsewhere—and while a holistic approach to managing data and data flows sounds desirable, it remains to be seen whether such an approach is achievable.

This chapter will examine the conflicting legal and other issues smart cities face, including how to provide access to tools and data to enable creation of apps, content, or products and adapt products for local and global needs; how to encourage use and deployment of data-dependent systems such as artificial intelligence (AI); and how to allow companies to fulfil obligations to provide customer support, enable commercial transactions, or the flow of digital currencies. Finally, this chapter explores how a seemingly minor exemption in copyright law could have large commercial implications for companies employing AI.

The chapter locates its analysis with a case study of Hong Kong, a city that depends on trade flows for its continued growth and development. Hong Kong also aims to be a leading smart city, but to date has only introduced regulations concerning data and external data flows on an uncoordinated and piecemeal basis. The chapter begins with a short historical overview of Hong Kong's quest to be a smart city and measures its progress against an objective. The chapter will then evaluate the potential downsides of Hong Kong's laissez-faire approach to regulation and advocate for the establishment of a coordinated framework and policy for managing cross-border data flows.

## **5.2 Hong Kong's Desire to Be a Smart City**