COVER LETTER FOR EXHIBITS A, B and C
Chapter 9.64 of the Oakland Municipal Code (OMC) covers policy areas related to surveillance technology and requires City Council approval for new and existing surveillance technology.
Mobile parking payment providers collect data on their customers and are therefore subject to the requirements of this chapter.
Additionally, OMC Section 9.64.020.1 requires that, “Prior to seeking City Council approval for existing city surveillance technology under Section 9.64.030 city staff shall submit a surveillance impact report and surveillance use policy to the Privacy Advisory Commission (PAC) for its review at a regularly noticed meeting. The following exhibits were reviewed and approved by the PAC at its meeting on September 7
th, 2003. These documents will be incorporated into the professional services agreements with each mobile payment providers (Provider), requiring them to adhere to the policies and practices contained in each Exhibit.
Exhibit A: City Data Addendum
The City Data establishes what information will be collected, who owns that information, and how that information may be used. Finally, it lays out Provider’s security system requirements, what will be done if a data incident occurs, and what will be done with the information upon termination of the Agreement.
Exhibit B: Anticipated Impact Report
The Anticipated Impact Report provides definitions of the types of data that will be generated, establishes how these data will be used, shared, and secured by Providers. It also discusses the purpose and need for the data collection, where data will be collected, potential impacts on civil liberties, mitigations to those impacts and fiscal costs. Finally, it covers alternatives to the required data security features and the track record of mobile parking payments with ParkMobile.
Exhibit C: Use Policy
The Use Policy described how data will be collected, used, shared, maintained and secured by Providers. It details what data City staff will have access to and who is authorized to use the data. It discusses the Provider’s responsibilities regarding employee training and procedures for alerting the City in case of a data breach. It also describes what data may be shared with the public and other third parties.