Data protection in a smart city bike system: the example of Turku

Abstract

This study aims at analysing the data protection measures necessary in the city of Turku’s bike system. The city of Turku, Finland, has launched a city bike service, handled by the public transportation service ‘Föli’ and providing 300 bikes for rental all over the city. This new city feature makes Turku attractive, easily discoverable, eco-friendly and smart. For the purpose of this thesis, Turku is even considered as a smart city, as together with other smart services the city bikes allow for smart transportation and enhances urban life. Yet, as smart as the city can be, data protection should not be despised. The new General Data Protection Regulation 2016/679 (GDPR), enforceable on May 25th 2018, changes the rules for processing personal data and organisations are required to get compliant with it. Compliance with the GDPR encompasses several aspects, both from a technical and a legal point of view. This thesis analyses Turku’s city bike system and particularly all the steps requiring processing of personal data. This paper examines the possible technical risks, the actors involved and their liability under the GDPR, the applicable data protection requirements as well as the possible solutions for a smooth processing of personal data. The research has been made in concertation with Turku’s city bike system team with the aim of identifying the legal steps necessary to this system for a lawful processing of personal data.