Data Protection in Smart Cities

This page is a translation of the original Portuguese text, provided for convenience. It deals with Brazilian law. If there is any discrepancy, the Portuguese version prevails. Read the original in Portuguese

Smart cities promise urban efficiency, but the mass collection of personal data by sensors, cameras, and IoT devices calls for rigorous due diligence to avoid violations of the LGPD (Brazil’s General Data Protection Law) and of citizens’ fundamental rights.

The Data Ecosystem in Smart Cities

Smart cities represent a model of urban management that uses digital technologies to optimize public services, from traffic control to the distribution of electricity. In this context, the technological infrastructure of these cities depends on continuous, massive data collection. Much of that data is personal, or becomes personal when it is cross-referenced with other databases. Video surveillance cameras with facial recognition, urban mobility sensors, interactive kiosks, public Wi-Fi networks, and public transit apps are only a few of the devices that feed this real-time data ecosystem.

The volume of information generated in this environment is extraordinary. A single intersection equipped with smart sensors can record the movement patterns of thousands of people every day. When that data is combined with electronic fare-card records, geolocation data from municipal apps, and access logs from public buildings, the result is a detailed behavioral profile of residents, often without their full awareness of how far this surveillance extends. The General Data Protection Law (Law 13.709/2018) applies directly to these operations. It requires the government and its private partners to observe principles such as purpose, necessity, and transparency when processing this information.

The picture grows more complex because smart city projects often involve public-private partnerships. Technology companies supply infrastructure, develop platforms, and operate systems on behalf of the public administration. This data processing chain creates multiple points of vulnerability, which makes data protection due diligence essential before, during, and after the rollout of each urban technology project.

Data Due Diligence: Concept and Application in Urban Projects

In the smart city context, data due diligence is a structured process of investigating and assessing the risks associated with processing personal data in urban technology projects. It goes beyond a simple check of legal compliance. It also covers the technical, organizational, and ethical aspects that determine whether a project respects the rights of data subjects and the limits set by current legislation.

The due diligence process should begin with a complete mapping of data flows. In practice, this means cataloging every collection point (sensors, cameras, apps, kiosks), the types of data captured (images, location, device identifiers, biometric data), the legal basis used for each processing operation, the parties involved in the chain (controllers, processors, subprocessors), and the mechanisms for sharing data between public and private entities. Without this detailed map, any risk assessment will be incomplete and potentially misleading.

Second, due diligence should evaluate the information security measures in place. Smart city projects frequently rely on cloud infrastructure, wireless communication networks, and data transmission protocols that carry specific vulnerabilities. The review should cover encryption in transit and at rest, access controls, retention and disposal policies, incident response plans, and mechanisms for anonymizing or pseudonymizing the data collected.

Data Protection Impact Report (RIPD)

The Data Protection Impact Report (Relatório de Impacto à Proteção de Dados Pessoais, or RIPD) is a central instrument in due diligence for smart city projects. Article 38 of the LGPD provides that the ANPD (Brazil’s National Data Protection Authority) may order a controller to prepare this report, especially when the processing is based on legitimate interest. In smart cities, where public interest is often invoked as the legal basis, the RIPD serves as essential documentation to show that the processing is proportionate and necessary.

Data protection in smart cities is not an obstacle to urban innovation. It is a condition for innovation to be sustainable, ethical, and legally secure.

The RIPD must describe the processing activities that may create risks to civil liberties and fundamental rights, including an assessment of surveillance technologies such as facial recognition and behavior monitoring in public spaces. Preparing this document should not be treated as a mere bureaucratic formality. It is a genuine exercise in weighing the benefits of the technology project against the risks to citizens’ rights.

Specific Risks and Critical Points of Attention

Several risks deserve special attention during due diligence for smart city projects. The first is what is known as “function creep,” a phenomenon in which data collected for one specific purpose comes to be used for entirely different purposes without the knowledge or consent of the data subjects. A camera system installed to monitor vehicle flow can, without adequate controls, be repurposed for behavioral surveillance or for identifying individuals at public demonstrations. That would directly violate the purpose principle set out in Article 6, item I, of the LGPD.

The second significant risk is algorithmic discrimination. Artificial intelligence systems used in smart cities to allocate public resources, carry out predictive policing, or prioritize services can reproduce and amplify biases present in historical data. Due diligence should include algorithmic audits that assess whether the models produce discriminatory results based on race, gender, geographic location, or socioeconomic status, in keeping with the non-discrimination principle established in Article 6, item IX, of the LGPD.

Data Sharing Between Public and Private Entities

One of the most sensitive issues in smart city projects is the sharing of data between the public administration and the private companies that operate the technology infrastructure. Article 26 of the LGPD provides that the shared use of personal data by public authorities must serve specific purposes of carrying out public policies and legal duties. Article 27, in turn, prohibits public authorities from transferring personal data to private entities, except in narrowly defined situations, such as the decentralized execution of a public activity or when the data is publicly accessible.

Due diligence should closely examine the contracts between the government and technology companies, checking the clauses on ownership of the data collected, use limitations, security obligations, audit rights, and responsibility in the event of incidents. In many smart city projects in Brazil and around the world, the lack of robust contract clauses has allowed private companies to build up valuable databases from information collected in public spaces and to use them for commercial purposes not contemplated in the original project.

Data Governance and Best Practices for Municipalities

A data governance program is an indispensable requirement for any municipality that intends to move forward with smart city projects. The program should establish clear organizational structures, including the appointment of a data protection officer (DPO) as required by Article 41 of the LGPD, data governance committees, and communication channels that citizens can easily use to exercise their rights as data subjects.

Good governance practices include adopting the principle of “privacy by design” in all urban technology projects. This means data protection must be built in from the planning and procurement stage, not added as an extra layer after the system is built. Public bidding notices for smart city projects should contain explicit LGPD compliance requirements, including data minimization, anonymization where possible, proactive transparency about the processing carried out, and mechanisms that let citizens view, correct, and request deletion of their data.

Transparency deserves special emphasis in the urban setting. In private contractual relationships, data subjects can choose not to provide their data. A citizen moving through a smart city often has no real choice about the collection of their information. Walking down a street monitored by facial recognition cameras or riding public transit with electronic fare cards are everyday activities that generate personal data almost unavoidably. For this reason, the public administration has a heightened duty to inform the population about what data is collected, for what purposes, how long it is stored, and with whom it is shared.

Periodic Assessment and Continuous Monitoring

Data due diligence in smart cities cannot be treated as a one-time event. Urban technology projects are dynamic: software gets updated, sensors are added, new features are introduced, and technology partners change. This calls for continuous monitoring. We recommend periodic audits (at least annually) that reassess data flows, verify the effectiveness of security measures, test incident response mechanisms, and confirm that the processing remains within the limits of the legal bases originally identified.

This monitoring should also include a review of legislative and regulatory changes. The ANPD has published regulations supplementing the LGPD that directly affect smart city projects, and case law on data protection in Brazil is developing rapidly. Municipalities that maintain active data protection compliance programs adapt to these changes more quickly, which reduces the risk of administrative penalties and lawsuits.

Liability and Consequences of Noncompliance

Failing to comply with data protection rules in smart city projects can have severe consequences for both the public administration and the private partners involved. Articles 52 to 54 of the LGPD provide for administrative sanctions that include a warning, a simple fine of up to 2% of revenue (capped at R$ 50 milhões per violation), a daily fine, public disclosure of the violation, and blocking and deletion of the personal data. In addition to administrative sanctions, processing agents may be held civilly liable for damages caused to data subjects under Articles 42 to 45 of the LGPD.

Liability in the smart city context is more complicated because so many parties are involved. Article 42, paragraph 1, item I, of the LGPD provides that a processor is jointly and severally liable for damages when it fails to comply with the legal obligations or with the controller’s lawful instructions. In smart city projects, the processing chain may include the municipality (controller), technology companies (processors), subcontractors, and even other public bodies. Clearly defining roles and responsibilities during due diligence is therefore essential to avoid disputes and to ensure that injured data subjects are effectively compensated.

Beyond the direct legal consequences, data protection violations in smart cities cause significant reputational harm and can undermine citizens’ trust in urban modernization initiatives. Projects that fail to show respect for residents’ privacy tend to face public resistance, legal challenges, and implementation difficulties that proper due diligence could have avoided from the start.

This topic is directly related to our complete guide, which we cover in a dedicated article.

To round out your reading, see also the firm’s article on sensitive data under the LGPD.

As informações deste artigo são de caráter informativo e não substituem consulta jurídica individualizada. Cada caso possui particularidades que exigem análise específica.