Do European smart city developers dream of GDPR-free countries? The pull of global megaprojects in the face of EU smart city compliance and localisation costs

Introduction

Research and development (R&D) funding is one of the policy tools shaping the development of technologies associated with smart cities (Kitchin, 2022). Due to their capacity to be used for surveillance and policing purposes, smart city technologies can have detrimental effects on human rights. Here, we presume that research and development (R&D) funding is one of the policy tools shaping the development of technologies associated with smart cities (Kitchin, 2022), and that it is crucial to mitigate human rights risks in the R&D phase. This socio-legal study of the Helsinki metropolitan area (HMA) reviews whether and how the smart city technology R&D funding instruments present in the area, and the data protection by design principle (DPbD) of the General Data Protection Regulation (GDPR), facilitate the development of human rights compliant technology.

In our analysis, we discovered four features in the Finnish and EU landscape for smart city technology development that may attract companies to pursue markets outside the EU with lower standards of respect for human rights and the rule of law. The smart city R&D funding landscape in HMA displays the following features:

1. GDPR compliance is perceived as a burden.
2. The funding instruments do not push participants to have sufficiently deep citizen, multidisciplinary and international feedback on the technology. Consequently, they may lose valuable insight into the impact of the technology on human rights at the design stage.
3. The potential for replicability, scalability and exports are important in smart city R&D initiatives and piloting.
4. Integrating the technology into local contexts is subject to the burden of compliance, with multiple sets of norms and (often) long-term coordination with a network of city officials. As a result, large ground-up smart city initiatives outside Europe attract attention.

These features may lead to technology developers overlooking human rights risks in the R&D phase due to one-sided inputs and myopia in identifying human rights risks in technology exports. The neoliberal, technological solutionism of smart cities is in conflict with human rights on the local, national and the EU global level. Therefore the governance measures should include both facilitation of the development and adoption of local, human rights-compliant smart city technology and oversight of the human rights effects of exported technology.

This section introduces the technosolutionst and neoliberal characteristics of the smart city concept, and the contradictory policy goals of smart city R&D in the EU. We will then explain human rights risks associated with smart city technology, the importance of their mitigation in the R&D phase and the role GDPR plays in addressing them. While human rights are universally recognised (Universal Declaration of Human Rights), in this paper we will refer to the protections as transposed to the European Charter of Fundamental Rights (CFREU).

Technological solutionism with neoliberal characteristics: On smart city discourse

The discourse on smart cities has been described as a “language game”, involving corporations, universities, city officials and other actors over how cities are to be understood, conceptualised and planned (Söderström et al., 2014). As a result, there is no set definition of smart cities. However, according to the bibliometric work of Mora, Bolici and Deakin (2017), two dominant interpretative models can be discerned: a technocentric view and a human-centred perspective. The former is mainly corporate-driven, whereas the latter is led by (in particular European) universities and connected to the needs of governments. The technocentric view tends to understand the “smart city” as a depoliticised matter of merely applying ICT technologies to urban challenges to create datafied conditions for decision making, efficiency and innovation (e.g. Dirks & Keeling, 2009; Washburn & Sidhu, 2010; Mitchell et al., 2013). In contrast, the human-centred perspective views technology as a tool to facilitate broader goals: the empowerment of citizens through participation and investment in their human and social capital become crucial to facilitating their use of the city as a laboratory for urban change (e.g. Giffinger et al., 2007; Schaffers et al., 2012; Manville et al., 2014).

In practice, however, the two paradigms might have more in common than not, as both tend to promote technological solutionism with neoliberal characteristics (Cardullo & Kitchin, 2019). Technosolutionism refers to the assumption that societal and social problems can be solved with “computable solutions”, or through optimised processes (Morozov, 2013, p. 5). It relies on the algorithmic processing of data that does not account for local, urban knowledge that defies computation (Mattern, 2020). The datafication of city processes reduces urban problems into technical problems that can be solved by applying ICT (Coletta & Kitchin, 2017; Vanolo, 2013; Green, 2020), in addition to paving the way for “neoliberal governance” by quantifying the social into something “nudgeable” (Krivy, 2016; Gandy & Nemorin, 2019). Ultimately, even human-centred governments rely on data capture, analysis and open transparent information for evidence-informed policy development (Kitchin, 2014). The smart city has therefore been viewed as a site for capital accumulation, profit-making and tech-led urban entrepreneurialism, through which a neoliberal political economy is deepened, often through strategies of “accumulation by dispossession”. These strategies include: (a) capturing public assets and services through which city administrations are pressured to draw on the competencies and technological solutions of the industry through public-private partnerships, deregulation, privatisation and market competition; (b) fostering local economic development conducive to attracting foreign direct investment, the establishment of innovative start-up sectors or digital hubs and human capital; (c) encourage property-led development and attract investment in real-estate projects where smart technologies feature; and (d) putting in place architecture that enables neoliberal governmentality and governance (Kitchin et al., 2019, pp. 5-7).

In Finland, tension emerges within the neoliberal values of the smart city discourse. The country’s technology adoption is facilitated by the high level of the rule of law (WJP, 2020), popular trust in the government and science (OECD, 2022) and the low levels of perceived corruption (Transparency International, 2021). Using citizen data for democratic purposes has traditionally defined the Nordic social-democratic welfare state. However, in more contemporary national initiatives, such as the Act on the Secondary Use of Health and Social Data (26.4.2019/552), many smart city projects are characterised by the facilitation of commodification, and the accumulation of data with the aim of participating in the global data markets (Tupasela et al., 2020) and the logic extends to smart city projects (Ylipulli & Luusua, 2020). This tension is also expressed in the growing data activism in Finland, with organisations such as MyData striving for citizen and consumer agency, and ensuring human dignity, while promoting the monetisation of personal data, where each individual will be the commercial owner of their data, as a means to these ends (Lehtiniemi & Ruckenstein, 2019).

Contradictory policy goals behind EU Smart City R&D and exports

The European Union (EU) and European states continuously invest in programmes that support the development of smart city technologies, such as applications of big data and artificial intelligence (AI), to facilitate the provision of public services or enable business opportunities in an urban context. Supporting the development of smart cities has been on the EU agenda, through a number of programmes, since the early 2010s (Paskaleva, 2011; Vanolo, 2013), predated by EU initiatives for the promotion of intelligent cities (Komninos, 2002; Hollands, 2008). More recently, the public R&D funding of smart city technology is aimed at goals such as innovation and regional competitiveness, ecosystem building and sustainability (EC, 2022a; Business Finland, n.d.-a), often emphasising scalability and replication (Cardullo & Kitchin, 2019) as well as exportation (Business Finland, n.d.-b; Manville et. al., 2014, p.18).

Hence, competition emerges as another feature of the neoliberal technosolutionism of the smart city discourse in the EU. Various parameters of smartness are developed to help cities sharpen their locational profile and improve their position in competition with other cities and rival global economies (Griffinger et al., 2007). The EU approaches competitiveness by creating conditions to attract “resources (human or otherwise) throughout Europe and the globe and returning ideas, income and other benefits” (Manville et al., 2014, p. 18), or more concretely, by developing a competitive advantage in smart city-related goods and services that could “help Europe to assist developing countries in managing mega-city development in ways that improve their welfare, reduce the risk of exported problems and help them to become better trading partners for Europe” (p. 23).

How does human rights compliance align with the goal of competitive exports? The GDPR grants EU citizens protection for their personal data and other fundamental rights and freedoms within and, to some extent, outside the EU (Arts. 1,3 & Chapter V). The protection enjoyed by EU citizens has impacted global markets: non-EU states have adopted privacy laws following the GDPR standard (de jure Brussels effect). To ensure access to the EU market, companies are incentivised to standardise their technology production across the world, rendering the EU standard a global standard (de facto Brussels effect) (Bradford, 2012). However, EU companies are not obliged to comply with the GDPR in exports outside the EU, but must comply with the laws of importing countries, which offer varying levels of protection for privacy, data and fundamental rights.

Legal and ethical concerns regarding EU states’ technology exports have been raised before (e.g. Amnesty International, 2020), relating also to data colonialism, i.e. companies’ practices of extracting, appropriating and privatising user data while testing data-driven systems in developing countries (Couldry & Mejias, 2019; Hao & Swart, 2022). The EU’s attempts to expand export controls for surveillance technology have been watered down (Kanetake 2019; Seoane, 2020). The EU contends that it promotes human rights in its foreign policy (Art. 21(1) TEU), and human-centric digital transformation in its relations with third countries (European Declaration (2022) para 11). In 2020, the European Commission proposed an action plan on Democracy and Human rights aimed at harnessing opportunities and addressing challenges associated with new technologies, promoting a global system for human rights and democracy, and building resilient, inclusive and democratic societies (EP, 2022). However, the plan is currently on hold, although the proposal for EU Due Diligence Directive (DDD) stems from the initiative.

Human rights risks of smart city technologies

In smart cities, technologies such as big data, Internet-of-Things, CCTV, cloud computing (Edwards, 2016), facial recognition technology, platforms, digital apps (Goodman, 2020) and more recently, AI, are embedded into the urban context (Goodman, 2020; Brauneis & Goodman, 2018; Luusua & Ylipulli, 2022; Botero Arcila, 2022).¹Many of the technologies associated with smart cities also allow for the surveillance and identification of individuals and pose threats to a range of human rights, potentially undermining democratic development (Williams, 2020, pp. 1-3). Due to the growing digital divides in the city (Graham & Marvin, 2001, pp. 291-292), citizens may also be excluded from enjoying their rights, such as the integration of persons with disabilities (Art. 26 CFREU; Kempin Reuter, 2020), good administration (Art. 41 CFREU) and social security (Art. 34 CFREU).

Smart city technologies are also associated with dual use (Galdon-Clavell, 2013, p. 720). The idea behind this concept is that technology, research or products which were intended to be used for something positive also have the capability to be used for (morally negative) purposes that are not aligned with the intentions of their developers (Forge, 2010). In EU law, “dual-use items” refer to items “which can be used for both civil and military purposes” (Art. 1 Dual-Use Regulation). It is not uncommon for military technology to later be adopted for civilian use in a smart city (Sadowski, 2020, p. 139). The surveillance capacity may also expand over time due to function creep (Monahan, 2007, p. 378; Wisman, 2012), which can be defined as “an imperceptibly transformative and therewith contestable change in a data-processing system’s proper activity” (Koops, 2021, p. 53).

Constant and ubiquitous surveillance by smart infrastructures (Sadowski, 2020) endangers citizens’ rights to privacy (Art. 7 CFREU) and the protection of personal data (Art. 8 CFREU) (Edwards, 2016; von Grafenstein, 2020; Botero Arcila, 2022). The protection of these two fundamental rights is a prerequisite for enjoying other fundamental rights and freedoms, such as freedom of speech, non-discrimination and political and religious beliefs (Buttarelli, 2017). For instance, smart city technology, especially when used for safety purposes, also facilitates expansive, data-driven and predictive policing (Joh, 2019, Sadowski, 2020), which can reinforce exclusion and the policing of marginalised groups (Sadowski, 2020; Williams 2020; Ranchordas, 2021a; Botero Arcila, 2022). It may also undermine the presumption of innocence (Art. 48 CFREU); the right to liberty and security (Art. 6 CFREU); the right to non-discrimination (Art. 21 CFREU, Schlehahn et al., 2015) and fair trial (Art. 47 CFREU, Williams, 2020; von Grafenstein, 2020). Furthermore, citizens' enjoyment of rights may be chilled (Penney, 2021) due to socio-technical processes governing smart policing – sensors, algorithms, data-flows and control rooms (Sadowski, 2020, pp. 137, 148, 155). Indeed, the use of smart city technologies in public spaces may curtail the freedom of expression and information (Art. 11 CFREU), movement (Art. 45 CFREU), religion (Art. 10 CFREU) and assembly (Art. 12 CFREU) (Williams, 2020). Ultimately, smart city technologies can serve as a means to digital repression (Feldstein, 2021, pp. 25-26) and empower and maintain authoritarian regimes (Akbari, 2022).

GDPR as an example of fundamental rights-driven technology regulation

Smart cities may amplify digital divides, reinforce inequalities and support state or city-level surveillance while minimising citizens’ privacy (Kempin Reuter, 2020). However, the EU is well-positioned to develop human rights-compliant smart city technology. It has been a forerunner in the risk-based and fundamental-rights-driven approach to technology regulation, which the GDPR, adopted in 2018, represents (Gellert, 2017). The approach was recently followed by the passing of the Digital Services Act to regulate platforms and the AI Act (AIA), which proposed to regulate algorithmic systems. In this article, we concentrate on the role of the GDPR in risks associated with smart city technologies at their design phase.

The GDPR establishes a unified approach to the protection of personal data “any information relating to an identified or identifiable natural person” (Art. 4(1)) amongst all EU Member States (Recitals 10, 13). Its purpose is to lay down rules relating to the processing of personal data, to facilitate the free movement of personal data within the EU internal market and to protect the fundamental rights and freedoms of natural persons, in particular their right to data protection (Art. 1). The Regulation codifies general data protection principles, i.e. lawfulness, purpose limitation, data minimisation, accuracy, storage limitation, confidentiality, security and accountability (Art. 5); grants rights to data subjects (individuals concerned), while imposing obligations on data controllers (actors who determine the purposes and means of personal data processing (Art. 4(7)).

Our focus will be on controller obligations (Art. 24-43), in particular, the data protection by design (DPbD) requirement enshrined in Article 25 GDPR, which demands consideration of data protection and other “rights and freedoms”, including the fundamental rights (EDPD, 2020) of individuals throughout the technological design process. The core idea behind the DPbD principle is to mandate controllers to adopt technical and organisational measures that are designed to implement the general data protection principles effectively. It also requires them to integrate the necessary safeguards into personal data processing in order to meet the requirements of the GDPR, while ensuring the protection of data subject rights. Article 25 aims to reduce the commonly voiced “catch-up-with-technology” issue in regulatory progress by imposing data protection interests in the architecture of ICT systems, and enforcing these interests throughout the lifecycle of systems’ development (Bygrave, 2017).

R&D phase matters for human rights compliance

The human rights risks associated with smart city technologies, and the contradictory policy goals of EU smart city technology development raise a question as to whether the R&D instruments and the DPbD principle may contribute to the development of human rights compliant smart city technologies inside and outside the EU. Research on ethical and legal aspects of smart city technologies further emphasise the importance of the R&D phase to this end.

In this study, we recognise that technology is normative (Hildebrandt & Tielemans, 2013; Larsson, 2019) and embodies values upon adoption (Winner, 1980) and design (Nissenbaum, 1998, pp. 38-39; Koulu, 2021). Technology may reflect biases present in the social realm, such as the values of its developers (Friedman & Nissenbaum, 1996, pp. 332-336). For instance, algorithmically-driven search engines such as Google, by the very way they render web content findable, tend to perpetuate the racial and gender biases present in society (Umoja Noble, 2018). Facial recognition technology was found to have discriminatory performance concerning race and gender due to the biassed datasets used for training the algorithms (Buolamwini & Gebru, 2018; Najibi, 2020). Discriminatory effects may also emerge from the context of use or the features and limitations of technology (Friedman & Nissenbaum, 1996, pp. 332-336). Respectively, we adopt the view that technology can be proactively designed to reflect desired values (Friedman et al., 2013), such as human and fundamental rights.

In contrast to ethical values, enforceable fundamental rights are passed through a democratic process, and their protection should be considered when the technology is designed, for example, through stakeholder participation (Hildebrandt, 2021, pp. 235, 236, 237, 247). This approach represents the goal of ex-ante oversight (Hakkarainen, 2021). It was codified in law by the GDPR, through obligations to implement DPbD (Arts. 24(1), 25(1)) and to carry out data protection impact assessments meant to address risks, not only to data protection, but all fundamental rights of data subjects (Art. 35(1)). While the GDPR permits derogations from data subjects’ rights for data processing for scientific research purposes, it does not free the controllers from DPbD obligations (Art. 89) during the R&D phase. In the EU, the GDPR is generally used as a “proxy for the protection of other individual fundamental rights and freedoms” (Oostveen & Irion, 2016, p. 17) in connection with data-driven technologies.

However, the existing human rights framework is not always well-suited to address the risks associated with AI applications (Mantelero, 2018; Yeung et al., 2019; Smuha, 2021), as is increasingly common in smart city projects. For example, the protections afforded by the GDPR are insufficient with respect to profiling, algorithmic decision-making and solutions that do not rely on processing personal data (Ostveen & Irion, 2016). AI systems may fall out of the scope of GDPR’s protection due to human involvement in their decision-making mechanism; the ambiguity of legal effects produced by automated decision-making (Bygrave, 2020); as well as multi-stage (Binns & Veale, 2021), and group profiling (Schreurs et al., 2008; Galič & Gellert, 2021).

The EU has taken action to address these shortcomings: it has published ethical guidelines for AI (AI HLEG, 2019) and is in the process of adopting the AIA, which aims to prevent AI applications’ adverse impact on fundamental rights (para 13) by means such as conformity assessments (Art. 43) and other obligations that cover the life-cycle of the system (p. 3). These are set to direct collaborative work in technology development. Meanwhile the Council of Europe (CoE, 2021; Breuer, 2022) is working on a proposal for a “legally binding transversal instrument”, the scope of which covers, “the development, design and application of AI systems” (para 12) to mitigate the risks AI can pose to human rights, democracy and the rule of law (paras 3-4) by means such as human rights, democracy and rule of law impact assessment (para 19, XII). Europe can thus be seen as moving towards a human rights-based approach, not only in the governance of technologies processing personal data, but also AI (Yeung et al., 2019; Smuha, 2021).

The wider discussion surrounding ethical AI and data, which also inform the legislative reforms discussed above, stress the importance of multidisciplinary and multi-stakeholder collaboration in the design phase. Compliance with the DPbD principle of Article 25 requires adopting interdisciplinary methods (von Grafenstein et al., 2022). Furthermore, socio-legal scholars also emphasise the importance of studying inherently political social processes and consequences of technology design (Koulu, 2021), and call for interdisciplinary socio-legal research to ensure that AI-driven technologies, which have long-term impacts, are ethical (Larsson, 2019). Developers should engage in multidisciplinary exchange to avoid digital divides and reinforcement of inequalities in urban spaces (Kempin Reuter, 2019, 2020; Graham, 2002; Sloane, 2022). Multi-stakeholder consultation is also highlighted in connection with intersectional data feminism as a means to foster data justice and combat oppression from data science designed by dominant societal groups (D’Ignazio & Klein, 2020a, 2020b, 2020c). The role of public R&D funding and tendering in building human rights-compliant smart city technology is understudied (only example Brown, 2019, pp. 55-59, 61), and its role in the development of ethical AI has only recently been researched (Gardner et al., 2021).

Methodology

We employed a multi-method approach (Nielsen, 2012) by conducting Case Study Research (CSR) (Yin, 2014) of the funding landscape of smart city projects in the Helsinki metropolitan area (HMA) of Finland, interviewing experts representing various funding instruments. We analysed the material utilising a Grounded Theory (GT) approach (Glaser & Strauss, 2006 [1967]) in combination with legal doctrinal analysis.

Our study aimed to explore the potential human-rights risks and legislative gaps of smart city projects during their R&D phase. We chose Finland and the HMA due to their internationally recognised favourable attitude toward smart city projects. We identify Finland as a “critical case” for observing the tendency of smart city technology developers to pursue markets with less restrictive human rights and data protection regimes than the EU, in the sense of providing a clear set of circumstances from which one can draw analytical generalisations (Yin, 2014, p. 51).

The GT approach is here understood as a form of qualitative content analysis where the analysis is carried out in a reflexive and comparative manner for the purpose of developing concepts and theories (Glaser & Strauss, 2006 [1967]). The Straussian variant of GT (as opposed to the Glasserian approach (Glaser, 2012)), sees it as desirable to acquaint oneself with the relevant literature to derive relevant questions (Strauss & Corbin, 2015, pp. 52ff), thus making it compatible with CSR (Halaweh, et al., 2008). Our legal knowledge and assumption about potential human rights risks involved in smart city projects were a constant backdrop to our process. Resultantly, the content analysis was “directed”, where human rights and EU law represented sensitising concepts that guided the data analysis of the phenomenon (Bowen, 2006; Hsieh & Shannon, 2005). Moreover, conducting expert interviews demands the researcher’s familiarity with the discourse and field within which the interviewees are active, as their readiness to share knowledge might depend on the level of competency with which the interviewer presents themself (Meuser & Nagel, 2009). Thus, previous knowledge helped us formulate and focus our research propositions, define relevant samples and direct our analysis.

Helsinki smart metropolitan area as a “critical case”

As an object of study, we chose the role of public funding instruments in smart city technology development in the HMA, which includes the cities of Helsinki, Espoo, Vantaa and Kaunianen.

Finland is highly digitalised, being the EU state that ranked highest in the 2022 Digital Economy and Society Index (EC, 2022b), with regard to human capital (digital skills) of the population, connectivity, integration of digital technology among firms and digital public services. The share of ICT-related activities in GDP, as well as ICT employees as the share of total employees, are at the higher end in comparison with other EU-countries (figure 1 and figure 2).

Finland ranks as one of the most innovative countries in the world (WEF, 2015, p. 14; EC, 2020, p. 16). The country has high levels of R&D investment (figure 3), but was also the world leader in patent filings (per million inhabitants) for technologies related to the “Fourth Industrial Revolution” in the period 2000-2018 (figure 4).

Within Finland, the HMA is considered to be the leading innovative cluster of the country, as the most developed region in terms of innovation activity, such as R&D spending, patenting, human-capital concentration and knowledge-intensive firms (Makkonen & Inkinen, 2015; Kiuru & Inkinen, 2017). The Finnish economy is open, with exports accounting for over 40% of GDP, and this is where HMA distinguishes itself as the leading region in exports of services embodying intangible capital consisting of R&D, organisational capital and ICT (Piekkola, 2018, p. 9).

These conditions make Finland fertile soil for smart city projects, with the HMA being particularly relevant as it features the country's largest and wealthiest cities, hosting numerous smart city initiatives. Helsinki ranked 6th in the Smart City Index (IMD, 2021), whereas both Helsinki and Espoo were selected in the EU’s Mission to build 100 European carbon-neutral and smart cities by 2030 (Espoo, 2022). Finland supported smart city development with public R&D funding through Witty City programme 2013-2017 (Mustonen et al., 2014, p. 26; Tekes, 2018) and INKA programme in 2014-2017 (TEM, 2017). During this period, smart city initiatives such as living labs (Hielkema & Hongisto, 2013), open data sharing practices (Jaakola, 2013) and initiatives for smart districts also emerged in the HMA (Tekes, 2015).

Sampling and sample

We based our sampling by defining an expert as someone who holds particular technical, procedural and interpretative knowledge relevant to smart city projects, and who can affect the practice and actions of others in the field (Bogner & Menz, 2009, pp. 54-55; Meuser & Nagel, 2009, pp. 26-30). Following the GT approach, our sampling procedure was “theoretical”, meaning purposely “biassed” to get the most relevant participants who could provide data conducive to theory development. As such, the sampling is likewise guided by the concepts that are derived from the evolving analysis of previous data to refine the concepts further (Glaser & Strauss, 2006, pp. 45ff).

Our sample consists of 19 semi-structured, thematic interviews with a total of 21 representatives (table 1, appendix) with complementary grey literature on the initiatives. The interviews were conducted between November 2021 and December 2022 via video call platforms and recorded with consent. The interviews lasted between 50 to 90 minutes. Our sampling started with the R&D initiatives in the HMA region that focused explicitly on smart cities, or integration of AI and IoT in urban environments or city functions and appeared, on the basis of grey literature review, to receive the largest amount of public funding. Additional interviewees would often be contacted on the basis of snowballing from previous interviews. This allowed us to verify the expert status of the interviewees through other sources of data and experts (Bogner & Menz, 2009, p. 55). The sampling emphasised the diversity of public funding instruments and pre-competitive public-private R&D initiatives until reaching saturation (Strauss & Corbin, 2015, pp. 149-150, 203). To verify initial findings, we also interviewed four non-HMA-based experts.

Since the study deals with potentially sensitive topics, interviewees were provided with a higher level of anonymity at the expense of more detailed descriptions of the R&D initiatives researched. The types of initiatives as sources are described in the appendix. The majority of the interviews concerned ongoing funding programmes. The governance of many of the funding instruments reviewed featured “nestedness” (Madison et al., 2009). The distribution of certain types of EU funding was governed on the national, regional and municipal levels. Some instruments required matching funding from companies or municipalities. An individual programme or a project may have received funding from numerous funding sources or have interdependencies with other initiatives.

Expert interviews

When interviewing experts, it is generally advised to make use of a semi-structured interview model, which is topic-guided (Meuser & Nagel, 2009) and problem-centred (Döringer, 2021), asking open-ended questions to stimulate narration structured by the individual’s concerns (revealing tacit knowledge), while also allowing for more specific questions to be asked. The benefit of this interview approach is that it highlights the individual perspective while enabling comparability of the gathered data. Our themes would revolve around (a) smart cities and smart city technology, (b) governance of procuring and getting involved with smart cities and (c) managing risks and opportunities.

We acknowledged that interviewees may have identified important risks that were not legal by nature. Therefore, we posed general questions on the topic before bringing up the topic of legal risks, such as threats to data protection. We held assumptions regarding the human-rights risks of smart city technology while also realising that most people – expert or not – are generally not used to reflecting on risks in legal terms. Therefore, we asked open-ended, exploratory questions regarding the ‘how’ of decision-making and procedures to get answers that might reveal such risks implicit in the decision-making processes (see appendix for questions).

Interview analysis

We conducted directed (qualitative) content analysis. "Directed” means the analysis process was informed by previous research, human rights and EU law, from which we deductively developed an initial rough scheme of relevant concepts and codes. The following coding procedure remained “open”, or inductive, towards new emerging concepts and modifications (Hsieh & Shannon, 2005, p. 1281).

Our coding procedure was initially “open” (breaking the data into discrete parts with labels), but gradually we started drawing connections between the concepts and categories, thus “axially” coding them (Strauss & Corbin, 2015, pp. 222ff, 240ff). We also kept separate analytical notes of the material, as comparing these allowed us to notice varying connections and interpretations within the team, acting as a corroborative mechanism.

Qualitative research findings

In our analysis, we found that the Finnish and EU smart city technology development, and the smart city R&D funding landscape in HMA, displays four features, as discussed below. For the full quotes referred to throughout the text, see our quote repository (table 2, appendix).

GDPR as a perceived burden

The relevance of data protection was generally acknowledged by the interviewees. Applications, such as video recordings and cameras, data collection from public spaces, user interfaces with citizens, healthcare and social service applications, were perceived as riskier than projects focused, for example, on infrastructural connectivity and analytics.

Legal-wise, the GDPR is a huge risk, with the dozens and dozens of cameras that we have (E1: Q1).

Generally, data protection was perceived to involve a trade-off between diligent compliance that minimises the risk of re-identification and the targeting of individuals, and having the possibility to utilise the data more broadly, for instance for the purposes of service development.

If we make it completely anonymous, it’s completely useless, there is no data left. But if we keep certain aspects of data, then it becomes [increasingly] likely that someone with access to anonymized data will identify people. And erring on the side of caution, what we do, leads to risks of underutilizing data that we have (E8: Q1).

Data protection compliance is a part of, or an indication of professionalism for actors involved in smart city R&D. Especially in collaborations involving cities, ensuring GDPR compliance was a necessary part of setting up the R&D initiative. Companies that have not thoroughly considered data protection in their applications are perceived as “not qualifying” for funding (E3: Q1). Especially for companies, the risk of GDPR enforcement and potentially getting fined motivated compliance efforts.

GDPR compliance was perceived as a novelty in both the private and public sectors, requiring considerable effort to interpret the law and resources to establish the required risk management processes. An interviewee mentioned that employees might have learned to work in a certain way, and using data or requirements for data protection impact assessments required efforts to re-learn ways of working (E9: Q1). Another interviewee expressed challenges with the ambiguity of GDPR requirements: “[The GDPR was] just recently set up in Europe [...] and [the EU regulators] are making the situation very unclear because people are not really understanding what it means on many practical levels” (E5: Q1).

For successful compliance in municipality-driven projects, key factors echoed the DPbD criteria (Art. 25 GDPR). Firstly, organisational processes were viewed as key to compliance: “All risks are subordinate to lack of proper process, [...], if you don’t have proper processes, for example, legal compliance cannot be fulfilled. You will always miss something” (E12: Q1). The establishment of organisational processes also enabled multistakeholder learning on technologies and risks, requiring collaboration between the “technology side” and the “legal side” (E20: Q1). Secondly, balancing the limitations against making use of the flexibilities within the GDPR was deemed a best practice for successful compliance (E8: Q1). Lastly, GDPR compliance was ensured through devising technical means to ensure compliance, such as automated pseudonymisation or focusing the surveillance on the masses, rather than individuals. For instance, an interviewee explained that the technology used was “designed to not detect any biometric information” (E17: Q1).

At its worst, the compliance was perceived as complicated, costly and time-consuming both by the private and public sectors, leading to project delays. Difficulties arose from three factors, one of them being the timing of compliance measures for technology that is under development. Some R&D projects were reported to be in too early a stage to initiate plans for data protection compliance: “We need to tackle legal aspects such as the GDPR at some point, before reaching market availability of [our solutions]. However, we are in such an early phase that we do not know what the solutions might be” (E4: Q1). Additionally, risks could become evident only through testing a solution: “Development of AI and data-driven tech led to the awareness about their risks. Also, the maturing of the tech helps us to understand the possible risks. One needs also to experiment to become aware of the materialisation of such risks” (E21: Q1).

Other challenges related to the disproportionate compliance costs for small, short-term R&D projects with an uncertain life-cycle. Compliance was a challenge also within multiparty projects where compliance policies must be successfully introduced to each new participant.

I wish that there would be some kind of leniency in the policies or laws regarding piloting, testing and experimentation. So for example, that we could be doing something for six months, that would not be okay to do in the long run, in the production version, but [be allowed] while we're testing (E5: Q2).

We spend time solving these GDPR issues and kind of know how we should do it, comply with the legislation. Fine, we do it now. But we know that it will be a risk for new partners to come and try to get it because it is such a complicated and time-consuming procedure (E1: Q2).

Against this background, the private sector perceived the limitations and costs set by the GDPR to put European smart city technology developers at a disadvantage vis-a-vis countries that allow for freer re-use and recombination of data for R&D and commercialisation purposes: “[...] it’s much easier to develop and test these types of solutions in an environment like, for example, China, where the data is not controlled like the GDPR regulations now” (E5: Q3). A company project director (E1: Q3) emphasised that “the best innovations go elsewhere” if the EU becomes too strict with GDPR enforcement.

One-sided development inputs

The governance of the instruments funding the R&D initiatives rarely featured norms that would mandate diversity among developers, or enhance feedback loops during the development processes. Both private and public actors reported a lack of incentives to gain more interdisciplinary or diverse feedback on the initiative (or its potential risks). While instruments supporting company-led R&D and ecosystem building emphasised the diversity of participating companies, multidisciplinarity and citizen engagement was left up to the initiative of the companies and research institutions proposing the research projects. There were no norms on the inclusion of researchers from social sciences in the R&D projects. Companies' path-dependencies may lead to certain collaboration opportunities and risks remaining unidentified: “we are too busy to, you know, get the cash flow starting, that we don't get stuck in the minor details like legal aspects which might end up backfiring” (E6: Q1).

The lack of diversity also stemmed from conditions on who can be funded. Some of the national instruments could not fund cities’ participation in projects, offering them only a more passive advisory role on a volunteer basis (E2: Q1). The fact that some of the nationally funded projects were confidential apart from designated outputs makes it difficult to evaluate whether the initiative lacked input from an important stakeholder or a group. Since the funding instruments, more generally, are geared towards enhancing the competencies of Finnish companies or regional development, their conditions typically excluded collaboration with foreign companies, which reduced input on international development and the application of smart city technologies.

Most of the projects are driven by Finnish companies, universities and research institutes - we don't have that much of an understanding or even opportunities to understand what is happening in the smart city domain in China, or the US or South America or Africa, which might lead us to not understanding the global definition or a smart city (E4: Q3).

In contrast, the funding instruments involving cities and their own initiatives sought greater transparency and engagement, which was reinforced by the initiatives’ alignment with municipalities’ strategic goals, such as digitalisation, service-delivery and sustainability (E15: Q1; E20: Q2), as well as the Nordic culture’s openness and trust in the public sector (E3: Q2). However, citizen engagement and feedback has been reported as also being hindered by COVID-19 measures (E16: Q1), and vulnerable to the overrepresentation of privileged digital natives and ethics washing, where the legitimacy of a project is “reducible to consulting the residents” (E8: Q2). Similarly, technosolutionist funding instruments diverted attention from the implications of the technology. For instance, when asked about AI ethics, a respondent discussed the integrity of the technical features of the solution, i.e. assessing whether AI is part of the solution (E2: Q2).

Scale-up as an aim

Smart city projects are more likely to receive funding if they are expected to be replicable and scalable, traits ultimately deeming the projects to also be exportable: “[W]e do not do anything just once, or tailor it for a specific purpose [...] The goal is always scalability” (E8: Q3). This is demonstrated by the fact that cities are viewed as innovation platforms, where companies may test their smart city solutions before replicating them in another district, city or country (E5: Q4). Besides companies, municipalities also discovered scalable governance and business solutions through smart city R&D initiatives (E20: Q3; E17: Q2 & E15: Q2).

A solution’s exportability is also perceived as a reflection of its monetary value. Some of the national funding instruments spearheaded export potential as explicit funding criteria. Exportable products bring tax money to Finland. In this context, smart city megaprojects, for example in the Middle East, are viewed as lucrative exporting opportunities for dozens of Finnish companies (E7: Q1).

Quite many companies have given us very good feedback that the actual pilots have helped them in product development and to commercialise products, which of course means that hopefully they will be a successful business and then try to bring tax euros to Helsinki (E3: Q3).

With respect to smart city exports, Finland was perceived to have a favourable brand, in terms of sustainability and trustworthiness, especially in data protection and governance, where human rights compliance contributes to upholding and reinforcing this image. Data protection compliance was thus perceived as part of a marketing strategy to advance scale-up.

Finland has been a pioneer in open smart city data and also a forerunner in setting up the governance and legislation for data, including requirements of consent from individuals, which is relevant for export (E7: Q2).

Discouraging costs of localisation

Both the private and public sectors viewed seamlessness in the provision of services to citizens as a relevant goal for the development of smart city technologies. The development requires the integration of input from many stakeholders, such as city departments. Where the services in question were not purely digital, their provision was presumed to be supported by IoT solutions.

Many things in smart cities are under the hood; citizens benefit from them without anyone actually seeing them (E9: Q2; see also E15: Q3).

One of the biggest challenges, both in the development of such technologies and their introduction as finished, legally compliant solutions to municipalities, is the complexity of cities as organisational units and the applicable laws, not only data protection law, but also public law applying to municipalities and norms specific to the given city.

The hardest part [of GDPR compliance] was to communicate with different city units, because they have their own data management things. It was not centralised. So you had to have good contacts with the relevant department (E13: Q1).

Pilots run by companies with the city do not guarantee public procurement of the solution and thus, scale-up. From the outside, the procurement processes were perceived as complicated and intransparent, and the regulations rigid. Indeed, in a large city, individual procurement processes involve a large number of people with the aim to ensure both legal compliance (E12: Q2) and that the procured solutions suit the needs of the relevant city department.

The problems are exacerbated when the technology aims to offer a more “seamless” experience, when the introduction of it does not align with sector-specific planning and procurement practices. For this reason, offering smart city solutions to new neighbourhoods was generally seen as more attractive and less administratively burdensome than retrofitting them into established districts. A company project director (national funding) described how his team would have needed to get several permits to change the smart city infrastructure they were developing, adding that their solution’s complexity “is a challenge because no one person can handle this. And in city organisations there are usually many departments. So there is a risk of missing out something and blocking some things we are able to do” (E1: Q4).

The city funding of holistic solutions also poses a challenge, as the benefits may not be directly seen by the citizens or accrue in a cross-departmental fashion. As a consequence, within a municipality it may be difficult to make a strong enough case for including them in the city budget. Where smart city technology requires wide-scale hardware instalments in the urban environment, technology developers must either market the solutions to the municipalities who can afford such investments, or devise a business case, such as one reliant on the re-use of data, that will attract private investors.

Cities are usually not the investors to infrastructure in Finland, [...] if we go to Dubai or other kind of countries where the cities are a bit maybe more rich in finance, they can do the investments (E1: Q5).

R&D funding instruments that empower municipalities and emphasise cross-departmental, multi-stakeholder integration appear to mitigate the obstacles by devising local, integrative solutions.

Ad hoc-nature of R&D projects and human rights risks

Data protection by design in R&D

The interdependencies between the four features in the Finnish and EU smart city R&D funding landscape discussed above may lead to situations where the technology developed by European companies neither supports the fulfilment of fundamental rights in Europe, nor outside the EU. We identify issues relating to the ad hoc-nature of R&D projects and international myopia, discussing them and their solutions in the following two sections.

Our qualitative analysis reveals compliance with the DPbD principle (Art. 25), presupposing a relatively stable, and continuous organisational context, where once the principle is implemented technically and organisationally, it can be maintained at lower marginal costs than its initial set-up required. This contrasts with the often ad hoc nature of R&D projects and pilots that may involve temporary, open collaboration among heterogeneous stakeholders. The risks of fines is an important motivation behind GDPR compliance in the R&D phase, but the upfront costs of establishing heavy organisational measures were perceived as burdensome, especially when the available budget was limited.

Both the assessment of technology’s impact on data protection and other fundamental rights, as well as the protection of these rights through technology design, can be challenging given the relative and context-specific qualifications of the controller’s obligations under Art 25 GDPR. The process of translating abstract values into design specifications is not straightforward (Nissenbaum, 2005; Flanagan et al., 2008; van de Poel, 2013; Koulu, 2021). For example, the CFREU contains 50 articles on citizens’ rights and freedoms and, as discussed in the introductory section, smart city technologies may affect a number of them. Evaluation of technology’s impact on an individual right can be very complex: an assessment tool for the non-discriminatory impact of AI in its development phase consists of a list of 70 factors (Ojanen et al., 2022). Even without going to such lengths, GDPR compliance might have unintended effects on innovation and market structure. Recent studies have found the GDPR obligations to have had a significant inhibitory effect on innovation in mobile app development (Janßen et al., 2022), as well as shrinking the market for third-party web technologies while also increasing the concentration of market share by dominant firms (Peukert et al., 2021).

Thorough compliance with the DPbD obligations in the R&D context is also challenging due to the emergent and experimental nature of the technical solutions developed in the project. DPbD must be implemented at the time when the means of processing are determined (Art. 25. GDPR). Yet, the possible impact may not be evident at the initiation phase and only emerge over time. Many studies of public R&D funding instruments lacked norms, nudges and resources to diversify inputs in the R&D phase in the manner that would give a broader overview of the impact of the technology on human rights. We assume that such incentives are even fewer in private sector R&D. As prototypes may define the ultimate design of the technology (Vakkuri et al., 2020, p. 207), one-sided inputs and a lack of assessment measures may lead to smart city technology being placed on the market, and having an undesirable impact on fundamental rights when scaled up. In both situations of prohibitive costs of compliance and undercompliance, opportunities to develop smart city technology that supports the fulfilment of human rights may be jeopardised.

Legal measures to support compliance

Interest in lowering the compliance standard for companies in the R&D phase was voiced in our data. The AIA proposal may respond to company interests by introducing regulatory sandboxes where innovative AI solutions can be developed and tested; also in “real world conditions”, under lower GDPR compliance requirements and regulatory oversight before they are placed on the market or put into service (Recital 71, Art. 53(-1a); Art. 54(1)(7) (as per Council revisions)). Real-world testing of high-risk AI systems would be subject to more defined criteria, for example, regarding testing subjects’ consent (Recital 72a; Art. 54a). Regulatory sandboxes are expected to provide regulators with an improved understanding of novel technologies while fostering innovation, allowing businesses to explore and experiment with new products and reduce the time-to-market cycle for products (Madiega & Van De Pol, 2022). Despite the potential benefits, regulatory sandboxes have been criticised: they are often politicised, subject to methodological deficiencies and offer limited validity of their results (Ranchordas, 2021b). Furthemore, the sandboxes do not free the actors from the challenges of cross-disciplinary interaction with regulatory oversight.

The extent of obligations the AIA will pose for smart city technology developers at the R&D stage is unclear. The most extreme proposal to date excludes the applicability of AIA to R&D activity (Recital 12b), but nevertheless maintains DPdD obligations when testing technology in a sandbox (Recital 72-a). Whether and how the AIA’s R&D exemptions and sandboxes will foster organisational learning to identify the fundamental rights risks posed by AI requires more research.

Apart from AIA, R&D funding agencies and municipalities should play a more active role in ascertaining the human rights compliance of smart city technologies. Indeed, the funding organisations and municipalities studied acknowledged that emergent data-driven technologies posed novel risks, and many were developing guidelines for data and AI ethics. However, the funding criteria of initiatives studies rarely emphasised fundamental rights at large.

Recent research on AI ethics suggests that R&D institutions can do more to ensure that they are funding accountable AI, such as demanding the developers to file a “trustworthy AI statement”, or establish boards to evaluate the trustworthiness of AI (Gardner et al 2021). Yet, ethics-based approaches to technology are criticised for being prone to ethics washing (Floridi, 2019, pp. 187-188; Metzinger, 2019), and vulnerable to a proliferation of overlapping ethics frameworks (Sætra & Danaher, 2022). Relevant principles, even if based on the content of fundamental rights (Smuha, 2019, p. 101; AI HLEG, 2019) are unenforceable (Hagendorff, 2020, p. 99). Where the AIA’s sandboxes do not reach the same aims or will not apply, public funding for smart city technology should support interdisciplinarity, feedback loops and organisational learning on human rights impacts throughout the project life-cycle. This may take the form of a “soft law” sandbox.

More generally, it would be advisable for public funding agencies to set human and fundamental rights as a normative goal of smart city projects and tie the respect of such conditions to incentives or sanctions. On the macro level, the EU appears to be moving in this direction. For example, the European Regional Development Fund, which also funds programmes on smart and sustainable cities, lists the programme’s respect and implementation of fundamental rights as one of the funding conditions (Arts. 9 & 15, Annexes III & IV, Regulation (EU) 2021/1060). Similarly, actions supported by the Horizon Europe framework programme should respect fundamental and human rights, as well as mandating that legal entities be funded to carry out mandatory ethics self-assessments and governance for ethics screening and checks. In addition, the Horizon Framework specifically funds research and innovation initiatives geared towards strengthening democratic values and fundamental rights (rec 71; Art 19, Annex I, Regulation (EU) 2021/695). Part of its proposals for the 2023-2024 Work Package Programme explicitly mention fundamental rights as evaluation criteria for projects on AI (EC, 2022c). How the emerging governance instruments publicly funded R&D succeed at translating the normative values of fundamental rights into technology, deserves further research.

International myopia

Human-rights risks of exported technologies

From our data, we also observe a tendency toward international myopia, where the deterring compliance and coordination costs, and the unprofitableness of integrating smart city technology locally attracts companies to pursue top-down megaprojects in places where the GDPR does not apply, such as Gulf countries. This may lead to technology exports that harm the human rights of citizens in the importing country. This would be on the grounds of insufficient screening of the technology impacts and international inputs in the R&D phase, and the fact that many smart city technologies can be subject to dual-use:

When you are using solutions that collect all your information, it can be used either for you or against you, depending on the use case. So, in that sense, there is a very thin line between these technological solutions. Traditionally, the dual-use technologies have been referring to technologies that can be used also for military purposes, but in this new world, I think that the dual-use technologies are covering a much wider area, and it’s not only kind of military use, but let’s say, one could use for good and for bad (E21: Q2; see also E16: Q2).

As not all countries have similar levels of fundamental rights protection, what is the responsibility EU companies should assume when exporting technology outside the EU? Exporting technology into a country with an alarming record of human rights violations may represent conscious profit-seeking irresponsibility, a purposeful malpractice of “digital ethics dumping” (Floridi, 2019, p. 190) or, alternatively, naivety on behalf of European smart city developers.

What possible protections afforded by technology were initially designed to be GDPR-compliant and exported outside the EU, under the brand of trustworthiness of the exporting country? According to Hildebrandt “legal protection by design” is afforded by the contestability of rights in a court of law. When such technology is exported to a country that does not afford its citizens rights similar to the GDPR, or strong protection of the rule of law, it may be deemed “legal by design” (Hildebrandt, 2020a). As a consequence, the fundamental rights of citizens may be protected precariously, relying on data or AI ethics (see Mittelstadt, 2019; Hildebrandt, 2020b). Nevertheless, such technology exports may serve the EU companies' interests on the global market of smart cities, with the possibility to reinforce welfare-enhancing practices in developing countries (Manville, 2014, p. 19) and possibly extend the de facto Brussels effect (Bradford, 2012).

When the exported technology is not GDPR compliant by design, or on the basis of complying with the legislation of the country of import, the European smart city technology developers may, in the worst case, offer tools to support authoritarian rule in other countries, as has already occurred with European ICT suppliers (Wagner, 2012; Kanetake, 2019). Such concerns are also raised when EU developers seek states with lower legal constraints and supervision for testing the systems, which might then be imported back into the EU (see Floridi, 2019, p. 190). In this light, we observe a contradiction between European policies and legal standards for human rights compliance of smart city technology set for the internal market, and that for exports.

Measures to support respect for human rights

Two EU law instruments may mitigate the potential adverse effects of exported technology on human rights abroad: technology manufacturers’ human rights due diligence obligations (Donahoe & MacDuffee Metzger, 2019; DDD proposal), as well as export control for dual-use technologies (Whang, 2021; Dual-Use Regulation).

The EU has caught up with the development in which member states make corporate due diligence obligations (OHCHR, 2011; OECD, 2018) binding by law (Kitukwe, 2022). The DDD proposal aims to promote respect for human rights and sustainability by imposing due diligence practices (e.g. identification and prevention of adverse impacts on human rights or the environment) to companies’ global supply chains (Art. 4). In this way, the proposed rules aim to “advance the green transition and protect human rights in Europe and beyond” (EC, 2022d). Albeit the proposed act does not explicitly deal with data, AI or smart cities, it can be interpreted to also pose obligations to prevent human rights abuses caused by AI (Lane, 2022) and other technology in companies’ value chains also outside the EU.

The Dual-Use Regulation seeks to promote responsible technology export from the EU, and to prevent the use of EU-exported technology for the development of weapons. The Regulation “establishes a Union regime for the control of exports, brokering, technical assistance, transit and transfer of dual-use items” (Art. 1), meaning items which can be used both for civil and military purposes. It requires companies to acquire authorisation from a national competent authority when exporting items belonging to the ‘dual-use’ category (Art. 3). Notably, it also demands authorisation for the provision of technical assistance related to dual-use items (Art. 8). Our interviews suggest that smart city technologies have a low and nebulous threshold for creating negative effects. The Dual-Use Regulation was in 2021 recast to give a wider account of human rights risks and cover more surveillance technology (rec. 2, Art. 5). Further research is needed on the applicability of the Dual-Use Regulation on smart city technology exports.

Policy measures to address the lack of risk mitigation, stemming from insufficient knowledge on human rights and their protection in the country of export, are also necessary. This responsibility could be taken by the EU embassies, delegated to Supervisory authorities under the DDD (Art. 18) or initiated by member states’ own initiative. Within the EU, it is important to make the European market for smart city technology more attractive vis-a-vis global megaprojects. Measures should be developed to facilitate effective and human rights-compliant technology localisation and procurement by European cities. Support for the development of replicable compliance processes and governance solutions for piloting and adopting technology across a range of national and European municipalities is also of value. Cooperative measures between cities are also of relevance (Ringel, 2021). European cities may also have an indirect impact on exports by requiring a higher level of corporate human rights due diligence from their contractors, whereas companies sanctioned under DDD could be excluded from public R&D funding (Art. 24).

Conclusion

Publicly funded smart city technology developers in the HMA may pursue exports to countries with lower standards of human right protection due to one-sided development inputs, high costs of compliance and localisation, as well as international myopia. We believe that the case of the HMA is relevant beyond the narrow confines of Finland: further research could focus on generalising this claim with comparative case studies in other countries.

The problems identified should be addressed at different governance levels. European and national R&D funding agencies should be conscious that the technologies associated with smart cities can have a much stronger impact on human rights, society and power relations than the R&D they had been funding in the past. The agencies, with the support of institutions directing them, must adopt a critical lens towards their agendas’ societal objectives and impacts. The power relations reinforced by solutions should not be ignored (Powles & Nissenbaum, 2018; Munn, 2022; Sloane, 2022). Norms that enhance the diversity and interdisciplinarity of the funded projects, including the presence of social sciences (see Sloane & Moss, 2019) and mandating stakeholder consultation and involvement, are necessary. The agencies should also require the development of legal compliance measures as well as assessments and audits of the technology impacts while supporting these actions with expertise, governance and financing.

For smart European cities and, ultimately, the European project to be more than a neoliberal dream (Cardullo & Kitchin, 2018; Hermann, 2007), the EU must align its policy goals for smart cities, fundamental rights-driven technology regulation, and technology exports. Otherwise, it maintains the practices of digital colonialism, strengthens non-democratic developments abroad that may lead to globally destabilising effects and makes its own citizens vulnerable to imported technologies that are developed elsewhere with less oversight.

Appendix: Interview themes and questions

1. Smart Cities and smart city tech

• What does Smart City mean to you?
• What is your exposure to Smart Cities through your work?

2. Governance of procuring, piloting or getting involved with a smart city

• What kind of principles and rules guide you in selecting whether and how you support a smart city project?

3. Managing risks and opportunities

• Do you see any problems or risks with the smart city project(s) you are involved with or more generally?
• What are the means to manage the possible risks are you aware of?

Please feel free to inform us either in advance, or during the interview if you are uncomfortable answering any of the questions.

The sample discusses initiatives funded by EU funding sources, including, the European Social Fund, the European Regional Development Fund, including its Urban Innovative Actions sub-Fund, Horizon 2020 and Horizon Europe, the European Commission’s Digital Europe Programme and the Recovery and Resilience Facility. We also covered national funding governed by the Finnish Ministry of Economic Affairs and Employment, or other ministries including funding distributed through, Business Finland, government organisation for innovation funding and trade, travel and investment promotion. Interviewees also discussed R&D financed through municipalities’ own budgets, sometimes governed or executed by city-owned companies.

We conducted interviews on large initiatives, such as multistakeholder R&D collaborations and ecosystem-building initiatives, including multi-project programmes as well as smaller projects, such as testbed and piloting initiatives, and cities’ in-house development, complemented with interviews on procurement and projects for its facilitation.