Open-source data sharing agreement clauses, compliant with the general data protection regulation (GDPR), that can be used by cities to enable development of the sustainable mobility sector.
Will secure long-term data flows and ensure that mobility providers feed mobility data to municipalities who need to enter such data into carefully drafted data sharing agreements. The drafting could be adopted by cities and organisations in public procurement agreements and data processing agreements.
(A) The Data Discloser operates smart mobility services and collects the Shared Personal Data through the provision of those services. The Data Receiver wishes to analyse the Shared Personal Data for the Climate Purposes and to facilitate achievement of the Sustainability Goals.
(B) The Data Receiver agrees to use the Shared Personal Data on the terms set out in this agreement.
(C) [This is a free-standing agreement that does not incorporate any commercial terms established by the parties under separate commercial arrangements.]*
* [Drafting note: do not use this wording if the smart mobility provider is providing services to the city and this is being used as the data sharing agreement for that arrangement.]
[Drafting note: this clause has been drafted from an EU perspective and will need to be adapted for use in the US, UK or elsewhere in the world. The drafting assumes that these terms would be inserted into a standard data sharing agreement that would include all normal data sharing provisions concerning Data Protection Impact Assessments, Lawful Basis for processing, the specific technical and organisational measures and all standard definitions, terms and boilerplate clauses relevant to Data Processing agreements.]
2. Purpose
2.1 This agreement sets out the framework for the sharing of Personal Data when the Data Discloser discloses Personal Data to the Data Receiver.* It defines the principles and procedures that the parties shall adhere to and the responsibilities the parties owe to each other. The Data Discloser agrees to share the Shared Personal Data with the Data Receiver on the terms set out in this agreement.
* [Drafting note: it is assumed for the purposes of this drafting that the transfer of data is one way. If it is intended to flow in both directions the clauses will need to be amended accordingly.]
2.2 Each party considers this data sharing initiative necessary as [insert reasons, such as: smart mobility data sharing is crucial for the Data Receiver’s policy goals of creating a sustainable municipality, specifically for making a greener city of [location]]. It will serve to benefit society by [insert benefit, such as: reducing carbon emissions by reducing traffic congestion].*
* [Drafting note: insert agreement-specific information here to address whether:
to align with the terms of the commercial agreement that runs in partnership with the data sharing agreement.]
2.3 Insights derived from Shared Personal Data will be used by the Data Receiver to allow for evidenced-based decisions and policies. The Data Receiver agrees to process Shared Personal Data, as described in clauses 3.1, 3.2 and 3.3, solely for the following purposes (together the Climate Purposes):
(a) [PURPOSE, such as: for monitoring the Environmental Performance of the Data Receiver’s [access to mobility programme]];
(b) [PURPOSE, such as: to increase access to mobility to users of transport in [●], especially in underserved communities];
(c) [PURPOSE, electrification];
(d) [PURPOSE, reducing car use and congestion];
(e) [PURPOSE, air quality];
(f) [PURPOSE, such as: where used in anonymised and aggregated form, to contribute to public statistics and/ or academic research]; [and]
(g) [PURPOSE, [insert any relevant but specific purposes which contribute to the Data Receiver’s Sustainability Goals or Sustainability Alignment (including contributing to the Paris Agreement goals and identifying specific emission reduction requirements) but which are limited and defined enough to comply with the purpose limitation aspect of data protection regulation.]
The Data Receiver shall not process Shared Personal Data in a way that is incompatible with the Climate Purposes.
2.4 Each party shall appoint a single point of contact (SPoC) with climate, mobility and data expertise who will work together to reach an agreement with regards to any issues arising from the data sharing and to actively improve the effectiveness of the data sharing initiative. The SPoCs for each of the parties are:
(a) Data Discloser: [insert name, role, team and contact details of Data Discloser’s SPoC];
(b) Data Receiver: [insert name, role, team and contact details of Data Receiver’s SPoC].
3. Shared Personal Data
3.1 Only the following types of Personal Data will be shared between the parties during the Term of this agreement:
(a) [location data][specify level of accuracy for GPS];
(b) [vehicle registration and/ or vehicle emissions date];
(c) travel routes and time stamp data;
(d) number of passengers in vehicle;
(g) [names] [Drafting note: delete if all data to be anonymised or pseudonymised];
(f) journey start and end location[; and]
(g) [Drafting note: add any other categories of data required to be shared for the purposes],
together with further details outlined in Schedule [1], the Shared Personal Data.
3.2 Each party severally agrees not to share the following kinds of data with any other party to this agreement:
(a) Criminal Offence Data;
(b) Special Categories of Personal Data, including but not limited to biometric and facial recognition information,
where parties shall check Personal Data before sharing to ensure that it does not directly or indirectly include or risk inclusion of these categories of data, and shall redact or remove any such data from the Personal Data before it is shared.
3.3 The Shared Personal data shall be processed in accordance with the access and processing restrictions set out in Schedule [1].
3.4 The [parties/ Data Discloser] shall ensure that the Shared Personal Data is not irrelevant or excessive with regard to the Climate Purposes.
3.5 [Drafting note: insert details to make it clear which of the parties shall be data controllers in respect of Shared Personal Data, in accordance with the specific circumstances of the agreement, if not already covered in the agreement].
4. Lawful, Fair and Transparent Processing
[Drafting note: add in addition to standard data sharing provisions.]
4.1 The Data Discloser shall, in respect of Shared Personal Data, ensure that it provides clear and sufficient information to the Data Subjects, in accordance with the Data Protection Legislation, of the purposes for which it will process their Personal Data, the legal basis for those purposes and such other information as is required by Article 13 of the GDPR and other laws and standards, including but not limited to:
(a) that the purpose of a transfer to a third party is for the Climate Purposes [Drafting note: consider inserting specific agreed wording that will be cascaded to the data subject to highlight the benefit to society and climate];
(b) if Shared Personal Data will be transferred to a third party, that fact and sufficient information about such transfer and the purpose of such transfer to enable the Data Subject to understand the purpose and risks of such transfer.
4.2 If, for any reason, one party reasonably considers that the data sharing under this agreement is not lawful, fair or transparent, the SPoC of such party shall immediately contact the SPoC of the other party or parties to notify them of such concern and consider what action, including suspending any future data sharing, needs to be taken.
[Drafting note: consider adding further provisions to fully operationalise this process.]
5. Data Interoperability
5.1 To collaborate and work efficiently to achieve the Climate Purposes and Sustainability Goals, the parties agree to use compatible datasets and to record all Shared Personal Data using the methods set out in Schedule [2].
5.2 The Data Discloser shall ensure that, before the Commencement Date, Shared Personal Data are accurate and that it has appropriate internal procedures in place for the Data Receiver to sample Shared Personal Data before the Commencement Date and it will update the Shared Personal Data if required before transferring the Shared Personal Data.
6. Data Retention and Deletion
[Drafting note: align these provisions with those detailing what may be done with the data. For example if data may be combined with other data sets or anonymised, this clause 6 should be amended accordingly.]
6.1 The Data Receiver shall not retain or process Shared Personal Data for longer than is necessary to carry out the Climate Purposes.
6.2 Notwithstanding clause 6.1, the parties shall be permitted to continue to retain Shared Personal Data in accordance with any statutory or regulatory retention periods applicable to them. The parties may put in place common rules for the retention and deletion of Shared Personal Data.
6.3 The Data Receiver shall ensure that any Shared Personal Data are returned to the Data Discloser or destroyed in the following circumstances:
(a) once processing of the Shared Personal Data is no longer necessary for the Climate Purposes; or
(b) [on termination of this agreement].
6.4 Following the deletion of Shared Personal Data in accordance with clause 6.3, the Data Receiver shall notify the Data Discloser that the Shared Personal Data in question has been deleted.
7. Additional Party and Termination of Agreement*
7.1 Any additional Data Receiver that wishes to be part of this data sharing initiative and agreement shall complete and submit a data sharing request. The consent of every party is required for the additional party to be included into this agreement.**
7.2 In the event that a party terminates the agreement or a new Data Receiver joins the agreement in accordance with clause 7.1, an amended and updated version of this agreement will be drafted as soon as practicable and circulated to all other parties.
* [Drafting note: consider including express provisions for:
** [Drafting note: consider if it would be simpler for each data receiver to complete a separate agreement, avoiding potential issues with joint and several liability.]
Schedule [1]: [Shared Personal Data]
[Drafting note: insert (i) any further details (as referred to in clause 3.1), and (ii) access and processing restrictions for Shared Personal Data (as referred to in clause 3.3).]
Schedule [2]: [Data Quality and Compatible Datasets]
Compatible datasets under this agreement are:
[Drafting note: insert methods for recording Shared Personal Data (as referred to in clause 5.1).]
1. Definitions
Climate Purposes has the meaning given to it in clause 2.3.
Environmental Performance means all or any of the following in relation to the [location]:
(a) energy consumption;
[(b) water consumption and discharge;]*
[(c) waste generation and management;]*
(d) GHG Emissions; and/ or
(e) other adverse environmental impacts, including outcomes for nature and biodiversity.
* [Drafting note: keep this if relevant to the subject of the data sharing, e.g. as part of the context of city and mobility planning]
Greenhouse Gas (GHG) Emissions means emissions of the greenhouse gases listed at Annex A of the 1998 Kyoto Protocol to The United Nations Framework Convention on Climate Change, as may be amended from time to time, including carbon dioxide (CO2), methane (CH4), nitrous oxide (N2O), nitrogen trifluoride (NF3), hydrofluorocarbons (HFCs), perfluorocarbons (PFCs) and sulphur hexafluoride (SF6), each expressed as a total in units of carbon dioxide equivalent (CO2e) and from all sources, categorised as scope 1, 2 and 3 emissions by The Greenhouse Gas Protocol: A Corporate Accounting and Reporting Standard, Revised Edition 2015, as updated from time to time. [Scope 1, 2 and 3 emissions are defined on page 27 of the GHG Protocol.]
Material Climate Breach means [any action by a party [in relation to this agreement]/ a breach of the Climate Purposes of this agreement], which is material with regard to all relevant circumstances, including without limitation taking any action that is contrary to the achievement of the Sustainability Goals. [Drafting note: consider this definition carefully in light of any indemnities in the main agreement.]
MDS means Mobility Data Specification, a digital tool that standardises communication for exchanging data between mobility operators and cities or other regulators to manage transportation in the public right of way, as governed by the Open Mobility Foundation.
Nationally Determined Contribution (NDC(s)) means the stated successive intended goals of a country to reduce its national GHG Emissions and adapt to the impacts of climate change as required under Article 4, paragraph 2 of the Paris Agreement.
Paris Agreement means the climate change agreement among countries to reduce GHG Emissions to (i) limit the global average temperature increase to well below 2°C (3.6°F) above pre industrial levels by the year 2100; (ii) pursue efforts to limit the global average temperature rise to 1.5°C (2.7°F) above pre-industrial levels; and (iii) reach net zero GHG Emissions in the second half of this century, agreed during the 21st Conference of the parties to the UNFCCC in Paris in 2015.
Shared Personal Data has the meaning given to it in clause 3.1.
SPoC has the meaning given to it in clause 2.4.
Sustainability Alignment means the operation of the Data Receiver in a manner which (i) supports the achievement of the goals set out in Articles 2.1 and 4.1 of the Paris Agreement, (ii) supports the achievement of one or more of the United Nations Sustainable Development Goals as set out in the 2030 Agenda for Sustainable Development and (iii) supports [insert name of country]’s achievement of its Nationally Determined Contribution.
Sustainability Goals means the Data Receiver’s goals and objectives for achieving and maintaining Sustainability Alignment, which shall include [but shall not be limited to]:
(a) [undertaking projects to create smart solutions to reduce GHG Emissions and air pollution, including in transport;]
(b) [undertaking projects to electrify operations, including, where possible, transport and logistics;]
(c) [implementing zero waste and circular economy practices and principles in existing operations and design of new policy goals;]
(d) identifying electric charging locations and requirements; and
(e) undertaking smart grid and Internet Of Things.*
* [For an explanation of Internet of Things, see IoT for All, A Beginner's Guide to Internet of Things (IoT) 2021 (September 2021).]
Tell us about your experience with this clause so we can improve it.