VEHICLE-FOR-HIRE DATA SHARING AGREEMENT
(the “Agreement”)
Between
CITY OF TORONTO
(the “City”)
OF THE FIRST PART
-and-
[Insert Private Transportation Company Name]
(“the PTC”)
OF THE SECOND PART
Whereas, Toronto Municipal Code Chapter 546, Licensing of Vehicles-for-Hire (“Chapter 546”) regulates the operation of private transportation companies (“PTCs”) and PTC Drivers in the City of Toronto; and
Whereas, Chapter 546 requires the City and the PTC to collect and exchange data about PTC Drivers and other individuals who wish to use or are using the PTC’s platform so that the PTC can comply with Chapter 546 and the City can perform certain licensing services, enforce the Toronto Municipal Code, and advance transportation planning, among other things; and
Whereas, the collection, storage, use, exchange, disclosure, and disposition of data exchanged by the PTC and the City must be in accordance with all relevant privacy legislation and Chapter 546;
THE PARTIES AGREE AS FOLLOWS:
1.0 Interpretation
1.1 The following terms shall have the meanings indicated unless otherwise specified:
“Audit Trip Data” shall include:
“Audit Trip Data Report” means the document prepared for the City, in the form and manner approved by the Executive Director that contains the Audit Trip Data, and shall be a City Business Record.
“City Business Record” means the specific records created by or for the City of Toronto under the terms of this Agreement, and identified as such herein.
“Consent” means the document attached to this Agreement as Schedule “A”.
“Data” means all information and data fixed in any medium of expression, regardless of form or format. Data includes “personal information” defined in s.2 of MFIPPA, even if such information is not subject to MFIPPA.
“PTC Data” means any Data collected or otherwise obtained by the PTC for purposes other than its obligations under this Agreement.
“Executive Director” means the Executive Director, Municipal Licensing and Standards Division of the City of Toronto.
“MFIPPA” means the Municipal Freedom of Information and Protection of Privacy Act, R.S.O 1990, c. M.56
“PIPEDA” means the Personal Information Protection and Electronic Documents Act, S.C. 2000, c.5
“PTC Driver” means a driver who provides transportation to passengers through the PTC and is licensed or is required to be licensed under Chapter 546.
“PTC Driver Data” shall include:
“PTC Driver Data Report” means the document prepared for the City, in the form and manner approved by the Executive Director that contains the PTC Driver Data, and shall be a City Business Record.
“PTC Driver E-Licence” means the document prepared by the City, which is the electronic copy of the PTC Driver Licence issued by the City in accordance with Chapter 546, and shall be a City Business Record.
“PTC Driver Licence Data” includes the following information in relation to any individual applying for or holding a PTC Driver’s licence:
“PTC Driver Licence Data Report” shall mean the document prepared by the City containing any PTC Driver Licence Data provided by the City to the PTC, other than the PTC Driver Suspension Request and PTC Driver E-Licence, and shall be a City Business Record.
“PTC Driver Suspension Data” shall include the full name, phone number, e-mail address, PTC Driver licence number, date of receipt of suspension request, and date of suspension or termination; and, such other information as may be required by the Executive Director, as authorized by Chapter 546.
“PTC Driver Suspension Data Report” means the document prepared for the City, in the form and manner approved by the Executive Director that contains PTC Driver Licence Data, and shall be a City Business Record.
“PTC Driver Suspension Request” shall mean the document prepared by the City containing such PTC Driver Licence Data as is required to inform the PTC of the request for suspension or termination from the PTC platform of PTC Driver(s), and shall be a City Business Record.
1.2 The Parties agree that this Agreement establishes the PTC’s obligations with respect to “Data-Sharing” which means the collecting, exchanging, and disclosing of Data collected by the licensed PTC and provided to the City, or provided by the City to the PTC, as necessary for processing business and driver licensing applications, monitoring and enforcing compliance of the PTC and PTC Drivers with the requirements of this Agreement and Chapter 546, and conducting related transportation planning, congestion management, and other initiatives.
2.0 PTC Requirements
2.1 The PTC shall distribute to PTC Drivers the Consent described in subsection 4 and PTC Driver E-Licences in the form and manner approved by the Executive Director.
2.2 The PTC shall, upon a PTC Driver agreeing to the Consent, collect from the PTC Data the information comprising the PTC Driver Data and Audit Trip Data and shall then create the PTC Driver Data Report and Audit Trip Data Report.
2.3 The PTC shall, upon receiving a PTC Driver Suspension Request, collect from the PTC Data and the PTC Driver Suspension Request information comprising the PTC Driver Suspension Data and shall create PTC Driver Suspension Data Report.
2.4 The PTC shall transmit the PTC Driver Data Report, PTC Driver Suspension Data Report, and Audit Trip Data Report to the City in accordance with Section 5 and on a daily basis, unless any variation to this schedule is approved the Executive Director.
2.5 The Parties acknowledge and agree that any Data delivered or otherwise supplied to the City by the PTC under this Agreement, including the Agreement itself, may be subject to disclosure under the terms of MFIPPA. The Parties agree that the City will not be found in breach of this Agreement where the City discloses any Data in accordance with applicable law.
2.6 Where a Party receives a request, under MFIPPA or otherwise, or demand, by court order, summons, or subpoena for the disclosure of City Business Records or other records arising from this Agreement, the Party shall notify counsel for the other Party in writing, as soon as practicable, such that the other Party can take steps to protect its legal interests and respond, as may be appropriate, with regard to the nature of the request or demand.
3.0 Manner of Data Collection by PTC
3.1 The PTC shall:
3.2 After taking these steps, the PTC shall collect all the PTC Driver Data and Audit Trip Data from PTC Data; and shall collect all the PTC Driver Suspension Data from the PTC Data and the PTC Driver Suspension Request.
4.0 Consent Requires Approval by the City
4.1 The PTC shall provide to potential new PTC Drivers and PTC Driver Applicants the Consent in a method and manner approved by the Executive Director.
4.2 If, during the term of its licence or at the time of any application for licence renewal, the PTC wishes to amend the Consent or the manner in which potential new PTC Drivers and PTC Driver Applicants are asked to provide the Consent, the PTC shall provide both the approved Consent and the proposed Consent and information regarding the method by which individuals would be asked to agree to the Consent to the Executive Director for approval.
4.3 In such circumstances where the City needs to collect Data concerning passengers utilizing a PTC service, the PTC shall provide such other Data, and all assistance requested by the Executive Director as necessary to allow the City to provide any further notice or consent to such individuals for purposes of compliance with MFIPPA.
4.4 The PTC shall not collect, store, use, exchange, or disclose any City Business Record or Data contained therein relating to an individual unless it has confirmed that that individual has received and agreed to the Consent.
5.0 Security and Method of Data Transfer
5.1 The PTC shall ensure that City Business Records and the Data contained therein are stored separately, in a secure manner and format, from PTC Data.
5.2 The PTC shall ensure that appropriate security protocols, to the satisfaction of the Executive Director, are in place to ensure access to City Business Records and the Data contained therein is restricted only to staff of the PTC who require access for the purposes of fulfilling the PTC’s obligations under this Agreement (“Authorized Staff”).
5.3 The PTC and the City shall exclusively use SFTP (Secure File Transfer Protocol), in the form and manner approved by Executive Director, for the transfer of any City Business Record to or from the City, unless the PTC receives express written permission from the Executive Director to use another specified method of data transfer. The PTC will use SFTP (Secure File Transfer Protocol) in the form and manner approved by Executive Director for the file transfer of City Business Records to the PTC Driver as required by the Agreement.
5.4 The PTC warrants and represents that all Data-Sharing involving City Business Records shall be in compliance with this Agreement, and that no other method of Data transfer will be used or permitted before or after the issuance of the PTC’s business licence unless with the express prior written permission of the Executive Director.
5.5 The PTC agrees to implement the technical requirements requested by the Executive Director to permit all Data-Sharing involving City Business Records be encrypted in a manner approved by the Executive Director during transmission between the parties.
5.6 The PTC will provide the City with 60 days advance notice of all system changes that will require reprogramming or retesting of servers by the City, including changes arising from: SFTP hostname changes, changes to the IP address (or addresses) of the SFTP server, and programming code change or upgrades. For routine planned maintenance that will affect uploads to or downloads from the production SFTP account, including programming code upgrades, the PTC shall provide the City with 14 days advance notice.
5.7 The PTC agrees that the City Business Records and the Data therein shall only be shared with the City in accordance with this Agreement or pursuant to the direction of the Executive Director, and with no other person. If the PTC receives any request to share City Business Records or the Data therein from a third party or by any method other than that required by this Agreement, the PTC shall immediately report such request to the Executive Director.
5.8 The City and the PTC will test the technical requirements implemented for Data-Sharing under this Agreement to the satisfaction of the City prior to the PTC business licence being issued through the use of “Test Data”. “Test Data” includes fictitious Data or other Data which has had personal information replaced with fictitious information and/or general characters such that the Data is no longer unique or associated with any identifiable individual.
5.9 The PTC represents and warrants that it shall take all reasonable measures to ensure that all Data delivered to the City is accurate and complete, and is provided to the City in an electronic format approved by and satisfactory to the Executive Director.
6.0 Storage and Retention of Data
6.1 The PTC will securely store City Business Records and records used to verify the information required by §546-112E.1 for a minimum of three years after the receipt or creation thereof, as required by Chapter 546. After such time, the PTC may request permission from the City to either destroy or return to the City all copies of City Business Records and the City shall provide direction to the PTC on this request within 7 business days. The PTC shall provide the City written confirmation of the successful destruction or return of City Business Records upon request.
6.2 The PTC agrees that all City Business Records shall be stored in a manner that would constitute, to the satisfaction of the Executive Director, reasonable measures to prevent inadvertent destruction, inadvertent damage, and unauthorized access, and to prevent access to the City Business Records other than by Authorized Staff.
6.3 In any event, upon expiry or termination of the PTC business licence, the PTC agrees that all City Business Records created or received by the PTC as a result of or in connection with its operations as a licensed PTC shall be destroyed or returned to the City in a secure manner of the City’s choosing within 45 calendar days, as the City directs,.
6.4 All City Business Records sent to or received from the City by the PTC shall be stored in a separate and secure location from any PTC Data. The PTC agrees that it shall ensure that only Authorized Staff of the PTC shall have access to City Business Records. Personnel assigned by the PTC to perform tasks related to or to produce the City Business Records or any part of these City Business Records, may, in the sole discretion of the City, be required to sign non-disclosure agreements satisfactory to the City before being permitted to perform such tasks.
6.5 The PTC shall ensure that all City Business Records are stored, maintained, and transmitted exclusively within the Province of Ontario, Canada, unless the Executive Director gives prior, written consent to an alternative arrangement.
6.6 The PTC shall provide to the City a certificate of destruction or an affidavit, satisfactory to the Executive Director, as proof of the destruction or return of the City Business Records in the manner required by the City.
7.0 City Data Sharing Activities
7.1 The City shall provide the PTC with such PTC Driver Licence Data as the City believes is required for the PTC to undertake the suspension or termination of a PTC Driver from the PTC’s platform through the provision of a PTC Driver Suspension Request.
7.2 The City shall provide the PTC with such other PTC Driver Licence Data as the City believes is required for the PTC to monitor and manage its compliance with the requirements of Chapter 546, the applicable screening criteria, and such other policies of the City as apply to the PTC and PTC Drivers, through the provision of a PTC Driver Licence Data Report.
7.3 As soon as practicable after the City’s issuance of a licence to an individual PTC Driver, the City shall transmit to the PTC the PTC Driver E-Licence.
8.0 Disclosure Rules
8.1 The PTC agrees that it will not disclose any City Business Record or any Data contained therein except as may be required for the PTC to fulfill its obligations under this Agreement, or as outlined in this section.
8.2 The Parties agree that upon confirmation of the Consent, that the PTC may use, and otherwise disclose the content of the PTC Driver Licence Data Report, and PTC Driver Suspension Request for purposes unrelated to the obligations of the PTC to the City under this Agreement.
9.0 Prompt Disclosure of Any Potential Data Breach
9.1 In the event that the PTC becomes aware of any breach or compromise of its security that has or may lead to disclosure to unauthorized sources of any City Business Record or any Data collected or otherwise obtained by the PTC to fulfill its obligations under this Agreement, it shall advise the Executive Director, in writing, immediately.
9.2 The PTC shall take immediate steps to correct, restore, or implement new security measures to address the cause of any such breach or compromise for the purpose of ensuring compliance with its obligations to ensure that City Business Records are secure and that access to City Business Records is restricted.
9.3 The PTC shall advise the Executive Director as to what caused or contributed to a breach or compromise described in 9.1 and what measures will or have been taken to address the breach or compromise. Upon receiving this information, the Executive Director shall, as soon as practicable, inform the PTC of any additional steps that the City believes are required to address the breach or compromise with respect to City Business Records or any Data collected or otherwise obtained by the PTC to fulfill its obligations under this Agreement. The PTC shall promptly take the additional steps required by the Executive Director and shall notify the Executive Director when the breach or compromise is corrected, restored, or when new security measures are in place.
10.0 Amending and Assignment
10.1 This Agreement may be amended by the written agreement of the parties herein. Any amendments must comply with the requirements of MFIPPA, PIPEDA and the Toronto Municipal Code.
10.2 This Agreement ensures to the benefit of and is binding upon each party, its successors and permitted assigns. The PTC shall not assign or sub-contract this Agreement or any interest herein without the prior written consent of the City. No assignment or sub-contracting of this Agreement, in any circumstances, relieves the PTC of its responsibilities, obligations and liabilities regarding City Business Records, or any Data collected or otherwise obtained by the PTC for its obligations under this Agreement.
11.0 Changes that may Affect Data Sharing
11.1 In the event that Chapter 546 or other Chapters of the Toronto Municipal Code, MFIPPA, PIPEDA, or any other relevant legislation is amended and, as a result, provisions of this Agreement must be amended in order to ensure compliance with any of the legislative requirements applicable to the parties, the Executive Director shall notify the PTC of the terms of the Agreement that must be amended. Any amendments subsequently agreed upon shall be in writing and executed by the parties. If the parties cannot agree upon whether or how the Agreement shall be amended, the Agreement shall be terminated.
12.0 Termination and Remedies
12.1 The Agreement shall terminate 12 months from the date the PTC’s business licence is issued, unless it is terminated sooner in accordance with the provisions of this Agreement. Failure of the PTC to perform its obligations under the Agreement shall entitle the City to terminate the Agreement upon ten (10) calendar days’ written notice to the PTC if a breach which is not remediable is not rectified in that time.
12.2 No delay or omission by the City in exercising any right or remedy shall operate as a waiver of them or of any other right or remedy, and no single or partial exercise of a right or remedy shall preclude any other or further exercise of them or the exercise of any other right or remedy.
12.3 If the Agreement is terminated for any reason, the City shall not incur any liability to the PTC in relation to its collection, storage, use, exchange, disclosure or disposition of any Data or its acquisition or use of equipment, work or services used for the purpose of this Agreement.
12.4 The PTC understands that any breach of this Agreement may provide reasonable grounds for the Executive Director to believe that the PTC or its officers, directors, employees, or agents have not carried on, or will not carry on, its business in accordance with law and with integrity and honesty and that the PTC’s carrying on of its business has infringed, or would infringe, the rights of other members of the public or has endangered, or would endanger, their health or safety.
12.5 The PTC acknowledges and agrees that any collection, disclosure, or use of City Business Records or Data in a manner contrary to the requirements of this Agreement may cause irreparable harm to the City and that remedies at law may be inadequate to protect against such a breach. Where the breach is ongoing, the PTC agrees in advance to the granting of injunctive relief, including the requirement that the PTC cease its business operations, without proof of actual damages, in addition to any other remedy the City may be entitled to at law.
12.6 The PTC agrees that it will well and truly save, defend, keep harmless, and fully indemnify the City, its successors and assigns, officers, employees, agents, sub-agents, contractors, and subcontractors (the “Indemnitees”) from and against all actions, claims, and demands whatsoever (“Proceedings”) that may be brought against or made upon the Indemnitees and against all loss, liability, judgments, claims, costs, demands or expenses that the Indemnitees may sustain, suffer or be put to that relates to the PTC’s failure or alleged failure to exercise reasonable care, skill, or diligence in the performance of its obligations under or the requirements of this Agreement, including any costs the Indemnitees may have incurred before the PTC was notified of such Proceedings or that the City may incur should it choose to defend itself. For the purposes of this section, “costs” shall include costs awarded in accordance with the order of a court, board, tribunal or arbitrator or costs negotiated in the settlement of a claim or action, but in no circumstance shall the PTC agree to or execute the settlement of a Proceeding with respect to the Indemnitees without the City’s prior approval.
13.0 Audit
13.1 The PTC agrees that the City shall have the right to audit any aspect of the PTC’s operations, including all books, accounts, financial records, electronic records, reports, files and all other papers, things, or property belonging to and/or used by the PTC in relation to the fulfilment of the PTC’s obligations under this Agreement and its compliance with the applicable provisions of the Toronto Municipal Code, and that the City shall have unrestricted access for that purpose during the term of this Agreement, through its own staff (including its Auditor-General and his/her staff) or any other person(s) or entity(ies) engaged at its direction.
13.2 Any audit conducted by the City’s Auditor-General shall be for the purposes of and subject to the requirements of Part V of the City of Toronto Act, 2006, and any other audit conducted by the City shall be for the purposes of (1) verifying the accuracy of the records and data provided to the City under this Agreement; (2) verifying the PTC’s compliance with obligations under the applicable provisions of the Toronto Municipal Code; and (3) examining the PTC’s performance of and conformance to the terms of this Agreement.
13.3 Without charge, the PTC shall provide for every audit access to all such records as described above and provided for under this Agreement and appropriate support to auditing personnel, including, without restriction, expeditious and comprehensive responses to relevant inquiries. Auditing personnel shall make every reasonable effort to minimize their use of the PTC’s resources, and minimize disruption to the PTC’s service and other business activities.
14.0 Governing Law
14.1 This Agreement is governed and construed in accordance with the laws of the Province of Ontario and the parties irrevocably attorn to the courts of that province, and agree that any proceeding in relation to this Agreement shall be commenced in Toronto.
IN WITNESS WHEREOF the parties hereto have duly executed this Agreement under seal.
SIGNED AND DELIVERED ) CITY OF TORONTO
In the presence of ) per:
)
)
)
) ________________________
) Executive Director,
) Municipal Licensing and Standards
)
)
)
)
) ________________________
) Date
)
) PTC:
) per:
)
)
)
)
)
) ________________________
) Name:
) Title:
)
)
) ________________________
) Date
VEHICLE-FOR-HIRE DATA SHARING AGREEMENT
SCHEDULE A – CONSENT
I, { individual’s name} understand that filing a business licence application through { Private Transportation Company Name} and using its services shall result in the collection of personal information from or about myself, including location data.
I, { individual’s name} authorize the City of Toronto to collect this personal information indirectly by accessing copies of this information collected by { Private Transportation Company Name, and for the { Private Transportation Company Name} to disclose this information to the City of Toronto.
I further consent to the collection and disclosure by the City of Toronto of my personal information, including: my full name, phone number, and e-mail address; my Ontario driver’s licence number; my criminal reference check; my driving record abstract; my certificate of insurance for the PTC vehicle that I will be driving; confirmation that I have notified the company insuring my vehicle that I offer or intend to offer transportation through a PTC; verification that I have completed a driver training course; the provincial licence plate number, vehicle identification number, make, model, fuel type, and model year of the PTC vehicle that I will be driving; confirmation that I have read and agreed to this consent; and information relating to charges or convictions under municipal by-laws, including but not limited to Chapter 546, Licensing of Vehicles-For-Hire, the Criminal Code, the Highway Traffic Act, and other applicable laws, among other information indicated in Chapter 546, to the {Insert Private Transportation Company Name}, Toronto Licensing Tribunal, and other law enforcement agencies.
The information collected by the City shall be used to: process, review, and evaluate applications for licences under Chapter 546, Licensing of Vehicles-For-Hire; issue, monitor, and regulate licences in accordance with Chapter 546; suspend, terminate, or revoke issued licences; investigate potential violations of Chapter 546 and enforce its provisions; administer the accessibility fund program under Chapter 546; carry out transportation planning and other initiatives; and to contact licence applicants and licence-holders in relation to services offered by the City of Toronto.
This information is collected under the authority of ss. 7, 8, 86, and 94 of the City of Toronto Act, 2006 and Toronto Municipal Code Chapter 546, Licensing of Vehicles-for-Hire. Any questions concerning this collection may be directed to the Manager of Licensing Services, 850 Coxwell Avenue, 3rd Floor, Toronto, Ontario, M4C 5R1, or by telephone at: 416-392-6700.