European laws have ushered in a new era in how companies and governments manage and promote responsible use of personal data. Yet it is the city that looks set to be one of the major battlegrounds in a shift towards greater individual rights, where expectations of privacy and fair use clash with ubiquitous sensors and data-hungry optimised services.

Amid the clamour for ‘smart’ new urban infrastructure, from connected lampposts and bins to camera-enabled phone boxes, a fresh debate about digital ethics is emerging. Who decides what we do with all this data? And how do we ensure that its generation and use does not result in discrimination, exclusion and the erosion of privacy for citizens?

While these new sources of data have the potential to deliver significant gains, they also give public institutions – and the technology companies who help install smart city infrastructure – access to vast quantities of highly detailed information about local residents.

A major criticism has been a lack of clear oversight of decisions to collect data in public spaces. US cities have deployed controversial police technologies such as facial recognition without elected officials, let alone the public, being adequately informed beforehand – something which academic Catherine Crump has described as “surveillance policymaking by procurement”.

Meanwhile the digital economy has flourished around urban centres, with new digital platforms creating rich trails of information about our daily habits, journeys and sentiments. Governments often work with app-developers like Waze, Strava and Uber to benefit from these new sources of data. But practical options for doing so in a truly consent-driven way – that is, not simply relying on companies’ long T&Cs – remain few and far between. There’s no simple way to opt-in or -out of the smart city.

Given the increasing tension between increasing ‘smartness’ on the one hand, and expectations of privacy and fair data use on the other, how can city governments respond? In Nesta’s new report, written as part of our involvement with a major EU Horizon 2020 project called DECODE, we looked at a handful of city governments that are pioneering new policies and services to enhance digital rights locally, and give people more control over personal data.

City governments such as Seattle are improving accountability by appointing designated roles for privacy in local government, including both senior leadership positions and departmental ‘Privacy Champions’. The city’s approach is also notable for its strong emphasis on public engagement. Prior to the approval of any new surveillance technology, relevant departments must host public meetings and invite feedback via an online tool on the council’s website.

Elsewhere cities are becoming test-beds for new technologies that minimise unnecessary data collection and boost citizen anonymity. Transport for New South Wales, Australia, collaborated with researchers to release open data about citizens’ use of Sydney’s public transport network using a mathematical technique called differential privacy – a method which makes it difficult to identify individuals by adding random ‘noise’ to a dataset.

Other experiments put more control into the hands of individuals. Amsterdam is testing a platform that allows local residents to be “authenticated but anonymous”. The system, known as Attribute-Based Credentials, lets people collect simple and discrete ‘attributes’ about themselves in an app (like “I am over 18”), which they can use to verify themselves on local government services without revealing any more personal information than absolutely necessary.

Not all the policy measures we came across are about privacy and anti-surveillance. Local governments like Barcelona are fundamentally rethinking their approach to digital information in the city – conceiving of data as a new kind of common good.

In practical terms, the council is creating user-friendly ‘data commons dashboards’ that allow citizens to collect and visualise data, for example about environmental or noise pollution in their neighbourhoods. People can use the online tools to share information about their community directly with the council, and on their own terms: they decide the level of anonymity, for instance.

Local authorities are more nimble, and in a better position to test and develop new technologies directly with local residents, than other levels of government. As the tides in the personal data economy shift, it will be cities that are the real drivers of change, setting new ethical standards from below, and experimenting with new services that give more control over data to the people.

Theo Bass is a researcher in government innovation at the innovation charity Nesta.