Strategic areas

GOVERNANCE POLICIES AND PROCESSES

As a support for the purpose and functions of municipal manager’s offices and bodies, and in coordination with the people in charge of data, the municipal processes, standards and policies applicable to all the organisation’s data resources will have to be defined, put into practice and maintained.

Subsidiary municipal bodies must obtain this from the CTID, in coordination with the governance committees, where processes and policies will be defined in sufficient detail in order to manage data resources appropriately. As a minimum, these processes and policies will require any investments and projects under development to be evaluated, in order to determine the applicability of the agile methodology, data standards and open content, privacy and the ethical and social impact as well as the indicators for measuring the cost, use and general evaluation of the data resources as a whole.

It must be ensured that:

LEADERSHIP AND HUMAN RESOURCES

Subsidiary municipal bodies must develop a set of requirements and skills for the teams responsible for or working with data, which will include aspects concerning access, analysis, privacy and security, among others. More specifically, it must be ensured that the teams responsible for data are able to foresee innovation and adapt to it, in a context of constant change. The department of Human Resources must ensure that the executive/management personnel dealing with data have sufficient knowledge to carry out their task appropriately. The people in charge of the organisation must supervise how their data personnel carry out their functions, as well as coordinating with the CTID and the CDO in order to select the staff.

PRIVACY

In compliance with Regulation (EU) 2106/679, the City Council will appoint a council Data Protection Officer (DPO) to assume the functions assigned to that officer under this regulation.

Subsidiary municipal bodies must establish and maintain a data-protection programme, in accordance with the municipal policy on privacy, which ensures compliance with privacy requirements and develops, evaluates and manages the risks associated with privacy. When evaluating risks to privacy, privacy systems must take into account risks concerning the people associated with the creation, collection, use, treatment, storage, maintenance, dissemination and destruction of personal data.

In accordance with municipal policy and the law, municipal organisations and bodies may only create, collect, use, store or disclose personal data if they have the appropriate authorisation. This authority must be clearly identified in their data management software (DMS) and in the architecture document (AD).

The bodies have to designate an RDAD and a data-protection officer who is responsible for their data and who are answerable for developing, putting into practice and maintaining privacy programmes in order to ensure compliance with all regulations, norms and directives that affect the life cycle of personal data, by means of a privacy policy that applies legal measures to privacy risks. The CTID and the corporate personnel responsible for data, the CDO and the DPO, will have authority over the sub-DPOs in each organisation and will coordinate them.

The principles for personal data protection must be respected, and the details of those principles must be established under the responsibility of the DPO. Specifically, these will include:

DATA SECURITY

In order to guarantee appropriate data security levels and to ensure confidentiality and correct use, the CTID must designate a person in charge of data security, a Data Security Officer (DSO), who will be responsible for developing and maintaining a security programme for the unit’s data, in accordance with pertinent legislation and in collaboration with the Technical Commission for Data Protection Security.

The data will be protected in accordance with the risk arising from unauthorised access to, the use, disclosure, interruption, modification or destruction of this information. The units must produce a recovery plan that includes continuity strategies, in order to ensure that services and access can be restored in time to satisfy the mission’s needs. Furthermore, any information project or system must guarantee the possibility of tracing access to the data and the analysis of decision-making algorithms (or those supporting decision-making) and prepare and facilitate any audits that may be undertaken. Any third party involved in the processing of municipal data must offer sufficient guarantees concerning the implementation and maintenance of the required security measures, and the other directives defined in the Code of Technological Practices and the Technical Commission for Security.

All projects and systems must comply with current laws and regulations, including the General Data Protection Regulation, the Spanish data protection law, Decree 3/2010, of 8 January, which regulates the National Security Scheme for Electronic Administration, and international security regulations, in particular regulation ISO/IEC 27002:2005, which establishes guidelines and general principles for initiating, putting into practice, maintaining and improving the information security management in an organisation.

The physical or logical security of data will be determined by the IMI-defined standards.

COLLABORATION, COORDINATION AND SUPERVISION

General data governance is described in the directive that accompanies this measure, in Appendix. This is comprised of the Inter-departmental Coordination of Data. Its main aim is to coordinate cross-departmental projects and to act as a means of disseminating the projects.

For proper coordination between the various areas of municipal management, data officers will be defined for each sector, who will be responsible for the data in their own manager’s office and for coordination with the council as a whole. Cross-departmental data coordination makes it possible to establish directives for and monitor the work carried out in the MDO and in the various sectoral centres for storing, analysing and disseminating municipal data; establishing operational and treatment criteria for guaranteeing all aspects of the data’s life cycle and added value; the monitoring of inter-departmental and council projects, as well as the management of data protection and the regulations concerning intellectual property and authorship protection for the data.

This coordination must lead to the proper management and review of resources and programmes, and ensure coordinated and unified budget management. The CDO will also take part, for the review and authorisation, with the aim of providing effective, specific and visible corporate management of IT resources and data.

Each unit’s manager’s office, in consultation with municipal data officers, must describe the processes used to define the inventory of IT resources for efficiently achieving management objectives, considering new investments in IT and their potential and appropriateness for the council inventory. It will also be necessary to identify the differences between the programmed and executed budget, the schedules and the evaluation of IT objectives, and ensure that the necessary corrective measures are carried out.

This tool establishes principles and directives for correct data management, in accordance with the principles indicated in this measure. The more technical aspects of this management are included in the Code of Technological Practices, published under the Government Measure for open digitalisation: free software and the agile development of services, of October 2017.

Subsidiary municipal bodies must manage data responsibly, inventory and register the authorised treatment processes, identify the data’s sources and its basic metadata, guarantee the data’s life cycle and take users into account when determining the format and frequency of updates, as well as other data management considerations. They must collaborate with other organisations on the promotion of efficient public services in order to comply with all the transparency policies and those related to privacy, security and accessibility.

Specifically, municipal bodies must follow all the processes established by the DPO regarding strict compliance with data protection regulations, notify the Catalan Data Protection Authority about the creation of databases where necessary, and appoint the people in charge of data. It is necessary to minimise the collection of personal data, apply anonymisation or pseudo-anonymisation wherever possible, obtain the consent of the people concerned, and take into account the repercussions that every action at each moment of the data’s life cycle has on every other moment and the people concerned.

GUIDING PRINCIPLES FOR ETHICAL AND RESPONSIBLE DATA MANAGEMENT

Subsidiary municipal bodies must include the following steps in their planning, budgeting and management, where appropriate:

The municipal bodies must provide the general public with the information in a way that is coherent with its objectives and mission, based on current legislation. Anonymised data must be provided, so that access, analysis and reuse of the data can be promoted for a wide range of purposes. The information must be publicly accessible and automated, and it must be correctly described, complete and up to date. This also includes data being available in formats that are accessible to people with functional diversity. It is necessary to consider the cost of this public service for the organisation, as the imposition of charges or public prices should be avoided.

Municipal bodies must store information in such a way as to allow interoperability between information systems and, wherever appropriate, its public disclosure by means of open formats, data and metadata standards. The organisations must also make mechanisms for obtaining feed-back on the data available to the general public. Municipal finance systems must be able to reward the units that include systems for the long-term preservation of data and its access in their service contracts.

The City Council and all municipal group units must observe a set of procedures aimed at improving the acquisition of data and which make effective, economical, safe, ethical and open data management possible, as well as guaranteeing privacy. Planning has to focus on the data that supports each unit’s mission, and they have to implement management processes that are integrated into budgetary programming and execution.

PLANNING AND BUDGET

Budgetary planning is an essential part of producing and maintaining a data management strategy, and it must ensure effective collaboration between the various manager’s offices and directorates in this area of management.

Strategic planning: data management plans (DMP). As a support for Barcelona City Council’s management needs and its mission, and as part of the general strategy and planning to improve the municipal group’s processes, each unit must produce and maintain its own data management plan (DMP) that describes the objectives of IT resources, including, among others, the processes described in this strategy. The DMP must show how the map of the IT resource objectives relates to the unit’s mission and priorities. The objectives must be specific, measurable and verifiable, so that their progress can be monitored.

One example of an emblematic project in the budgetary area is Open Budget, a tool that facilitates the general public’s analysis and understanding of Barcelona City Council’s budgets. Open Budget allows users to download data in open formats, to browse items ranging from the most aggregated to the most detailed budgetary data, for both the current fiscal year and previous years. (http://ajuntament.barcelona.cat/estrategiaifinances/pressupostobert/ca/).

INVENTORY

Business units will have to keep an inventory^[1] of their main information systems, containers and dissemination tools, with a determined level of detail for their supervision and management. This inventory must identify the datasets containing personal information and procedures will be determined to enable regular checks that ensure this data is of the necessary quality, that it is possible to respond to the rights of the people concerned and that it is the minimum required to develop the unit’s powers and functions. Each unit will also have to keep a record of all the actions taken regarding both management and analytical databases. The Municipal Data Office must determine the metadata for these systems.

MANAGEMENT OF DATA PROCESSING SYSTEMS

The units and subsidiary bodies must be able to continually facilitate the adoption of new technologies and to evaluate the entire life cycle of each information system, with an inventory of the software tools and machines associated with the system, the management and sustainability of the resources and the infrastructures supporting the system; they must actively determine the updates, revisions, substitutions and provisions needed to properly carry out the unit’s functions and protect its assets, and it must ensure the terms and conditions of the contracts and other service agreements involved in the collection, processing, storage, access, exchange and availability of municipal information, which are confirmed and in line with the data-protection policy and cover the units’ legal and ethical requirements.

RISK MANAGEMENT

Units must evaluate the security measures for information and data, records management, transparency, impact assessment and supply chains, and they must do so during the entire data cycle, so that the risks are assessed and managed. Furthermore, in coordination with the DPO, the CDO and the CTID, they must produce a plan so that the information systems are duly protected and ensured, while updating, revision, substitution and withdrawal are given the highest level of priority.^[2] It is also necessary to periodically review and report on the risks concerning processes, people and technologies.

RESILIENCE PLAN

Municipal units and subsidiary bodies must produce a resilience plan that takes into account the management of their data. This resilience plan is crucial for ensuring services are able to continue carrying out their tasks during disruptions. It is therefore necessary for organisations to develop continuity strategies in order to ensure that services can be reestablished in time to meet their objectives. “Manual shortcuts” must be part of this, so that critical operations can have continuity while normal services have not been resumed.

This line of action aims to define the conditions at the architectural level in order to make the City Council’s internal management more agile, improve the services that the City Council offers city residents and facilitate the joint exchange of interesting data with society, both inside and outside the municipal government, and to ensure its preservation and continual access. The CDO and their office will be responsible for understanding the City Council’s data and having a unified, documented concept of it, as well as maintaining, planning and developing its architecture by using a unified management model.

The City Council therefore has to work towards a model of grouped data from different sources in order to create common repositories for management, analysis and secure preservation.

These repositories are:

City OS is a cross-departmental deposit and architecture project for the centralised, uniform storage and access of the city’s data. It is the sole analytic repository for municipal data. Municipal data as a whole is stored in various systems according to the needs of use and the technology that is applied. City OS provides an analytical layer for all the data. It has been developed in such a way as to allow autonomous management of the knowledge of the variety of municipal data by the operational data-management systems. In other words, it makes data analysis and operational management independent. The data is organised according to a system of ontologies geared to creating analytical knowledge.

It will be necessary to write an information policy that includes all the data and obligatory processes needed to complete the data life cycle and deposit it in the city lake or in the secure preservation repository, according to preference. In order to do this, close collaboration from the IMI (technology provider and responsible for the development and maintenance of the City Council’s technological infrastructure) and from the various units and services that have their own infrastructures.

Units must develop an architectural description (AD) that details the available architecture, the target architecture and the plan to achieve the latter. Each unit’s AD must be in line with the data model defined by the MDO. The AD must include the unit’s plans for significant changes in updating, revisions, substitution or availability of information when the systems no longer effectively support the required needs and functions. The AD must align operational resources and technologies in order to attain strategic objectives. The descriptive process for the present and future state of the unit helps to eliminate duplications and irrelevant data, increases shared services, maximises performance and promotes interrelation between areas. The AD must identify the functions that need access to certain systems and which profiles have access to what information and under what circumstances. Requirements must be defined, based on attributes for accessing sensitive information and they must be recorded in the logging systems.

In regard to the emblematic City OS project, various sub-projects will be carried out, such as:

Data is becoming increasingly important in the Administration. It is necessary to design a long-lasting strategy for carrying out City Council projects, based on innovative data exploitation, carrying out better analysis and using big-data methodologies so as not to fall behind society and the private sector. In this sense, it is a good idea to learn from advanced experiences in this field, and the United States is a good example.^[3]

Modern organisations are characterised by the need for managing their services and processes, fundamentally with a set of databases which have multiplied in recent years and which will continue to grow in the near future. In an organisation like Barcelona City Council, efficient, coordinated and structured data management contributes to various objectives. Beyond specific, instrumental purposes for each database, global governance must include two essential objectives in a modern public organisation:

Barcelona City Council’s need to create knowledge and intelligence has always been and continues to be of strategic importance. In recent years, the volume of information has increased exponentially (big data). However, municipal analytical tools cannot handle this volume of information properly. The available information is disperse (mostly in spreads-heets), unconnected and subject to unplanned maintenance. To counter this “hole”, various initiatives have been set in motion to create a culture of accessible, centralised data and the corresponding culture to feed and, in the near future, use the platform’s data. This includes City OS, the project for a centralised municipal information deposit that will facilitate the capture, preparation, organisation and analysis of data from municipal services and the general public, in order to foster these data-based projects through the City Council and outside it (see the next section on open data).

The new data culture makes it possible for information and knowledge to flow through the organisation much more efficiently. However, in today’s world, it is not enough to obtain and analyse data in post-mortem processes. It is necessary to have the capacity for analysing data in real time and to be able to produce projections and scenarios using complex algorithms, in order to foresee and predict possible future situations and reduce undesired repercussions. This capacity cannot be substituted; it must be internalised by the organisation, as it is a major part of its grey matter. Until now, digital service projects have been led by sectors unrelated to data analysis or data science (IT, transactional application managers, etc.). In order to ensure that the data-analysis management model works smoothly, it is necessary to move between the old model of business intelligence, based on data selection and visualisation, and a new data-science model that leads to predictive analysis, prescriptive analysis and artificial intelligence. From this perspective, the MDO must play a relevant role in the key areas of defining and managing data, as well as those of modelling, access, metadata, quality and life cycles.

Analysis must answer the maximum number of questions relating to various areas:

Along these lines, the MDO has the mission of changing the organisation’s internal culture regarding data management in its projects. Given that the data and technology associated with this discipline are very new, the DMO must provide data-based analytical consultancy and solution services to the other units. These services must be accompanied by appropriate courses, ensuring that every City Council unit is progressively trained, so that they understand the methodology of a data-based qualitative focus on city problems. It must also lead an internal transformation, in order to “evangelise” the organisation in data culture, by means of internal workshops and seminars. Within the DMO, an analysis area must be created that offers internal services to various City Council areas, in the form of “internal consultancy”, with one part dedicated to solving problems and also training personnel from each department on how to use the developed tools.

As integral analytical elements, the DMO and the analysis area must also collaborate in order to establish the vision and strategy for all initiatives geared towards council data, the exchange of knowledge about data-administration policies, standards and good practices, as well as aligning technological tools to needs of use.

The emblematic projects in this area are:

Barcelona City Council collects and regularly publishes an important set of data, statistics, indicators and sectoral studies concerning the city and its surrounding area, so that urban leaders, people in the field of research, consultancies and the entrepreneur community and the general public can get precise knowledge about the city, socio-demographic dynamics, the economy, the urban area, the general public’s opinion on various subjects, etc.

The objective of this work is to create the BCN Data Exchange, an essential part of data commons, and to organise, centralise and improve the formats, the reusability (through interoperability) and access to the data published by the City Council, from a technical perspective (based on City OS) and a relational perspective, and establish contact with groups of Barcelona data users and reusers and attempt to show our concept of data as a public asset that must be shared under clear and transparent regulations.

The BCN Data Exchange project aims to connect the city to data stakeholders, understand their perception of data and try to build a framework that encourages the responsible use of data and for data to be seen as a provider for creating solutions and services rather than as an owned asset that offers an advantage. Furthermore the city will listen to their contributions on matters relating to public tenders and data-exchange practices.

This line of action includes tasks dedicated to processing and publishing city data, with the infrastructure needed to do so, and to involving a community of professional data users and proactive data consumers (prosumers) in a constructive dialogue, covering the data as a whole and the opening of infrastructures.

A major part of this information, which includes data of various kinds and formats (raw data, indicators, statistical tables, opinion studies, surveys, maps, sectoral analyses, etc.), is collected and published manually or semi-automatically through various municipal departments and websites.

With the aim of facilitating and promoting the use of all this accumulated information and knowledge, Barcelona City Council plans to design and set in motion a new portal for consulting and exploring information, based on City OS, which centralises all the currently managed and published information and documents in a single website, i.e. to create the Barcelona Data Exchange, with various objectives:

This new Barcelona data portal will be aimed at users with different profiles and needs, from municipal political and technical personnel, who need to have access to vital, complete information on the dynamics which affect their decision-making, to normal city residents who are looking for specific information or who are curious about some urban information or indicators. This involves controlling security, by applying various profiles and functions. Between these extremes there are researchers, journalists and students, who have different needs, in terms of the type, quantity and amount of detail given in city information.

With regard to the city’s current data repository and website projects, the Barcelona Data Exchange will improve access to information and compliance with FAIR principles for open scientific data with interoperable data and standard formats.

In this sense, initiatives for the “external” publication and evaluation of data include actions such as:

The emblematic projects in this area are: