Selected Papers of #AoIR2023: The 24th Annual Conference of the Association of Internet Researchers Philadelphia, PA, USA / 18-21 Oct 2023 Suggested Citation (APA): Shaffer, G. (2023, October). Deplatforming The Smart City: Giving Residents Control Over Their Personal Data. Paper presented at AoIR2023: The 24th Annual Conference of the Association of Internet Researchers. Philadelphia, PA, USA: AoIR. Retrieved from http://spir.aoir.org. DEPLATFORMING THE SMART CITY: GIVING RESIDENTS CONTROL OVER THEIR PERSONAL DATA Gwen Shaffer California State University Long Beach Background and rationale for the research Smart city platforms–encompassing mobile apps, cameras, sensors, algorithms, and predictive analytics—function as surveillance tools. These internet-connected devices and services generate troves of data on residents, including travel patterns, mobile device identifiers, internet browsing history, phone contacts, and more. Research suggests that excessive surveillance reinforces a sense of insecurity and leads residents to fear civil liberties violations, particularly among communities of color. By contrast, our recently-piloted digital rights platform aims to give Long Beach residents agency over how the City collects, uses and stores their personal data. We intentionally chose the term digital rights platform to upend the dominant notion of platforms like Android, Meta and Amazon—which extract data from users, and then commodify that personal information in order to generate revenue. This digital rights platform project considers the technical, legal, ethical, and spatial aspects of smart technologies. Grounded in frameworks of trust and contextual integrity, the platform also advances goals associated with two critical and closely intersecting priorities: operationalizing Long Beach’s Data Privacy Guidelines (City of Long Beach, 2021) and implementation of its Framework for Reconciliation (City of Long Beach, 2020). Toward this goal, the project is focused on the City’s vision to use data in ethical ways that avoid reinforcing existing racial biases and discriminatory decision-making. When fully implemented, this project will operationalize both privacy and racial equity as priorities for all deployments of smart city technology. Long Beach is the second largest city in Los Angeles County, with nearly 500,000 residents (U.S. Census, 2023). Project design First, the platform will feature text and the open-source Digital Trust for Places and Routines (DTPR) iconography that visually conveys how the City of Long Beach uses specific technologies, what data the devices collect and how the City utilizes that data. We plan to strategically deploy these information points across Long Beach, physically adjacent to or digitally embedded within civic technologies, e.g., sensors, cameras, small cells, mobile payment kiosks, and a 311 app. The platform will include a feedback application consisting of access (via QR code or hyperlink) to an online dashboard where users may learn additional details, update data collection preferences, and share comments/concerns with local government officials. The ultimate goal is to develop a backend solution that enables residents to opt-out of data collection. This emergent digital rights platform will provide Long Beach residents with not only a clear understanding of how local government applies predictive and diagnostic analytics to personal data, but will also empower community members by granting them agency. The project will take a “human centered” and “activity” design approach to ensure resident concerns and needs are met; that racial and social inequities are addressed; and, ultimately, that Long Beach residents experience improved quality of life. The co- PIs intend to incorporate both social and technical elements that account for community perceptions about data collection and use, as well as recognize nascent digital equity and accessibility barriers. Long Beach’s digital rights platform also has the potential to serve as a model for meaningful partnerships among community stakeholders, local policymakers, industry, and academia. This project reimagines the current notice and consent regime by developing a community-informed digital rights platform that emerges from the understanding that data privacy is a human right (United Nations, 2022). Rather than viewing residents as customers—a current dynamic driven by third-party vendors who rely on residential data to maximize profit—this project strives to give community stakeholders agency over their data. The project considers both social and technical issues, informed by community members’ perceptions, attitudes and concerns surrounding data collection and use. Specifically, the co-PIs are planning to develop a “civic user testbed” for facilitating workshops and conducting qualitative research with diverse community members to co-design (designing with, as opposed to designing for) innovative approaches. The civic user testbed is a field-based approach—in contrast to traditional focus groups or interviews, for example—meant to ensure the City is transparent about how data are collected through devices, mobile apps and City services. The findings will inform novel accountability strategies meant to that ensure wildly disparate smart city technologies—each employed for a distinct purpose—respect residents’ data privacy and avoid discriminatory impacts. Research questions RQ1: How does the presence of data privacy notices impact how residents interact with City deployed technologies? Does transparency foster trust? RQ2: Do transparency and accountability surrounding data collection serve as a catalyst for the City of Long Beach to alter practices and/or collect less data on residents? In answering these questions, my co-PIs and I will critique relationships among infrastructures, practices and imaginaries surrounding data privacy and smart cities. For instance, how do government-sponsored surveillance technologies redefine public space? How do contexts, practices and situations involving smart technologies shed light on civic norms and power relations? We will rely on a “cultures of trust” framework and Helen Nissenbaum’s (2004) theory of contextual integrity to analyze data collected during the proposed activities. These approaches will guide our efforts to design a digital rights platform that prioritizes community voices, rather than technology company priorities. Pilot study In October 2022, the PI worked with the City of Long Beach to pilot the digital rights platform downtown, and facilitated “data walks” with nearly 40 Long Beach residents (see photos above). Study participants encountered a data privacy notification adjacent to an automated license plate reader in a City-owned parking garage, and another privacy notice adjacent to an “eco-totem” that uses sensors to count pedestrians and cyclists. These signs informed study participants (in English, Spanish, Khmer and Tagalog) they were interacting with a technology that collects personal data. Participants responded to questions on a custom mobile app about the signage design and their experiences scanning the QR codes. We returned to the Main Library for a discussion about trust and comfort levels with smart technology. In general, study participants expressed mixed feedback on the design and placement of the two signs—some suggesting more text, while others proposed a simpler format. Others noted that a QR code assumes everyone has a smart phone. Preliminary findings also suggest that residents are, mostly, resigned to the idea of smart city technologies and accompanying privacy violations. Comments included, “I feel like it is almost inevitable. I mean, it concerns me. But it seems like one of the toughest things to reverse or limit.” Many participants expressed a desire for greater transparency about how their data are used, sharing comments such as, “I’m not as worried about what is collected as I am about how long it is kept and who has access to it. We were talking about how data is sold and third parties, what are they doing with it.” These sentiments are informing the next phase of the project, including deployment of privacy notices in three diverse neighborhoods, and workshops with City staff to ensure buy-in of the project. References City of Long Beach (2021, January). Data Privacy Guidelines. http://longbeach.gov/globalassets/smart-city/media-library/documents/final_data- privacy-guidelines. City of Long Beach (2020, June 26). Framework for Racial Reconciliation. https://longbeach.legistar.com/View.ashx?M=F&ID=8595273&GUID=107D5EFA- D10F-4444-B35A-3E7C272887BD. Nissenbaum, H. (2004). Privacy as contextual integrity. Washington Law Review (79)1, 119-157. https://crypto.stanford.edu/portia/papers/RevnissenbaumDTP31.pdf. United Nations (2022, June 27). Digital human rights. https://www.un.org/techenvoy/content/digital-human-rights. U.S. Census. (January 2023). QuickFacts: Long Beach, Calif. https://www.census.gov/quickfacts/fact/table/longbeachcitycalifornia/RHI425220# RHI425220. http://longbeach.gov/globalassets/smart-city/media-library/documents/final_data-privacy-guidelines http://longbeach.gov/globalassets/smart-city/media-library/documents/final_data-privacy-guidelines https://longbeach.legistar.com/View.ashx?M=F&ID=8595273&GUID=107D5EFA-D10F-4444-B35A-3E7C272887BD https://longbeach.legistar.com/View.ashx?M=F&ID=8595273&GUID=107D5EFA-D10F-4444-B35A-3E7C272887BD https://crypto.stanford.edu/portia/papers/RevnissenbaumDTP31.pdf https://www.un.org/techenvoy/content/digital-human-rights https://www.census.gov/quickfacts/fact/table/longbeachcitycalifornia/RHI425220#RHI425220 https://www.census.gov/quickfacts/fact/table/longbeachcitycalifornia/RHI425220#RHI425220