Smart Cities and International Trade Law

Abstract

A ‘smart city’ is a buzz term and concept. The ‘smart city’ has mainly been discussed in the scholarly literature on urban planning, architecture, and geography. While the ‘smart city’ has been under-analyzed in international trade law, the term ‘smart city’ is commonly used in Asian trade policies. The Association of Southeast Asian Nations (ASEAN) established the ‘ASEAN Smart Cities Network’ and the ‘smart city’ is now an important market opportunity for exporting smart technologies and services to ASEAN. Against this backdrop, this article addresses how smart cities can be regulated and governed by international trade law. The trade law perspective facilitates a broader understanding of smart city governance, which includes under-explored ‘global’ regulatory dimensions concerning the interaction between local governments and foreign firms. This article selects three relevant trade areas for discussions: (1) Internet of Things in the context of trade in goods and services; (2) international standard-setting activities; and (3) data governance. It further considers what kinds of regulatory issues international smart city projects can add to the current digital trade discourse. Drawing on the smart city literature, the article points out additional problems concerning security and privacy that have not yet been acknowledged in digital trade.

1. Introduction

A ‘smart city’ is a buzz term and concept. The ‘smart city’ has mainly been discussed in the scholarly literature on urban planning, architecture, and geography. In the smart city literature, there has been a long-standing discussion about the concept of smart cities that arose from concerns over the relationship between high-tech companies, information and communication technologies (ICT), and society. The debate started in the 2000s; early critiques cautioned that smart city initiatives were a form of ‘business-led urban development’.¹ The debate continued in the 2010s: scholarship warned that high-tech companies’ smart city discourse was ‘utopian storytelling’,² and also criticized smart city research for ‘one-size fits all narratives [to urban problems], an absence of in-depth empirical case studies … and comparative research that contrasts smart city developments in different locales’.³

The utopian vision of smart cities is over.⁴ Recently, it is argued that ‘far from being the imagined utopia of a few years ago, it is a reality in many cities around the world’.⁵ In the past, the academic debate over smart cities in Europe and North America addressed high-profile cases, such as London, Amsterdam, Barcelona, New York, and Chicago; however, smart cities are becoming an increasingly real choice for local governments.⁶ Smart cities can be possible solutions for implementing the Sustainable Development Goals⁷ or responding to changes in city life post the COVID-19 pandemic.⁸ Accordingly, smart cities are happening at ‘ordinary’ cities and also bring business opportunities in Asia. For example, the term ‘smart city’ is commonly used in Asian trade policies.⁹ The Association of Southeast Asian Nations (ASEAN) established the ‘ASEAN Smart Cities Network’ to promote regional cooperation in smart city projects.¹⁰ For Japan, China, and Korea, the ‘smart city’ is now an important market opportunity for exporting smart technologies and services to ASEAN. In particular, China is the most active player in supporting smart city projects abroad in the context of the ‘digital aspects’ of China's ‘Belt and Road’ Initiative,of which ‘Digital Silk Road’ projects are one component. While China's ‘Belt and Road’ initiative refers to China's investment strategies to supply traditional infrastructure outside China,¹¹ ‘Digital Silk Road’ projects involve the supply of digital infrastructure (such as 5G networks) as well as e-commerce, mobile payments, and smart city projects.¹² There are a number of smart city projects which are led by Chinese big-tech corporations, such as the Alibaba and Huawei groups, along the ‘Digital Silk Road’.¹³

Against this backdrop, this article explores how smart cities can be regulated and governed by international trade law. The proliferation of smart city initiatives (from high-profile to ordinary ones) with emerging technologies has not only expanded research in urban planning and architecture but has also gradually inspired legal research. It has been an issue in domestic public law to consider how local governments regulate smart city development.¹⁴ International trade law also matters for smart cities; however, it is under-analyzed.¹⁵ The trade law perspective facilitates a broader understanding of smart city governance, which includes ‘global’ regulatory dimensions because international smart city projects inevitably involve the interaction between local governments and foreign firms. This article argues that smart cities can be analyzed from three issue areas of trade regulation: trade in goods and services, international standards, and data governance (although these three issues are interrelated). Especially, the data governance aspect is important in the smart cites context because, for urban solutions, artificial intelligence (AI) and big data are key ‘smart’ technologies, and it is here where privacy and security issues come in.

The remainder of this article is organized as follows. Section 2 unpacks the concept of smart cities and situates them within the context of global trade. Then, Section 3 examines smart cities in terms of trade in goods and services. In particular, this section focuses on incorporating and applying the Internet of Things (IoT) in smart cities. Section 4 addresses international standard-setting activities for smart cities, which have flourished but are becoming increasingly complex. This section considers how to address standard-setting games for smart cities among stakeholders under international trade law. Section 5 focuses on the data governance aspects of smart cities and examines the current regulatory situation with a focus on the Digital Economy Partnership Agreement (DEPA). This section examines to what extent provisions under existing digital economy agreements are relevant to international smart city projects and further considers what kinds of regulatory issues smart city governance can add to (or go beyond) the traditional digital trade discourse. Drawing on the smart city literature in urban planning and architecture, the section discusses additional questions concerning security and privacy that have been under-explored in digital trade. Section 6 concludes.

2. What are Smart Cities? – Definition and Context

As noted above, there has been a long-standing scholarly debate over the concept of smart cities.¹⁶ This article is not a place for a historical review of the definition and concept of smart cities; instead, it may be helpful to look at the recent trends in smart city definitions. For example, the Organisation for Economic Co-operation and Development (OECD) recently discussed smart cities. The 2019 OECD report defines smart cities as ‘initiatives or approaches that effectively leverage digitalisation to boost citizen well-being and deliver more efficient, sustainable and inclusive urban services and environments as part of a collaborative, multi-stakeholder process’.¹⁷ The report explains that ‘while digital innovation remains central to the smart city concept’, this definition focuses on ‘the life of people’ and emphasized ‘the importance of citizen engagement’.¹⁸ This understanding of smart cities has resonated with the scholarly debate in urban studies on the concept of ‘human-centric’ smart cities.¹⁹

ASEAN also provides a concept of smart cities. Among ASEAN countries, Singapore has taken the lead in promoting regional urban connectivity through smart city development.²⁰ In the 2018 ASEAN Summit, Singapore proposed the ‘ASEAN Smart Cities Network’.²¹ ASEAN identifies three objectives for smart city development: competitive economy, sustainable environment, and high quality of life.²² Under these objectives, there are six targeted areas for smart city development: (1) civic and social, (2) health and well-being, (3) safety and security, (4) quality of the environment, (5) built infrastructure, and (6) industry and innovation.²³ ASEAN's objectives and targeted areas for smart cities indicate that Asian smart cities are more rooted in ‘problem-oriented’ projects; that is, in Asia, smart cities are tools to solve specific urban problems.

However, these definitions and concepts may not convey the real image of how smart city projects are actually exported aboard. On this point, it might be useful to conceive of smart cities as a three-layered system (Figure 1).²⁴ First, the bottom layer (layer 1) consists of city infrastructure and utilities (such as energy management systems, water and waste management systems, and public transportation controls), linked to digital equipment (mobile phones, meter readings, cameras, GPS, sensors etc). Second, in the middle layer (layer 2), data are collected via digital equipment, and connected and integrated by software and applications on a platform. Finally, in the top layer (layer 3), data-based urban services are offered in multiple sectors, such as mobility, energy, administration, health, safety, and sightseeing. What makes smart cities different from ordinary cities is the ‘data management’ aspect.²⁵ Here, AI and big data emerge. Ultimately, AI and big data are key technologies for urban solutions. ‘Smart’ technologies usually refer to three elements of technology: collection of data, data processing, and automation of decision-making (using AI) to deliver urban services.²⁶

Figure 1. Three-Layered System of Smart Cites.

Source: Created by the author based on The Cabinet Office, Japan, National Strategic Special Zones, Super City Initiative, www.chisou.go.jp/tiiki/kokusentoc/english/super-city/index.html.

Ideally, the multiple sectors (e.g., mobility, energy, and sightseeing) in layer 3 are all integrated by a data platform created at layer 2. However, the smart city literature has noted that, far from a holistic approach, past smart city initiatives tended to choose only one or two sectors. Thus, not all smart city projects have completed the three-layered system; rather, very few smart cities have achieved such a ‘data-centric’ and ‘interconnected’ smart city.

Each smart city project entails unique features and various development pathways – thus, smart cities differ from country to country, and within countries. For example, under the ‘ASEAN Smart Cities Network’, currently, 26 pilot cities have been launched under the Network.²⁷ The 26 pilot cities include large Asian cities, such as Bangkok, Singapore, Kuala Lumpur, and Mania. However, there are also new cities; for example, Siem Reap in Cambodia. The Japanese government provides smart city technologies and infrastructure to Siem Reap through the Japan International Cooperation Agency.²⁸ In Siem Reap, there is an iconic temple ‘Angkor Wat’, identified as a world heritage site; therefore, tourism has been growing as its main industry.²⁹ However, the city infrastructure and utilities have not been prepared to receive a number of tourists from aboard and are unable to handle rapid urbanization.³⁰ Thus, the city needs infrastructure, such as public transport and waste management systems (layer 1). At the same time, the city of Siem Reap is interested in gathering data on tourists (layer 2).³¹ Here, data issues will arise. As will be discussed later (in Section 5), privacy issues need to be addressed when collecting data, with the questions on how to share and use the data among relevant stakeholders.

As such, there are various development stages for smart city projects, each interacting at different layer levels. While the reality of smart city projects varies, this three-layered system involves certain elements of international trade law, such as trade in goods and services, international standards, and data governance. In the law of the World Trade Organization (WTO) and in free trade agreements (and even digital economy agreements as will be discussed later), no rules directly mention smart cities. At the international-level agreement, the 2019 G20 Osaka Leaders' Declaration briefly touched upon smart cities: one paragraph in the section addressing ‘Innovation: Digitalization, Data Free Flow with Trust’ mentioned smart cities along with the issues of AI principles and the promotion of digital security.³² Thus, while there are no direct provisions addressing smart cities in existing trade law, this article considers which aspects of international trade law would apply to smart cities as a layered system.

However, one may question how international trade law, which principally binds states,³³ affects the engagement of local governments in smart city projects. There are two dimensions to answer this question. First, according to WTO jurisprudence, state parties are not precluded from being found to be inconsistent with WTO law because the dispute is concerned with sub-national or provincial measures.³⁴ In this sense, international trade law directs central and local governments. Second, while the main stakeholders in smart city projects are local governments and firms, in the Asian context, states (rather than cities) initially support and promote foreign smart city projects. In the ‘ASEAN Smart Cities Network’, Singapore's leadership has been echoed by other countries’ incentives to export infrastructure and smart technologies to Asia. For example, Japan has formed a mutual partnership with ASEAN to support smart city initiatives, by assisting in project planning and formation and offering financial support.³⁵ In addition, Korea, China, and Australia are active players in supporting smart city development in ASEAN.³⁶ Thus, legal provisions at the state level matter and can assist in enabling international smart city projects. This article will now turn to consider how to regulate international smart city projects under international trade law.

3. Smart Cities, IoT, and Trade in Goods and Services

The three-layered vision of smart cities indicates a regulatory complex for smart cities. The complexity is concerned with the distinction between ‘goods’ and ‘services’ that has been debated in international trade law against the background of an increase in dual-feature businesses in the ICT sector.³⁷ On this point, smart city projects are generally a package of ‘goods’ and ‘services’ – while layer 3 addresses ‘services’, layer 1 deals both with ‘goods’ and related ‘services’. Layer 2 also involves ‘services’: when firms engage in the development of software/applications for foreign smart city projects, they participate in ‘services’.³⁸ For firms, the most common way to participate in international smart city projects is to export urban infrastructure/digital equipment (layer 1) or become involved in the development of software or applications (layer 2). Simultaneously, there are cases in which one firm is in charge of the entire digitalization process (all three layers) for one city (e.g., the Sidewalk Labs smart-city project in Toronto, Canada³⁹). Accordingly, firms may trade in both goods and services for foreign smart city projects.

Given the complexity of goods and services, the next sub-section starts by considering layers 1 and 2. Among various ICT (such as blockchains, AI, and machine learning), the deployment of IoT is the basis for layers 1 and 2 of a smart city. Here, it can be described that ‘[t]he Smart City uses both its own infrastructure network of sensors and data collection as well as those of private parties and the IoT’.⁴⁰ In the trading context, IoT systems incorporated into various smart goods/infrastructures are exported and applied to smart city projects. Accordingly, there are two points worth considering: how to regulate IoT incorporation/application in smart cities, and how (trade) agreements concerning digital commerce regulate IoT and smart cities.

3.1 Regulating the Incorporation and Applications of IoT and the Smart City

For a more precise understanding, the definition of IoT is provided by the International Organization for Standardization (ISO)⁴¹ as follows: ‘infrastructure of interconnected entities, people, systems and information resources together with services which processes and reacts to information from the physical world and virtual world’.⁴² In addition, an IoT system is defined as a ‘system providing functionalities of IoT’.⁴³ On this point, there is a note written that ‘[a]n IoT system can include, but not be limited to, IoT devices, IoT gateways, sensors, and actuators’.⁴⁴ Furthermore, an IoT device is defined as an ‘endpoint that interacts with the physical world through sensing or actuating’.⁴⁵

According to these definitions, in the context of smart cities, an IoT system can include (1) classic IT devices, such as smart phones and laptops; (2) smart devices, such as health devices, monitoring cameras, and drones with data-gathering and data-processing functions; and (3) smart infrastructure and networks, such as smart buildings and smart factories that interconnect information on energy use, air conditioning, or entry/exist. One noticeable point from the IoT definition is that IoT does involve ‘services’. Accordingly, IoT can include data-gathering and processing services (as well as some kinds of ongoing management services based on these data) provided through smart devices (e.g. health devices, monitoring cameras, and drones) and smart infrastructure (e.g. smart buildings and smart factories).

This perspective of the IoT resonates with Chander's view that the IoT is regulated by both the General Agreement on Tariffs and Trade (GATT)⁴⁶ and the WTO's General Agreement on Trade in Services (GATS)⁴⁷ disciplines.⁴⁸ He suggests China–Electronic Payment Systems as a relevant WTO case, where the Panel admitted that an electronic payment ‘system’ can include services, such as, processing infrastructure and network, delivering information, and managing payment.⁴⁹ Chander finds that since ‘it seems better to treat the service as bundled with the good itself at the point of sale [of smart objects]’, ‘it makes sense to see a Smart Object as both a good and an ongoing service’.⁵⁰

Furthermore, regulating IoT incorporation/applications necessarily involves addressing cybersecurity and privacy issues,⁵¹ which are also concerned with international smart city projects. Cybersecurity concerns have increased in smart cites because ‘critical services and infrastructure are digitally connected and data dependent on the smart network’.⁵² As noted previously, Chinese big-tech corporations, such as Huawei, have been engaging in foreign smart city projects. Chinese companies’ technologies and systems can spread through overseas smart city projects along the ‘Digital Silk Road’ under China's ‘Belt and Road’ Initiative.⁵³ Such business activities involve cybersecurity risks in IoT. On this point, we can recall that Huawei 5G devices have been banned by the US, Australia, Japan, and other countries.⁵⁴ However, under smart city projects backed up by a mutual agreement between China and other countries, such import bans on Chinese smart devices will not be applied based on certain trusts between the two countries. Regardless of smart city projects using Chinese devices, both city governments and companies doing business with smart IoT devices should ensure to ‘insert cyber security in the process as design, deployment, and sustainment consideration for every new project’⁵⁵ in the age of 5G systems.

However, despite being proactive against security threats, privacy concerns arising from data gathered by smart IoT devices remain. This concerns how a city or central government regulates data issues, which are addressed in Section 5.

3.2 Agreements Concerning Digital Commerce and IoT

Second, it is important to examine e-commerce chapters under free trade agreements (in particular, this article looks at the Comprehensive and Progress Agreement for Transpacific Partnership [CPTPP, 2018]⁵⁶ and Regional Comprehensive Economic Partnership [RCEP, 2022],⁵⁷ considering the context of smart city initiatives in ASEAN) and digital regulation under so-called Digital Economy Agreements (DEAs). Such agreements regulate digital commerce beyond WTO rules. In particular, DEAs are new and special agreements on digital trade that facilitate regulatory cooperation within the digital economy.⁵⁸ This article addresses five DEAs: (1) Agreement between the United States of America and Japan concerning Digital Trade (the US–Japan Digital Trade Agreement, 2020);⁵⁹ Australia–Singapore Digital Economy Agreement (the Australia–Singapore DEA, 2020);⁶⁰ Digital Economy Partnership Agreement between Singapore, Chile and New Zealand (the DEPA, 2020);⁶¹ Digital Economy Agreement between the United Kingdom of Great Britain and Northern Ireland and the Republic of Singapore (the UK–Singapore DEA, 2022);⁶² and Digital Partnership Agreement between the Government of the Republic of Korea and the Government of the Republic of Singapore (the Korea–Singapore DPA, 2023).⁶³

Among the CPTPP, RCEP, and five DEAs, only the UK–Singapore DEA uses the term of ‘IoT’ (under the cybersecurity and AI provisions). Other agreements do not use the term ‘IoT’; instead, the term ‘digital products’ is used. The definition of ‘digital products’ is almost the same wording among the agreements (except for the RCEP and the UK–Singapore DEA, without a definition); ‘digital products’ includes ‘a computer programme, text, video, image, sound recording or other product that is digitally encoded, produced for commercial sale or distribution, and that can be transmitted electronically’.⁶⁴ This definition is usually accompanied by a note: ‘The definition of digital product should not be understood to reflect a Party's view on whether trade in digital products through electronic transmission should be categorised as trade in services or trade in goods’.⁶⁵ Again, the boundaries between goods and services remain open.

While there are variations in the regulatory topics for e-commerce chapters under free trade agreements and DEAs, there are some common rules across the agreements concerning digital products. One common rule across the agreements concerns ‘no customs duties on electronic transmissions’.⁶⁶ Another common rule across the agreements may be the ‘non-discriminatory treatment of digital products’.⁶⁷ However, the RCEP and the UK–Singapore DEA do not contain this rule. One research suggests that the non-discrimination principle for digital products is not so obvious among trade agreements because of digital products’ intangible character and diversity in consumption behavior, which makes it difficult to assess ‘like product’ criteria under the principle.⁶⁸ Data issues in the agreements are addressed in Section 5.

4. International Standard-Setting Activities Relevant to Smart Cities

4.1 International Trade Rules on International Standards

To address the question of how smart cities are regulated under international trade law, setting international standards for smart cities is the most active area to explore. What is the role of international standards for firms participating in overseas smart city projects? As the international standardization literature explains, ‘standard battles’ occur among members (i.e., firms) of international standard-setting bodies. While international standard-setting bodies usually aim at reaching consensus among members, ‘standardization is rarely about reaching compromise among different regulatory models and approaches … but instead about battles for preeminence of one approach or solution over another’.⁶⁹ Accordingly, when developing international standards, members of international standard-setting bodies attempt to shape standard content that reflects interests – for example, standards that reflect certain technologies or systems developed by a particular firm. This is based on the pursuit of a first-mover advantage, that is, minimizing switching costs to unfavorable international standards and gaining foreign market opportunities.⁷⁰ Thus, in the context of smart cities, if members succeed at developing international standards for smart cities reflecting their interests, the firms will have an advantage over participation in overseas smart city projects, insisting that their technologies and systems are accepted as international standards.

This advantage is further underpinned by the WTO Agreement which encourages WTO Members to consider the existence of international standards. First, the WTO's Agreement on Technical Barriers to Trade (TBT Agreement)⁷¹ is relevant in the context of international standardization in the ICT sector. The TBT Agreement requires WTO Members to base their domestic regulations on international standards if relevant standards exist except if such international standards are ineffective or inappropriate for fulfilling legitimate objectives (Art. 2.4). Furthermore, whenever a domestic technical regulation is in accordance with relevant international standards, ‘it shall be rebuttably presumed not to create an unnecessary obstacle to international trade’ (Art. 2.5). Thus, when firms export smart devices and infrastructure for overseas smart city projects, international standards aligned with their goods may promote exports.

GATS also addresses international standards. As noted, the sales of smart devices or smart infrastructure often entail data gathering and data processing services and some kinds of ongoing management services. In addition, when firms develop software/applications for foreign smart city projects, they participate in ‘services’. On this point, GATS Article VI (5) states that WTO Members shall not nullify their specific GATS commitments by applying technical standards, and when conformity with this obligation is evaluated, international standards are taken into account. In this regard, the Joint Initiative on Services Domestic Regulation is also relevant. At the 12th WTO Ministerial Conference in 2021, a reference paper on services domestic regulation was adopted by a group of WTO Members under the Joint Initiative. According to that reference paper, Members shall encourage their domestic competent authorities or relevant international organizations ‘to adopt technical standards developed through open and transparent processes’.⁷²

Moreover, international standards are concerned with government procurement. When goods and services associated with smart cities fall under city governments’ procurement processes, the WTO's Agreement on Government Procurement (GPA)⁷³ applies to GPA Members.⁷⁴ GPA Article X(2)(b) states that when a procuring entity prescribes technical specifications for the goods and services being procured, it is necessary to base these technical specifications on international standards.

Finally, a few DEAs include a provision on ‘standards and conformity assessment’.⁷⁵ This provision generally highlights the importance of the role of standards and conformity assessment procedures in the digital economy and fosters cooperation in developing standards and procedures.

4.2 Complexities in International Standard-Setting for Smart Cities

In which forums have international standards for smart cities been developed? In the ICT sector, there are the ‘big three’ plus one, i.e., the well-known ‘big four’ international standard-setting bodies.⁷⁶ The ‘big three’ bodies are as follows: ISO, International Electrotechnical Commission (IEC), and International Telecommunication Union (ITU). The fourth body (or ‘plus one’ body) is the ISO/IEC Joint Technical Committee (JTC) 1, which was established in 1987, specializing in standardization for information technology.⁷⁷

Although the ISO, IEC, and ITU are often collectively considered large international standard-setting bodies in the ICT sector, their memberships differ. Since the ITU is a specialized agency of the United Nations (UN), UN Member States are full participants in the standard development processes.⁷⁸ However, the ISO and IEC are often described as ‘private organizations’ or ‘hybrid public–private bodies’⁷⁹ because their members are national standard-setting bodies (either public or private) and do not necessarily represent governments on their own.⁸⁰ One consequence of this difference is that, while ITU standards (which are termed ‘recommendations’) are available free of charge,⁸¹ ISO and IEC standards are not.

Among the ‘big four’ forums, the ISO has been the most active in developing smart-city standards. ISO 37120 (Indicators for city services and quality of life) is one of the well-known ISO standards under ISO/TC 268 (first created in 2014, later updated in 2018).⁸² This ISO standard comprises about 100 indicators under 19 sectors relevant to city life.⁸³ It was originally developed at the University of Toronto in Canada, under the Global City Indicators Facility project.⁸⁴ Later, Canada took the initiative under the ISO/TC 268 to transform the University of Toronto's project into an ISO standard. Moreover, in 2019, a new complementary ISO standard was developed with a special focus on smart cities under TC 268/ WG2⁸⁵ – ISO 37122 (Indicators for Smart Cities).⁸⁶

Another notable standardization activity is undertaken by the ITU (as noted, ITU standards are termed ‘recommendations’). In 2016 and 2022, the ITU adopted three recommendations for ‘Key Performance Indicators in Smart Sustainable Cities’.⁸⁷

The importance of assessing smart city projects by indicators has been well recognized because indicators will help cities (1) define the goal they want to pursue; (2) quantify outcomes and measure their success or failure; and (3) compare themselves with other cities.⁸⁸ It is beyond the scope of this paper to review and analyze the vast array of smart-city indicators developed under the ISO and ITU; however, interesting comparative research has already been undertaken regarding these indicator standards in light of the areas covered (e.g., environment, transportation, waste, water, health, safety, etc.) and indicator types (e.g., indicators for measuring processes, results, or impacts, etc.).⁸⁹

Finally, the ISO/IEC JTC1 is active in setting standards for smart cities. Under the JTC 1, several sub-committees and working groups are operating: in particular, working group 11 (‘WG 11’) was created in 2015 to deal with smart cities.⁹⁰ China has taken the lead in WG 11 as a convenor and secretary, and under its leadership, seven standards for smart cities have been published (as of September 2023), including smart city ICT indicators.⁹¹ Indeed, the smart city is one of the topics on which China's presence in international standardization has received attention.⁹² Notably, China has increased the number of its secretariat positions in the committees of international standard-setting bodies, catching up with the United States, Germany, and Japan.⁹³ Occupying secretariat positions in standard committees is one effective strategy for controlling the consensus-building process and winning standard battles. While seeking the basis for consensus among various participants in the committee, a secretariat is in a good position to control the discussion within the committee, thereby skillfully advancing domestic firms’ interests in the standardization process.

In 2020, one standard-setting initiative by China has received significant attention: China proposed standard drafts regarding ‘public health emergencies’ before all four smart city standardization forums.⁹⁴ The draft titles were not the same; however, all drafts focus on public health emergencies in smart cities. Such standard-setting initiatives by China resonate with the observation that since 2020 ‘China has accelerated the international promotion of some of its smart city technologies’, and ‘providing “anti-epidemic solutions” has become the new selling point for several Chinese tech companies’.⁹⁵ Moreover, China's proposal is interesting because it proposes drafts with cross-cutting concerns over ‘public health emergencies’ that may have broader impacts across multiple standard-setting forums. Thus, creating and submitting draft standards that involve cross-cutting issues may be an effective standardization strategy to advance China's national interests in international standard-settings.

Indeed, it has been noticed that ‘the COVID-19 pandemic is accelerating the deployment of innovation and technology in urban areas’.⁹⁶ Although surveillance and monitoring technologies have been widely used even before the COVID-19 pandemic, a novel development noticed during the pandemic is ‘the digitalization of disease surveillance through disease tracking and contact tracing’ which can generate individual health data.⁹⁷ Villarreal argues that during the COVID-19 pandemic, ‘digital tools based on the use of tracking software emerges as a feasible alternative to the “classic” manual surveillance’.⁹⁸ On this point, one important research question for the post-pandemic period is whether there are changes in citizens’ attitudes and behavior towards such digitalized surveillance technologies compared to before the pandemic.⁹⁹ The question is: Do citizens benefit from using smart technologies for outbreak detection and pandemic control, setting back negative concerns about privacy issues?¹⁰⁰ The answer depends on several factors, such as the technological development stage or the political regimes of the countries.¹⁰¹ However, we can imagine that health data collected at international airports may be shared across nations during future disease outbreaks, and if so, the standardization of data communication and sharing is necessary.¹⁰² It is against this backdrop that China's proposal of international standardization for public health emergencies in smart cities should be considered.

Another implication from different proposals backed up by countries is that standardization is not only ‘a strategic tool in interfirm competition’ but also ‘a competitive tool among nations’.¹⁰³ Accordingly, ‘strategic behaviour is sometimes observable’,¹⁰⁴ both for firms and nations. Thus, possibilities for ‘standard-setting games’ are not limited to firms: governments may also get interested in the games.¹⁰⁵ In this regard, the US–EU Trade and Technology Council (TTC), launched in 2021, is an interesting initiative. One of the TTC's purposes is to coordinate and cooperate in developing technology standards.¹⁰⁶ Such a cooperation initiative between the US and EU may prove the importance of coordinating and enlightening different standard-setting forums over digital technologies, which may also lead to a counter against China's growing presence in international standardization.

4.3 The Legitimacy Question on International Standards for Smart Cities

As such, international standard-setting activities for smart cities have flourished and become increasingly complex. There has been a marked increase in standard-setting topics in the ICT sector. Wi-Fi, USB, and HTML attracted considerable attention a decade ago.¹⁰⁷ The current issues include self-driving cars, drones, cryptographic mechanisms, and AI. Existing literature has already noted ‘complexity’ in international standardization (due to member competitions within a standard-setting body or between such bodies)¹⁰⁸ or a ‘balkanization of ICT standard-setting’ situation (due to the rise of new standard-setting actors other than the ‘big four’).¹⁰⁹ The topic of smart cities is not an exception.

Then, how can we address the observed growth of international standards for smart cities under international trade law? In other words, are those international standards considered legitimate under international trade law? The WTO jurisprudence provides several key points for answering this question.

First, while the ‘big four’ international standard-setting bodies have been recognized as major bodies in the ICT sector, it should be noted that the TBT Agreement has not expressly specified these bodies as recognized international bodies/organizations for ICT standardization. Even in the most recent WTO's 2021 reference paper on services domestic regulation, ‘relevant international organizations’ for technical standards are merely referred to as ‘international bodies whose membership is open to the relevant bodies of at least all Members of the WTO’.¹¹⁰

This understanding of international bodies aligns with the US–Tuna II (Mexico) case. In the US–Tuna II (Mexico) case, the Appellate Body explained that standards could be recognized as ‘international standards’ when standards are approved by an international standardizing body, that is, ‘a body that has recognized activities in standardization and whose membership is open to the relevant bodies of at least all Members’.¹¹¹ The Appellate Body further explained that ‘the body's standardization activities are recognized, for example, if a large number of WTO Members participate in the development of the standard, and acknowledge the validity and legality of the standard’.¹¹² On this point, the Appellate Body was asked to address the 2000 TBT Committee's Decision on Principles for the Development of International Standards, Guides, and Recommendations¹¹³ when interpreting international bodies’ ‘open’ membership requirements and the concept of ‘recognized activities’ by international bodies. The Appellate Body admitted the TBT Committee Decision as a ‘subsequent agreement’ under the Vienna Convention, and stated that ‘this Decision will inform the interpretation and application of a term or provision of the TBT Agreement in a specific case’.¹¹⁴

According to this Appellate Body's explanation, the ‘big four’ forums can be admitted as ‘recognized’ international standard-setting bodies for smart cities. However, the question remains as to why the TBT Agreement does not explicitly list these bodies. Again, the TBT Agreement merely defines an international body/system as ‘[b]ody or system whose membership is open to the relevant bodies of at least all Members’ (Annex 1.4). This is contrasted with the WTO's Agreement on the Application of Sanitary and Phytosanitary Measures¹¹⁵ where names of three international standard-setting bodies (the so-called ‘three sister’ organizations, i.e. Codex Alimentarious Commission, International Office of Epizootics, and International Plant Protection Convention) are listed (Annex A.3). This (not listing the names of international standard-setting bodies in the TBT Agreement) is largely explained by the disagreement between the European Community and the US during the Uruguay Round negotiations.¹¹⁶ The European Community strategically approached international bodies and attempted to influence their standard-setting processes (i.e., to shape standards to reflect European interests). In contrast, the multiple US domestic standard-setting bodies tended to focus on their internal work on national standards for US markets: they did not have much incentive to work with international standard-setting bodies. It is explained that such a different stance towards international bodies consequently led to different views on the specification of international bodies in the TBT Agreement during the Uruguay Round.

Even if international standards are developed by recognized international bodies, a question of ‘legitimacy’ of international standards still remains.¹¹⁷ In the EC–Sardines case, the question was addressed as to whether only standards adopted by consensus in international bodies were treated as relevant international standards under the TBT Agreement.¹¹⁸ The Appellate Body denied this view; thus, adoption by consensus is not required for recognition as an international standard in the WTO.¹¹⁹ However, the Appellate Body's view was criticized by trade law scholarship. For instance, Howse argued that if their practices or procedures upon adopting international standards were never scrutinized by the WTO, it would mean that the authorities of international standards were automatically introduced into the WTO.¹²⁰ Relatedly, Scott argued that international standards’ development processes could be considered in reviewing ‘appropriateness’ (or ‘inappropriateness’) of international standards under Art. 2.4 of the TBT Agreement.¹²¹ On this point, Delimatsis argues that ‘the principles set out in the TBT Committee decision are not sufficiently inclusive’, and proposes to include additional criteria ‘for a standard to be regarded as a genuinely international standard’, such as participation of stakeholders, voting rules, and scientific rigour.¹²²

Such scholarly debates indicate that the legitimacy question of international standards is still controversial, particularly in light of development processes. However, the current situation of international standards for smart cities is too complex to oversee the standard development processes. One advice for national standard-setting bodies is not to miss the chance to voice one's interests in the development processes of important international standards,which is a more practical approach than assessing legitimacy after adopting international standards. Moreover, in the face of the uncoordinated increase in standardization of smart cities, national bodies participating in international bodies can collect information on standard proposals submitted by foreign members across various standard-setting forums in a timely fashion and consider effective strategies to create meaningful competition. At the same time, it would be ideal to seek opportunities for coordination between different standardization proposals based on shared information and to attempt to reduce fragmented standardization activities for smart cities.¹²³

5. Smart Cities and Data Issues

Smart city initiatives are described as ‘data-driven’ urbanism.¹²⁴ While the smart city literature has already recognized how big data can transform cities and enhance smart city services,¹²⁵ the challenges posed by urban big data – security and privacy – have also been recognized.¹²⁶ Concerns over security and privacy related to big data and cities usually revolve around three general questions:¹²⁷ (i) who has access to the collected data and who can control the data, especially when outsourcing smart city services to firms; (ii) how do we ensure data security, particularly when creating systems to connect different data sources; and (iii) how do we secure privacy when data are used and shared by several actors. Particularly in the (i) context, the smart city literature points out that one of the controversies is to define who can decide ‘the purposes and means of data processing’ under a data-processing contract between a local government and a private company.¹²⁸ This is important because, in the smart city context, ‘it is likely that data is processed or even controlled by private companies that try to miximise its value’.¹²⁹

This section examines how digital trade regulation addresses data issues related to smart cities. On this point, it is again important to highlight regulation under the DEAs and this section focuses on the DEPA's regulation because of its wide scope and potential impacts. It is noticed that ‘its scope is wide, flexible and covering several emergent issues, such as those in the areas of AI and digital inclusion’.¹³⁰ Also, the DEPA's potential impacts on businesses are notable: ‘The DEPA responds [to business interests] by seeking to put in place rules and frameworks that create a more enabling digital environment overall’.¹³¹ Such a DEPA's ‘business-oriented’ approach is backed up by Singapore's leadership in digital trade and is also parallel to Singapore's strong initiative in promoting ‘ASEAN Smart Cities Network’. Notably, China and Korea are showing interests in joining the DEPA; this seems rational when we recall that Korea and China are active players in supporting smart city development in ASEAN. It is already pointed out that ‘DEPA's “soft” approach to rulemaking and norm-setting has proved effective in an Asian context … ’¹³²

5.1 Issues Related to Smart Cities

This section looks at the following data issues in the DEPA: (1) data flows; (2) cyber security; (3) personal information protection; (4) emerging technologies; (5) data innovation; and (6) open government data. While the DEPA is regarded as the most innovative DEA, some provisions follow the paths of previous free trade agreements, e.g. the CPTPP. On this point, the following analysis also includes a comparative analysis among agreements.

First, in the smart city context, data will flow between public and private actors inside one country, and even go outside the country if private companies process data at their home countries. On this point, the DEPA recognizes the principle of no restrictions on cross-border data transfer except for being subject to legitimate public policy objectives.¹³³ Similarly, the DEPA prohibits the localization of computing facilities as a business condition in the territory, except when it is subject to legitimate public policy objectives, which is parallel to the CPTPP.¹³⁴

In terms of cyber security, the DEPA has relatively simple provisions, recognizing the importance of building the capabilities of national entities responsible for a computer security incident response and using existing collaboration mechanisms for cooperation.¹³⁵ On this point, the UK–Singapore DEA contains the most detailed cybersecurity provision and touches on IoT, stating that parties should recognize the importance of ‘establishing mutual recognition of a baseline security standard for consumer Internet of Things devices to raise overall cyber hygiene levels and better secure cyberspace domestically’.¹³⁶

Regarding personal information protection, the DEPA is written in more detail than the CPTPP and RCEP.¹³⁷ Like the CPTPP and RCEP, the DEPA basically requires parties ‘to adopt or maintain a legal framework that provides for the protection of the personal information of the users of electronic commerce and digital trade’.¹³⁸ In addition, the DEPA sets detailed principles underlying the legal framework, such as collection limitations, purpose specification, transparency, and accountability.¹³⁹ Moreover, there is a unique provision under the DEPA, promoting the use of ‘trustmarks’¹⁴⁰ – that is, the DEPA encourages parties to adopt ‘data protection trustmarks by businesses that would help verify conformance to personal data protection standards and best practices’.¹⁴¹ Furthermore, there are relevant provisions promoting information exchange and sharing experiences on data protection trustmarks and efforts to mutually recognize the other parties' trustmarks as a valid mechanism.¹⁴²

Moreover, unique features of the DEPA can be found in the DEPA's novel provisions on emerging technologies and data innovation.¹⁴³ First, concerning emerging technologies, the provision for AI is important. The DEPA states, ‘The Parties shall endeavour to promote the adoption of ethical and governance frameworks that support the trusted, safe and responsible use of AI technologies’.¹⁴⁴ While it is an ‘endeavour’ provision, such an AI provision can influence countries engaging in smart city projects. A similar AI provision exists in the Australia–Singapore DEA: the provision also recognizes the importance of developing ethical governance framework but emphasizes cooperation among relevant parties. For instance, cooperation through ‘promoting and sustaining the responsible use and adoption of AI technologies by businesses and across the community’¹⁴⁵ seems to be more relevant to smart city projects. In addition, the UK–Singapore DEA contains an AI provision, which seems to be the most detailed among existing trade agreements and DEAs.¹⁴⁶ This provision addresses AI and other ‘emerging technologies’, including the IoT. The provision also emphasizes cooperation by ‘promoting collaboration between each Party's governmental and non-governmental entities across research, academia, and industry’,¹⁴⁷ which is also concerned with smart city development.

Second, the DEPA promotes data innovation, by stating that ‘innovation may be enhanced within the context of regulatory data sandboxes where data, including personal information, is shared amongst businesses in accordance with the Parties’ respective laws and regulations’.¹⁴⁸ Additionally, the DEPA provides, ‘The Parties shall endeavour to collaborate on data-sharing projects and mechanisms, and proof of concepts for new uses of data, including data sandboxes, to promote data-driven innovation’.¹⁴⁹ Such innovative provisions will be helpful for countries and companies participating in smart city projects because data sharing is an important data management aspect for developing and implementing smart services.

Finally, the DEPA includes the provision on ‘open government data’. Open data provision is important in the smart city context because it can promote transparency and accountability and strengthen public trust in city operations. While the CPTPP and RCEP do not include this provision, all five DEAs do. However, the DEPA's open government data provision is simpler than that of other DEAs, which facilitates access to government information and open data and promotes cooperation.¹⁵⁰ In contrast, other DEAs provide more detail, ensuring that ‘the information is appropriately anonymised, contains descriptive metadata and is in a machine readable and open format that allows it to be searched, retrieved, used, reused and redistributed’.¹⁵¹

5.2 Going Beyond the Current Digital Trade Discourse

Overall, the data provisions above can provide certainty for smart city businesses abroad; however, a question that can arise from such issues is whether existing digital rules are sufficient to regulate/govern international smart city projects. Smart cities involve additional data concerns: for instance, it has been pointed out that ‘smart city security is inherently more difficult than securing individual smart objects, such as smartphones, IoT objects, and service platforms’ because the sum of vulnerabilities of these objects ‘increases smart city's attack surface’.¹⁵² This leads us to question whether the DEPA's general cyber security provision is sufficient for ensuring security in smart cities.

Furthermore, collecting data from citizens and integrating data from different sources add more data complexity. Smart cities integrate and combine data from different sources on a data platform, which has not been the focus of attention in traditional digital trade discourse. Based on the smart city literature in urban planning and architecture, at least two considerations can inform future research agenda.

The first concerns accessible and open government data provision.¹⁵³ Data related to smart cities are not necessarily administrative and bureaucratic datasets collected by governments; they are often collected from citizens by private companies. Then, a question arises whether accessible and open government data include data collected/processed by private companies in addition to data maintained by governments. At this point, the purposes and means of data processing based on a data contract between a local government and a private company are relevant and necessarily affect the accessibility and openness of the data afterward. Moreover, we must consider data ‘anonymization’. As noted, the open government information provision under several DEAs requires ensuring appropriate ‘anonymization’ of the information; however, the scholarship discusses how the concept of anonymization (or de-identification) varies among different legal contexts.¹⁵⁴ Reflecting a variety of techniques for anonymization (or de-identification) and possible risks of re-identification, it is necessary to consider what is appropriate anonymization when releasing the information as open data to the public.¹⁵⁵ However, one difficulty in the smart city context lies in the fact that ‘[t]he more data is combined about a single person, the more easily that person can be re-identified’.¹⁵⁶

The second consideration relates to a smart city's public character and privacy issues.¹⁵⁷ In smart city projects, data can be collected through ‘connected cars’ and ‘wearable devices’, and data analysis can be conducted regarding driving patterns and health management. Simultaneously, data can be collected with a much wider scope via monitoring and surveillance devices (e.g., cameras, GPS, and sensors). Monitoring data (sometimes, real-time data) collected by such devices in public spaces is necessary for urban safety and environmental protection. However, the use of monitoring data raises privacy concerns. What should cities do if they ‘cannot notify citizens about a specific data collection in advance or at the time of collection’?¹⁵⁸ Occasionally, obtaining consent from all citizens regarding routine monitoring data is impractical. Thus, in the smart city context, there is always a tension between smart city surveillance in public spaces and privacy issues that is difficult to address. Additional rules for smart city governance may include, for instance, setting up an ethical review board inside governments and conducting a privacy impact assessment by governments,¹⁵⁹ which are not yet written into the current DEAs.

On this point, it is useful to look at how a soft-law agreement regulate data issues over smart cities. The ‘G20 Global Smart Cities Alliance’ activity is such an example. Currently, the World Economic Forum (i.e., the Centre for the Fourth Industrial Revolution, Japan) serves as a secretariat for the Global Smart Cities Alliance.¹⁶⁰ One important project undertaken by the Alliance was the development of global norms ‘for data collection and use, transparency and public trust, and best practices in smart city governance’.¹⁶¹ The Alliance established five principles: (1) equity, inclusivity, and social impact; (2) security and resiliency; (3) privacy and transparency; (4) openness and interoperability, and (5) operational and financial sustainability.¹⁶² Furthermore, the implementation of these five principles is supported by a ‘Policy Roadmap’¹⁶³ that encompasses detailed policy elements, such as ensuring open data and privacy impact assessment. For instance, the model policy for ‘open data’ addresses the need for ‘permission-based access’ for ‘sensitive data … where anonymization or deidentification is neither possible nor practical’.¹⁶⁴ The model policy for ‘privacy impact assessment’ provides details of ‘a consistent method for identifying, evaluating and addressing privacy risks’ in smart city projects.¹⁶⁵

Moreover, other forums consider data governance and smart cities. For example, the OECD is discussing concerns posed by data and smart cities, including ‘privacy risks’.¹⁶⁶ The EU is another example; the European Commission hosts a platform among relevant actors (e.g. cities, industries, investors, and researchers) named ‘The Smart Cities Marketplace’,¹⁶⁷ where ‘the Citizen's Control of Personal Data Initiative’¹⁶⁸ has been launched. Thus, the challenges posed by data regarding smart cities are discussed and regulated in many ways – by treaties or soft-law approaches, at the local, regional, and global levels.

6. Conclusion

Previously, smart cities were not a global concern; instead, they reflected the concerns of local governments, high-tech companies, and citizens. While privatization and digitalization by companies have been concerned with city governance,¹⁶⁹ it is not an international issue. However, smart cities are now receiving significant global attention because they are an important area of international cooperation that also generates business opportunities abroad, especially in the ASEAN context. Accordingly, this article considered how smart city projects can be situated in international trade law.

As discussed, smart cities involve long-standing trade law issues, such as the intersection between goods and services or international standard-setting complexities in the ICT sector. Simultaneously, smart cities are concerned with new digital trade issues. As big data and AI have become the focus of attention, smart cities are facing global ethical and responsibility issues. In other words, smart cities do encounter challenges similar to those posed by the digital economy in general, such as ‘social inequality; social control through public and private surveillance … national security threats and geopolitical rivalry; cyber security risks; and threats to personal privacy and dignity’.¹⁷⁰

Such questions related to data issues are not theoretical. Imagine future developments in the ‘ASEAN Smart Cities Network’. The ASEAN network envisages to ‘stimulate and catalyse greater collaboration and connectivity within and among ecosystems [of people, businesses and infrastructure] for a better world across ASEAN’.¹⁷¹ Accordingly, data communication and sharing from multiple smart-city sources may occur among ASEAN smart city projects in the future, after a certain period of time of development and collaboration. After the COVID-19 pandemic, we can imagine that such data communication and sharing across countries are more likely in the context of regional disease outbreaks and urban safety management. Thus, central/local governments, high-tech companies, and citizens should recognize the importance of privacy and security issues in international smart city projects.¹⁷² How these regulatory efforts actually affect smart city initiatives in Asia and other regions remains to be seen.¹⁷³