Model Smart Mobility Data Sharing Clauses

Clauses

[Drafting note: this clause has been drafted from an EU perspective and will need to be adapted for use in the US, UK or elsewhere in the world. The drafting assumes that these terms would be inserted into a standard data sharing agreement that would include all normal data sharing provisions concerning Data Protection Impact Assessments, Lawful Basis for processing, the specific technical and organisational measures and all standard definitions, terms and boilerplate clauses relevant to Data Processing agreements.]

1. Purpose

1.1 This agreement sets out the framework for the sharing of Personal Data when the Data Discloser discloses Personal Data to the Data Receiver.* It defines the principles and procedures that the parties shall adhere to and the responsibilities the parties owe to each other. The Data Discloser agrees to share the Shared Personal Data with the Data Receiver on the terms set out in this agreement.

1.2 Each party considers this data sharing initiative necessary as [insert reasons, such as: smart mobility data sharing is crucial for the Data Receiver’s policy goals of creating a sustainable municipality, specifically for making a greener city of [location]]. It will serve to benefit society by [insert benefit, such as: reducing carbon emissions by reducing traffic congestion].**

1.3 Insights derived from Shared Personal Data will be used by the Data Receiver to allow for evidenced-based decisions and policies. The Data Receiver agrees to process Shared Personal Data, as described in clauses 2.1, 2.2 and 2.3, solely for the following purposes (together the Climate Purposes):

1.3.1 [PURPOSE, such as: for monitoring the Environmental Performance of the Data Receiver’s [access to mobility programme]];

1.3.2 [PURPOSE, such as: to increase access to mobility to users of transport in [●], especially in underserved communities];

1.3.3 [PURPOSE, electrification];

1.3.4 [PURPOSE, reducing car use and congestion];

1.3.5 [PURPOSE, air quality];  

1.3.6 [PURPOSE, such as: where used in anonymised and aggregated form, to contribute to public statistics and/or academic research]; [and]

1.3.7 [PURPOSE, [insert any relevant but specific purposes which contribute to the Data Receiver’s Sustainability Goals or Sustainability Alignment (including contributing to the Paris Agreement goals and identifying specific emission reduction requirements) but which are limited and defined enough to comply with the purpose limitation aspect of data protection regulation.] 

The Data Receiver shall not process Shared Personal Data in a way that is incompatible with the Climate Purposes.

1.4 Each party shall appoint a single point of contact (SPoC) with climate, mobility and data expertise who will work together to reach an agreement with regards to any issues arising from the data sharing and to actively improve the effectiveness of the data sharing initiative. The SPoCs for each of the parties are:

1.4.1 Data Discloser: [insert name, role, team and contact details of Data Discloser’s SPoC];

1.4.2 Data Receiver: [insert name, role, team and contact details of Data Receiver’s SPoC].

* [Drafting note: it is assumed for the purposes of this drafting that the transfer of data is one way. If it is intended to flow in both directions the clauses will need to be amended accordingly.]

** [Drafting note: insert agreement-specific information here to address whether:

• Resultant analysis can be shared and published; and
• Where the data can be combined with other datasets for analysis and commercialised, a fee will be paid in respect of any cost saving as a result of analysis, to align with the terms of the commercial agreement that runs in partnership with the data sharing agreement.]

2. Shared Personal Data

2.1 Only the following types of Personal Data will be shared between the parties during the Term of this agreement:

2.1.1 [Location data][specify level of accuracy for GPS]; 

2.1.2 [Vehicle registration and/or vehicle emissions date];

2.1.3 Travel routes and time stamp data;

2.1.4 Number of passengers in vehicle;

2.1.5 [Names] [Drafting note: Delete if all data to be anonymised or pseudonymised];

2.1.6 Journey start and end location[; and]

2.1.7 [Add any other categories of data required to be shared for the purposes], together with further details outlined in Schedule [1], the Shared Personal Data.

2.2 Each party severally agrees not to share the following kinds of data with any other party to this agreement: 

2.2.1 Criminal Offence Data;

2.2.2 Special Categories of Personal Data, including but not limited to biometric and facial recognition information, where parties shall check Personal Data before sharing to ensure that it does not directly or indirectly include or risk inclusion of these categories of data, and shall redact or remove any such data from the Personal Data before it is shared. 

2.3 The Shared Personal data shall be processed in accordance with the access and processing restrictions set out in Schedule [1].

2.4 The [parties/ Data Discloser] shall ensure that the Shared Personal Data is not irrelevant or excessive with regard to the Climate Purposes.

[Drafting note: insert details to make it clear which of the parties shall be data controllers in respect of Shared Personal Data, in accordance with the specific circumstances of the agreement, if not already covered in the agreement].

3. Lawful, Fair and Transparent Processing

[Drafting note: add in addition to standard data sharing provisions.]

3.1 The Data Discloser shall, in respect of Shared Personal Data, ensure that Personal Data will only be shared with the consent of the Data Subjects, where such consent is required and it provides clear and sufficient information to the Data Subjects, in accordance with the Data Protection Legislation, of the purposes for which it will process their Personal Data, the legal basis for those purposes and such other information as is required by Article 13 of the GDPR and other laws and standards, including but not limited to:

3.1.1 That the purpose of a transfer to a third party is for the Climate Purposes [Drafting note: Consider inserting specific agreed wording that will be cascaded to the data subject to highlight the benefit to society and climate];

3.1.2 If Shared Personal Data will be transferred to a third party, that fact and sufficient information about such transfer and the purpose of such transfer to enable the Data Subject to understand the purpose and risks of such transfer.

3.2 If, for any reason, one party reasonably considers that the data sharing under this agreement is not lawful, fair or transparent, the SPoC of such party shall immediately contact the SPoC of the other party or parties to notify them of such concern and consider what action, including suspending any future data sharing, needs to be taken.*

* [Drafting note: consider adding further provisions to fully operationalise this process.]

4. Data Interoperability

4.1 To collaborate and work efficiently to achieve the Climate Purposes and Sustainability Goals, the parties agree to use compatible datasets and to record all Shared Personal Data using the methods set out in Schedule [2].

4.2 The Data Discloser shall ensure that, before the Commencement Date, Shared Personal Data are accurate and that it has appropriate internal procedures in place for the Data Receiver to sample Shared Personal Data before the Commencement Date and it will update the Shared Personal Data if required before transferring the Shared Personal Data.

5. Data Retention and Deletion*

5.1 The Data Receiver shall not retain or process Shared Personal Data for longer than is necessary to carry out the Climate Purposes.

5.2 Notwithstanding clause 5.1, the parties shall be permitted to continue to retain Shared Personal Data in accordance with any statutory or regulatory retention periods applicable to them. The parties may put in place common rules for the retention and deletion of Shared Personal Data.

5.3 The Data Receiver shall ensure that any Shared Personal Data are returned to the Data Discloser or destroyed in the following circumstances:

5.3.1 Once processing of the Shared Personal Data is no longer necessary for the Climate Purposes; or

5.3.2 [On termination of this agreement].

5.4 Following the deletion of Shared Personal Data in accordance with clause 5.3, the Data Receiver shall notify the Data Discloser that the Shared Personal Data in question has been deleted.

* [Drafting note: align these provisions with those detailing what may be done with the data. For example, if data may be combined with other data sets or anonymised, this clause 6 should be amended accordingly.]

6. Additional Party and Termination of Agreement

[Drafting note: consider including express provisions for:

(a) Termination;

(b) The suspension of data sharing whilst the parties consider concerns with the other party's performance; and/or a right of termination where one party does something to bring the other party into disrepute, e.g. where one is making use of personal data in such a way as to offend perceptions of ethical use of data.]

6.1 Any additional Data Receiver that wishes to be part of this data sharing initiative and agreement shall complete and submit a data sharing request. The consent of every party as well as of the Data Subject is required for the additional party to be included into this agreement.*

6.2 In the event that a party terminates the agreement or a new Data Receiver joins the agreement in accordance with clause 6.1, an amended and updated version of this agreement will be drafted as soon as practicable and circulated to all other parties.

* [Drafting note: consider if it would be simpler for each data receiver to complete a separate agreement, avoiding potential issues with joint and several liability.]

Schedule [1]: [Shared Personal Data]

[Drafting note: insert (i) any further details (as referred to in clause 2.1), and (ii) access and processing restrictions for Shared Personal Data (as referred to in clause 2.3).]

Schedule [2]: [Data Quality and Compatible Datasets]

Compatible datasets under this agreement are:

• [MDS]; and/or
• [CDS-M]

[Drafting note: insert methods for recording Shared Personal Data (as referred to in clause 4.1).]