#  Executive Summary

This deliverable constitutes the initial Data Management Plan for the
+CityxChange project (824260). It specifies Data Governance and handling of
data in the project, what types of data are expected to be generated in the
project, whether and how it will be made open and accessible for verification
and re-use, how it will be curated and preserved, and details ethical,
privacy, and security issues.

All beneficiaries are informed of the applicable regulations around human
participation, informed consent, data processing, data security, and the
pertinent regulations such as GDPR or H2020 Ethics or FAIR guidelines. When
personal data collection or processing is started, the DMP information will be
updated accordingly to include updated data summaries, consent forms,
compliance, and institutional approval where necessary. Processing of personal
data will respect Data Protection Principles.

This document provides the overview of data handling in the project and
provides the initial guidelines for the project. The project will support
openness according to the EU principle "as open as possible, as closed as
necessary" together with the project ambition of “Open by Default”.

#  Section 1: Introduction

This deliverable presents the initial Data Management Plan (DMP) for the
+CityxChange project (824260). This is the first version of the DMP. It
describes overall Data Governance in the project, including the lifecycle of
data to be collected, generated, used, or processed within the project and the
handling of data, including methodologies, data sharing, privacy and security
considerations, legal and regulatory requirements, informed consent, open
access, for during and after the project. The Deliverable is part of Task
11.6: Delivery of Data Management Plan and is linked with Task 11.2: Delivery
of Consortium Plan, and Task 11.1: Project Management. It is further linked to
Ethics

Deliverables D12.1 H - Requirement No. 1 on Human Participants and D12.2 POPD
- Requirement No. 2 on Protection of Personal Data. Some content from D12.1
and D12.2 and the Description of Action (DoA) is reiterated here.

+CityxChange has a strong commitment in place for maximizing dissemination and
demonstration of the value of the implemented targets and measures. Strong
dissemination of results, sharing of data, communication, and replication are
a key success factor in making the project results more accessible,
attractive, evaluable, replicable, and implementable for a broad set of
stakeholders. The project aims to make research data findable, accessible,
interoperable and re-usable (FAIR) in line with the H2020 Guidelines on FAIR
Data Management  1  . +CityxChange participates in the Pilot on Open Research
Data (ORD) and thus delivers this Data Management Plan to define how the
project will implement data management, dissemination, and openness according
to the principle "as open as possible, as closed as necessary" together with
the project ambition of “open by default”.

The consortium will provide Open Data and Open Access to results arising from
the project to support a number of goals, namely: benchmarking with other
projects and comparison of developed measures; improving dissemination,
contribution to the Smart Cities Information System (SCIS), and exploitation
of data and results; improving access and re-use of research data generated
within the project; and knowledge sharing with citizens, the wider public,
interested stakeholders, cities, industry, and the scientific community.

The project is built around transparency and openness. 86% of 148 deliverables
are open, only 20 are confidential, which is a great support for outreach and
replication. Deliverables are expected to be used both internally and
externally, to both inform the project and its team members about activities
and results, and to infirm external stakeholders and potential collaborators
and replicators. This means that documentation is written with a focus on
usefulness for the project and the European Cities and other stakeholders.
Such outreach will also be supported through the inter- and extraproject
collaboration between SCC1 projects in WP9.

In addition, +CityxChange aims to fulfil all ethical requirements and
acknowledges that compliance with ethical principles is of utmost importance
within H2020 and within Smart Cities and Communities projects that involve
citizens and other actors, especially regarding human participants and
processing of personal data. As such, the beneficiaries will carry out the
action in compliance with: ethical principles (including the highest standards
of research integrity); and applicable international, EU and national law.
Beneficiaries will ensure respect for people and for human dignity and fair
distribution of the benefits and burden of research, and will protect the
values, rights and interests of the participants. All partners are aware of
the H2020 Rules of Participation  2  (Sections 13, 14) and the Ethics clauses
in Article 34 of the Grant Agreement and the obligation to comply with ethical
and research integrity principles set out therein and explained in the
annotated Model Grant

Agreement  3  . The project will respect the privacy of all stakeholders and
citizens and will seek free and fully informed consent where personally
identifiable data is collected and processed. Processing of personal data will
respect Data Protection Principles.

Data provided by the project will support a range of goals, such as improving
dissemination and exploitation of data and results; improving access and reuse
of research data; and knowledge sharing with citizens, the wider public,
interested stakeholders, and the scientific community. Documentation and
research data repositories will follow the H2020 best practice, with a focus
on open access, peerreviewed journal articles, conference papers, and datasets
of various types.

This document is based on the main formal project description of the Grant
Agreement and additional documentation built so far in the project. The
+CityxChange project is part of the H2020 SCC01 Smart

Cities and Communities Programme. The related documents for the formal project
description are the Grant Agreement Number 824260 - CityxChange “Positive City
ExChange” (Innovation Action) entered into force 01.11.2018, including the
core contract, Annex 1 Part A (the Description of Action, DoA: beneficiaries,
work packages, milestones, deliverables, budget), Annex 1 Part B (Description
of project, work, background, partners), Annexes (Supporting documentation,
SEAPs, BEST tables, Dataset mapping, etc.), and Annex 2 - Budget. In addition,
the Consortium Agreement of +CityxChange, entered into force 01.11.2018,
details the Consortium Governance and relations of beneficiaries towards each
other. It includes IP-relevant background, including existing data sources.
The parts about open data, security, and privacy processes are taken from the
internal living documentation on ICT governance.

For the role of the Data Manager, the Coordinator has appointed the Project
Manager. As part of the responsibilities of the Project Management Team, the
Data Manager will review the +CityxChange Data Management Plan and revise it
annually or when otherwise required with input from all partners.

This public document describes the status of the DMP at the time of delivery,
January 2019. It will be refined by future deliverables of the DMP and updates
in individual Work Packages, especially around ICT in WP1 and Monitoring &
Evaluation in WP7.

#  Section 2: Ethics, Privacy, and Security Considerations

+CityxChange is an innovation action. It is a complex, cross-sectoral, and
interdisciplinary undertaking that involves stakeholders from widely varying
backgrounds. Furthermore, it is a city-driven project, putting cities and
their citizens in the focus.

This means that a majority of data collection and human participation happens
through activities around automated data collection in energy and mobility
scenarios, monitoring and evaluation, as well as citizen participation,
stakeholder engagement, events or peer-to-peer exchanges in developing and co-
creating innovative solutions.

The approach and structure of the project leads to diverse data being
collected and generated using a range of methodologies. As the data is
heterogeneous, a number of methodologies and approaches can be used.

##  Ethics Considerations

All 11 Demonstration Projects in the +CityxChange Lighthouse Cities will
require data processing and most require evaluation involving human research
subjects and the collection of personal data. The ethics self-assessment and
Ethics Summary Report identified three ethical issues: 1) human participation,
2) personal data collection of data subjects, and 3) potential tracking or
observation of participants. Details on these are given in D12.1 and D12.2 and
summarised below.

The details for each demonstration case are summarised in the following table
(from D12.1).  
  
<table>  
<tr>  
<th>

**Identified Demonstration Projects**

</th>  
<th>

**Human**

**Participants**

</th>  
<th>

**Collection of personal data**

</th>  
<th>

**Tracking or observation of participants**

</th> </tr>  
<tr>  
<td>

Residential, office, multi-use buildings, Norway

</td>  
<td>

X

</td>  
<td>

X

</td>  
<td>

X

</td> </tr>  
<tr>  
<td>

Energy data, building level,

Norway

</td>  
<td>

X

</td>  
<td>

X

</td>  
<td>

X

</td> </tr>  
<tr>  
<td>

Energy data, system level, Norway

</td>  
<td>

X

</td>  
<td>

X

</td>  
<td>

X

</td> </tr>  
<tr>  
<td>

Transport data, Norway

</td>  
<td>

X

</td>  
<td>

X

</td>  
<td>

X

</td> </tr>  
<tr>  
<td>

Community Engagement, Norway

</td>  
<td>

X

</td>  
<td>

X

</td>  
<td>

X

</td> </tr>  
<tr>  
<td>

Residential, office, multi-use buildings, Ireland

</td>  
<td>

X

</td>  
<td>

X

</td>  
<td>

X

</td> </tr>  
<tr>  
<td>

Energy data, building level, Ireland

</td>  
<td>

X

</td>  
<td>

X

</td>  
<td>

X

</td> </tr>  
<tr>  
<td>

Energy data, system level, Ireland

</td>  
<td>

X

</td>  
<td>

X

</td>  
<td>

X

</td> </tr>  
<tr>  
<td>

Transport data, Ireland

</td>  
<td>

X

</td>  
<td>

X

</td>  
<td>

X

</td> </tr>  
<tr>  
<td>

Community Engagement,

Ireland

</td>  
<td>

X

</td>  
<td>

X

</td>  
<td>

X

</td> </tr> </table>

All activities within +CityxChange will be conducted in compliance with
fundamental ethical principles and will be underpinned by the principle and
practice of Responsible Research and Innovation (RRI)  4  . RRI is important
in the Smart City context where projects work to transform processes around
cities and citizens. Through the +CityxChange approaches of Open Innovation
and Quadruple Helix collaboration, societal actors and stakeholders will work
together to better align the project outcomes with the general values, needs
and expectations of society. This will be done throughout the project, with a
focus within WP9 and WP10 and the city Work Packages. The project uses open
data and openness as part of Open Innovation 2.0 and for stakeholder
participation through measures such as open data, open licences, public
deliverables, hackathons, outreach, living labs, existing innovation labs.

The consortium confirms that the ethical standards and guidelines of Horizon
2020 will be rigorously applied, regardless of the country in which the
research will be carried out, and that all data transfers will be permissible
under all necessary legal and regulatory requirements. This was detailed in
D12.1 and D12.2 and will be followed up in the following section.

All proposed tasks are expected to be permissible under the applicable laws
and regulations, given proper observance of requirements. Where appropriate
information and consent of all stakeholders and citizens is mandated, the
consortium will ensure that all necessary procedures are followed,
particularly with regard to the signing, collation, and storing of all
necessary Informed Consent Forms prior to the collection of any data. All
involved stakeholders and citizens will be informed in detail about measures
and the consortium will obtain free and fully informed consent.

All necessary actions will be taken within the project management and by all
beneficiaries to ensure compliance with applicable European and national
regulations and professional codes of conduct relating to personal data
protection. This will include in particular Directive 95/46/EC regarding data
collection and processing, the General Data Protection Regulation (GDPR,
2016/679), and respective national requirements, ensuring legal and regulatory
compliance. Ethics considerations will feed into research and data collection
protocols used in the project. This will include the collecting and processing
of personal data as well as surveys and interviews. For all identified issues,
in line with the above standards, ethical approvals will be obtained from the
relevant national data protection authorities and/or institutional boards.

In line with existing regulations by the university partners relevant for
social science research, the mapping of the ID and the person will be
safeguarded and will not be available to persons other than the ones working
with the data. This will minimise the risks of ethical violations. Since data
stemming from other kinds of research might be de-anonymized and reconnected
to a person, discipline-specific study designs aim to mitigate or remove this
risk as well for different types of data collection. Results may be used in
anonymised or aggregate form for analysis and subsequent publication in
project reports and scientific papers. All beneficiaries will handle all
material with strict care for confidentiality and privacy in accordance with
the legal and regulatory requirements, so that no harm will be done to any
participants, stakeholders, or any unknown third parties. NTNU as the
coordinator has internal guidelines that comply with GDPR and these will be
followed in all data management.

In addition to relevant national data protection authorities, the university
partners have separate institutional ethics boards or respective national
research boards, which will ensure the correct implementation of all human
participation and data protection procedures and protocols around social
science research. In detail, this includes for Ireland the University of
Limerick Research Ethics Governance and respective Faculty Research Ethics
Committees, and for Norway the Norsk samfunnsvitenskapelig datatjeneste (NSD)
- National Data Protection Official for Research. The Lighthouse Cities
Limerick (IE) and Trondheim (NO) will closely collaborate with their local
universities. The Follower Cities Alba Iulia (RO), Písek (CZ), Smolyan (BG),
Sestao (ES), and Võru (EE) will follow similar procedures for any potential
replication of demonstration projects. Details will be developed within the
respective tasks, mostly in WP3, and input into ongoing versions of the DMP.

##  Ethics Requirements and Confirmations

Recruitment and informed consent procedures for research subjects will fulfil
the following requirements (cf. D12.1):

  1. The procedures and criteria that will be used to identify/recruit research participants. 

  

  2. The informed consent procedures that will be implemented for the participation of humans. 

  

  3. Templates of the informed consent/assent forms and information sheets (in language and terms intelligible to the participants). 

  

  4. The beneficiary currently foresees no participation of children/minors and/or adults unable to give informed consent. If this changes, justification for their participation and the acquirement of consent of their legal representatives will be given in an update of the DMP and relevant documentation within the respective tasks. 

  

  

In addition, for the processing of personally identifiable data the following
requirements will be observed (cf. D12.2):

  1. The contact details of the host institution’s DPO are made available to all data subjects involved in the research. Data protection policy for the project will be coordinated with the DPO. 

  

  2. A description of the technical and organisational measures that will be implemented to safeguard the rights and freedoms of the data subjects/research participants as well as a description of the anonymisation/pseudonymisation techniques that will implemented. 

  

  3. Detailed information on the informed consent procedures linked to the above in regard to data processing. 

  

  4. Templates of the informed consent forms and information sheets (in language and terms intelligible to the participants) linked to the above regarding data processing. 

  

  5. The project currently does not foresee profiling. In case this changes, the beneficiary will provide explanation how the data subjects will be informed of the existence of the profiling, its possible consequences and how their fundamental rights will be safeguarded in an update of the DMP. 

  

  6. The beneficiaries will explain how all of the data they intend to process is relevant and limited to the purposes of the research project (in accordance with the ‘data minimisation’ principle). 

  

  7. The project does not foresee the case of further processing of previously collected personal data. In case this changes, an explicit confirmation that the beneficiary has lawful basis for the data processing and that the appropriate technical and organisational measures are in place to safeguard the rights of the data subjects will be submitted in an update to the DMP. 

  

  

##  Recruitment of Participants and Informed Consent Procedures

The project will engage with a multitude of participants and stakeholders in
different Work Packages and Tasks. This runs from open to highly targeted
activities, co-creation workshops, citizen engagement, outreach activities,
stakeholder and citizen groups, and other activities. The Deliverable on Human
Participants D12.1 H - Requirement No. 1 has described general guidelines on
the processes to be used. The current drafts of informed consent forms are
shown in the Annex of D12.1.

The updates to these will be included in future versions of the DMP.

More detailed requirements and documentation will be generated before the
start of any activity involving participation of humans being the subjects of
the study, while fully operating within local, national, and EU regulations.
These forms will be detailed and tailored to the individual demonstration
projects within the Lighthouse cities, in the official language of the
country/city where the demonstration takes place, and include demonstration-
specific aspects and referring to the relevant regulations on data protection
and/or other legislation if applicable.

For all applicable physical meetings and consortium events we will inform
participants that pictures will be taken, and participants will have to
actively consent to, with an option to opt out, pictures being used in project
specific communication. It also concerns photographic evidence of events,
demonstrations, etc. that is done throughout the project and may be needed for
documentation of task and milestone completion. This will also be taken up
with WP10 on communication and WP9 on interproject collaboration with regards
to documentation of events.

##  Data Privacy and Personal Data

Detailed requirements and descriptions of the technical and organisational
measures that will be implemented to safeguard the rights and freedoms of the
data subjects/research participants will be described by tasks that implement
them. Where necessary, data will be anonymised or pseudonymised.

Data minimisation principles will be followed in line with applicable
legislation. The relevance of data collected for tasks will be considered  5
,  6  .

As the project will include the participation of numerous cities requiring
multiple data measurements per city, the actual project beneficiaries,
external stakeholders and citizens involved will vary between tasks. The
project will respect the privacy of all stakeholders and citizens and will
seek free and fully informed consent where personally identifiable data is
collected and processed as described above, implementing suitable data
handling procedures and protocols to avoid potential identification of
individuals. This will include participants’ data in activities that use
techniques such as questionnaires, interviews, workshops, or mailing lists as
well as automatic building, energy, and mobility data collection.

The +CityxChange consortium is aware of potential issues arising from data
aggregation from different sources, scales, flows, and devices. Data collected
in the project will thus be anonymised and aggregated as close to the source
as possible. In certain cases, personal data avoidance and minimisation can
eliminate and/or reduce identifiability. For example, energy consumption with
a high temporal resolution can be used to identify personal daily patterns and
routines when gathered at an individual household level. Aggregate data either
with lower temporal resolution (e.g. once a day) or with a lower geographical
resolution (e.g. energy consumption on a district level as is directly
available for energy providers) mitigates this risk. The same approach will be
implemented for mobility data, which can incorporate a much higher level of
personal information and will need to be treated with adequate anonymisation
and aggregation methods.

##  Data Protection Officers and GDPR compliance

As Coordinator and host institution, NTNU confirms that it has appointed a
Data Protection Officer (DPO) and the contact details of the DPO will be made
available to all data subjects involved in the research (see D12.2).

Respective partners will also follow their internal data protection and
European GDPR  7  regulations. In line with GDPR, individual beneficiaries are
responsible for their own data processing, so the respective beneficiaries are
to involve their own DPOs, who will ensure the implementation and compliance
of the procedures and protocols in line with internal processes and national
regulations. Processing of personal data will respect Data Protection
Principles as set out: Lawfulness, fairness and transparency; Purpose
limitation; Data minimisation; Accuracy; Storage limitation; Integrity and
confidentiality; accountability.

Each beneficiary is reminded that under the General Data Protection Regulation
2016/679, the data controllers and processors are fully accountable for the
data processing operations. Any violation of the data subject rights may lead
to sanctions as described in Chapter VIII, art.77-84.

##  Data Security

The beneficiaries will implement technical and organisational measures to
ensure privacy and data protection rights in the project.

All ICT systems to be developed will be designed to safeguard collected data
against unauthorized use and to comply with all national and EU regulations.
Engineering best practices and state-of-theart data security measures will be
incorporated as well as GDPR considerations, and respective guidelines and
principles. Ultimately, each partner is responsible for their own information
security in developed systems, but for overall guidelines, replication
blueprints, and documentation, the ICT architecture and ecosystem (WP1,
T1.1/T1.2) will incorporate this aspect in the overall development as part of
_data governance_ .

Information security management, which is central to the undertaking of the
project, will follow the guidelines of relevant standards, e.g., ISO/IEC 27001
and 27002 (Code of practice for information security management), to ensure
confidentiality, integrity, and availability. It will additionally include the
Directive on security of network and information systems (‘Cybersecurity
directive’, NIS-Directive 2016/1148) on the security of critical
infrastructures and the ePrivacy Directive 2002/58, as well as European Union
Agency for Network and Information Security (ENISA) guidance. In addition,
data storage will fully comply with the national and EU legal and regulatory
requirements. Partners will ensure and document that used cloud infrastructure
complies with applicable regulations.

##  City Processes on Privacy and Security

All project beneficiaries have existing and operational policies regarding
potential ethics issues as well as privacy and security regulations or will
ensure their provision for the tasks where they are necessary.

In addition to the cities, the solution providers in +CityxChange have their
own data protection routines established in their existing operations and in
their development and test activities of the project. They are responsible to
established compliance with GDPR and other data protection and security
regulations. They will further support and implement guidelines from the ICT
tasks (WP1) of +CityxChange.

In the following, we detail the city procedures. Details on all partners will
be given in further updates of the DMP as far as it can be made available.

TK is currently in the process of establishing a formal privacy policy. It
uses internal tools to ensure internal control and audit and to keep track of
all processes around personal data. TK will ensure that it has legal consent,
updated routines, valid risk and vulnerability analysis, in compliance with EU
and Norwegian law. It has a Data Protection Officer (DPO) in the municipality
and an assistant DPO in each business area, following National Datatilsynet  8
regulations. Following these regulations, TK has a project under the municipal
director of organization to ensure compliance with GDPR, and future Norwegian
personal data privacy act regulations; TK continuously aims to maintain
compliance. TK has a strong focus on privacy and security when it comes to ICT
systems, including IoT, encryption, etc. Work is based on ISO 27001 and it
complies with all relevant national and EU policies. It has a dedicated role
of Security Architect and relies on an operational provider for the internal
cloud, who is bound by SLAs. TK is one of the initiators and is participating
in the Norwegian municipal sector (KS) investigation by municipal-CSIRT
(Computer Security Incident Response Team). CSIRT is one of the key elements
of the NIS directive.

LCCC has updated its Data Protection Policy to one that is in line with GDPR
and the Data Protection Act 2018. A new role has been created for GDPR
compliance for the Data Protection Officer - DPO. An existing staff member
with auditing experience has been awarded the full time role and will ensure
compliance with the requirements of the Irish Data Protection Commissioner  9
. The DPO is currently auditing the organisation for GDPR compliance. This
work is being carried out in conjunction with the Digital Strategy Program
Manager. LCCC is currently reviewing its Data Processors Agreements with all
its suppliers that access data. A database of data sets, access, security,
business processes, anonymisation etc. is being documented through this audit
and captured into the organisation's CRM system. LCCC has strict security
policies to protect its systems and data, handled by the ICT Network Team.
LCCC complies with the NIS directive by taking appropriate technical and
organisational measures to secure network and information systems; taking into
account the latest developments and consider the potential risks facing the
systems; taking appropriate measures to prevent and minimise the impact of
security incidents to ensure service continuity; and notifying the relevant
supervisory authority of any security incident having a significant impact on
service continuity without undue delay.

Alba Iulia Municipality is compliant with the Data Protection Regulation (EU)
2016/679. It implemented the process of a formal privacy policy. The
municipality elaborated privacy policy notifications for every employee
regarding the new Data Protection Regulation and dedicated a section in the
official web page. Internal tools will ensure internal control and audit and
to keep track of all processes around personal data. Alba Iulia will ensure
that it has legal consent, updated routines, valid risk and vulnerability
analysis, in compliance with EU and Romanian law. A Data Protection Officer
(DPO) is appointed for all the municipality departments in line with GDPR and
ensures compliance with national regulations by the National supervisory
Authority for personal data processing  10  . AIM follows its security policy
for ICT use within the municipality organized by the IT team and the head of
IT, with outsourced contract for server management and maintenance, and the
latest audit carried out in 2018. The NIS Directive was transposed into local
law, aligning Romania with the common European framework for responding to
cyber security incidents.

Písek has developed an analysis of municipal processes and its compliance with
GDPR. The City

Council approved an inner policy directive for GDPR on 2018-10-05 (decision
no. 290/18). A role of

DPO is assigned since 01.03.2018 in the City Bureau, in line with the national
Office for Personal Data Protection  11  and the Act No. 101/2000 Coll., on
the Protection of Personal Data (currently amended to meet the GDPR
conditions). The Security Policy and IS Security Management Plan is handled by
the IT department and the IT Management Committee in reference to Act No.
365/2000 Coll., On Public Administration Information Systems, by the IT
Management Committee. The NIS

Directive is reflected in Act No. 181/2014 Coll., on Cyber Security, the
Decree of the National Security Authority (NBÚ) No. 316/2014 Coll., the Cyber
Security Order; Decree of NBÚ and Ministry of the interior (MVČR) No. 317/2014
Coll., on Important Information Systems and their Criteria.

The Municipality of Sestao and Sestao Berri are complying with all relevant
regional, national, and European legislation around data security and privacy
in line with the Spanish data protection authority AGPD  12  and the Basque
data protection authority AVPD  13  . The latter is working on guides for the
adaptation of public administrations to the General Data Protection Regulation
(GDPR) for the Basque municipalities. The data protection role (Delegado de
Protección de Datos) is taken by the General Register of the City of Sestao
(Registro General del Ayuntamiento de Sestao). Detailed data handling for
different data sources of the municipality is described in an extensive list
on data use, justification, and rights.  14

In Smolyan, the policies for information security management are part of the
Integrated Management System of the Municipality; they comply with the
international standards ISO 9001: 2008, ISO 14001: 2004 and ISO 27001: 2013
for which the municipality is certified. They are implemented by the

Information Security Working Group. A Personal Data Protection System,
complying with Regulation (EC) 2016/679 of the European Parliament and of the
Council of 27 April 2016 has been adopted by the Municipality of Smolyan. The
system has been documented, implemented and maintained through 9
procedures/policies that include internal regulations, technical and
organizational measures, which the Municipality of Smolyan applies. The system
for protection of personal data is approved by Order № РД - 0455 / 23.05.2018
of the Mayor of Smolyan Municipality. It is constantly improving both in the
case of significant changes in the legal framework and in other related
circumstances.

A DPO has been appointed, following regulations from the Commission for
Personal Data Protection  15  and working with the Information Security
Working Group. The Personal Data Administrator is responsible for the
compliance of the processing of personal data, as required by European and
national legislation.

It links with the Bulgarian Law for protection of personal data (The Privacy
Act) and the Act for Access to Public Information. A Network Security
Management and Remote Access Policy is based on

ISO 27001:2013 with respect to the protection of the information on the
network, the supporting infrastructure and the establishment of rules for
configuring the internal servers owned and managed by the municipality of
Smolyan. It connects to the Management Policy of the Municipality of Smolyan
as well as a total of nine Information Security Management Policies, which are
part of the Integrated Management System of the Municipality.

Võru follows its own privacy policy with its ISKE working group and data
protection working group. Specialists have additional tasks to supervise
implementation of the privacy policy in the organisation, following the rules
of the Estonian Data protection Inspectorate  16  . The DPO has mapped the
current situation, and works with documentation and suggests changes if
needed. The national principles are observed, in the coordination of the
respective draft law, including recommendations from the Information Systems
Authority.

#  Section 3: Data Management, Sharing and Open Access

+CityxChange will distinguish four key categories of data arising from the
project:

  * **underlying research data** : data necessary for validation of results presented in scientific papers, including associated metadata, which works hand in hand with the general principle of openness of scientific results. The consortium will provide timely open access to research data in project-independent repositories and link to the respective publications, to allow the scientific community to examine and validate the results based on the underlying data. +CityxChange has a commitment to publish results via Gold Open Access and has allocated a budget for it. The deposition of research data will depend on the type and channel of publication, ranging from associating data with a publication at the publisher, university or national research data repositories, or the use of the OpenAIRE infrastructure, following the H2020 best practice, with particular focus on peer-reviewed journal articles, conference papers, and datasets of various types. 

  

  * **operational and observational data** : This category includes curated or raw data arising from the implementation, testing, and operation of the demonstrators (operational data), and data from related qualitative activities, such as surveys, interviews, fieldwork data, engagement activities (observational data). +CityxChange will make this data available in coordination with the ICT ecosystem designed in WP1 and respective partner repositories, opening it up for project partners and stakeholders, and to citizens and interested third parties to support engagement and innovation (WP3), where possible and allowed under regulations and privacy issues. 

  

  * **monitoring and evaluation data** : This data will specifically be captured to track KPIs of the project performance in WP7 and will be regularly reported and published to the Smart Cities Information System (SCIS)  17  in a clearly defined and open way. 

  

  * **documentation, instruments, and reusable knowledge** : This concerns general and specific documentation of the project and demonstration/implementation projects, including tools, methods, instruments, software, and underlying source code needed to replicate the results. A number of collaboration and document management tools will be used, ranging from collaboration solutions, source code repositories (e.g. git) over document stores to the project website (WP10). Clean and consistent documentation and publication will support dissemination impact. All public Deliverables will be published on the project website in Open Access with open licenses. 

  

##  Data Handling Descriptions

Apart from other mechanisms within the project, such as communication,
outreach, citizen participation, peer-to-peer learning workshops and networks,
measures such as sharing of data, documentation, and results will be an
important contributing factor to the project goals. The project will ensure
that research data is ‘findable, accessible, interoperable and reusable’
(FAIR), in line with the H2020 Guidelines on FAIR Data Management.

The following describes the guidelines and expectations for relevant data sets
along with detailed description, metadata, methodology, standards, and
collection procedure. Further details are types of data, data formats and
vocabularies, storage, deadlines for publication, data ownership rules, and
detailed decisions regarding data management and protection.

Issues to be defined will be, for example, the confidentiality needs of
utility providers, the privacy needs of citizens, commercialisation and
cybersecurity issues, together with general ethical, legal, and regulatory
considerations and requirements.

At the time of delivery, most tasks have not yet fully defined the type and
structure of the data that they need or will generate or can make available.

Part of these tasks is also considered and documented in the overall ICT
architecture and interface

Tasks (T1.1 and T1.2) and in the KPI development and data collection in WP7 on
Monitoring and Evaluation. As part of the DMP, storage, processing,
protection, dissemination, retention, destruction will be collected and
documented.

For this, individual Tasks within the Work Packages will specify and implement
approaches related to data collection, management, and processing measures
that are most appropriate based on data avoidance, especially concerning
personally identifiable aspects of data sets, in coordination with Task T11.6
for the DMP.

Individual data collection will be handled by the involved partners and cities
in the Work Packages, keeping much data processing close to the source and
within the originating partners, while providing a loosely coupled overall
architecture through suitable architecture choices and guidelines.
Architectural details will be described by the ICT ecosystem Tasks T1.1, T1.2
in WP1.

To ensure maximum use and quality of open research data and re-use of existing
data for example from city Open Data Portals, the project will base much of
the internal collaboration on structured research data sets collected in
standardized formats in collaboration with WP1/2/3, WP7 and WP10/11. This will
help that deposited datasets will be evaluated internally as well regarding
their use for the scientific community (‘dogfooding’, and organisation using
its products and services also internally. In this case, also avoiding
duplicate work by making as much data as possible available in structured
formats for internal use and external dissemination). Such an approach should
also support outreach activities such as hackathons, by enabling low-barrier
access for external stakeholders. Where possible, research data and associated
metadata (standardised as Dublin Core, W3C DCAT, or CSVW) will be made
available in common standard machine-readable formats such as Linked Open Data
(LOD) in coordination with T1.2, enabling it to be linked to other public
datasets on the

Web and to facilitate discovery and automatic processing. Example approaches
include the ESPRESSO framework  18  , Open ePolicy Group, and other to be
detailed in WP1. In addition, data must also be interoperable to facilitate
ease of access and exchange. As set out in the new EU ‘Interoperability
Framework’  19  , this is vital to the functioning of pan-European business
and to impact for H2020 projects.

For all tasks, digital copies of all data will be stored for a minimum of
three years after the conclusion of the grant award or after the data is
released to the public, whichever is later. All information and data gathered
and elaborated will be suitably described in the respective Deliverables. All
public Deliverables will be made available and archived on the project website
and through the EU Community Research and Development Information Service
(CORDIS) for the project  20  . The project aims to make research data and
publications freely available through Open Access and suitable repositories.

Pending detailed descriptions, the following table shows the data handling
summary template for use within the DMP and within Tasks for documentation:

Template for data handling and management summary  
  
<table>  
<tr>  
<th>

Task/Demo/Activity

</th>  
<th>

Task Name

</th> </tr>  
<tr>  
<td>

Description

</td>  
<td>

</td> </tr>  
<tr>  
<td>

Purpose and relevance of data collection and relation to objectives

</td>  
<td>

</td> </tr>  
<tr>  
<td>

Methodology

</td>  
<td>

</td> </tr>  
<tr>  
<td>

Data source, data ownership

</td>  
<td>

</td> </tr>  
<tr>  
<td>

Standards, data formats, vocabularies

</td>  
<td>

</td> </tr>  
<tr>  
<td>

Storage

</td>  
<td>

</td> </tr>  
<tr>  
<td>

Security & Privacy considerations

</td>  
<td>

</td> </tr>  
<tr>  
<td>

Exploitation/Dissemination

</td>  
<td>

</td> </tr>  
<tr>  
<td>

Dissemination Level, Limitations, Approach, Justification

</td>  
<td>

</td> </tr>  
<tr>  
<td>

Stakeholders

</td>  
<td>

</td> </tr> </table>

##  Access Rights and Procedures

In line with the Consortium Agreement and the Grant Agreement, research
results are owned by the partner that generates them. However, the stated aim
is to make data and results publicly available, whenever possible. Further
access rights and regulations are set forth in the Consortium Agreement as
rights and obligations of partners. In particular, consortium partners will
give each other access to data that is needed to carry out the project.
Partners will furthermore give each other access under fair and reasonable
conditions to exploit their results. For other affiliated entities, access can
be granted under fair and reasonable conditions for data and research output,
as long as it is not covered by the Open Access conditions, provided such
access is in line with the project goals and confidentiality agreements. Data
published or otherwise released to the public will include disclaimers and/or
terms of use as deemed necessary.

Regarding the protection of intellectual property rights, detailed terms for
access rights and collective and individual exploitation of IP are agreed upon
in the Consortium Agreement (Section 8 page 19, Section 9 page 21, Section 10
page 26) and Grant Agreement (Section 3, page 43).

Some Deliverables will include project internals that do not need to be
public. Some others will include detailed specifications for the software
tools and methodologies; these will remain confidential as per the Deliverable
designation as they contain potentially patentable information.

Any data relating to the demonstration sites, e.g. metered data, utility bills
will remain the property of the demonstration sites and will only be shared
with the permission of the demonstration site owner.

Aggregated data for purposes of Monitoring and Evaluation will be shared under
open licenses (cf. Section Dissemination).

Software licenses will be aimed to be as open as possible, with Creative
Commons for documentation and GNU-style licenses for software as a default.
For example, GPLv3 (GNU General Public License)  20  , MIT  21  , or Apache
22  are open and permissible licenses, with GPL additionally using a share-
alike model for sharing only under the original conditions (reciprocal
license).

Adaptations are expected for commercial partners to be aligned with their IPR
strategy. A balance is needed for openness and need for marketability,
patenting, other IPR issues. This will be handled by the industry partners
together with the cities and is also linked to WP8 on Replication and the
Innovation Manager in the Project Management Team.

##  Open Access to publications

The dissemination activities within the project will include a number of
scientific and other publications. +CityxChange is committed to dissemination
and the principle of Open Access for scientific publications arising from the
project, in line with the H2020 Guidelines to Open Access  23  . It further
aims to make research data open as described above. A budget has been set
aside for the academic partners to support gold open access publishing.

Publication of scientific papers will be encouraged by the +CityxChange
consortium. For cases where it may interfere with seeking protection of IPR or
with publication of confidential information, a permission process for
publishing any information arising from the project is put in place in the
Consortium Agreement. Notification needs to be given at least 45 days before
the publication, with objections subject to the rules of the Consortium
Agreement.

The project aims for Gold Open Access publication of scientific peer-reviewed
papers where possible and will adopt a Green Open Access strategy as a
fallback. At the minimum, this will include selfarchiving of publications in
known centralized or institutional repositories, for example the NTNU
institutional archive NTNU Open  25  the UL Institutional Repository  24  , or
OpenAIRE  25  . Authors will ensure appropriate bibliographic metadata is
published as well, where possible. It will be in a standard format and include
the terms "European Union (EU)" & "Horizon 2020"; the name of the action,
acronym & grant number as below; publication date, length of the embargo
period, if applicable; and a persistent identifier.

These requirements are also codified in Article 29.2 of the Grant Agreement on
Open Access.

Authors will aim to retain copyright and usage rights through open licenses,
such as Creative Commons Attribution License (CC-BY 4.0  26  /CC-BY-SA) or
otherwise publisher agreements to similar effect will be pursued. Project
participants will ensure that all publications acknowledge the EU H2020
funding and the name and grant number of the project, including the standard
disclaimer as also found on the title page of this document (+CityxChange,
project number 824260). Deliverables are public by default through a Creative
Commons CC-BY4.0 license. Other CC licenses can be applied after consultation.
_External third-party material_ will be labeled as such, to clearly identify
such content and exclude it from the free use given for consortium-generated
material. This can be done by excluding such content in the general license
statement and by identifying copyright information next to third-party
material included in documents  27  .

##  Open Research Data and Open City Data

Quality-assured data is a cornerstone of scientific research and of industry
and city developments. Research data should be freely, publicly, and
permanently available where possible and appropriate to support validation of
results and re-use of data for example in research, development, and open or
citizen science as well as Open Innovation.

+CityxChange participates in the Pilot on Open Research Data (ORD)  28  and
will thus aim to provide open access to raw and aggregated curated datasets.
The project aims to make research data findable, accessible, interoperable and
re-usable (FAIR) in line with the H2020 Guidelines on FAIR Data Management.

Data will be made accessible for verification and reuse through appropriate
channels and repositories. Limits of access and availability are to be given
in individual data descriptions and will be further developed within the
project with the aim of greater openness.

Where research data is made available, it will be made available in recognized
repositories such as OpenAIRE or Zenondo, or local repositories of
universities or national research institutes, with possible assistance from
national OA desks.

Apart from research data repositories, the cities in +CityxChange are working
on or running their own City Open Data Portals, where general data arising
from the project should also be made available. Data may also be federated
into research repositories or other systems. The Lighthouse Cities have a
strong interest in this and will focus on open data through existing or new
projects.

Insight.Limerick.ie is the Limerick Data as a Service platform that integrates
data about Limerick from multiple sources and provides open access to linked
open data and open APIs at

_http://insight.limerick.ie/_ . Data is available for viewing in charts and
maps and also as open format downloads. While no formal open data policy is
being enforced, the concept of making data available as open data is being
encouraged throughout the workforce. Open data published here will also become
available in the national open data portal www.data.gov.ie.

Trondheim is setting up an open data portal based on CKAN. At the time of
writing, a temporary test version is available on
_https://open.trondheim.kommune.no/_ . During the start of 2019, the interface
will be changed and new data will be added. In TK, there is a general drive
towards making more data available. TK has a wealth of data, and currently is
in the process of opening up as much nonpersonally-identifiable data as
possible. Data is and will also made available in the national open data
portal _http://data.norge.no/_

The Follower Cities are working towards Open Data, and are already using a
variety of processes and tools to make data available.

Smolyan uses the National Portal for Open Data, as required by the Access to
Public Information Act. The Open Data Portal is a single, central, public web-
based information system that provides for the publication and management of
re-use information in an open, machine-readable format, along with relevant
metadata: _https://opendata.government.bg/?q=smolyan_

Písek follows the national level guideline for Open Data publishing and is
preparing its publication plan as part of Smart Písek. Initial solutions are
implemented for new information systems:

_https://smart.pisek.eu/portal.html_

Alba Iulia is building an open data portal as one component of its smart city
portfolio. It is being tested and will be published when sufficient data is
available. Regarding the fact that Open data underpins innovation and out-of-
the-box solutions in any area, Alba Iulia is an early partner in the Open
Energy project, developed by one of the Alba Iulia Smart City Pilot Project -
CivicTech (IT-based NGO). This is the first open energy consumption data
platform in public institutions, having the purpose to monitor this
consumption transparently, which will enable the identification of better
patterns of consumption prediction, facilitate the transfer of good
institutional practices, encourage investment in the efficiency of energy
consumption and in the future will support the taking of responsible
consumption of electricity among the whole society.

Sestao and Voru currently have no own portals.

The project aims to make anonymised data sets public, but will aim to strike a
balance between publication of data and privacy and confidentiality issues.
When in doubt, the consortium will refrain from publishing raw datasets and
only report aggregate measures. Decisions will be made on a caseby-case basis
by senior researchers to ensure that privacy, anonymity, and confidentiality
are not breached by publication of datasets or any other type of publication.
In addition, ongoing consultation with the relevant Data Protection Offices
will be ensured during the lifetime of the project.

This will also ensure that data is preserved, available, and discoverable. In
any case of data dissemination, national and European legislation will be
taken into account. To ensure free and open access with clear licensing, the
project will mostly adopt Creative Commons licenses ranging from attribution
to share-alike licenses (such as CC-BY 4.0/CC-BY-SA 4.0).

As above, publications will have bibliographic metadata attached where
possible, which is extended to research data. Where possible, research data
and associated metadata will be made available in common standards and
possibly as Linked Open Data. Annotations will be at minimum at the dataset
level, to support interoperability of data.

There is currently no separate operating budget for this, as it will be taken
as part of the budget for website and platform management, use existing
infrastructure at the Coordinator, the cities for example through their Open
Data portals (see next section), other partners, or will use free and open
repositories.

##  Document Management

As noted in the overall consortium plan (D11.1), documents in the consortium
are handled in one overall platform for easy collaboration and findability of
overall project documentation. The project has set up a shared file repository
in the form of an Enterprise installation of Google Drive, including
collaborative editing tools for documents, spreadsheets, and presentations.
The instance is made available by Trondheim Kommune and is compatible with all
applicable regulations. The repository is only accessible by invitation.
Access will be granted to registered members of the consortium.

Generally, it is recommended to not share highly sensitive data, as far as it
needs to be shared, on this system.

The handling of sensitive documents will be coordinated with the DPO of the
host partner. The partners have internal repositories and processes for
dealing with such sensitive data and how it can be shared for research.

Additional sharing and development tools can be set up by specific tasks if
needed, such as version control software that is outside the scope of the
overall platform, but will be documented and linked there.

##  Archiving and Preservation

Deliverables will be archived on the project website. The internal datasets
will be backed up periodically so that they can be recovered (for re-use
and/or verifications) in the future. Published datasets, raw or aggregated,
will be stored within internal and external repositories and thereby ensure
sustainability of the data collection. Records and documentation will be in
line with common standards in the research fields to ensure adherence to
standards, practices, and data quality. Data will be retained for three years
after the conclusion of the grant award or after the data are released to the
public, whichever is later.

The LHCs LCCC and TK together with NTNU as the Coordinator will ensure long-
term data curation and preservation beyond the project period. It will be
implemented as sustainability of the monitoring and evaluation platform and
data, linked to WP7 and prepared in T7.6 on migration of the monitoring
system, and as sustainability of project documentation and website, linked to
WP10 and WP11.

#  Section 4: Dissemination and Exploitation

Disseminating and exploitation of the project outputs and results are an
important step to achieve the project goals. This is done in cooperation with
WP10 on Dissemination and Communication, WP9 on Inter- and Intra Project
Collaboration, WP11 on Project Coordination, and all partners. As detailed
above, data will be made as open as possible. All consortium partners together
take responsibility for exploitation and dissemination of results and to
ensure visibility and accessibility of results. Implementing FAIR data
principles will support the openness and re-use of data and therefore
dissemination and replication. Different dissemination channels are estimated
to be used and maintained during and after the project as shown in the
following table:  
  
<table>  
<tr>  
<th>

**Dissemination type**

</th>  
<th>

**Usage**

</th>  
<th>

**Policy**

</th> </tr>  
<tr>  
<td>

**Website**

</td>  
<td>

Main reference point for project

dissemination and data description

</td>  
<td>

Creative Commons where applicable. External rights clearly marked.

</td> </tr>  
<tr>  
<td>

**Deliverables**

</td>  
<td>

Deliverables to the EU and the public. Disseminated through the project
website cityxchange.eu and the EU Cordis system.

</td>  
<td>

Dissemination level set per deliverable, public by default and open with
Creative Commons Attribution CCBY4.0. 86% of 148 deliverables are public, 20
are confidential.

</td> </tr>  
<tr>  
<td>

**Social Media**

</td>  
<td>

Support of communication

activities

</td>  
<td>

To be decided. Creative

Commons where applicable

</td> </tr>  
<tr>  
<td>

**Newsletters**

</td>  
<td>

Regular updates and links to website and other channels

</td>  
<td>

Creative Commons where applicable

</td> </tr>  
<tr>  
<td>

**Publications**

</td>  
<td>

Scientific and other publications arising from the project

</td>  
<td>

Open Access as detailed above

</td> </tr>  
<tr>  
<td>

**Benchmarking, Monitoring & Evaluation, KPIs **

</td>  
<td>

Monitoring of indicators for project and city performance

</td>  
<td>

Aggregate KPI data can be openly and publicly reported to

SCIS, in line with the overall

SCIS policy and license

(updated with the updated SCIS license for dissemination). Limitations due to
privacy and data policies may apply. General data governance issues around
this will be followed up in future versions of the DMP and in WP1 and WP7. Raw
data or supporting data and documentation for evidence archiving (for example

</td> </tr>  
<tr>  
<td>

</td>  
<td>

</td>  
<td>

for survey-based indicators or detailed personally identifiable data from
single areas) will be kept confidential. This will be

detailed in the WP7 methodology

</td> </tr>  
<tr>  
<td>

**Research data as laid out in Data Management section**

</td>  
<td>

Underlying research data of the project

</td>  
<td>

Open Access with limitations due to privacy, as detailed above, in accordance
with the

FAIR guidelines on Data

Management in H2020

</td> </tr>  
<tr>  
<td>

**Any other data**

</td>  
<td>

TBD

</td>  
<td>

Where ever possible, open through Creative Commons or other open licenses. 'As
open as possible, as closed as necessary'.

</td> </tr> </table>

#  Section 5: Conclusion

This deliverable constitutes the initial DMP for +CityxChange at the time of
delivery of January 2019. The Project Management Team will regularly follow up
with the consortium members to refine and update the DMP. Responsibilities
reside with NTNU and all consortium members.

More detailed procedures, descriptions, forms, etc. will be added as they
become available through the ongoing work in the respective Work Packages. The
next update will include detailed data summaries for the work that is being
started in that period.

The DMP will be updated at least annually, with the next regular update due in
M12 as D11.7 Data Management Plan 2. Updates will include more detailed
partner processes and descriptions of data sets and consent procedures.