Designing data policy and governance for smart cities: theoretical essay using the IAD framework to analyze data-driven policy

This article examines data-driven policy for smart cities and how the institutional analysis and development framework (IAD) is a tool to analyze data governance and data policy design. The research assumes that data-driven policy underpins smart city initiatives and incorporates collective action dilemmas, directly impacting policy design and data governance. The article’s motivation is to examine the elements of the IAD framework and decompose the constitutive components of data policy in smart cities, obtaining principles that guide data governance in complex situations of digital transformation. The article is a theoretical essay to discuss data policy in smart cities and how policy design understands dilemmas and conflicts of collective action motivated by data control.


INTRODUCTION 1.1 Digital transformation and smart cities
Digital tools have a high potential to transform the public sector and promote institutional changes that transform, in turn, governance practices.Digital transformation in governments is essential for public policy research (Luna-Reyes & Gil-Garcia, 2014).The digital transformation considers that digital tools are part of a complex puzzle involving organizations, institutions, citizens, and companies to change the government's value chain.The digital world changes the public sector's governance, inaugurating conventionally called digital-era governance (Dunleavy & Margetts, 2013).
The digital world transforms government organizations because it changes management and public service structures.Regarding the structure of public service, the digital transformation changes the interaction between governments and society and between governments and companies, making these interactions mediated by machines (Filgueiras & Almeida, 2021).Concerning the management structure, digital tools modify the procedures and the work performed by managers, constituting new and augmenting capacities in the public sector.Finally, changes in the political structure occur due to changes in communication between the government and society.Digital transformation in governments comprises ideas that link actors and institutions to produce institutional changes through the mediation of digital tools (Mergel, Edelman, & Haug, 2019).
There are several concepts for digital transformation, understanding it as a process of institutional change related to digital technologies' adoption (Veale & Brass, 2019).Conceptually, digital transformation is how organizations respond to changes in their environment by using digital technologies to alter the process of building public value (Vial, 2019).Changes in the governance environment result from the digitization and digitalization of society and management structures (Anthony, 2020).What epitomizes this approach is the role that digitization and digitalization play in bringing about institutional change.First, the digitalization process is a necessary condition for digital governance to transform public sector practices.The adoption of digital tools such as artificial intelligence, the Internet of things, blockchain, and platforms is essential in the digital transformation, placing digital tools in changing public policy.Digitalization refers to adopting socio-technical methods to digitize techniques to improve social and institutional contexts, optimizing various policy topics, such as constructing smart cities.Second, digitization is to transform information into a computable object, allowing information to be converted into data and that it can be stored and communicated by machines (Anthony, 2020).These tools allow managers to modify their practices and have new frameworks and concepts regarding public policy.Smart cities extensively uses digital tools to change urban policy.These tools can create interventions for building solutions to wicked problems (Meijer, 2018).The smart city is a fuzzy concept that encompasses different labels such as digital city, intelligent city, and wired city, among others, to address the relationship between technology, people, and community.A smart city brings together a technological, human, and institutional perspective (Nam & Pardo, 2011a).More broadly, the smart city concept refers to how urban places are composed of "everyware" (Greenfield, 2006).In other words, the smart city is the urban space composed of pervasive and ubiquitous computing that creates digitally instrumented devices built in the broader fabric of the urban environment.In this broader fabric of the urban environment, citizens' access to networks is expanded, public utilities, services, and urban infrastructure are digitally controlled, management systems are built, and sensors are spread across the urban space to collect, store and process data to manage and regulate city flows and processes in real-time.
Smart city projects modify the possibilities of participation and collaboration between local governments and citizens to change policy conditions and promote development processes (Pereira, Cunha, Lampoltshammer, Parycek, & Testa, 2017).Cities are developing digital technologies that modify the design of urban infrastructure and create conditions for sustainable urban development and a better quality of life, as well as a capacity for the participatory management of natural resources (Caragliu, Del Bo, & Nijkamo, 2011;Gil-Garcia, Pardo, & Nam, 2015;Meijer & Rodríquez-Bolívar, 2016;Nam & Pardo 2011b;Townsend, 2014).Smart city is an urban space that has different digital tools to collect data through sensors, voice activators or identification.This data is used to design technological solutions that enhance local well-being and provide governments with the capacity to build urban interventions.Synthetically, smart cities design and offer different urban policies based on data-driven policy.Data-driven policies are policies whose design is based on big data instruments to solve policy problems (Athey, 2017;Walravens, Ballon, Compernolle, & Borghys, 2021).
Smart city projects are attractive for public managers and political actors because digital technologies increases capacity to implement public policy.However, implementation of smart city projects requires care from the perspective of data governance.Data governance is a sine qua non condition for smart city projects to be successfully implemented, producing the desired economic growth and sustainability (Meijer, 2018).Smart city projects require computing infrastructure to extend the process of collecting, storing, processing, and sharing data."Data are units or morsels of information that in aggregate form the bedrock of modern policy decisions by government and non-governmental authorities" (Gitelman & Jackson, 2013, p. 1).
The importance of data for smart cities projects emerges precisely from big data and the growing society's datafication.The growing connection of citizens and organizations on the Internet produces the society's datafication, in which the various interactions between humans and humans, or between humans and organizations, can be understood from large volumes of data (Mayer-Schönberger & Cukier, 2013).Data is obtained through growing surveillance frameworks, use of public records, or by crowdsource, making them resources whose exploitation is essential to support business models.This computational infrastructure can be public or private, making data resources disputed in urban space (Frischmann, 2012).To support smart solutions for urban space, data is shared resources.
As data is shared resources, data governance is politically conflicting because of a complex relationship between municipal management, technology companies, and citizens (Kitchin, 2014).Furthermore, the unregulated process of collecting and exploiting local governments' data has raised essential political and social concerns.The improper exploitation of these data, which concern different dimensions of citizens' lives, can promote new forms of exclusion and compromise digital governance's expected benefits (Filgueiras & Almeida, 2021).
Local governments are beginning to challenge their dependence on tech companies, which are the big beneficiaries in accessing and exploiting data in their business models.The asymmetry between local governments, technology companies, and citizens compromises smart city projects, producing policy failures that compromise, in turn, the outcomes obtained with innovation policy.The data collection and exploitation generated by local governments have enormous potential to support smart city projects that benefit society.However, failures in data governance and policy instruments compromise the policy objectives, compounding essential frustration from the smart city design (Drapalova & Weigrich, 2020).
Data and the application of digital technologies in governance must be digital commons because of a resource with public and private characteristics, which can be appropriated and used to benefit society (Filgueiras & Almeida, 2021).Cities like Barcelona, for example, have designed institutional initiatives like "Data as Commons" promoted as an element to empower citizens to consider data as shared resources.These data improve public services and public policies in the local government.Initiatives like this demonstrate how a data structure shared between local governments, companies and society can improve the quality of life and need institutional mechanisms that solidify the application of digital tools in urban policy (H.March & Ribera-Fumaz, 2018).Smart cities, designing policies and services based on data, can facilitate processes of co-production of public services and expand mechanisms of citizen participation with the use of different technologies (Meijer, 2018).
Misguided use of data, as in smart cities projects, can promote processes of exclusion, algorithmic gender, and race biases (Benjamin, 2019), the inefficiency of public services and new organizational risks (Filgueiras & Almeida, 2021), technological redlines (Eubanks, 2018), cybersecurity problems (Shackelford, 2020), and problems of effectiveness about the structure of services and policies based on big data instruments.Finally, the relationship between public organizations and technology companies is generating a new form of global colonization, making the state dependent on these companies, generating all sorts of problems due to failures or even the impossibility of applying regulatory instruments to establish an institutional approach for the use of data (Couldry & Mejias, 2019).To minimize these problems that arise with emerging technologies, governments -local and national -are building institutions for data governance and designing data policy.
Data governance is about allocating authority and control over data and the exercise of such authority through decision-making in data-related matters (Plotkin, 2013).Data governance involves an institutional, organizational and accountability dimensions.The concept of data governance is rules and organizational responsibilities that makes a data policy to strengthen decision-making and accountability concerning data understood as organizational resources (Abraham, Schneider & Vom Brocke, 2019;Nielsen, 2017).
In governments, data governance involves the constitution of data as essential commons for public governance and also involves collective action dilemmas.Collective action dilemmas in data governance emerges from problems concerning collecting and exploiting data to generate business models and digital transformation (Benfeldt, Persson, & Madsen, 2020;Mattioli, 2017).Data governance is the decision-making process and the construction of authority to specify the decision rights and accountability that encourage the desired behavior concerning the use, security, integrity, and data availability.Thus, the authority constitutes policies, standards, and guides consistent with the governance objectives (Weber, Otto, & Oesterle, 2009).Data governance involves collective action problems and should be based on institutional cooperation to maintain the sustainability and resilience of data understood as commons.Data governance frameworks, in this sense, must work with the perspective of reducing the collective action dilemmas and fostering collaboration between the different actors, shaping the design of data policy.
Data governance and data policy is an emerging topic in the study of public policy.Data policy is about collective choices, focusing on general rules and principles (governance) that guide the actors in collecting, storing, processing, and sharing data, ensuring appropriate use of data and information assets.Data policy includes actions for data quality, access, security, privacy, and usage, and possibilities to design technological applications that focus the data usage on applying in policy and services.Data governance implies distributing and redistributing resources and operational norms, creating responsibilities and compliance to principles and norms.
Whereas data represents an essential policy resource in digital transformation, regulation and standards impact the development of technologies based on massive data.In smart city projects, data governance and data policy are essential to support the use of digital instruments in the urban space.However, as pointed out earlier, smart city projects can produce public policy failures such as creating technological redlines, algorithmic discrimination, technology design problems, or data misuse that infringes civil rights due to surveillance mechanisms.Investigating how governments design their institutional apparatus for data policy and governance is essential for several technological regimes deploying emerging technologies.Data governance and policy requires the constitution of an analytical framework capable of building answers to the collective action problems implicit in collecting, storing, processing, and sharing data.The answers, in the case of smart cities, must observe the dilemma of social choices, which is implicit in the need to expand data sharing in urban space for the digitalization process, on the one hand, and the policy problems that may emerge from the over-exploitation and private appropriation of data, on the other hand.
The paper aims to provide an analytical perspective for design of data policy and governance to smart cities projects.This framework must understand the action situations and policy issues related to society's datafication and the emerging collective action dilemmas.For this objective, the Institutional Analysis and Development Framework (IAD) is as a critical analytical lens to understand the collective action dilemmas concerning the extension of big data tools in governments.In the first section, the paper provide an overview of the IAD framework.In the second section, IAD framework is applied to analyze the constituent elements of data policy and governance to smart cities.Finally, the paper conclude by showing the challenges for the institutional analysis of the design of data policy and governance.

IAD FRAMEWORK
Institutional Analysis and Development Framework (IAD) is a method for organizing policy analysis that considers the role of institutions and actors in the construction of outcomes and the policy design (Ostrom, 2005;Polski & Ostrom, 1999) 1 .The IAD framework's starting point is to consider that public policies are institutional regime that organize the rules of the game for society to produce public goods and solve collective action dilemmas (Heikkila & Andersson, 2018;Ostrom, 1990).For the IAD framework, institutions are formal and informal norms that express rules, shared understandings, and strategies that structure human behavior and social choices.These shared rules, understandings, and strategies are collectively created, enforced, adapted, and monitored (Ostrom, 2005).
The institutional theory assumes that institutions define constraints, incentives, meanings, and values that guide human behavior (Hall & Taylor, 1996;J. G. March & Olsen, 1984, 1985, 1989;Peters, 2019;Riker, 1962). 2 The institutional theory assumes that human behavior is not idiosyncratic and autonomous.Human behavior occurs in context and depends on the meanings established so that collective choices and actions have a problem-solving perspective and produce outcomes.
The assumption is that the link between institutions and outcomes -consequences of collective choices and actions -is behavior (Arrow, 1951).Norms -formal and informal -will define what is allowed or prohibited and positions in society, composing a grammar that defines human action's meanings in different contexts (Crawford & Ostrom, 1995).The corollary of institutional theory seeks explanations of human behavior's regularities and patterns by understanding institutions (Ostrom, 2005;North, 1990).
Based on this premise, the IAD framework seeks to understand the action situations and how these situations guide the actors' interactions in the policy context and the outcomes achieved.Institutional regimes govern policy situations, which will define demands, places, and people.Individuals and groups deliberately craft these institutional regimes to make the actors' interactions more predictable, reduce uncertainties and risks (Polski & Ostrom, 1999).Thus, understanding action situations is at the heart of the IAD framework, producing the link between institutions and how they guide individuals and groups' behavior and the outcome achieved by policy (Ostrom, 2011).The institutional analysis of public policy must, therefore, include: (i) the set of actors, (ii) the specific positions to be filled by participants, (iii) the set of allowable actions and their linkage to outcomes, (iv) the potential outcomes that are linked to individual sequences of actions, (v) the level of control each participant has over choice, (vi) the information available to participants about the structure of the action situation, and (vii) the costs and benefits -which serve as incentives and deterrents -assigned to actions and outcomes (Ostrom, 2011, p. 11).
The IAD framework is not precisely a theoretical model or a finished theory.IAD framework should be understood as a framework for assessing policy design by bringing together actors and institutions in complex situations.Action situations involve agency nested in multilevel and polycentric decision systems, including constitutional issues, collective choices, and operational level (Carlisle & Gruby, 2017;Carney, Heikkila, & Wood, 2019).The corollary of the IAD framework is that public policies emerge to solve collective action dilemmas, in which individuals can solve shared problems in a bottom-up manner, using self-governance mechanisms (Ostrom, 1990).In this conceptual definition, we have an introductory first statement: policy design involves decisionmaking by multiple actors who may be engaged in policy in a cooperative or conflicting manner.The design that the policy will perform depends on political factors and institutional dynamics.Thus, the IAD framework is engaged by a policy design perspective (Dunlop, Kamkhaji, & Radaelli, 2019).Figure 1 below summarizes the IAD framework's fundamental corollary, relating the institutions to the action situations.manner.The design that the policy will perform depends on political factors and institutional dynamics.Thus, the IAD framework is engaged by a policy design perspective (Dunlop, Kamkhaji, & Radaelli, 2019).Figure 1 below summarizes the IAD framework's fundamental corollary, relating the institutions to the action situations.Source: Polski and Ostrom (1999, p. 24).
To understand the action situations, the researcher must understand the institutions as the gathering of physical and material conditions available, the attributes of the community that involve the actors' social positions, and the rules in use that define the Source: Polski and Ostrom (1999, p. 24).
To understand the action situations, the researcher must understand the institutions as the gathering of physical and material conditions available, the attributes of the community that involve the actors' social positions, and the rules in use that define the action arena and its scope (Ostrom, 2005;Polski & Ostrom, 1999).Analysis of material conditions, community attributes, and rules in use provides a way to define policy design or governance institutions' essential elements.The rules in use connect these three elements, which define what is allowed, prohibited, and the actors' social positions (Ostrom, 2005).Thus, institutions are composed of: (i) the material elements that are related to the goods or services that must be deployed and the capacities built to achieve policy objectives; (ii) by the attributes of the community, which means the attributes of the policy participants and how they share the activities related to the policy; (iii) the rules that define positions, boundaries, authority, aggregation, scope, information, and payoff to define governance mode.These three elements must be examined to extract the social positions of the actors, the delimitation of the policy participants, the construction of authority and control mechanisms, the intended outcomes, the information available to the actors, and the action payoffs (costs and benefits ratio) (Polski & Ostrom, 1999).
Policy design is a political problem because it involves implementing interventions on citizens' actions (Peters, 2018).Contemporary policy design literature presents an important gap regarding the institutional analysis of the design process, the choice and calibration of policy tools, and when design decisions are made in a multilevel way (Howlett & Capano, 2020).IAD framework can fill this gap.First, the IAD framework emphasizes a problem-solving perspective by looking at action situations and how actors engage in ventures by coordinating and competing or engaging in conflict (Schlager & Cox, 2018).Second, the IAD framework provides for scholars clarity when observing opaque objects and concepts that are difficult to measure in the policy design (Heikkila & Andersson, 2018).Third, the IAD framework recognizes that policy design is embedded in adaptive rule-making and participatory structures tied to policy issues.
The product of the IAD framework is to configure eight principles for the policy design that govern the constitution of public goods and services (Ostrom, 1990).The eight principles for policy design can offer fundamental insights into the challenges of data policy and governance to smart cities.They offer an interesting resource for the policy design that constitutes public goods and services and involves shared resources that produce collective action dilemmas.Since the IAD framework works with shared resources, the design principles are inserted in the institutional policy design oriented to producing outcomes based on self-governance models.These principles enable power relations and define important topics to understanding policy (Mudliar & Koontz, 2019).These principles are: • Boundaries of users and resources are clear; • Congruence between benefits and costs; • Users had procedures for making their own rules; • Regular monitoring of users and resource conditions; • Graduated sanctions; • Conflict resolution mechanisms; • Minimal recognition of rights by the government; • Nested enterprises.
Design of data policy and data governance require a shared resource to produce public goods, such as smart cities solutions.In the contemporary world, data represent the element that enables digital tools to deploy public goods (Frischmann, Madison, & Strandburg, 2014).Artificial intelligence solutions based on machine learning, the Internet of things, blockchain, and platform applied in smart city projects are based on data collection, storage, processing, and sharing.Its application by governments depends on adequate institutional frameworks to protect citizens' privacy, increase the data quality, and enable better technologies and policies based in accountability structures and citizens' participation.The following section produces the meeting between the insights from the IAD framework and the constitution of objectives, and the design of government data policy and governance applied to smart city.

HOW ANALYZE DATA POLICY AND GOVERNANCE WITH THE IAD FRAMEWORK?
Data policy and governance is an emerging field of policy sciences that designs several interventions focusing on emerging technologies (Filgueiras & Lui, 2022).These emerging technologies use big data and data-driven policy instruments.As an emerging field, data policy and governance implies the design of various institutions that ensure authority on data, data-driven policies, and regulatory mechanisms.Governments worldwide are formulating data policy and governance to establish the rules of the game, create the regulatory and distributive mechanisms necessary to deal with society's datafication, and solve the collective action dilemmas embedded in the use of big data methodologies.Society's datafication imposes policy challenges and delimits new problems that will require data governance institutions that design data policy.

Promises and collective action dilemmas in societies' datafication
Governments -local and national -are designing data-driven policies in different policy domains.Big data methodologies to formulate and design policies are a growing trend in governments, making up the main feature of digital transformation (Giest, 2017;Souza & Jacob, 2017;Williamson, 2014).The data-driven policy requires that digital technologies collect, process, and share data (Athey, 2017).Gradually, organizations commodify information in distributed networks (Hess & Ostrom, 2007).Different digital technologies, such as machine learning algorithms, require vast training data to produce the expected results.Data implies a logic of shared resources in a networked place, with a private and public nature.Governments use these data to develop applications to provide services and policy through information control (Filgueiras & Almeida, 2021).These complex digital technologies comprise different mechanisms that collect information and transform it into data and control.These digital technologies' working depends on sharing data -thought as a resource -and its use to construct information and application by organizations (Frischmann & Selinger, 2018).
Data must be understood as resources that enable the input of policies to deploy policy tools based on digital technologies (Filgueiras & Almeida, 2021).For example, the constitution of facial recognition systems for public safety (Power, 2016).Governments must mobilize massive data in all these situations that allow autonomous agents to accomplish some policy objective.Artificial intelligence technologies are agents that accomplish a goal (Russell, 2019) and can be applied in public policy to achieve policy objectives (Filgueiras, 2023).In these different cases and the design of digital tools, it is necessary to build institutional mechanisms for data stewardship (Dawes, 2010) and institutional data sharing structures.Data stewardship is a fundamental aspect of data governance, with this actor being responsible for ensuring data quality, validity, and security, managing risks, and making public organizations responsible for handling information with care and integrity (Dawes 2010;Plotkin, 2013).
As essential resources in the smart city, data configure new dilemmas for collective action (Hiller & Blanke, 2016).Data is collected, stored, and processed by proprietary algorithms related to business models that depend on information to achieve their goals.Data is monetized in contemporary capitalism, creating asymmetries from competition for use, free riding, and overharvesting data (Frischmann et al., 2014).The practical outcome is the creation of asymmetries between the actors involved in the digital world.Asymmetries between governments, tech companies, and users -citizensimply a fundamental characteristic of the digital world: competition for the use of data, monetization, and the massive and unregulated dissemination of information, followed by surveillance and the production of new inequalities (Benjamin, 2019;Eubanks, 2018;Joyce et al., 2021).
In the smart city, collective action dilemmas emerge from the asymmetries between local governments, tech companies, and citizens.For tech companies, smart cities are big business, as they enable pushing new technologies and collect and exploit data from urban actions.In addition, tech companies strengthen surveillance systems to support their business models, and political actors harness the potential for economic growth (Kitchin, 2014).The answer to these dilemmas requires local capacities to manage the technology and data infrastructure, the creation of standards and data management strategies that guide public servants' work and create adequate regulatory structures to deal with contracts and partnerships formed with tech companies.In addition, it requires service co-creation structures and citizen participation as central stakeholders in the construction of smart cities (Xu & Tang, 2020).
Data policy and institutions of data governance in smart city is related to collective action dilemmas.The challenge of data governance is a process of institutional building that establishes socially accepted norms and rules and creates adaptive capacities and self-governance mechanisms.On the other hand, data policy in smart cities is related to the collective action dilemmas that emerge from government actions aimed at data quality, a sharing process that preserves citizens' privacy and supports the use and reuse of data for services and public policies.Collective action dilemmas are not restricted to a single round because they often have an evolutionary aspect (Ostrom, 2010).Social norms play a fundamental role in building cooperation, as they are a shared understanding of obligatory, permitted, and prohibited actions (Ostrom, 2000).

Policy resources -Capacities and materials
Data protection is an essential aspect of the rules in use in the data governance (Hiller & Blanke, 2016).However, it means creating the conditions to sustain data-driven policies, such as, for example, smart city policies (Meijer, 2018).One of the policy objective of smart city project is to create data repositories that support data-driven policies and services and create digital tools based on big data structures that can be applied in different policy domains.In smart cities, data governance create institutions and data policy is essential for public actions that instrumentalize intelligent agents, facial recognition systems, IoT, autonomous decision systems, among other tools.Based on big data methodologies, these tools require robust data repositories, which present collections of qualified data and guide the process of collecting, storing, processing, and sharing data to produce more effective and legitimate urban actions.
The explicit requirements in data-driven policies demand the understanding of data as essential resources for the policy design that uses digital tools in its implementation.The understanding of data as resources and its application in policy design starts from the first requirement of the IAD framework to understand the physical world and the attributes of the goods in dispute to create public goods or services (Ostrom, 2011).Smart cities are not dealing with a physical asset about data, which is the most common object of analysis engaged with the IAD framework.Instead, digital tools tend to produce new socio-political regimes with new forms of currency and exchanges (Joyce et al., 2021;Sadowski, 2019).These new forms of currency originated from digitization and digitalization processes, which commodify information and transform it into resources and creates new dynamics in society.Data are virtual resources that flow not only on a local scale -usually the object of an IAD framework -but also on a global scale, involving exploitation processes to support digital tools.
Working with data requires governments to support and regulate the infrastructure necessary to collect, store, process, and share data.This infrastructure can be public or private and makes up a sharing arrangement that defines data governance.Alternatively, governments can enter contracts with the data brokers industry responsible for working with data and feed government systems (Crain, 2018).For example, in the United States the Federal Bureau of Investigation (FBI) has also been purchasing cell phone location data from data broker Venntel.The purpose of this FBI contract with Venntel is to buy information without warrants, in order to bypass prohibitions on companies handling data directly to law enforcement. 3Governments can also enter cloud computing contracts, modifying data storage and processing logic, impacting sovereignty (Irion, 2012).For example, the Brazilian federal government maintains a cloud computing contract with Google for the operation of the Gov.br Platform.This cloud system supports with data, obtained from user interaction with the interface, all the functioning of artificial intelligence layers that promote personalization and effectiveness of digital public services (Filgueiras, Palotti, & Nascimento, 2022).
In any case, the necessary infrastructure means controlling resources, establishing the terms and conditions under which the public receives access, and determining how the infrastructure and various dependent systems evolve (Frischmann, 2012).The infrastructure related to data work represents a particular set of resources to create value by which a resource is shared with the community.In other words, the necessary infrastructure for working with data represents an essential commons and is subject to collective action dilemmas (Frischmann et al., 2014).
This shared infrastructure is extensive.It corresponds to the access of citizens and companies to the Internet, the computational and network infrastructure of organizations -public and private -, cybersecurity systems, and network control.Data and the infrastructure correspond to the resources in dispute and define the need for policy instruments that guide collecting, storing, processing, and sharing data internally to governments and society so that smart city can effectively create public value.
Finally, the resources in dispute also include the necessary human capacities (Polski & Ostrom, 1999) to design data-driven policy.Human resources and capabilities are essential to the success or failure of the policy and comprise the necessary conditions for engaging and mobilizing people with analytical capacities to work with data (Filgueiras & Almeida, 2021).

Rules in use
The rules in use comprise three levels of rules, namely constitutional rules, social choices, and operational rules.Constitutional rules define who is eligible to craft collective-choice rules and how these rules may be changed.Collective-choice rules define who operates public policy and is eligible to participate in activities that affect the operational level.Finally, the operational level of the rules affects participants in everyday decision-making on political and economic issues (Polski & Ostrom, 1999).Therefore, the rules in use define positions, boundary, authority, aggregation, scope, information, and payoff (Ostrom, 2005).
Data governance in smart cities emerge from constitutional rules, collective choice rules, and operational rules that define authority on data and procedures to working with data.The rules guide the actors' behavior when defining who has authority over what, when, where and how.When defining the actors, the rules in use for the smart city define who are the stakeholders that contribute with data or what the data is about, and stakeholders who use the data and benefit from that use.Several policies converge the collection and use of data by different actors.In smart city projects data is collected from various smart service users.This collected data is used in the deployment of different technologies that build policy interventions in urban space.The rules in use specify whether governments collect, store, and use the data to design policies or employ other means such as hiring data brokers or technology companies through contracts with the private sector and procurement.
The rules in use define the actors and boundaries of the data policy.Likewise, the rules in use of the data policy define the regulatory authority for the data and control and monitoring mechanisms.They also define the policy objectives related to the structuring of data stewardship, the mechanisms of transparency and accountability, and the cost and benefit ratio of the data policy actors.

Design principles application
The design principles applied to data stewardship in smart cities can represent reflective content that organizes action arenas by governments, regulatory agents, technology companies, data brokers, and users of different digital public services and utilities.Applying the design principles, smart cities must be related to institutional conditions of data stewardship that organize, in turn, the action arenas.The Ada Lovelace Foundation (2020) applies the design principles from IAD framework to making data stewardship.The Box below summarizes the design principles related to the IAD framework:

Boundaries of users and resource are clear
Clearly define the stated purpose for data collection and use, the contributors who contribute data or who the data is about; and benefits that use the collected data.
Congruence between benefits and costs Define the business models for the data operation, defining as data stewardship is funded, what methods and tools are used to store data and how the data can be accessed or used.
Users had procedures for making their own rules State as users affected by the data policy rules can participate in modifying the rules, as the legal bases define consent procedures and how the data is processed.
How participants can participate in data governance.

Regular monitoring of users and resource conditions
Define who and how to audit data governance, how data accuracy is managed, how organizations, strategies, and data access are defined and audited.Define transparency criteria about who accesses the data, reports, how the results of working with data are shared, and data security architecture.

Graduated sanctions
Establish sanctions to prevent misuse of data and violations of operational rules by those who own the data.

Conflict resolution mechanisms
Existence of arenas for conflict resolution between appropriator and officials.Establish mandates for regulators and limits for data access.

Minimal recognition of rights by the government
Establish the rights of data appropriators to devise their institutions.
Nested enterprises Appropriation, provision, monitoring, enforcement, conflict resolution, and governance activities are organized in multiple layers by nested enterprises, defining a regulatory framework and interoperability standards.
The design of data governance and policy involves recognizing these different principles since the nature of the policy is regulatory and with clear procedures for data stewardship.Applying these principles can take place in different emerging institutional frameworks, such as data sharing pools, data cooperatives, public data trusts, and personal data sovereignty (Micheli, Ponti, Craglia, & Suman, 2020).As applied by the city of Barcelona, for example, data pools are the constitution of platforms that expand access to data by bringing together data from different sources (Grossman, Heath, Murphy, Patterson, & Wells, 2016).Data public trust is the institutional model of data governance based on the fiduciary duty of organizations that collect data and share it.This fiduciary duty organizes the relationship between the individual who has the personal data collected and the collectors (Delacroix & Lawrence, 2019).Data cooperatives address societal challenges and produce data policy focusing on justice and fairness conditions to value production (Borkin, 2019).Finally, personal data sovereignty is focused on data subjects self-determination (Ilves & Osimo, 2019).These data governance models frame different action situations that shape data policy and organize power relations (Micheli et al., 2020).
Based on these design principles, understanding data policy in smart cities from the IAD framework means questioning whether the action arena is legitimate to relate the normative attributes of the community affected by the policy -such as the value of privacy, for example.Also, the IAD framework questioning the attributes of the resources and capacities, the actors participating in the policy, the governance rules, and the standards.Finally, understanding the policy outcomes that are shared and disputed in the provision of public goods and services (Sanfilippo, Frischmann, & Strandburg, 2021).
The design of data governance provides different mechanisms to make data stewardship in smart cities effective and ensure that data sharing structures occur within robust institutional parameters, capable of benefiting society and minimizing the risks of data misuse for different purposes.The IAD framework requires guidance by these principles, explaining policy design in its different aspects concerning the action arenas (Blomquist & DeLeon, 2011;Heikkila & Andersson, 2018;Ostrom, 2011;Polski & Ostrom, 1999).The action arenas fill the gap from an instrumental perspective of policy design, comprising its aspects of power (Mudliar & Koontz, 2020), social choices (Ostrom, 2005), evaluation, and action that produce the policy outcomes.Policy design correlates the objectives of policies, actors and their interests, rules that structure the constitutive elements, social choices, and operational aspects to explain the outcomes and the evaluation possibilities oriented towards the constitution of policy robustness (Anderies, Janssen, & Ostrom, 2004).

DISCUSSION AND CONCLUSION
IAD framework is an interesting tool for analyzing data policy and governance in smart cities.Data are essential resources in the smart cities, and policies are being designed to create institutional frameworks that enable data governance, the incorporation of data in the urban policies, creation of tools and instruments for data collection, storage, processing and sharing, protection of privacy and citizens' rights, data qualification, control of training bases in order to avoid algorithmic biases, establishment of policies aimed at accountability for the use of data.IAD framework is a powerful approach to understand the social dilemmas that constitute smart city and the institutional dynamics that guide the actors' interactions to policy design.Data policy guides the actors' behavior in collecting, storing, processing and sharing data from the data governance rules and authority.IAD framework has a practical value that can help scholars and practitioners to understand the dynamics that inform policy design.
IAD framework has limitations that need to be informed.IAD framework operates with policies built around collective action dilemmas, with difficulties for the framework to deal with legislative or bureaucratic rule-making decisions (Heikkila & Andersson, 2018).IAD framework also does not apply to different policy contexts.IAD framework offers conditions to observe the application of the different components of policy design, which can support the study of the relationship between design features and policy outcomes.However, there are difficulties in studying the connection between policy subsystems and decision streams.
The insights presented from years of research using the IAD framework make it possible to state that policy design activities do not follow a fixed instrumentation parameter or form, understanding power relations and interactions mediated by institutional rules and grammars.Policy design activities are dynamic and respond to the contextualized understanding of situations and arenas that structure institutional choices and outcomes achieved by policies (Ostrom, 2005).
The institutional diversity in public policy is informed by action situations that emerge from different capacities, resources in dispute, community attributes, and rules in use, which must be contextualized and mobilize actors in the arenas that shape the policy design.Applied in the analysis of data policy, the IAD framework can contribute to understanding different action situations and contexts that guide the policy design dynamics.Data policy faces challenges in establishing adequate institutional choices to deal with problems related to emerging technologies.There is a certain degree of experimentalism based on actors' uncertainties and ambiguities related to different perspectives that arise with the scope and power of ideas from digital transformation as an emerging policy.Smart cities, in this sense, depend on institutional choices that are shaping data policy, enabling the digital transformation of urban policies and the safe use of data that responds to a structure of citizens' rights.
IAD framework can be a powerful tool for a future research agenda related to comparing different designs of smart cities, analyzing the institutional choices, and comparing the results in terms of policy objectives.The comparison of smart cities designs allows us to understand how institutional diversity emerges from different conflicts and consensus that arise from rules in use and different capacities that shape action situations that deliver the policy design.This relationship between the IAD framework and design problems makes it possible to understand the design activity in a dynamic way, advancing knowledge about policy conditions and the production of outcomes.
There is a tendency to imagine that smart cities are technologically determined (Nam & Pardo, 2011a).However, the use of data to constitute urban interventions depends not only on available technology but also on human constructs and actions guided by institutions.The analysis of smart city projects can be enhanced if an understanding is that institutions and action situations created in institutional contexts matter to understand policy outcomes.Smart cities face challenges that require the design of policy and data governance institutions capable of tackling cybersecurity, surveillance, and abuse of fundamental rights, producing new patterns of inequalities and emerging threats.These problems arise from data thought of as shared resources that are fundamental for contemporary companies and governments.Finally, to prevent the smart city from being subject to the tragedy of the commons (Almeida et al., 2020), the IAD framework can be an essential tool to support the design of data governance institutions and for the design of policies aimed at the increasing qualification, protection, and use of data in the public sphere.
FIGURE 1 RELATIONSHIP BETWEEN RULES IN USE AND ELEMENTS OF THE POLICY ACTION ARENA

Figure 1
Figure 1Relationship between rules in use and elements of the policy action arena DESIGN PRINCIPLES APPLIED TO THE DATA GOVERNANCE AND POLICYOstrom's PrinciplesApplication to the data policy