Data Governance Models in Smart Cities: Privacy by Design or Surveillance by Default?

Introduction

Urbanisation comes with its own problems. As the population grows, the demands increase as well. As the need for infrastructure grows, governments have started using technology to manage transportation, resources and public services. Smart cities are often found as a good solution to these problems, since they are built by integrating information and communication technologies with urban infrastructure. They offer efficiency, sustainability and quick resolution using real time data analytics, and interconnected systems.

Yet, this promise is accompanied by a set of risks, the very technologies that enable efficiency also enable the large scale collection of data about citizens’ movements, habits, and interactions. While such data can optimize urban services it also raises concerns about surveillance data, miss-use and the erosion of privacy. These concerns are not theoretical. From facial recognition cameras in Singapore to predictive policing tools in the United States, smart city technologies prioritise efficiency and security at the expense of individual rights.

This debate has crystallised into two contrasting models of governance. On one side is the principle of privacy by design which advocates for embedding, privacy and security protection into architecture of systems from the outside. On the other is the reality of surveillance by default, in which data collection becomes the norm, and protections are either secondary outset.

Research Objectives

The primary objective of this blog is to analyse how different models of data governance influence the balance between privacy and surveillance in smart cities. The blog seeks to evaluate whether privacy by design can realistically guide the development of urban technologies or whether surveillance is becoming the default mode of governance. A second objective is to examine how jurisdictions such as Europe Union, United States, Singapore and India have approached this dilemma through law, policy and practice. Finally, the blog aims to provide normative recommendations for embedding citizen centric privacy protection into smart city frameworks.

Analysis

Smart cities are complex data ecosystems which collect data through sensors, Internet of Things (IoT) devices, and surveillance infrastructure. This data is then processed by various computer algorithms that provide quick decisions and resolution regarding various activities like traffic management and even energy distribution. This makes administration of such urban systems accountable for even data flows and access rights.

The concept of privacy by design provides one path for regulating these ecosystems. Originating in the work of Ann Cavoukian, this principle insists that privacy should not be an afterthought or a reactive measure. Instead, it must be embedded into technological systems from the earliest design stages. Applied to smart cities, privacy by design would mean limiting unnecessary data collection, ensuring anonymisation, securing meaningful consent, and giving citizens greater control over their data. The EU has institutionalised this approach through Article 25 on the GDPR, which mandates data protection by design and by default.

In contrast, surveillance by default emerges when efficiency and control dominate governance choices, this model uses data primarily as a tool for optimisation and security, often downplaying, or overlooking the risks to individual freedoms. Predictive policing algorithms, mass, CCTV networks, and facial recognition technologies, exemplify this tendency. Shoshana Zuboff (2019) has described this phenomenon as surveillance capitalism, where personal data becomes the primary commodity extracted from citizens. Within smart cities, this translates into governance structures that normalise constant observation.

The legal and political tension lies in how societies balance these competing imperatives. Privacy by design requires strong legal protection, cultural recognition of individual rights, and mechanism of accountability. However, surveillance is used under the name of national security and economic competitiveness to control the public, overriding their individual rights.

Case Studies and Jurisdictional Comparisons

The governance of smart cities varies widely across the jurisdictions, illustrating the practical implications of these models.

Barcelona offers, perhaps the most developed example of privacy by design in practice. Through projects like DECODE, the city has transferred ownership of data from corporations and governments to citizens themselves. Initiatives such as the “Decidim” platform allow citizens to directly participate in governance decisions, making data use transparent and accountable. This citizen first approach demonstrates how urban innovation can coexist with strong privacy protection.

However, Singapore’s Smart Nation initiative reveals the efficiency first model. The country has made heavy investments in biometric identification, surveillance and cameras to upgrade urban life. While the initiative has created better security and services, it has also left the citizens with little control over their own data and granting extensive powers with the government. (Ho, 2017).

India occupies a middle ground, but with a worrying tendency towards surveillance smart cities mission launched in 2015 to retrofit existing cities with advanced technologies has often emphasised surveillance infrastructure such as CCTV networks without corresponding privacy safeguards. Although the Digital Personal Data Protection Act, 2023, marks progress towards a privacy framework, it retains broad exemptions for state surveillance, raising doubts about its effectiveness in protecting citizens.

The United States presents a fragmented landscape. With no comprehensive federal data protection law, cities are left to adopt their own governance mechanisms. San Diego uses predictive policing tools while New York’s relies on facial recognition. Sometimes, local governments ban such technologies which shows the conflict between efficiency and privacy even at the municipal level.

Findings

The comparative analysis suggests that privacy by design, while conceptually robust, requires strong institutional commitment to be realised in practice. Jurisdictions such as the European Union and cities like Barcelona highlight that enabling privacy into systems develops amongst the public and citizens are encouraged to take part smart city initiatives when their rights are recognised and respected.

Conversely, surveillance by default emerges where efficiency is treated as paramount. Singapore provides the clearest illustration of this efficiency trap. While citizens benefit from the optimised services, the cost is a governance model that normalises state control and limits individual autonomy. This approach therefore bridged trust gaps between the citizens and government as and when the individuals got aware of the privacy threats posed by surveillance.

India appears to have taken a safe approach. The introduction of national data protection law offers a normative framework for privacy but the practical reality of widespread surveillance infrastructure undermines this potential. The United States, meanwhile demonstrates the dangers of fragmented governance, with the absence of national level protection, the privacy vulnerable to local variation and corporate influence.

The key argument emerging from this analysis is that privacy by design is not merely a technical principle but a rights based imperative. Smart cities can be used to control the public instead of empowering them if independent oversight is not kept.

Conclusion

Smart cities showcase the paradox of modern governance that is the promise, efficiency, sustainability and responsiveness yet risk of surveillance and diminishing liberty and individual rights. This project has shown that governance models adopted by states and cities determine whether the smart technologies, enhance democracy or erode privacy by design offers a blueprint for aligning technological innovation with civil liberties, but its success depends on legal, cultural, and institutional reinforcement.

To ensure that privacy becomes the foundation of smart city governance, several measures are essential. Laws must go beyond rhetorical commitments to privacy and mandate concrete safeguards at every stage of system design. Data collection models should give individuals significant control over their personal data while independent oversight bodies must monitor compliance and penalise misuse. Suggestions should be collected from different stakeholders including the citizens through discussion and digital mediums. Also, use of technological methods such as anonymisation, differential privacy, and decentralised data storage is a must.

Author: Radhika Chugh, in case of any queries please contact/write back to us via email to chhavi@khuranaandkhurana.com or at  Khurana & Khurana, Advocates and IP Attorney.

Endnotes

1. Ann Cavoukian, Privacy by Design: The 7 Foundational Principles, Privacy by Design: The 7 Foundational Principles (Information and Privacy Commissioner of Ontario, 2009). Available at: https://privacy.ucsc.edu/resources/privacy-by-design---foundational-principles.pdf.

2. Regulation (EU) 2016/679 (General Data Protection Regulation), Article 25 (Data Protection by Design and by Default), Official Journal of the European Union, 27 April 2016. Available at: https://eur-lex.europa.eu/eli/reg/2016/679/oj.

3. Shoshana Zuboff, The Age of Surveillance Capitalism, The Age of Surveillance Capitalism: The Fight for a Human Future at the New Frontier of Power (Profile Books, 2019).

4. Government of India, Smart Cities Mission Statement and Guidelines, Ministry of Housing and Urban Affairs (2015). Available at: https://smartcities.gov.in.

5. Digital Personal Data Protection Act, 2023, No. 22 of 2023, Government of India. Available at: https://egazette.nic.in.

6. Ajuntament de Barcelona, DECODE: Decentralised Citizen-Owned Data Ecosystem, Barcelona City Council and European Commission Horizon 2020 Project. Available at: https://decodeproject.eu.