VEHICLE-FOR-HIRE DATA SHARING AGREEMENT

(the “Agreement”)

Between

CITY OF TORONTO

(the “City”)

OF THE FIRST PART

And

[Insert Private Transportation Company Name]

(“the PTC”)

OF THE SECOND PART

Whereas, Toronto Municipal Code Chapter 546, Licensing of Vehicles-for-Hire (“Chapter 546”) regulates the operation of private transportation companies (PTCs) and PTC drivers in the City of Toronto; and

Whereas, Chapter 546 requires the City and the PTC to collect and exchange data about individuals using the PTC’s platform so that the PTC can comply with Chapter 546 and the City can perform certain licensing services and enforce the Municipal Code; and

Whereas, the collection, storage, use, exchange, disclosure and disposition of data exchanged by the PTC and the City must be in accordance with all relevant privacy legislation and Chapter 546;

THE PARTIES AGREE AS FOLLOWS:

1.0 Interpretation

1.1 The following terms shall have the meanings herein specified unless the context otherwise specifies or requires:

“City Business Record” means the specific records created by or for the City of Toronto under the terms of this Agreement, and identified as such herein.

“Data” means all the information and data fixed in any medium of expression, regardless of form or format. Data includes “personal information” defined in s.2 of MFIPPA, even if such information is not subject to MFIPPA.

“PTC Data” means any data collected or otherwise obtained by the PTC for purposes other than its obligations under this Agreement.

“Executive Director” means the Executive Director, Municipal Licensing and Standards Division of the City of Toronto.

MFIPPA – Municipal Freedom of Information and Protection of Privacy Act, R.S.O 1990, c. M.56

PIPEDA – Personal Information Protection and Electronic Documents Act, S.C. 2000, c.5

PTC Driver – A driver who provides transportation to passengers through the PTC and is licensed or is required to be licensed under Chapter 546.

PTC Driver Data shall include, but is not limited to:

1. The full name, phone number and email address of every individual applying for a PTC driver’s licence (“PTC Driver Applicant”);

2. Complete information relating to the PTC Driver Applicant’s Ontario driver’s licence;

3. A criminal reference check for the PTC Driver Applicant;

4. A driving record abstract for the PTC Driver Applicant;

5. A certificate of insurance for the PTC vehicle that the PTC Driver Applicant will be driving when providing transportation to passengers that the Executive Director considers sufficient to satisfy the insurance requirements of Chapter 546;

6. The PTC Driver Applicant’s confirmation of that the insurance company insuring the vehicle the applicant will be operating has been advised that they offer or intend to offer transportation through a PTC;

7. The licence plate number, vehicle identification number, make, model, and model year of the PTC vehicle that the PTC Driver Applicant will be driving when providing transportation to passengers;

8. Vehicle Mechanical Safety Inspection Certificate; and

9. Confirmation of the Consent described in this Agreement.

Audit Trip Data shall include, but is not limited to, the following information for:

(1) Trips involving one passenger or one fare:

(a) Pick up location and destination (by reference to the intersection);

(b) Date and time each trip started and terminated; and

(c) Length of time elapsing between a passenger’s service request and start of each trip.

(2) Trips involving more than one passenger or for which multiple fares were charged:

(a) Total number of passengers paying separate fares;

(b) Pick up location(s) and destination(s) (by reference to the intersection) for each trip;

(c) Dates and times each trip started and terminated;

(d) Length of time that elapsed between the time the passenger(s) requested service and the trip started for each passenger;

(e) The fare(s) paid for the trip; and

(f) Number of trips involving multiple passengers paying separate fares.

(3) Trips involving accessible vehicles:

(a) Pick up location and destination (by reference to the intersection);

(b) Date and time each trip started and terminated; and

(c) Length of time elapsing between a passenger’s service request and start of each trip.

“PTC Driver Suspension Data” shall include, but is not limited to, full name, phone number, email address, PTC Driver Licence No. of the PTC Driver, date of receipt of suspension request, and date of suspension or termination.

“PTC Driver Licence Data” may include the following information in relation to any individual applying for or holding a PTC driver’s licence:

1. Their full name, email address and phone number;

2. Information relating to their Ontario driver’s licence or criminal record, including any driving-related or Criminal Code charges or convictions;

3. Information relating to any motor vehicle used to provide transportation to passengers using the PTC’s platform, including information related to insurance;

4. A request for suspension of a PTC Driver from a PTC platform; and,

5. Such additional information as ML&S considers necessary or appropriate to provide to the PTC to facilitate compliance with and enforcement of the requirements of Chapter 546.

“PTC Driver Suspension Request” shall mean the City Business Record prepared by the City containing such PTC Driver Licence Data as is required to inform the PTC of the request for suspension or termination from the PTC platform, in the form and manner approved by the Executive Director.

“PTC Driver Data Report” means the document prepared for the City, in the form and manner approved by the Executive Director that contains the PTC Driver Data, and shall be a City Business Record.

“Audit Trip Data Report” means the document prepared for the City, in the form and manner approved by the Executive Director that contains the Audit Trip Data, and shall be a City Business Record.

“PTC Driver Suspension Data Report” means the document prepared for the City, in the form and manner approved by the Executive Director that contains PTC Driver Licence Data, and shall be a City Business Record.

“PTC Driver Licence Data Report” shall mean the City Business Record prepared by the City containing any other PTC Driver Licence Data provided to PTC, other than the PTC Driver Suspension Request and PTC Driver E-Licence, in the form and manner approved by the Executive Director.

“PTC Driver E-Licence” shall mean the City Business Record prepared by the City, which is the electronic copy of the PTC Driver Licence issued by the City in accordance with Chapter 546.

1.2 The Parties agree that this Agreement establish the PTC’s requirements with respect to “Data-Sharing” which means the collecting, exchanging and disclosing of information collected by the licensed PTC and provided to the City, or provided by the City to the PTC, as necessary for processing business and driver licensing applications, monitoring compliance of the PTC and PTC Drivers with the requirements of this Agreement and Chapter 546, and related enforcement activities.

2.0 PTC Requirements

2.1 The PTC shall distribute to PTC Drivers the Notice described in subsection 4, and PTC Driver E-Licences in the form and manner approved by the Executive Director.

2.2 The PTC shall, upon obtaining the completed Notice, collect from the PTC Data the information comprising the PTC Driver Data, and Audit Trip Data.

2.3 The PTC shall create PTC Driver Data Report, and Audit Trip Data Report (both of which are City Business Records).

2.4 The PTC upon obtaining the PTC Suspension Request, shall collect from the PTC Data and the PTC Suspension Request information comprising the PTC Driver Suspension Data and shall create PTC Driver Suspension Data Report, which is a City Business Record.

2.5 The PTC shall transmit the PTC Driver Data Report, PTC Driver Suspension Data Report, and Audit Trip Data Report in accordance with Section 5 and on a schedule to be daily or weekly in accordance with Chapter 546 or as otherwise set by the Executive Director.

3.0 Manner of Data Collection by PTC

3.1 The PTC shall:

a. obtain the consent of each potential new PTC Driver and PTC Driver Applicant prior to the collection of their personal information and its disclosure to the City and/or law enforcement agencies; and

b. inform all each potential new PTC Driver and PTC Driver Applicant that the City may disclose personal information that it gathers about them in the course of administering and enforcing Chapter 546 to the PTC, including information related to current or pending offences or their driving record.

3.2 The PTC shall collect all the PTC Driver Data and Audit Trip Data from PTC Data; and shall collect all the PTC Driver Suspension Data from the PTC Data and the PTC Suspension Request.

4.0 Notice Requires Approval by the City

4.1 The PTC shall provide to potential new PTC Drivers and PTC Driver Applicants the form of consent that it shall use to comply with this Agreement and the requirements of Chapter 546 related to Data collection as attached in Schedule A hereto (the “Consent”). The PTC shall first obtain approval from the Executive Director of the method and manner in which drivers will provide the Consent.

4.2 If, during the term of its licence or at the time of any application for licence renewal, the PTC wishes to amend the Consent or the manner in which potential new PTC Drivers and PTC Driver Applicants are asked to provide the Consent, the PTC shall provide both the approved Consent and the proposed amended Consent and information regarding the method by which individuals are asked to provide the Consent to the Executive Director to request approval of the proposed amended Consent and the manner by which the Consent would be provided.

4.3 In such circumstances where the City needs to collect information concerning passengers utilizing a PTC service, the PTC shall provide such other information, and all assistance requested by the Executive Director as necessary to allow the City to provide any further notifications to such individuals for purposes of compliance with MFIPPA.

4.4 The PTC shall not collect, store, use, exchange, or disclose any City Business Record or Data contained therein relating to an individual unless it has confirmed that that individual has received and completed the Consent.

5.0 Security and Method of Data Transfer

5.1 The PTC shall ensure that City Business Records and the Data contained therein are stored in a separate and secure manner and format, from records and the Data of the PTC collected, utilized, disclosed for PTC operations other than those required under this Agreement (“PTC Business Data”).

5.2 The PTC shall ensure that appropriate security protocols, to the satisfaction of the Executive Director are in place to ensure access to City Business Records and the Data contained therein is restricted to only the staff of the PTC who requires access for the purposes of undertaking the requirements imposed under this Agreement (“Authorized Staff”).

5.3 The PTC and the City will use SFTP (Secure File Transfer Protocol) in the form and manner approved by Executive Director for the file transfer of City Business Records to or from the City. The PTC will use SFTP (Secure File Transfer Protocol) in the form and manner approved by Executive Director for the file transfer of City Business Records to the PTC Driver as required by the Agreement. Therefore, the PTC agrees to transfer all City Business Records to the City using SFTP in accordance with the technical requirements set out as follows. The PTC agrees that the use of e-mail to transfer City Business Records is prohibited.

5.4 The PTC warrants and represents that all Data-Sharing involving City Business Records shall be in compliance with this Agreement, and no other method of Data transfer will be used, requested or permitted before or after the issuance of the PTC’s Business Licence without the express written permission of the Executive Director.

5.5 The PTC agrees to implement the technical requirements requested by the Executive Director to permit all Data-Sharing involving City Business Records be encrypted in a manner approved by the Executive Director during transmission between the parties.

5.6 The PTC will provide the City with 60 days advance notice of all system changes that will require reprogramming or retesting of servers by the City, including changes arising from: SFTP hostname changes, changes to the IP address (or addresses) of the SFTP server, and programming code change or upgrades. For routine planned maintenance that will affect uploads to or downloads from the production SFTP account, including programming code upgrades, the PTC shall provide the City with 14 days advance notice.

5.7 The PTC shall provide the City with the PTC Driver Data Report, and Audit Trip Data Report, on at least a daily basis, in accordance with Chapter 546 or such other schedule set by the Executive Director.

5.8 Any request received by the PTC for Data-Sharing using a method other than the one specified in this Agreement must be reported immediately to the Director of Business Licensing and Regulatory Services, Municipal Licensing & Standards Division.

5.9 The City and the PTC will test the technical requirements implemented for Data-Sharing under this Agreement to the satisfaction of the City prior to the PTC business licence being issued, through the use of “Test Data”. “Test Data” includes fictitious data or other data which has had personal information replaced with fictitious information and/or general characters such that the data is no longer unique or associated with any identifiable individual.

5.10 The PTC represents and warrants that it shall take all reasonable measures to ensure that all data delivered to the City are accurate and complete, and are provided to the City in an electronic format approved by and satisfactory to the Executive Director.

6.0 Storage and Retention of Data

6.1 The PTC will securely store the City Business Records for a minimum of three years after the receipt or creation thereof, as required by Chapter 546, after such time all copies of City Business Records shall be destroyed or returned to the City upon receipt of written confirmation of the destruction or return from the Executive Director. The PTC agrees that all City Business Records shall be stored in a manner that would constitute, to the satisfaction of the Executive Director, reasonable measures to prevent inadvertent destruction, inadvertent damage, unauthorized access, and that the City Business Records are only accessed by Authorized Staff for the purposes of the obligations under this Agreement.

6.2 If requested by the PTC, after the expiry of three years, the City shall provide written confirmation concerning the destruction or return of the City Business Records, within 7 business days.

6.3 In any event, upon expiry or termination of the PTC business licence, the PTC agrees that all City Business Records created or received by the PTC as a result of or in connection with its operations as a licensed PTC shall be returned to the City or disposed of in a secure manner of the City’s choosing within 45 calendar days.

6.4 All City Business Records sent to or received from the City by the PTC shall be stored in a separate and secure location from any PTC Business Data. The PTC agrees that it shall ensure that only personnel of the PTC shall have access to City Business Records. Personnel assigned by the PTC to perform tasks related to or to produce the City Business Records or any part of these City Business Records, may, in the sole discretion of the City, be required to sign non-disclosure agreements satisfactory to the City before being permitted to perform such tasks.

6.5 The PTC agrees that it shall ensure that all City Business Records shall be stored maintained, and transmitted exclusively within the Province of Ontario, Canada, unless prior written approval is provided by Executive Director.

6.6 The PTC shall provide to the City a certificate of destruction or a signed and notarized Affidavit, satisfactory to the Executive Director, as proof of the destruction or return of the City Business Records in the manner required by the City.

7.0 City Data Sharing Activities

7.1 The City shall provide the PTC with, such PTC Driver Licence Data as the City believes is required for the PTC undertake a suspension or termination of a PTC Driver from the PTC’s platform through the provision of a PTC Driver Suspension Request that shall be transmitted in accordance with requirements of Section 5.

7.2 The City shall provide the PTC with, such other PTC Driver Licence Data as the City believes is required for the PTC to monitor and manage its compliance with the requirements of Chapter 546, the applicable screening criteria, and such other policies of the City as apply to the PTC and PTC Drivers, through the provision of a PTC Driver Licence Data Report, that shall be transmitted in accordance with requirements of Subsection 5.

7.3 As soon as practicable after the City’s issuance of the licence for an individual PTC Driver, the City shall transmit to the PTC, the PTC Driver E-Licence in accordance with requirements of Section 5.

8.0 Disclosure Rules

8.1 The PTC agrees that it will not disclose any City Business Record or any Data contained therein except as may be required for the PTC to undertake the obligations under this Agreement, or as outlined in this section.

8.2 The Parties agree that upon confirmation of the Consent, that the PTC may use, and otherwise disclose the content of the PTC Driver Licence Data Report, and PTC Driver Suspension Request for purposes unrelated to the obligations of the PTC to the City under this Agreement.

9. Prompt Disclosure of Any Potential Data Breach

9.1 In the event that the PTC becomes aware of any breach or compromise of its security that has or may lead to disclosure of any City Business Record to unauthorized sources, it will advise the Executive Director, in writing, immediately.

9.2 The PTC will take immediate steps to correct, restore, or implement new security measures to address the cause of any such breach or compromise for the purpose of ensuring compliance with its obligation to ensure the City Business Record is secure and access to the City Business Record is restricted.

9.3 The PTC will advise the Executive Director as to what caused or contributed to the breach or compromise, and advise as to what measures will or have been taken to address the breach or compromise. Upon receiving this information the Executive Director shall, as soon as practicable, provide notification of any additional steps that the City believes are required to address the breach or compromise. The PTC upon receipt of this notification shall immediately take any additional steps as notified by the Executive Director, to correct, restore, or implement new security measures to address the breach or compromise for the purpose of ensuring compliance with its obligation to ensure the City Business Record is secure and access to the City Business Record is restricted, The Page 9 of 11

PTC will also confirm to the Executive Director, in writing, when any breach or compromise of its security that has or may lead to disclosure of any City Business Record is corrected, restored, or new measures are in place.

10. Amending Procedures

10.1 This Agreement may be amended by the written agreement of the parties herein. Any amendments must comply with the requirements of MFIPPA, PIPEDA and the Municipal Code.

11. Changes that may Affect Data Sharing

11.1 In the event that Chapter 546 or other Chapters of the Municipal Code, MFIPPA, PIPEDA, or any other relevant legislation is amended and, as a result, provisions of this Agreement must be amended in order to ensure compliance with any of the legislative requirements applicable to the parties, the Executive Director shall notify the PTC of the terms of the Agreement that must be amended. Any amendments subsequently agreed upon shall be in writing and executed by the parties. If the parties cannot agree upon whether or how the Agreement shall be amended, the Agreement shall be terminated.

12. Termination

12.1 The Agreement shall terminate 12 months from the date the PTC business licence is issued, unless it is terminated sooner in accordance with the following provisions of this Agreement. Failure of the PTC to perform its obligations under the Agreement shall entitle the City to terminate the Agreement upon ten (10) calendar days’ written notice to the PTC if a breach which is remediable is not rectified in that time.

12.2 No delay or omission by the City in exercising any right or remedy shall operate as a waiver of them or of any other right or remedy, and no single or partial exercise of a right or remedy shall preclude any other or further exercise of them or the exercise of any other right or remedy.

12.3 If the Agreement is terminated for any reason, the City shall not incur any liability to the PTC in relation to its collection, storage, use, exchange, disclosure or disposition of any Data or its acquisition or use of equipment, work or services used for the purpose of this Agreement.

IN WITNESS WHEREOF the parties hereto have duly executed this Agreement under seal.

SIGNED, SEALED AND DELIVERED ) CITY OF TORONTO

In the presence of ) per:

)

)

)

) ________________________

) Clerk

)

) Page 10 of 11

)

)

)

) ________________________

CFO

)

) PTC:

) per:

)

)

)

)

)

) ________________________

Name:

Title: Page 11 of 11

VEHICLE-FOR-HIRE DATA SHARING AGREEMENT

SCHEDULE A – CONSENT

I, { individual’s name} understand that filing an application through { Private Transportation Company Name} and use of its services shall result in the collection of personal information from or about myself, including location data.

I, { individual’s name} authorize the City of Toronto to collect this personal information indirectly through accessing copies of this information collected by { Private Transportation Company Name, and for the { Private Transportation Company Name} to disclose this information to the City of Toronto.

I further consent to the disclosure by the City of Toronto of my personal information, including My full name, phone number and email address, complete information relating to my Ontario driver’s licence, my criminal reference check, my driving record abstract, my certificate of insurance for the PTC vehicle that I will be driving when providing transportation to passengers, my confirmation of the fact that I have notified the insurance company insuring my vehicle that I offer or intend to offer transportation through a PTC; the licence plate number, vehicle identification number, make, model, and model year of my vehicle, confirmation that I have read and agreed to this consent, as well as information relating to contravention of municipal by-laws, including but not limited to Chapter 546, Licensing of Vehicles-For-Hire, criminal offences or driving record, among other information indicated in Chapter 546, to the {Insert Private Transportation Company Name} and law enforcement agencies.

The information collected by the City shall be used to process, review and evaluate applications for licences under Chapter 546, Licensing of Vehicles-For-Hire, to issue, monitor and regulate licences in accordance with Chapter 546, to suspend, terminate or revoke licences issued, and to investigate potential violations of Chapter 546, and enforce compliance with its provisions, and to otherwise contact licence applicants and licence-holders in relation to services offered by the City of Toronto. This information is collected under the authority of Ss. 7, 8, 86, and 94 of the City of Toronto Act, 2006, and Chapter 546, Licensing of Vehicles-For-Hire. Any questions concerning this collection may be directed to the Manager of Licensing Services, 850 Coxwell Avenue, 3rd floor, Toronto, Ontario, M4C 5R1 or by telephone at: 416-392-6700