Subscribe Menu

Baltic big brother? Data privacy in Estonia’s smart cities

Estonia's global leadership in e-governance and digitization has made it an ideal setting for developing smart city technologies. Cities like Tallinn and Tartu have made significant progress, with innovations including automated homes to reduce carbon emissions and sensors to monitor noise levels. Yet these services rely on the collection and analysis of personal data, thus begging the question: when does a smart city become too smart? Must innovation come at the cost of privacy?

Robot in Tallinn, by Renee Altrov, from Invest in Estonia

Smart cities promote efficiency and solve urban challenges through the analysis of data collected from various technologies (known as the Internet of Things (IoT), information and communication technologies (ICTs), and artificial intelligence (AI), which allows “officials to make informed decisions that efficiently address the population's needs,” according to e-Estonia.

Tallinn and Tartu are home to a number of smart city initiatives. In 2019, Tallinn approved the implementation and use of more than 800 sensors around the city, designed by Tallinn University of Technology and its private partner organization, Thinnec, to collect data on and reduce traffic density, congestion, and noise levels, according to its website.

Over in Tartu, experts are tackling high carbon emissions from housing. When discussing how ICTs can be used to mitigate this, Hannes Astok, the Executive Director and Chairman of the Management Board at the Estonian e-Governance Academy said that, “We're currently looking at intelligent housing that could regulate its own temperature (through heating or air-conditioning) whenever necessary, and could even plan out temperature a few days ahead of time—a system that we could combine with solar panels, for example. We've renovated several buildings in Tartu, and from here on out, we'll be thinking about how to use technology for improved building isolation.”

Yet, these benefits must be approached with caution. At the heart of smart cities lies the collection of highly personal data, raising privacy concerns and the potential for surveillance.

“We've thought about solutions like recording daily activity through, say, refrigerator, toilet, or water use. If activity suddenly stops, someone could be called to come check on the person living there.”

(Hannes Astok)

“…The question we need to ask first is: how do we let people maintain their independence? Should we use sensors to help us get around our own houses? How do you monitor older people, or physically and/or mentally [disabled] people without becoming a kind of ‘Big Brother'? We need to find a way to do that without being intrusive. We've thought about solutions like recording daily activity through, say, refrigerator, toilet, or water use. If activity suddenly stops, someone could be called to come check on the person living there,” said Astok.

Harvard Professor Emerita Shoshana Zuboff cautions against the embrace of smart cities for their facilitation of surveillance capitalism — a term she popularized in her 2018 book The Age of Surveillance Capitalism. The term refers to the collection and subsequent transformation of private experiences (based on everyday data, including what you search for and purchase online, who you message, and the shops and parks you frequent), into predictive behavioural algorithms by corporations. These predictions “are sold to business customers in markets that trade exclusively in human futures, where companies compete on the quality of predictions: they sell certainty,” according to an article she wrote for Toronto
Life in 2019.

These issues came to a head in Toronto, when, in 2020, Sidewalk Labs cancelled its project of implementing smart city technologies in the Queens Quay neighbourhood. The project initially deemed the area as a testbed for various smart city technologies, where “private experience occurring within this experimental zone would be deemed ‘urban data' available for monitoring and actuation.”

In 2020, StateScoop reported that “Ann Cavoukian, an expert-in-residence at Ryerson University who served 17 years as Ontario's information and privacy commissioner, left Sidewalk Labs as a consultant in October 2018 after the company failed to commit to promises that it would ensure all sensor data within Quayside was de-identified at the point of data collection.”

At first glance, this may seem comparable to the ongoing “Test in Tallinn Framework,” where both Estonian and international companies are invited to test their smart city solutions.

…the General Data Protection Regulation (GDPR) requires EU organizations (as well as those outside the EU conducting business within it) to comply with strict guidelines regarding the collection, storing, and managing of personal data.

However, Estonia has solid precedents for data privacy and, generally speaking, high levels of public trust in digitized services. To qualify for testing in Tallinn, organizations are required to comply with strict legal frameworks — and, on a broader scale, the General Data Protection Regulation (GDPR) requires EU organizations (as well as those outside the EU conducting business within it) to comply with strict guidelines regarding the collection, storing, and managing of personal data.

Further digitization in urban environments is inevitable. Above all, it is necessary to ensure that this is done in a way that protects civil liberties, including the right to privacy. Estonia's success in this route serves as a valuable model for other nations seeking to implement smart city solutions.

This article was written by Natalie Jenkins as part of the Local Journalism Initiative.

Read more