London Privacy Register Beta published
Step forward in smart city transparency as smart city data protection assessments published in one place
We’ve published the first version of the London Privacy Register: a central catalogue of Data Protection Impact Assessments (DPIAs) of Greater London Authority Group smart city projects that collect personal information in public spaces. By publishing this in one place for the first time, we believe this represents a step towards greater public transparency.
This is important because over the next decade we anticipate an acceleration in the availability of smart city emerging technologies including networks of sensors, cameras, drones, robotics, mobility services, augmented and virtual reality, and automated and algorithmic decision-making. Take-up is also expected to rise rapidly as capability grows, costs lower and even more uses are developed.
The Privacy Register is part of the Mayor’s Emerging Technology Charter for London to guide the trialling and use of these data-gathering smart city technologies (and the Public London Charter which sets out the rights and responsibilities of the users, owners and managers of new public spaces).
When a project is likely to result in a high risk to individuals’ privacy, organisations are currently required to undertake a Data Protection Impact Assessment (DPIAs), a legal obligation to minimise risks identified. A privacy notice is also required when handling personal information, this tells everybody why personal information is being collected, for what purpose, where it is stored, and for how long.
The Information Commissioner’s Office encourages (but does not mandate) the publication of DPIAs: “although publishing a DPIA is not a requirement of UK GDPR, you should actively consider the benefits of publication. As well as demonstrating compliance, publication can help engender trust and confidence. We would therefore recommend that you publish your DPIAs, where possible, removing sensitive details if necessary.”
In practice, the public/civil society/journalists will often use Freedom of Information (FOI) requests to public bodies to make DPIAs public after launch. There’s now a mandate in London that GLA Group DPIAs will be published at the same time as the project goes live.
The Register is currently published as a Beta, meaning it’s the first public iteration of the service and it may change and improve over time following feedback from users.
We also aim to expand the scope of the Register by on-boarding of local authorities, private landowners and others in the coming months.
There’s also a function where Londoners can request the publication of a DPIA/privacy register for smart city technologies operating in the public realm. A request will trigger a communication from the Chief Digital Officer for London to the organisation responsible asking for DPIA publication.
