Smart city projects in Europe and North America are employing a novel approach to data analysis that processes hardly any or no personal data at all. As such, these projects-at least, for the most part-escape the scope of (European) data protection law. The idea behind this new approach to smartness can be condensed in the statement: "smart cities are only Big Brother to the masses. " In other words, if the data collected within smart city projects do not identify any individuals, then there are no issues with privacy and data protection law. This problematic assumption relies on two reductive understandings of key notions in this context: that of "personal privacy " and "personal surveillance. " In this contribution, I focus on the latter and call for a broader understanding of surveillance as a set of diverse modes of social control by privacy law scholars. After all, in order to reveal the underlying dynamics of power and how these might lead to surveillance abuse-even, or especially, when surveillance is based on the processing of seemingly non-personal data-concrete surveillance practices and their logics need to be examined. For this purpose, I take the example of the Stratumseind Living Lab in the Netherlands and examine it through the lens of Foucault's notion of security. This examination leads to two valuable insights for privacy and data protection law scholars. First of all, it strengthens the argument of contemporary group privacy scholars that a narrow focus on individual privacy and surveillance is inadequate and that the regulatory framework needs to be adapted. The second insight raises another broad issue: smart cities, which function according to the securitizing logic of surveillance, such as the Stratumseind Living Lab, are transforming public spaces into consumption spaces. Yet, the protection of privacy in public can and should serve to protect key aspects of public space-political participation and sociability-as well.