#  Executive Summary

This deliverable constitutes the second version of the Data Management Plan
for the +CityxChange project. It specifies Data Governance and handling of
data in the project, what types of data are expected to be generated in the
project, if and how it will be made open and accessible for verification and
re-use. It will also specify how it will be curated and preserved, with
details such as ethical, privacy, and security issues.

All beneficiaries are informed of the applicable regulations around human
participation, informed consent, data processing, data security, and the
pertinent regulations such as GDPR or H2020 Ethics or FAIR guidelines. When
personal data collection or processing is started, the DMP information will be
updated accordingly to include updated data summaries, consent forms,
compliance, and institutional approval where necessary. Processing of personal
data will respect the Data Protection Principles. This document provides an
overview of data handling in the project and provides the initial guidelines
for the project. The project will support openness according to the EU FAIR
approach and the principle "as open as possible, as closed as necessary"
together with the project ambition of “Open by Default”.

This document is an update of D11.5: Data Management Plan - Initial Version
and supersedes that document.

#  1 Introduction

This deliverable presents the first update to the Data Management Plan (DMP)
for the

+CityxChange project. This is the second version of the DMP and an update to
D11.5: Data Management Plan - Initial Version.

It describes overall Data Governance in the project, including the lifecycle
of data to be collected, generated, used, or processed within the project and
the handling of data, including methodologies, data sharing, privacy and
security considerations, legal and regulatory requirements, informed consent,
open access, for during and after the project. The Deliverable is part of Task
11.6: Delivery of Data Management Plan and is linked with Task 11.2: Delivery
of Consortium Plan, and Task 11.1: Project Management. It is further linked to
Ethics Deliverables D12.1 H - Requirement No. 1 on Human Participants and

D12.2 POPD - Requirement No. 2 on Protection of Personal Data. Some content
from

D11.5, D12.1, D12.2, and the Description of Action (DoA) is reiterated here.

+CityxChange has a strong commitment in place for maximizing dissemination and
demonstration of the value of the implemented targets and measures. Strong
dissemination of results, sharing of data, communication, and replication are
a key success factor in making the project results more accessible,
attractive, evaluable, replicable, and implementable for a broad set of
stakeholders. The project aims to make research data findable, accessible,
interoperable and re-usable (FAIR) in line with the H2020 Guidelines on

FAIR Data Management  1  . +CityxChange participates in the Pilot on Open
Research Data (ORD) and thus delivers this Data Management Plan to define how
the project will implement data management, dissemination, and openness
according to the principle "as open as possible, as closed as necessary"
together with the project ambition of “open by default”.

The consortium will provide Open Data and Open Access to results arising from
the project to support a number of goals, namely: benchmarking with other
projects and comparison of developed measures; improving dissemination,
contribution to the Smart Cities Information System (SCIS), and exploitation
of data and results; improving access and re-use of research data generated
within the project; and knowledge sharing with citizens, the wider public,
interested stakeholders, cities, industry, and the scientific community.

The project is built around transparency and openness. 86% of 148 deliverables
are open, only 20 are confidential, which is a great support for outreach and
replication. Deliverables are expected to be used both internally and
externally, to both inform the project and its team members about activities
and results, and to infirm external stakeholders and potential collaborators
and replicators. This means that documentation is written with a focus on
usefulness for the project and the European Cities and other stakeholders.
Such outreach will also be supported through the inter- and extra-project
collaboration between SCC1 projects in WP9.

In addition, +CityxChange aims to fulfil all ethical requirements and
acknowledges that compliance with ethical principles is of utmost importance
within H2020 and within Smart Cities and Communities projects that involve
citizens and other actors, especially regarding human participants and
processing of personal data. As such, the beneficiaries will carry out the
action in compliance with: ethical principles (including the highest standards
of research integrity); and applicable international, EU and national law.
Beneficiaries will ensure respect for people and for human dignity and fair
distribution of the benefits and the burden of research, and will protect the
values, rights and interests of the participants. 2

All partners are aware of the H2020 Rules of Participation (Sections 13, 14)
and the Ethics clauses in Article 34 of the Grant Agreement and the obligation
to comply with ethical and research integrity principles set out therein and
explained in the annotated Model Grant 3

Agreement . The project will respect the privacy of all stakeholders and
citizens and will seek free and fully informed consent where personal
identifiable data is collected and processed. Processing of personal data will
respect the Data Protection Principles.

Data provided by the project will support a range of goals, such as improving
dissemination and exploitation of data and results; improving access and reuse
of research data; and knowledge sharing with citizens, the wider public,
interested stakeholders, and the scientific community. Documentation and
research data repositories will follow the H2020 best practice, with a focus
on open access, peer-reviewed journal articles, conference papers, and
datasets of various types.

This document is based on the main formal project description of the Grant
Agreement and additional documentation built so far in the project. The
+CityxChange project is part of the H2020 SCC01 Smart Cities and Communities
Programme. The related documents for the formal project description are the
Grant Agreement Number 824260 - CityxChange “Positive City ExChange”
(Innovation Action) entered into force 01.11.2018, including the core
contract, Annex 1 Part A (the Description of Action, DoA: beneficiaries, work
packages, milestones, deliverables, budget), Annex 1 Part B (Description of
project, work, background, partners), Annexes (Supporting documentation,
SEAPs, BEST tables, Dataset mapping, etc.), and Annex 2 - Budget. In addition,
the Consortium Agreement of +CityxChange, entered into force 01.11.2018,
details the Consortium Governance and relations of beneficiaries towards each
other. It includes IP-relevant background, including existing data sources.
The parts about open data, security, and privacy processes are taken from the
internal living documentation on ICT governance.

  2. REGULATION (EU) No 1290/2013 (Rules for participation and dissemination in H2020) https://ec.europa.eu/research/participants/data/ref/h2020/legal_basis/rules_participation/h2020-rule s-participation_en.pdf 

  

  3. EU Grants: H2020 AGA — Annotated Model Grant Agreement: V5.0 – 03.07.2018 General MGA 

  

  

For the role of the Data Manager, the Coordinator has appointed the Project
Manager. As part of the responsibilities of the Project Management Team, the
Data Manager will review the +CityxChange Data Management Plan and revise it
annually or when otherwise required with input from all partners.

This public document describes the current status of the DMP at the time of
delivery,

October 2019. It will be refined by future deliverables of the DMP and updates
in individual

Work Packages, especially around ICT in WP1 and Monitoring & Evaluation in
WP7.

This document represents the current state of the DMP document and supersedes
the previous document, D11.5: Data Management Plan - Initial Version, to which
this is an update. Specific changes to the previous version are as follows:

  * Updates on city processes 

  

  * Updates from a workshop at Consortium Meeting 

  

  * Updates from T1.1/T1.2 work on ICT ecosystem and integration 

  

  * Added initial project-specific partner processes 

  

#  2 Ethics, Privacy, and Security Considerations

+CityxChange is an innovation action. It is a complex, cross-sectoral, and
interdisciplinary undertaking that involves stakeholders from widely varying
backgrounds. Furthermore, it is a city-driven project, putting cities and
their citizens in the focus.

This means that a majority of data collection and human participation happens
through activities around automated data collection in energy and mobility
scenarios, monitoring and evaluation, as well as citizen participation,
stakeholder engagement, events or peer-to-peer exchanges in developing and co-
creating innovative solutions. The approach and structure of the project leads
to diverse data being collected and generated using a range of methodologies.
As the data is heterogeneous, a number of methodologies and approaches can be
used.

##  Ethics Considerations

Most of the 11 Demonstration Projects in the +CityxChange Lighthouse Cities
will require data processing and most require evaluation involving human
research subjects and the collection of personal data. The ethics self-
assessment and Ethics Summary Report identified three ethical issues: 1) human
participation, 2) personal data collection of data subjects, and 3) potential
tracking or observation of participants. Details on these are given in D12.1
and D12.2 and summarised below.

The details for each demonstration case are summarised in the following table
(from

D12.1).  
  
<table>  
<tr>  
<th>

Identified Demonstration Projects

</th>  
<th>

Human

Participants

</th>  
<th>

Collection of personal data

</th>  
<th>

Tracking or observation of participants

</th> </tr>  
<tr>  
<td>

Residential, office, multi-use buildings, Norway

</td>  
<td>

X

</td>  
<td>

X

</td>  
<td>

X

</td> </tr>  
<tr>  
<td>

Energy data, building level, Norway

</td>  
<td>

X

</td>  
<td>

X

</td>  
<td>

X

</td> </tr>  
<tr>  
<td>

Energy data, system level, Norway

</td>  
<td>

X

</td>  
<td>

X

</td>  
<td>

X

</td> </tr>  
<tr>  
<td>

Transport data, Norway

</td>  
<td>

X

</td>  
<td>

X

</td>  
<td>

X

</td> </tr>  
<tr>  
<td>

Community Engagement, Norway

</td>  
<td>

X

</td>  
<td>

X

</td>  
<td>

X

</td> </tr>  
<tr>  
<td>

Residential, office, multi-use buildings, Ireland

</td>  
<td>

X

</td>  
<td>

X

</td>  
<td>

X

</td> </tr>  
<tr>  
<td>

Energy data, building level, Ireland

</td>  
<td>

X

</td>  
<td>

X

</td>  
<td>

X

</td> </tr>  
<tr>  
<td>

Energy data, system level, Ireland

</td>  
<td>

X

</td>  
<td>

X

</td>  
<td>

X

</td> </tr>  
<tr>  
<td>

Transport data, Ireland

</td>  
<td>

X

</td>  
<td>

X

</td>  
<td>

X

</td> </tr>  
<tr>  
<td>

Community Engagement, Ireland

</td>  
<td>

X

</td>  
<td>

X

</td>  
<td>

X

</td> </tr> </table>

All activities within +CityxChange will be conducted in compliance with
fundamental ethical principles and will be underpinned by the principle and
practice of Responsible Research 4 and Innovation (RRI) . RRI is important in
the Smart City context where projects work to transform processes around
cities and citizens. Through the +CityxChange approaches of Open Innovation
and Quadruple Helix collaboration, societal actors and stakeholders will work
together to better align the project outcomes with the general values, needs
and expectations of society. This will be done throughout the project, with a
focus within WP9 and WP10 and the city Work Packages. The project uses open
data and openness as part of Open Innovation 2.0 and for stakeholder
participation through measures such as open data, open licences, public
deliverables, hackathons, outreach, living labs, existing innovation labs.

The consortium confirms that the ethical standards and guidelines of Horizon
2020 will be rigorously applied, regardless of the country in which the
research will be carried out, and that all data transfers will be permissible
under all necessary legal and regulatory requirements. This was detailed in
D12.1 and D12.2 and will be followed up in the following section. No major
changes from the status of D11.5 have taken place.

All proposed tasks are expected to be permissible under the applicable laws
and regulations, given proper observance of requirements. Where appropriate
information and consent of all stakeholders and citizens is mandated, the
consortium will ensure that all necessary procedures are followed,
particularly with regard to the signing, collation, and storing of all
necessary Informed Consent Forms prior to the collection of any data. All
involved stakeholders and citizens will be informed in detail about measures
and the consortium will obtain free and fully informed consent.

All necessary actions will be taken within the project management and by all
beneficiaries to ensure compliance with applicable European and national
regulations and professional codes of conduct relating to personal data
protection. This will include in particular

4  EU H2020 Responsible research & innovation

https://ec.europa.eu/programmes/horizon2020/en/h2020-section/responsible-
research-innovation

Directive 95/46/EC regarding data collection and processing, the General Data
Protection Regulation (GDPR, 2016/679), and respective national requirements,
ensuring legal and regulatory compliance. Ethics considerations will feed into
research and data collection protocols used in the project. This will include
collection and processing of personal data as well as surveys and interviews.
For all identified issues, in line with the above standards, ethical approvals
will be obtained from the relevant national data protection authorities and/or
institutional boards.

In line with existing regulations by the university partners relevant for
social science research, the mapping of the ID and the person will be
safeguarded and will not be available to persons other than the ones working
with the data. This will minimise the risks of ethical violations. Since data
stemming from other kinds of research might be de-anonymized and reconnected
to a person, discipline-specific study designs aim to mitigate or remove this
risk as well for different types of data collection. Results may be used in
anonymised or aggregated form for analysis and subsequent publication in
project reports and scientific papers. All beneficiaries will handle all
material with strict care for confidentiality and privacy in accordance with
the legal and regulatory requirements, so that no harm will be done to any
participants, stakeholders, or any unknown third parties. NTNU as the
coordinator has internal guidelines that comply with GDPR and these will be
followed in its data management.

In addition to relevant national data protection authorities, the university
partners have separate institutional ethics boards or respective national
research boards, which will ensure the correct implementation of all human
participation and data protection procedures and protocols around social
science research. In detail, this includes for Ireland the University of
Limerick Research Ethics Governance and respective Faculty Research Ethics
Committees, and for Norway the Norsk samfunnsvitenskapelig datatjeneste (NSD)
-

National Data Protection Official for Research.

As an example for NTNU processes, we describe sample guidelines for
interviews: Let’s assume that the interviewees' quotations will include their
role and the date of interviews. Before interviews will be conducted, the
interviewees will be asked to sign a letter of consent, in which they certify
that they are aware that the interview will be recorded, and the resulting
report will reflect their role and the date of interviews, unless interviewees
wish to say something off the record. Those parts will be quoted as anonymous.

In addition, the researchers will store the collected data in a safe place and
in the personal computer, which is secured with a passcode. The interviewees
will also be informed that the information would be kept secret and
inaccessible. In Norway, any individual researcher is obliged to familiarize
himself/herself with the Research Ethics Act, research ethics guidelines and
information from the Norwegian Social Science Data Services (NSD) concerning
the Data Protection Official scheme and processing personal data and must
submit the respective notification form at least 30 days prior to commencing
data collection. Therefore, the NSB report will be provided before the data
collection process. The Lighthouse Cities Limerick (IE) and Trondheim (NO)
will closely collaborate with their local universities. The Follower Cities
Alba Iulia (RO), Písek (CZ), Smolyan (BG), Sestao (ES), and Võru (EE) will
follow similar procedures for any potential replication of demonstration
projects. Details will be developed within the respective tasks, initially in
WP3, and input into ongoing versions of this DMP.

##  Ethics Requirements and Confirmations

Recruitment and informed consent procedures for research subjects will fulfil
the following requirements (cf. D12.1):

  1. The procedures and criteria that will be used to identify/recruit research participants. 

  

  2. The informed consent procedures that will be implemented for the participation of humans. 

  

  3. Templates of the informed consent/assent forms and information sheets (in language and terms intelligible to the participants). 

  

  4. The beneficiary currently foresees no participation of children/minors and/or adults unable to give informed consent. If this changes, justification for their participation and the acquirement of consent of their legal representatives will be given in an update of the DMP and relevant documentation within the respective tasks. 

  

  

In addition, for the processing of personally identifiable data the following
requirements will be observed (cf. D12.2):

  1. The contact details of the host institution’s DPO are made available to all data subjects involved in the research. Data protection policy for the project will be coordinated with the 

  

  

DPO.

  2. A description of the technical and organisational measures that will be implemented to safeguard the rights and freedoms of the data subjects/research participants as well as a description of the anonymisation/pseudonymisation techniques that will be implemented. 

  

  3. Detailed information on the informed consent procedures linked to the above in regard to data processing. 

  

  4. Templates of the informed consent forms and information sheets (in language and terms intelligible to the participants) linked to the above regarding data processing. 

  

  5. The project currently does not foresee profiling. In case this changes, the beneficiary will provide explanation how the data subjects will be informed of the existence of the profiling, its possible consequences and how their fundamental rights will be safeguarded in an update of the DMP. 

  

  6. The beneficiaries will explain how all of the data they intend to process is relevant and limited to the purposes of the research project (in accordance with the ‘data minimisation’ principle). 

  

  7. The project does not foresee the case of further processing of previously collected personal data. In case this changes, an explicit confirmation that the beneficiary has lawful basis for the data processing and that the appropriate technical and organisational measures are in place to safeguard the rights of the data subjects will be submitted in an update to the DMP. 

  

  

##  Recruitment of Participants and Informed Consent Procedures

The project will engage with a multitude of participants and stakeholders in
different Work Packages and Tasks. This runs from an open to highly targeted
activities, co-creation workshops, citizen engagement, outreach activities,
stakeholder and citizen groups, and other activities. The Deliverable on Human
Participants D12.1 H - Requirement No. 1 has described general guidelines on
the processes to be used. The current drafts of informed consent forms are
shown in the Annex of D12.1. The updates to these will be included in future
versions of this DMP.

More detailed requirements and documentation will be generated before the
start of any activity involving participation of humans being the subjects of
the study, while fully operating within local, national, and EU regulations.
These forms will be detailed and tailored to the individual demonstration
projects within the Lighthouse cities, in the official language of the
country/city where the demonstration takes place, and include demonstration-
specific aspects and referring to the relevant regulations on data protection
and/or other legislation if applicable.

For all applicable physical meetings and consortium events we will inform
participants that pictures will be taken, and participants will have to
actively consent to, with an option to opt out from pictures being used in
project specific communication. It also concerns photographic evidence of
events, demonstrations, etc. that is done throughout the project and may be
needed for documentation of task and milestone completion. This will also be
taken up with WP10 on communication and WP9 on inter-project collaboration
with regards to documentation of events.

##  Data Privacy and Personal Data

Detailed requirements and descriptions of the technical and organisational
measures that will be implemented to safeguard the rights and freedoms of the
data subjects/research participants will be described by tasks that implement
them. Where necessary, data will be anonymised or pseudonymised.

Data minimisation principles will be followed in line with applicable
legislation. The

56 relevance of data collected for tasks will be considered , .

As the project will include the participation of numerous cities requiring
multiple data measurements per city, the actual project beneficiaries,
external stakeholders and citizens involved will vary between tasks. The
project will respect the privacy of all stakeholders and

  5. H2020 Ethics and Data Protection 

  

  

http://ec.europa.eu/research/participants/data/ref/h2020/grants_manual/hi/ethics/h2020_hi_ethics-d
ata-protection_en.pdf

  6. EU, Principles of the GDPR: What data can we process and under which conditions? 

  

  

https://ec.europa.eu/info/law/law-topic/data-protection/reform/rules-business-
and-organisations/pri nciples-gdpr/what-data-can-we-process-and-under-which-
conditions_en

citizens and will seek free and fully informed consent where personally
identifiable data is collected and processed as described above, implementing
suitable data handling procedures and protocols to avoid potential
identification of individuals. This process will include participants’ data in
activities that use techniques such as questionnaires, interviews, workshops,
or mailing lists as well as automatic building, energy, and mobility data
collection.

The +CityxChange consortium is aware of potential issues arising from data
aggregation from different sources, scales, flows, and devices. Data collected
in the project will thus be anonymised and aggregated as close to the source
as possible. In certain cases, personal data avoidance and minimisation can
eliminate and/or reduce identifiability. For example, energy consumption with
a high temporal resolution can be used to identify personal daily patterns and
routines when gathered at an individual household level. Aggregate data either
with lower temporal resolution (e.g. once a day) or with a lower geographical
resolution (e.g. energy consumption on a district level as is directly
available for energy providers) mitigates this risk. The same approach will be
implemented for mobility data, which can incorporate a much higher level of
personal information and will need to be treated with adequate anonymisation
and aggregation methods.

##  Data Protection Officers and GDPR compliance

As Coordinator and host institution, NTNU confirms that it has appointed a
Data Protection Officer (DPO) and the contact details of the DPO will be made
available to all data subjects involved in the research (see D12.2).

Respective partners will also follow their internal data protection and
European GDPR  2  regulations. In line with GDPR, individual beneficiaries are
responsible for their own data processing, so the respective beneficiaries are
to involve their own DPOs, who will ensure the implementation and compliance
of the procedures and protocols in line with internal processes and national
regulations. This also includes options to withdraw consent and procedures
that must be in place to deal with privacy violations in a timely manner.
Processing of personal data will respect the Data Protection Principles as set
out:

Lawfulness, fairness and transparency; Purpose limitation; Data minimisation;
Accuracy;

Storage limitation; Integrity and confidentiality; accountability.

Each beneficiary is reminded that under the General Data Protection Regulation
2016/679, the data controllers and processors are fully accountable for the
data processing operations, which means that every beneficiary is ultimately
responsible for their data collection and processing. Any violation of the
data subject rights may lead to sanctions as described in Chapter VIII,
art.77-84.

##  Data Security

The beneficiaries will implement technical and organisational measures to
ensure privacy and data protection rights in the project.

All ICT systems to be developed will be designed to safeguard collected data
against unauthorized use and to comply with all national and EU regulations.
Engineering best practices and state-of-the-art data security measures will be
incorporated as well as GDPR considerations, and respective guidelines and
principles. Ultimately, each partner is responsible for their own information
security in developed systems, but for overall guidelines, replication
blueprints, and documentation, the ICT ecosystem architecture (WP1, T1.1/T1.2)
will incorporate this aspect in the overall development as part of data
governance in D1.2: Report on the architecture for the ICT ecosystem, due in
M24 and currently under development.

Information security management, which is central to the undertaking of the
project, will follow the guidelines of relevant standards, e.g., ISO/IEC 27001
and 27002 (Code of practice for information security management), to ensure
confidentiality, integrity, and availability. It will additionally include the
Directive on security of network and information systems (‘Cybersecurity
directive’, NIS-Directive 2016/1148) on the security of critical
infrastructures and the ePrivacy Directive 2002/58, as well as European Union
Agency for Network and Information Security (~) guidance. In addition, data
storage will fully comply with the national and EU legal and regulatory
requirements. Partners will ensure and document that used cloud infrastructure
complies with applicable regulations.

##  City Processes on Privacy and Security

All project beneficiaries have existing and operational policies regarding
potential ethics issues as well as privacy and security regulations or will
ensure their provision for the tasks where they are necessary.

In addition to the cities, the solution providers in +CityxChange have their
own data protection routines established in their existing operations and in
their development and test activities of the project. They are responsible to
establish compliance with GDPR and other data protection and security
regulations. They will further support and implement guidelines from/with the
ICT tasks in WP1 and this DMP.

In the following, we discuss overall city procedures. Details on Demo Projects
and partners will be given in further updates of this DMP as far as they can
be made available.

TK is currently in the process of establishing a formal privacy policy. It
uses internal tools to ensure internal control and audit and to keep track of
all processes around personal data. TK will ensure that it has legal consent,
updated routines, valid risk and vulnerability analysis, in compliance with EU
and Norwegian law. It has a Data Protection Officer (DPO) responsible for the
municipality and an assistant DPO in each business area, following National
Datatilsynet  3  regulations. Following these regulations, TK has a project
under the municipal director of organization to ensure compliance with GDPR,
and future Norwegian personal data privacy act regulations; TK continuously
aims to maintain compliance. TK has a strong focus on privacy and security
when it comes to ICT systems, including IoT, encryption, etc. Work is based on
ISO 27001 and it complies with all relevant national and EU policies. It has a
dedicated role of Security Architect and relies on an operational provider for
the internal cloud, who is bound by SLAs. TK is one of the initiators and is
participating in the Norwegian municipal sector (KS) investigation by
municipal-CSIRT (Computer Security Incident Response Team). CSIRT is one of
the key elements of the NIS directive.

LCCC has updated its Data Protection Policy to one that is in line with GDPR
and the Data

Protection Act 2018. A new role has been created for GDPR compliance for the
Data Protection Officer - DPO. An existing staff member with auditing
experience has been appointed to the full time role and will ensure compliance
with the requirements of the Irish Data Protection Commissioner  4  5  ​. The
DPO is currently auditing the organisation for

GDPR compliance. This work is being carried out in conjunction with the
Digital Strategy Programme Manager. LCCC is currently reviewing its Data
Processors Agreements with all its suppliers that access data. A database of
data sets, access, security, business processes, anonymisation etc. is being
documented through this audit and captured into the organisation's CRM system.
LCCC has strict security policies to protect its systems and data, handled by
the ICT Network Team. LCCC complies with the NIS directive by taking
appropriate technical and organisational measures to secure network and
information systems; taking into account the latest developments and consider
the potential risks facing the systems; taking appropriate measures to prevent
and minimise the impact of security incidents to ensure service continuity;
and notifying the relevant supervisory authority of any security incident
having a significant impact on service continuity without undue delay.

Alba Iulia Municipality is compliant with the Data Protection Regulation (EU)
2016/679. It implemented the process of a formal privacy policy. The
municipality elaborated privacy policy notifications for every employee
regarding the new Data Protection Regulation and dedicated a section in the
official web page. Internal tools will ensure internal control and audit and
to keep track of all processes around personal data. Alba Iulia will ensure
that it has legal consent, updated routines, valid risk and vulnerability
analysis, in compliance with EU and Romanian law. A Data Protection Officer
(DPO) is appointed for all the municipality departments in line with GDPR and
ensures compliance with national regulations by the 10

National supervisory Authority for personal data processing . AIM follows its
security policy for ICT use within the municipality organized by the IT team
and the head of IT, with outsourced contract for server management and
maintenance, and the latest audit carried out in 2018. The NIS Directive was
transposed into local law, aligning Romania with the common European framework
for responding to cyber security incidents.

Písek has developed an analysis of municipal processes and its compliance with
GDPR. The

City Council approved an inner policy directive for GDPR on 2018-10-05
(decision no.

290/18). A role of DPO is assigned since 01.03.2018 in the City Bureau, in
line with the 11 national Office for Personal Data Protection and the Act No.
101/2000 Coll., on the Protection of Personal Data (currently amended to meet
the GDPR conditions). The Security

Policy and IS Security Management Plan is handled by the IT department and the
IT

Management Committee in reference to Act No. 365/2000 Coll., On Public
Administration

Information Systems, by the IT Management Committee. The NIS Directive is
reflected in Act No. 181/2014 Coll., on Cyber Security, the Decree of the
National Security Authority (NBÚ)

No. 316/2014 Coll., the Cyber Security Order; Decree of NBÚ and Ministry of
the interior

(MVČR) No. 317/2014 Coll., on Important Information Systems and their
Criteria.

The Municipality of Sestao and Sestao Berri are complying with all relevant
regional, national, and European legislation around data security and privacy
in line with the Spanish 12 13 data protection authority AGPD and the Basque
data protection authority AVPD . The latter is working on guides for the
adaptation of public administrations to the General Data Protection Regulation
(GDPR) for the Basque municipalities. The respective Spanish regulations are
followed (Organic Law 3/2018, of December 5, on the Protection of Personal

Data and guarantee of digital rights  14  ).

The data protection role (Delegado de Protección de Datos) is taken by the
General Register of the City of Sestao (Registro General del Ayuntamiento de
Sestao). Detailed data handling for different data sources of the municipality
is described in an extensive list on 15 data use, justification, and rights.

In Smolyan, the policies for information security management are part of the
Integrated

Management System of the Municipality; they comply with the international
standards ISO

9001: 2008, ISO 14001: 2004 and ISO 27001: 2013 for which the municipality is
certified. They are implemented by the Information Security Working Group. A
Personal Data Protection System, complying with Regulation (EC) 2016/679 of
the European Parliament and of the Council of 27 April 2016 has been adopted
by the Municipality of Smolyan. The system has been documented, implemented
and maintained through 9 procedures/policies that include internal
regulations, technical and organizational measures, which the Municipality of
Smolyan applies. The system for protection of personal data is approved by
Order № РД - 0455 / 23.05.2018 of the Mayor of Smolyan

11  Úřad pro ochranu osobních údajů, Czech Republic, https://www.uoou.cz/en/
12  Agencia Española de Protección de Datos - AGPD, Spain,
https://www.aepd.es/

  13. Agencia Vasca de Protección de Datos - AVPD, Basque Country, http://www.avpd.euskadi.eus/s04-5213/es/ 

  

  14. Ley Orgánica 3/2018, de 5 de diciembre, de Protección de Datos Personales y garantía de los derechos digitales, https://www.boe.es/buscar/doc.php?id=BOE-A-2018-16673  15  http://www.sestao.eus/es-ES/Institucional/Paginas/informacion-adicional.aspx 

  

  

Municipality. It is constantly improving both in the case of significant
changes in the legal framework and in other related circumstances.

A DPO has been appointed, following regulations from the Commission for
Personal Data

Protection  16  and working with the Information Security Working Group. The
Personal Data Administrator is responsible for the compliance of the
processing of personal data, as required by European and national legislation.

It links with the Bulgarian Law for protection of personal data (The Privacy
Act) and the Act for Access to Public Information. A Network Security
Management and Remote Access Policy is based on ISO 27001:2013 with respect to
the protection of the information on the network, the supporting
infrastructure and the establishment of rules for configuring the internal
servers owned and managed by the municipality of Smolyan. It connects to the
Management Policy of the Municipality of Smolyan as well as a total of nine
Information

Security Management Policies, which are part of the Integrated Management
System of the

Municipality.

Võru follows its own privacy policy with its ISKE working group and data
protection working group. Specialists have additional tasks to supervise
implementation of the privacy policy in 17 the organisation, following the
rules of the Estonian Data Protection Inspectorate . The DPO has mapped the
current situation, and works with documentation and suggests changes if
needed. The national principles are observed, in the coordination of the
respective draft law, including recommendations from the Information Systems
Authority.

##  Project-Specific Partner Processes on Privacy and Security

###  Building data and stakeholder/citizen engagement

For a number of tasks within the PEB for Limerick, data from building owners
is needed, for example yearly or monthly energy bills, and floorplans or
detailed blueprints of buildings. At later stages, detailed personal data may
be needed as well. Data has been difficult to obtain from the building owners,
and the level of approvals required from different parties was at a level not
previously anticipated. In addition, these activities needed to be aligned
with, plans and actions for citizen engagement, so that building owners were
not surprised by the request and can react positively to it,​ in line with
overall stakeholder engagement by the project and overall alignment​. This
also shows that collecting data is a part of overall interaction with the
communities and needs to be integrated into those plans. An overall

MoU is being developed for interactions with building owners.

Collecting data is a part of interaction with the communities.

  16. Комисия за защита на личните данни, Bulgaria, https://www.cpdp.bg/en/ 

  

  17. Andmekaitse Inspektsioon, Estonia, https://www.aki.ee/en 

  

  

Relevant risks on data availability and GDPR compliance in collecting data
have been added to the project risk table.

###  Data Privacy Impact Assessments

As part of the project work, Limerick is planning a Data Privacy Impact
Assessment (DPIA) for WP4. This process may be replicated later by the other
cities.

Main questions include:

  * Is personal data protected? 

  

  * How can we manage this? 

  

  * In what scenarios will we collect data? 

  

  * What Smart Grid application are we building? 

  

  * Status of a Data Controller or a Data Processor needs to be clarified with energy partners 

  

In addition, partners are examining the Data Protection Impact Assessment
Template for Smart Grid and Smart Metering systems (2018)  6  . Specifically,
for the Smart Grid applications, non-exhaustive examples of Personal Data
which gives rise to conduct a DPIA, would be: Consumer registration data,
Usage data (energy consumption, in particular household consumption, demand
information and time stamps), as these provide insight in the daily life of
the data subject, Amount of energy and power provided to grid (energy
production), as they provide insight into the amount of available sustainable
energy resources of the Data Subject, Profile of types of consumers, as they
might influence how the consumer is approached, Facility operations profile
data (e.g. hours of use, how many occupants at what time and type of
occupants), Frequency of transmitting data (if bound to certain thresholds),
as these might provide insight in the daily life of the data subject, Billing
data and consumer’s payment method

###  Workshop on Privacy and Smart City Data Model Structure

At the Consortium Meeting in Limerick on 23rd of October 2019, a workshop was
held on privacy and Smart City Data Model Structure. It focused on knowledge
sharing, challenges, and identification of possible solutions.

During this workshop 6 main points were discussed in relation to data
management and interoperability of the systems developed as part of the
project:

  1. Enterprise Architecture, 

  

  2. Data integration, 

  

  3. City Data, Open data portals, APIs, 

  

  4. Data Protection Impact Assessments 

  

  5. Informed consent 

  

  6. DMP and open research data 

  

  

During the project multiple partners will be creating new services, which need
to use data. How do we ensure data exchange between partners in the long term:
maybe responsibility can be fortified by data exchange contracts? We also need
to create a story for citizens to understand how the enterprise architecture
is applied in order to protect their personal data and interests. The new
services and solutions developed by +CityxChange for the LHCs will further
have to be replicated to the FCs. As stated above, the project will follow the
EU rules on GDPR. ​The legal basis for Personal Data Processing must always be
identified. Details on the discussion of DPIAs have been detailed in the
subsection above.

#  3 Data Management, Sharing and Open Access

+CityxChange will distinguish four key categories of data arising from the
project:

  * **underlying research data​** : data necessary for validation of results presented in scientific papers, including associated metadata, which works hand in hand with the general principle of openness of scientific results. The consortium will provide timely open access to research data in project-independent repositories and link to the respective publications, to allow the scientific community to examine and validate the results based on the underlying data. +CityxChange has a commitment to publish results via Gold Open Access and has allocated a budget for it. The deposition of research data will depend on the type and channel of publication, ranging from associating data with a publication at the publisher, university or national research data repositories, or the use of the OpenAIRE infrastructure, following the H2020 best practice, with particular focus on peer-reviewed journal articles, conference papers, and datasets of various types. 

  

  * **operational and observational data​** : This category includes curated or raw data arising from the implementation, testing, and operation of the demonstrators (operational data), and data from related qualitative activities, such as surveys, interviews, fieldwork data, engagement activities (observational data). +CityxChange will make this data available in coordination with the ICT ecosystem and respective partner repositories, opening it up for project partners and stakeholders, and to citizens and interested third parties to support engagement and innovation (WP3), where possible and allowed under regulations and privacy issues. 

  

  * **monitoring and evaluation data​** : This data will specifically be captured to track 

  

KPIs of the project performance in WP7 and will be regularly reported and
published 19 to the Smart Cities Information System (SCIS) in a clearly
defined and open way. In addition, monitoring data will be available in the
project’s M&E system (for system and data description, see D7.3: Data
Collation, Management and Analysis Methodology Framework; D7.4: Monitoring and
Evaluation Dashboard; ongoing reporting will be described in D7.5: Data
Collection and Management Guideline Reports 1; D7.6: Reporting to the SCIS
system 2; and the subsequent Deliverables).

  * **documentation, instruments, and reusable knowledge​** : This concerns general and specific documentation of the project and demonstration/implementation projects, including tools, methods, instruments, software, and underlying source code needed to replicate the results. A number of collaboration and document management tools will be used, ranging from collaboration solutions, source code repositories (e.g. git) over document stores to the project website (WP10). Clean and consistent documentation and publication will support dissemination impact. All public Deliverables will be published on the project website  20  in Open Access with open licenses. 

  

  19. EU Smart Cities Information System (SCIS) http://smartcities-infosystem.eu/ 

  

  20. +CityxChange Knowledge Base: https://cityxchange.eu/knowledge-base/ 

  

  

##  Data Handling Descriptions

Apart from other mechanisms within the project, such as communication,
outreach, citizen participation, peer-to-peer learning workshops and networks,
measures such as sharing of data, documentation, and results will be an
important contributing factor to the project goals. The project will ensure
that research data is ‘findable, accessible, interoperable and reusable’
(FAIR), in line with the H2020 Guidelines on FAIR Data Management.

The following describes the guidelines and expectations for relevant data sets
along with detailed description, metadata, methodology, standards, and
collection procedure. Further details are types of data, data formats and
vocabularies, storage, deadlines for publication, data ownership rules, and
detailed decisions regarding data management and protection. Issues to be
defined will be, for example, the confidentiality needs of utility providers,
the privacy needs of citizens, commercialisation and cybersecurity issues,
together with general ethical, legal, and regulatory considerations and
requirements.

At the time of delivery, most tasks have not yet fully defined the type and
structure of the data that they need or will generate or can make available.

Part of these tasks is also considered and documented in the overall ICT
ecosystem architecture and interface Tasks (T1.1 and T1.2) and in the KPI
development and data collection in WP7 on Monitoring and Evaluation. Regarding
data governance, main areas of concern are Open data, Open data models, Clear
definitions of data ownership and accessibility, Data audit process to support
transparency, Change management guidelines to track the data changes,
Standardised rules and guidelines.

As part of the DMP, storage, processing, protection, dissemination, retention,
destruction will be collected and documented.

For this, individual Tasks within the Work Packages will specify and implement
approaches related to data collection, management, and processing measures
that are most appropriate based on data avoidance, especially concerning
personally identifiable aspects of data sets, in coordination with Task T11.6
for the DMP.

Individual data collection will be handled by the involved partners and cities
in the Work Packages, keeping much data processing close to the source and
within the originating partners, while providing a loosely coupled overall
architecture through suitable architecture choices and guidelines.
Architectural details will be described by the ICT ecosystem Tasks T1.1, T1.2
in WP1.

To ensure maximum use and quality of open research data and re-use of existing
data for example from city Open Data Portals, the project will base much of
the internal collaboration on structured research data sets collected in
standardized formats in collaboration with WP1/2/3, WP7 and WP10/11. This will
help ensure that deposited datasets can be evaluated internally as well
regarding their use for the scientific community (‘dogfooding’, and
organisation using its products and services also internally. In this case,
also avoiding duplicate work by making as much data as possible available in
structured formats for internal use and external dissemination). Such an
approach should also support outreach activities such as hackathons, by
enabling low-barrier access for external stakeholders. Where possible,
research data and associated metadata (standardised as Dublin Core, W3C DCAT,
or CSVW) will be made available in common standard machine-readable formats
such as Linked Open Data (LOD) in coordination with T1.2, enabling it to be
linked to other public datasets on the Web and to facilitate discovery and 21
automatic processing. Example approaches include the ESPRESSO framework , Open
ePolicy Group, and others, to be detailed in WP1. In addition, data must also
be interoperable to facilitate ease of access and exchange. As set out in the
new EU 22

‘Interoperability Framework’ , this is vital to the functioning of pan-
European business and to impact for H2020 projects.

For all tasks, digital copies of all data will be stored for a minimum of
three years after the conclusion of the grant award or after the data is
released to the public, whichever is later. All information and data gathered
and elaborated will be suitably described in the respective Deliverables. All
public Deliverables will be made available and archived on the project website
and through the EU Community Research and Development Information 23

Service (CORDIS) for the project . The project aims to make research data and
publications freely available through Open Access and suitable repositories.

Pending detailed descriptions, the following table shows the data handling
summary template for use within the DMP and within Tasks for documentation:

  21. Espresso – systEmic standardisation apPRoach to Empower Smart citieS and cOmmunities http://espresso.espresso-project.eu/ 

  

  22. The New European Interoperability Framework | ISA² - Promoting seamless services and data flows for European public administrations, 2017, https://ec.europa.eu/isa2/eif_en 

  

  23. Positive City ExChange | Projects | H2020 | CORDIS | European Commission, https://cordis.europa.eu/project/rcn/219210/factsheet/en 

  

  

Template for data handling and management summary (to be made into a table in
the shared document space when examples are available)  
  
<table>  
<tr>  
<th>

Task/Demo/Activity

</th>  
<th>

Task Name/Demo Name/Task Links

</th> </tr>  
<tr>  
<td>

Description

</td>  
<td>

</td> </tr>  
<tr>  
<td>

Purpose and relevance of data collection and relation to objectives

</td>  
<td>

</td> </tr>  
<tr>  
<td>

Methodology

</td>  
<td>

</td> </tr>  
<tr>  
<td>

Data source, data ownership

</td>  
<td>

</td> </tr>  
<tr>  
<td>

Standards, data formats, vocabularies

</td>  
<td>

</td> </tr>  
<tr>  
<td>

Storage

</td>  
<td>

</td> </tr>  
<tr>  
<td>

Security & Privacy considerations

</td>  
<td>

</td> </tr>  
<tr>  
<td>

Exploitation/Dissemination

</td>  
<td>

</td> </tr>  
<tr>  
<td>

Dissemination Level,

Limitations, Approach, Justification

</td>  
<td>

</td> </tr>  
<tr>  
<td>

Stakeholders

</td>  
<td>

</td> </tr> </table>

##  Access Rights and Procedures

In line with the Consortium Agreement and the Grant Agreement, research
results are owned by the partner that generates them. However, the stated aim
is to make data and results publicly available, whenever possible. Further
access rights and regulations are set forth in the Consortium Agreement as
rights and obligations of partners. In particular, Consortium partners will
give each other access to data that is needed to carry out the project.
Partners will furthermore give each other access under fair and reasonable
conditions to exploit their results. For other affiliated entities, access can
be granted under fair and reasonable conditions for data and research output,
as long as it is not covered by the Open Access conditions, provided such
access is in line with the project goals and confidentiality agreements. Data
published or otherwise released to the public will include disclaimers and/or
terms of use as deemed necessary.

The protection of intellectual property rights, detailed terms for access
rights, and collective and individual exploitation of IP are agreed upon in
the Consortium Agreement (Section 8 page 19, Section 9 page 21, Section 10
page 26) and Grant Agreement (Section 3, page 43). Some Deliverables will
include project internals which do not need to be public. Some others will
include detailed specifications for the software tools and methodologies;
these will remain confidential as per the Deliverable designation as they
contain potentially patentable information.

Any data relating to the demonstration sites, e.g. metered data, utility bills
will remain the property of the demonstration sites and will only be shared
with the permission of the demonstration site owner. Aggregated data for
purposes of Monitoring and Evaluation will be shared under open licenses (cf.
Section Dissemination).

Software licenses will be aimed to be as open as possible, with Creative
Commons for documentation and GNU-style licenses for software as a default.
For example, GPLv3 (GNU General Public License)  7  , MIT  8  , or Apache  9
10  are open and permissible licenses, with GPL additionally using a share-
alike model for sharing only under the original conditions (reciprocal
license).

Adaptations are expected for commercial partners to be aligned with their IPR
strategy. A balance is needed for openness and need for marketability,
patenting, and other IPR issues.

This will be handled by the industry partners together with the cities, and is
also linked to

WP8 on Replication and the Innovation Manager in the Project Management Team.

##  Open Access to publications

The dissemination activities within the project will include a number of
scientific and other publications. +CityxChange is committed to dissemination
and the principle of Open Access for scientific publications arising from the
project, in line with the H2020 Guidelines to

27

Open Access . It further aims to make research data open as described above. A
budget has been set aside for the academic partners to support gold open
access publishing.

Publication of scientific papers will be encouraged by the +CityxChange
consortium. For cases where it may interfere with seeking protection of IPR or
with publication of confidential information, a permission process for
publishing any information arising from the project is put in place in the
Consortium Agreement. Notification needs to be given at least 45 days before
the publication, with objections subject to the rules of the Consortium
Agreement.

The project aims for Gold Open Access publication of scientific peer-reviewed
papers where possible and will adopt a Green Open Access strategy as a
fallback. At the minimum, this

will include self-archiving of publications in known centralized or
institutional repositories, for example the NTNU institutional archive NTNU
Open  28  the UL Institutional Repository  29  , 30 or OpenAIRE . Authors will
ensure appropriate bibliographic metadata is published as well, where
possible. It will be in a standard format and include the terms "European
Union (EU)" & "Horizon 2020"; the name of the action, acronym & grant number
as below; publication date, length of the embargo period, if applicable; and a
persistent identifier. These requirements are also codified in Article 29.2 of
the Grant Agreement on Open Access.

Authors will aim to retain copyright and usage rights through open licenses,
such as 31

Creative Commons Attribution License (CC-BY 4.0 /CC-BY-SA) or otherwise
publisher agreements to a similar effect will be pursued. Project participants
will ensure that all publications acknowledge the EU H2020 funding and the
name and grant number of the project, including the standard disclaimer as is
also found on the title page of this document (+CityxChange, project number
824260). Deliverables are public by default through a Creative Commons CC-
BY4.0 license. Other CC licenses can be applied after consultation. External
third-party material will be labeled as such, to clearly identify such content
and exclude it from the free use given for consortium-generated material. This
can be done by excluding such content in the general license statement and by
identifying 32 copyright information next to third-party material included in
documents .

##  Open Research Data and Open City Data

Quality-assured data is a cornerstone of scientific research and of industry
and city developments. Research data should be freely, publicly, and
permanently available where possible and appropriate to support validation of
results and re-use of data for example in research, development, and open or
citizen science as well as Open Innovation. 33

+CityxChange participates in the Pilot on Open Research Data (ORD) and will
thus aim to provide open access to raw and aggregated curated datasets. The
project aims to make research data findable, accessible, interoperable and re-
usable (FAIR) in line with the H2020 Guidelines on FAIR Data Management.

  28. https://www.ntnu.edu/ub/research-support/open-access 

  

  29. https://ulir.ul.ie/  30  https://www.openaire.eu/ 

  

  

  31. Creative Commons License Attribution 4.0 International (CC BY 4.0) https://creativecommons.org/licenses/by/4.0/ 

  

  32. For example, in the license label at the beginning: “CC-BY4.0 Creative Commons Attribution, except where otherwise noted.” and a full copyright and attribution next to third-party content in the document. 

  

  

See also the CC guidelines:

https://wiki.creativecommons.org/wiki/Marking/Creators/Marking_third_party_content

  33. H2020 Programme Guidelines to the Rules on Open Access to Scientific Publications and Open 

  

  

Access to Research Data in Horizon 2020

http://ec.europa.eu/research/participants/data/ref/h2020/grants_manual/hi/oa_pilot/h2020-hi-
oa-pil ot-guide_en.pdf

Data will be made accessible for verification and reuse through appropriate
channels and repositories. Limits of access and availability are to be given
in individual data descriptions and will be further developed within the
project with the aim of greater openness.

Where research data is made available, it will be made available in recognized
repositories such as OpenAIRE or Zenondo, or local repositories of
universities or national research institutes, with possible assistance from
national OA desks.

Apart from research data repositories, the partner cities in +CityxChange are
working on or running their own City Open Data Portals, where general data
arising from the project should also be made available. Data may also be
federated into research repositories or other systems. The Lighthouse Cities
have a strong interest in this and will focus on open data through existing or
new projects.

Insight.Limerick.ie is the Limerick Data as a Service platform that integrates
data about

Limerick from multiple sources and provides open access to linked open data
and open APIs at _​ http://insight.limerick.ie/  _ ​. Data is available for
viewing in charts and maps and also as open format downloads. While no formal
open data policy is being enforced, the concept of making data available as
open data is being encouraged throughout the workforce. Open data published
here will also become available in the national open data portal
www.data.gov.ie.

Trondheim has set up an open data portal based on CKAN. It is available at

_ https://data.trondheim.kommune.no  ​ _ .  In TK, there is a general drive
towards making more data available. TK has a wealth of data, and is in the
process of opening up as much non-personally-identifiable data as possible,
even though much data is unfortunately locked in vendors systems without a
proper API to get the data out. TK is part of a national research project
-SamÅpne- that looks into the barriers of opening up municipal data, and is
working on a solution. Data is and will also be made available in the national
open data portal ​  _http://data.norge.no/_

The Follower Cities are working towards Open Data, and are already using a
variety of processes and tools to make data available.

Smolyan uses the National Portal for Open Data, as required by the Access to
Public Information Act. The Open Data Portal is a single, central, public web-
based information system that provides for the publication and management of
re-use information in an open, machine-readable format, along with relevant
metadata:  _https://opendata.government.bg/?q=smolyan_

Písek follows the national level guideline for Open Data publishing and is
preparing its publication plan as part of Smart Písek. Initial solutions are
implemented for new information systems: _ https://smart.pisek.eu/portal.htm
​  l  _

Alba Iulia is building an open data portal as one component of its smart city
portfolio. It is being tested and will be published when sufficient data is
available. Regarding the fact that Open data underpins innovation and out-of-
the-box solutions in any area, Alba Iulia is an early partner in the Open
Energy project, developed by one of the Alba Iulia Smart City Pilot Project -
CivicTech (IT-based NGO). This is the first open energy consumption data
platform in public institutions, having the purpose to monitor this
consumption transparently, which will enable the identification of better
patterns of consumption prediction, facilitate the transfer of good
institutional practices, encourage investment in the efficiency of energy
consumption and in the future will support the taking of responsible
consumption of electricity among the whole society. At this point the open
data platform is not published yet as the partner found some difficulties in
funding the development of this solution. Being a pilot project and with no
financial involvement on behalf of Alba Iulia Municipality, it is dependent
entirely on local partners’ team efforts.

Sestao and Võru currently have no own portals.

The project aims to make anonymised data sets public, but will aim to strike a
balance between publication of data and privacy and confidentiality issues.
When in doubt, the consortium will refrain from publishing raw datasets and
only report aggregate measures. Decisions will be made on a case-by-case basis
by senior researchers to ensure that privacy, anonymity, and confidentiality
are not breached by publication of datasets or any other type of publication.
In addition, ongoing consultation with the relevant Data Protection Offices
will be ensured during the lifetime of the project.

This will also ensure that data is preserved, available, and discoverable. In
any case of data dissemination, national and European legislation will be
taken into account. To ensure free and open access with clear licensing, the
project will mostly adopt Creative Commons licenses ranging from attribution
to share-alike licenses (such as CC-BY 4.0/CC-BY-SA 4.0).

As above, publications will have bibliographic metadata attached where
possible, which is extended to research data. Where possible, research data
and associated metadata will be made available in common standards and
possibly as Linked Open Data. Annotations will be at minimum at the dataset
level, to support interoperability of data.

There is currently no separate operating budget for this, as it will be taken
as part of the budget for website and platform management, use existing
infrastructure at the Coordinator, and the cities will for example achieve
this through their Open Data portals (see next section), other partners, or
will use free and open repositories.

##  Document Management

As noted in the overall consortium plan (D11.1), documents in the consortium
are handled in one overall platform for easy collaboration and findability of
overall project documentation. The project has set up a shared file repository
in the form of an Enterprise installation of Google Drive, including
collaborative editing tools for documents, spreadsheets, and presentations.
The instance is made available by Trondheim Kommune and is compatible with all
applicable regulations. The repository is accessible by invitation. Access
will be granted to registered members of the consortium. Generally, it is not
recommended to share highly sensitive data, on this system.

The handling of sensitive documents will be coordinated with the DPO of the
host partner. The partners have internal repositories and processes for
dealing with such sensitive data and how it can be shared for research (see
also next section on archiving).

Additional sharing and development tools can be set up by specific tasks if
needed, such as version control software that is outside the scope of the
overall platform, but will be documented and linked there.

##  Archiving and Preservation

Deliverables will be archived on the project website. The internal datasets
will be backed up periodically so that they can be recovered (for re-use
and/or verifications) in the future. Published datasets, raw or aggregated,
will be stored within internal and external repositories and thereby ensure
sustainability of the data collection. Records and documentation will be in
line with common standards in the research fields to ensure adherence to
standards, practices, and data quality. Data will be retained for three years
after the conclusion of the grant award or after the data are released to the
public, whichever is later.

The LHCs LCCC and TK together with NTNU as the Coordinator will ensure long-
term data curation and preservation beyond the project period. It will be
implemented as sustainability of the monitoring and evaluation platform and
data. This is linked to WP7 and prepared in T7.6 on migration of the
monitoring system, and as sustainability of the project documentation and
website, linked to WP10 and WP11.

#  4 Dissemination and Exploitation

Disseminating and exploitation of the project outputs and results are an
important step to achieve the project goals. This is done in cooperation with
WP10 on Dissemination and Communication, WP9 on Inter- and Intra Project
Collaboration, WP11 on Project

Coordination, and all partners. As detailed above, data will be made as open
as possible. All consortium partners, together take responsibility for
exploitation and dissemination of results and to ensure visibility and
accessibility of results. Implementing FAIR data principles will support the
openness and re-use of data and therefore dissemination and replication.
Different dissemination channels are estimated to be used and maintained
during and after the project as shown in the following table:  
  
<table>  
<tr>  
<th>

Dissemination type

</th>  
<th>

Usage

</th>  
<th>

Policy

</th> </tr>  
<tr>  
<td>

Website

</td>  
<td>

Main reference point for project dissemination and data description

</td>  
<td>

Creative Commons where applicable. External rights clearly marked.

</td> </tr>  
<tr>  
<td>

Deliverables

</td>  
<td>

Deliverables to the EU and the public. Disseminated through the project
website cityxchange.eu and the EU

Cordis system.

</td>  
<td>

Dissemination level set per deliverable, public by default and open with
Creative Commons Attribution CC-BY4.0. 86% of 148 deliverables are public, 20
are confidential.

</td> </tr>  
<tr>  
<td>

Social Media

</td>  
<td>

Support of communication

activities

</td>  
<td>

To be decided. Creative

Commons where applicable.

</td> </tr>  
<tr>  
<td>

Newsletters

</td>  
<td>

Regular updates and links to website and other channels

</td>  
<td>

Creative Commons where applicable.

</td> </tr>  
<tr>  
<td>

Publications

</td>  
<td>

Scientific and other publications arising from the project

</td>  
<td>

Open Access to publications as detailed above.

</td> </tr>  
<tr>  
<td>

Benchmarking, Monitoring & Evaluation, KPIs

</td>  
<td>

Monitoring of indicators for project and city performance

</td>  
<td>

Aggregate KPI data can be openly and publicly reported to SCIS, in line with
the overall SCIS policy and license (updated with the updated SCIS license for
dissemination). Limitations due to privacy and data policies may apply.
General

</td> </tr>  
<tr>  
<td>

</td>  
<td>

</td>  
<td>

data governance issues around this will be followed up in future versions of
the

DMP and in WP1 and WP7. The license for KPI data inside the +CItyxChange M&E
system and the data to be reported into SCIS will be under a CC-BY4.0 Creative
Commons Attribution (https://creativecommons.or g/licenses/by/4.0/)

Raw data or supporting data and documentation for achieving targets (for
example for survey-based indicators or detailed personally identifiable data
from single areas) will be kept confidential. This will be detailed in the WP7
methodology.

</td> </tr>  
<tr>  
<td>

Research data as laid out in Data Management section

</td>  
<td>

Underlying research data of the project

</td>  
<td>

Open Access with limitations due to privacy, as detailed above, in accordance
with the FAIR guidelines on Data Management in H2020.

</td> </tr>  
<tr>  
<td>

Any other data

</td>  
<td>

TBD

</td>  
<td>

Wherever possible, open through Creative Commons or other open licenses. 'As
open as possible, as closed as necessary'; and ‘open by

default’.

</td> </tr> </table>

#  5 Conclusion

This deliverable constitutes the second DMP for +CityxChange at the time of
delivery by October 2019. The Project Management Team will regularly follow up
with the consortium members to refine and update the DMP. Responsibilities
reside with NTNU and all consortium members.

More detailed procedures, descriptions, forms, etc. will be added as they
become available through the ongoing work in the respective Work Packages. The
next update will include detailed data summaries for the work that is being
started in that period, and with more detailed partner processes and
descriptions of data sets and consent procedures.

The DMP will be updated at least annually, with the next regular update due in
M24 as

D11.16 Data Management Plan 3.