Do European smart city developers dream of GDPR-free countries? The pull of global megaprojects in the face of EU smart city compliance and localisation costs

Smart city technologies can have detrimental effects on human rights, making it crucial to mitigate them in the R&D phase. This qualitative socio-legal study of the Helsinki metropolitan area (HMA) explores how public funding for smart city research and development (R&D), and the data protection by design principle (DPbD) of the General Data Protection Regulation (GDPR), facilitate the development of human rights compliant technology. Our study shows that the tension between the neoliberal logic of smart cities and that human rights compliance extends from the local to the global level. High compliance and localisation costs, one-sided inputs and a push for scalability in smart city technology development in Finland and other EU states may attract companies to overlook human rights risks and pursue markets outside the EU with lower standards of respect for human rights and the rule of law. We propose policy measures to facilitate human rights compliant smart city R&D, localisation and procurement, and discuss human rights due diligence and export control measures as means to mitigate the potential adverse effects of smart city technology exported from the EU. The study contributes to research on human rights-based approaches to smart city technology development and European innovation and export policy, with attention given to the role of public R&D funding agencies.