Abstract

The paper explores the legal challenges and implications of processing personal data within public-private partnerships (PPPs) in smart city projects. Smart cities use a web of technologies to collect and analyse data from various sources, aiming to improve their efficiency and achieve multiple goals. However, this also raises concerns about privacy and adequate protection of data subjects' rights. The paper focuses on the legal basis for data processing regulated by the General Data Protection Regulation (GDPR) and how it differs between the public and private sectors involved in PPPs. The paper argues that the disparity in goals and legal grounds for data processing may create conflicts and uncertainties for joint data controllers, as well as data subjects. It intends to explore potential grey areas in the lawful grounds for collecting data and its implications for citizens' right to data protection in this context.