Dockless Mobility Data Sharing Clauses

Clauses

1. Purpose

1.1 The [Licensee/ Permittee] is required to share the Shared Personal Data with the [City/ County/ University/ Transit Authority/ Other] as a condition of the use of the right-of-way, according to the terms set out in this [License/ Permit].

This [License/ Permit/ Permit Application] sets out the framework for the [Licensee/ Permittee] to provide Personal Data to the [City/ County/ University/ Transit Authority/ Other]. It defines the principles and procedures that the parties shall adhere to and the responsibilities the parties owe to each other. 

1.2 Each party considers this data sharing initiative necessary as [insert reasons, such as: smart mobility data sharing is crucial for the [City/ County/ University/ Transit Authority/ Other]’s policy goals of creating a sustainable municipality, specifically for making a greener city of [location]. It will serve to benefit society by [insert benefit, such as: reducing carbon emissions by reducing traffic congestion].

1.3 Insights derived from Shared Personal Data will be used by the [City/ County/ University/ Transit Authority/ Other] to allow for evidenced-based decisions and policies. The [Licensee/ Permittee] agrees to process Shared Personal Data, for Climate Purposes and other purposes as set out in this [License/ Permit/ Permit Application], including:

1.3.1 [LIST FIRST PURPOSE, such as: for monitoring the Environmental Performance of the [Licensee/ Permittee]’s [access to mobility program]];

1.3.2 [LIST NEXT PURPOSE, such as: to increase access to mobility to users of transport in the jurisdiction of [City/ County/ University/ Transit Authority/ Other], especially in underserved communities];

1.3.3 [LIST NEXT PURPOSE, electrification];

1.3.4 [LIST NEXT PURPOSE, reducing car use and congestion and to encourage use of dockless bikes and scooters as an alternative to cars and trucks];

1.3.5 [LIST NEXT PURPOSE, air quality];  

1.3.6 [PURPOSE, such as: where used in anonymized and aggregated form, to contribute to public statistics and/or academic research]; [and]

1.3.7 [to best determine infrastructure needs of the dockless bike and scooter program, including protected lanes, bike or scooter paths, stations placement, and other needs.]

1.3.8 [LIST NEXT PURPOSE, [insert any relevant but specific purposes which contribute to the [City/ County/ University/ Transit Authority/ Other]’s Sustainability Goals or Sustainability Alignment but which are limited and defined enough to comply with privacy rights and data protection regulation.]  

1.4 [Licensee/ Permittee] and [City/ County/ University/ Transit Authority/ other] shall appoint a single point of contact (SPoC) who will work together to respond to issues arising from the data sharing and to actively improve the effectiveness of the data sharing initiative. The SPoCs for each of the parties are:

1.4.1 [Licensee/ Permittee]: [insert name, role, team, and work contact details of Licensee's/ Permittee's SPoC];

1.4.2 [City/ County/ University/ Transit Authority/ Other]: [insert name, role, team, and work contact details of [City/ County/ University/ Transit Authority/ Other]’s SPoC].

2. Shared Personal Data Requirements

2.1 Data sharing required: The [Licensee/ Permittee] is required to share the Shared Personal Data about smart mobility uses, including the use of dockless bikes, scooters, and other micromobility devices with the [City/ County/ University/ Transit Authority/ Other] as a condition for the use of the right-of-way, according to the terms set out in this [License/ Permit].

2.2 Types of Data: Only the following types of de-identified Personal Data will be shared between the parties during the Term of this [License/ Permit]:

2.2.1 [Location data][specify level of accuracy for GPS]; 

2.2.2 Travel routes and time stamp data;

2.2.3 Number of daily users;

2.2.4 Journey start and end location[; and]

[Drafting note: Add any other categories of data required to be shared for the purposes].

2.3 De-identification of Data Required: [Licensee/ Permittee] agrees to only provide de-identified data that does not identify individuals. [Licensee/ Permittee] shall not provide the following kinds of data to [City/ County/ University/ Transit Authority/ Other]:

2.3.1 Identifying data, including, but not limited to name(s), address(es), phone number(s), physical description, or any other identifying data or characteristics of individual users of the shared mobility device(s); and

2.3.2 Special Categories of Personal Data, including but not limited to biometric and facial recognition information.

2.3.3 [Licensee/ Permittee] shall ensure that [Licensee/ Permittee] does not directly or indirectly include or risk inclusion of these categories of data and shall redact or remove any such data from the Personal Data before it is provided to [City/ County/ University/ Transit Authority/ Other]. 

2.4 Processing Standards: The Shared Personal data shall be processed in accordance with the access and processing restrictions of this [License/ Permit]. 

2.5 Format: The Shared Personal Data shall be provided to [City/ County/ University/ Transit Authority/ Other] in the format set out in Schedule [2/ NUMBER/ LETTER/ other identifier]. The Licensee/ Permittee shall use datasets compatible with those used by [City/ County/ University/ Transit Authority/ Other] using the methods set out in Schedule [2/ NUMBER/ LETTER/ other identifier].

2.6 Irrelevant and Excessive Data Sharing Practices Prohibited: The [Licensee/ Permittee] shall ensure that the Shared Personal Data is not irrelevant or excessive with regard to the Climate Purposes and other purposes of this [License/ Permit].

3 Lawful Processing

[Drafting note: Add in addition to standard data sharing provisions.]

3.1 The [Licensee/ Permittee] shall, in respect of Shared Personal Data, ensure that it provides clear and sufficient information to any persons affected by the data gathering, use, or retention, in accordance with any federal, state, or local Data Protection Laws, of any information that is required to be provided by federal, state, or local laws and standards, including but not limited to:

3.1.1 That the purpose of a transfer to a third party is for the Climate Purposes and other purposes as set out in this [License/ Permit].

[Drafting note: Consider inserting specific agreed wording that will be provided to any person affected by the data gathering, use, or retention that addresses any specific state or local laws];

3.1.2 That Shared Personal Data may be transferred to a third party, with sufficient information about such transfer and the purpose of such transfer to enable the Data Subject to understand the purpose and risks of such transfer.

3.2 If, for any reason, one party reasonably considers that the data sharing under this [License/ Permit] is not lawful, the SPoC of such party shall immediately contact the SPoC of the other party or parties to notify them of such concern and consider what action, including suspending any future data sharing, needs to be taken.

4 Data Interoperability

4.1 To collaborate and work efficiently to achieve the Climate Purposes and Sustainability Goals, the parties agree to use compatible datasets and to record all Shared Personal Data using the methods set out in Schedule [2/ NUMBER/ LETTER/other identifier].

4.2 Before the Commencement Date of the [License/ Permit], the [Licensee/ Permittee] shall ensure that the system for curating Shared Personal Data provides accurate data and that it has appropriate internal procedures in place for the [City/ County/ University/ Transit Authority/ Other] to sample Shared Personal Data before the Commencement Date. Following the Commencement Date of the [License/ Permit], the [Licensee/ Permittee] shall update the Shared Personal Data as required for efficient sharing of data.

5 Data Retention and Deletion

5.1 The [Licensee/ Permittee] and [City/ County/ University/ Transit Authority/ Other] shall be permitted to continue to retain Shared Personal Data in accordance with any statutory or regulatory retention periods applicable to them.]

[Security of Information in Retention and Deletion Practices. 

5.1.1 The [Licensee/ Permittee] shall use methods in the retention and deletion of the Shared Personal Data that guarantees that there will not be any unauthorized release of any data that identifies or could be used to identify any individual.

5.1.2 The retention period for the Shared Personal Data shall be [the length of the License/ Permit]/ [[NUMBER] of years].

5.1.3 The Shared Personal Data shall be safeguarded in accordance with the following standards: 

(a) Implement policies and procedures that limit physical access to electronic information systems, hard or paper copies, and the facility where Shared Personal Data is stored.

(b) Implement policies and procedures that address maintenance, contingency, control, and validation of Shared Personal Data and limit access to the lowest number of persons necessary.

(c) Require non-disclosure agreements from persons who access Shared Personal Data. 

(d) Implement physical security for the facility where such information is located (for example, walls, doors, locks).

(e) Implement technical security measures to guard against unauthorized access to Shared Personal Data, including integrity controls, automatic log-off, and encryption.]

Schedules

Schedule [1]: Standards

[Set out any additional standards for collection, processing, storage, retention, or destruction of the data.]

Schedule [2]: Data Quality and Compatible Datasets

[Compatible datasets under this [License/ Permit] are:

[MDS]; 

[CDS-M]; or

[Other]].]