Attachment C TID_Data Privacy Policy Attachment.pdf

Data Privacy Policy Attachment

Welcome to the Data Privacy Policy Attachment. This document is a required submission as part of the RFP process if the Proposer is providing a technology information system, application, data collection mechanism, or rulemaking that handles or collects Personally Identifiable Information

(PII). This document serves two primary purposes. First, it collects essential information needed to complete Step 1 of the Privacy Evaluation

Process as mandated in the Long Beach Data Privacy Policy. (Page 1). Second, it gathers the necessary inputs to support transparency by enabling the publication of a corresponding entry in the Long Beach Digital Rights Platform. Together, these functions ensure that privacy risks are known and mitigated early and systematically, and that key stakeholders have visibility into how data is used and protected across initiatives.

1. Technology & Project Purpose

A detailed description of the technology, platform, or system proposed, including its primary purpose, functionality, and intended outcomes within the scope of this project.

2. Data Involved

A summary of the types of data that will be collected, used, or processed as part of this project / technology solution. This should explicitly include any personally identifiable information (PII), personal health information (PHI), financial data, or other sensitive data, if applicable. Proposals should also note how data classification and protection measures will be addressed.

3. Data Access & Roles

A clear outline of all parties who will have access to the data, including internal personnel (e.g., employees), external parties (e.g., contractors, consultants), and third party-vendors. The roles, responsibilities and access levels for each group should be clearly defined.

4. Supporting Documentation https://long-beach.dtpr.guide/devices/aec7fcb2-cd0b-4633-85f4-1f9f2a307252

DTPR Vendor Worksheet

Proposers are encouraged to provide supporting documentation to clarify the technology, data handling, and security measures involved in their proposal.

Recommended documents:

a. A standard project charter – strongly recommended (PDF preferred).

b. Data flow or technical architecture diagrams – strongly recommended (PDF, PNG, diagram tool export).

c. Workflow or data collection documentation - optional but helpful (PDF, PNG)

Submission guidance:

- Use clear, descriptive file names (e.g., Project_Charter.pdf, Data_Flow.pdf) to make review straightforward.

- If possible, combine related documents into a single file for ease of submission.

This worksheet is designed to guide you through the Digital Trust for Places and Routines (DTPR) taxonomy to create a “data chain” for a technology deployment. See this page for an example data chain.

Please complete each section below:

Accountable

Purpose

Technology

Data Type

Processing

Access

Storage

Feel free to provide more details in addition to the standard descriptions by filling out the “Additional Information” column for the selected taxonomy items. If there are multiple technologies in a deployment, this worksheet should be duplicated and completed for each individual technology. If you have any questions or would like support, please reach out to omar.moncayo@longbeach.gov.

The Icons, Design Guide and Taxonomy for DTPR are licensed by the Digital Trust for Places and Routines contributors under the Creative Commons Attribution 4.0 International (CC BY 4.0) .

Portions of the DTPR Icons incorporate elements of, or are derived from, Material Icons. They are available under the Apache License 2.0. The source code for this website and the Digital Channel

Prototype is licensed under Apache License 2.0.

https://dtpr.io/taxonomy https://long-beach.dtpr.guide/devices/aec7fcb2-cd0b-4633-85f4-1f9f2a307252 https://creativecommons.org/licenses/by/4.0/ https://fonts.google.com/icons?icon.set=Material+Icons https://www.apache.org/licenses/LICENSE-2.0 https://www.apache.org/licenses/LICENSE-2.0

About the Technology Deployment

Name of the technology:

Brief description of the technology and its use in the deployment:

Accountable

In the table below, list the organizations accountable for the technology deployment and data collection activities in the order of importance. For example, for a technology deployed by a municipality, the municipality would be listed first, followed by the technology vendor.

Accountable Description

Purpose

Number the items below that best describe the purpose(s) of this technology deployment in order of importance/relevance.

# Icon Purpose Description Additional Information

Accessibility Ensures that everyone has equal access to a space or a service. Find out more about accessibility and universal design

Agency & Interaction

Enables you to control or interact with aspects of a space or a technology. Find out more about interactive media and virtual reality

Arts & Culture Enables artistic and/or cultural expression. Find out more here

Commerce Enables the buying and selling of goods and services. Find out more here

Connectivity Enables connectivity of devices to a digital network. Find out

Dining For providing food or meal services. Find out more here or here

Ecology Supports the measurement or monitoring of the natural environment. Find out more about the natural environment, ecology and environmental science

Energy Efficiency Reduces energy use and/or helps conserve energy. Find out more about energy efficiency and energy conservation

Enforcement Used for enforcement of rules or regulations. Find out more here https://en.wikipedia.org/wiki/Accessibility https://en.wikipedia.org/wiki/Universal_design https://en.wikipedia.org/wiki/Interactive_media https://en.wikipedia.org/wiki/Virtual_reality https://en.wikipedia.org/wiki/Virtual_reality https://en.wikipedia.org/wiki/Interactive_art https://en.wikipedia.org/wiki/Commerce https://en.wikipedia.org/wiki/Computer_network https://en.wikipedia.org/wiki/Restaurant https://en.wikipedia.org/wiki/Catering https://en.wikipedia.org/wiki/Natural_environment https://en.wikipedia.org/wiki/Ecology https://en.wikipedia.org/wiki/Environmental_science https://en.wikipedia.org/wiki/Efficient_energy_use https://en.wikipedia.org/wiki/Energy_conservation https://en.wikipedia.org/wiki/Law_enforcement

Entry Supports authentication or validation in order to access a space or a service. Find out more here

Fire & Emergency Supports services that ensure public safety and health related to emergencies. Find out more about emergency services.

Health

Supports the measurement or monitoring of the aspects of the physical environment that impacts human health, such as radiation or air quality, or in specific contexts such as the workplace. Find out more about environmental monitoring and occupational health and safety

Inform Supports the provision of information, for example about a location, a service, or to provide assistance

Logistics Supports the movements of goods or materials. Find out more here

Mobility Supports how people and materials move around. Find out more

Planning & Decision-making

Supports the development of future plans; or to enable or measure the impact of a decision. Examples include urban planning

Research & Development

Supports exploratory research and testing. Find out more here.

Safety & Security

Enables a safe and/or secure environment, for example for the purposes of fire safety, home security or ensuring safe passage in places such as airports or roads

Social For interacting with another person or a group.

https://en.wikipedia.org/wiki/Access_control https://en.wikipedia.org/wiki/Emergency https://en.wikipedia.org/wiki/Emergency_service https://en.wikipedia.org/wiki/Radiation_protection https://en.wikipedia.org/wiki/Air_pollution https://en.wikipedia.org/wiki/Environmental_monitoring https://en.wikipedia.org/wiki/Occupational_safety_and_health https://en.wikipedia.org/wiki/Logistics https://en.wikipedia.org/wiki/Transport https://en.wikipedia.org/wiki/Urban_planning https://en.wikipedia.org/wiki/Urban_planning https://en.wikipedia.org/wiki/Research_and_development https://en.wikipedia.org/wiki/Fire_safety https://en.wikipedia.org/wiki/Home_security https://en.wikipedia.org/wiki/Airport_security https://en.wikipedia.org/wiki/Road_traffic_safety

Switch Supports a mechanical function - such as turning a device on or off, opening or closing, or adjusting brightness and intensity.

Waste

Management

Supports the handling and disposal of waste, including as recyclables, compost and hazardous materials. Find out more about waste management

Water Efficiency

Reduces water use and/or helps conserve water. Find out more about water efficiency and conservation, and green infrastructure.

Wayfinding &

Services

Enables navigation of a location and its amenities and services.

https://en.wikipedia.org/wiki/Hazardous_waste https://en.wikipedia.org/wiki/Waste_management

Technology

Put an X beside the items below that best describe the technology and the information being collected.

X Icon Technology Description Additional Information

Air Quality

Measures various aspects of air quality, such as pollen, particulate matter, ozone, and greenhouse gases. Find out more

Assistance Station Provides access to assistive services. Examples include assistive technologies and virtual assistants

Biometrics Biometrics are body measurements and calculations related to human characteristics. Find out more here

Cellular

This devices uses a cellular communication network where the last link is wireless, enabling portable transceivers (e.g., mobile phones) to communicate with each other and with fixed transceivers and telephones anywhere in the network. Find out more about cellular networks here

Contactless

Payments

Contactless payment systems are are credit cards and debit cards, key fobs, smart cards, or other devices, including smartphones and other mobile devices, that use radio-frequency identification (RFID) or near field communication (NFC) for making secure payments. Find out more about contactless payment systems here.

https://en.wikipedia.org/wiki/Pollen https://en.wikipedia.org/wiki/Particulate_pollution https://en.wikipedia.org/wiki/Ozone#Ozone_in_Earth's_atmosphere https://en.wikipedia.org/wiki/Greenhouse_gas https://en.wikipedia.org/wiki/Air_pollution https://en.wikipedia.org/wiki/Assistive_technology https://en.wikipedia.org/wiki/Virtual_assistant https://en.wikipedia.org/wiki/Biometrics https://en.wikipedia.org/wiki/Cellular_network https://en.wikipedia.org/wiki/Contactless_payment

De-identified Image

Collects still images of a sufficient resolution where individuals can be identified, for example by capturing images of faces or unique numbers such as vehicle license plates. However, images are processed in a way that removes identifying characteristics before it is used or stored (known as de-identified before first use or de-identified on device), for example by blurring faces using computer vision. Find out more about de-identification here.

De-identified Video

Collects video footage of a sufficient resolution where individuals can be identified, for example by capturing images of faces or unique numbers such as vehicle license plates.

However, the video is processed in a way that removes identifying characteristics before it is used or stored (known as de-identified before first use or de-identified on device), for example by blurring faces using computer vision.

De-identified Voice

Audio data is collected that does or can identify individuals, either through manual review or technologies that can determine either what is being said, or who is saying it. Find out more about speech recognition or speaker recognition. Data is processed in a way that removes identifying characteristics before it is used or stored (known as de-identified before first use or de-identified on device). Find out more about de-identification here.

DTPR API

The DTPR API provides machine-readable access to a place-centric registry of systems and sensors that are described using the open-source DTPR taxonomy. Find out more about the system here https://en.wikipedia.org/wiki/De-identification https://github.com/Helpful-Places/dtpr

Facial characterization

Facial characterization allows a system to make inferences such as gender, facial expression, and age range, but does not identify individuals. The technology does not retain or use any personally identifiable information.

GPS

GPS is one of the global navigation satellite systems that provides geolocation and time information to a GPS receiver anywhere on or near the Earth where there is an unobstructed line of sight to four or more GPS satellites. Find out more about

GPS here.

Hands-free

Describes a technology where the primary mode of interaction does not require the use of hands, for example, devices that respond to voice commands or gesture based "touchless" interfaces. Find out more about voice-user interfaces here and touchless interfaces here.

Identifiable Image

Collects still images of a sufficient resolution where individuals can be identified, for example by capturing images of faces or unique numbers such as vehicle license plates. Identifying information can be collected either through manual review of images by a person, or through computer vision techniques that derives information in the form of data from images.

Identifiable NFC

A wireless communication protocol for electronic devices that are within a short distance of each other, typically used in ticketing or payment systems. In this case, unique identification is possible, for example if a particular item is closely associated with an individual's personal data. Find out more here https://en.wikipedia.org/wiki/Global_Positioning_System https://en.wikipedia.org/wiki/Voice_user_interface https://en.wikipedia.org/wiki/Gesture_recognition#Touchless_interface https://en.wikipedia.org/wiki/Image#Characteristics https://en.wikipedia.org/wiki/Computer_vision https://en.wikipedia.org/wiki/Personal_data https://en.wikipedia.org/wiki/Near-field_communication

Identifiable RFID

Enables the identification of items using electromagnetic fields, commonly used to track inventory in stores. In this case, unique identification is possible, for example if a particular item is closely associated with an individual's personal data. Find out

Identifiable Video

Collects video footage of a sufficient resolution where individuals can be identified, for example by capturing images of faces or unique numbers such as vehicle license plates.

Identifying information can be collected either through manual review by a person, or through computer vision techniques that derives information in the form of data from video or images.

Image - infrared Collects still images in the infrared portion of the electromagnetic spectrum.

Image Collects still images. Find out more about cameras here

Inclinometer Measures the slope, angle or tilt of objects based on gravity.

Find out more here.

Intercom

An intercom (intercommunication device) is a stand-alone voice communications system for use within a building or small collection of buildings, and is separate from other communications networks (such as the telephone system). Find out more about intercom systems here

LiDAR

Uses lasers to measure distances to objects, collecting data that can create a 3-D representation of the object. Find out more https://en.wikipedia.org/wiki/Personal_data https://en.wikipedia.org/wiki/Radio-frequency_identification https://en.wikipedia.org/wiki/Video https://en.wikipedia.org/wiki/Computer_vision https://en.wikipedia.org/wiki/Infrared_photography https://en.wikipedia.org/wiki/Image#Characteristics https://en.wikipedia.org/wiki/Camera https://en.wikipedia.org/wiki/Inclinometer https://en.wikipedia.org/wiki/Intercom https://en.wikipedia.org/wiki/Lidar

Location Beacon

Beacons are Bluetooth low energy (LE) hardware transmitters that broadcast their identifier to nearby portable electronic devices. The technology enables smartphones, tablets and other devices to perform actions when in close proximity to a beacon. Find out more here

Microphone A device that collects audio. Find out more here

NFC

A wireless communication protocol for electronic devices that are within a short distance of each other, typically used in ticketing or payment systems. No identifying data is collected in this case. Find out more here

Non-identifiable

Video

Collects video footage incapable of identifying individuals due to factors such as low-resolution, so that faces or unique numbers such as vehicle license plates cannot be determined.

Passive Infrared

Sensor

An electronic sensor that measures infrared (IR) light radiating from objects in its field of view. Find out more here

Person detection

Person detection refers to when a system can detect the presence of humans in images or videos, and identify where they are located or how many there are in an image, but does not identify individuals. The technology does not retain or use any personally identifiable information.

Personal Device

A mobile device that combines cellular and mobile computing functions into one unit, that is intended for use by one person.

Find out more here https://en.wikipedia.org/wiki/Bluetooth_low_energy_beacon https://en.wikipedia.org/wiki/Microphone https://en.wikipedia.org/wiki/Near-field_communication https://en.wikipedia.org/wiki/Video https://en.wikipedia.org/wiki/Passive_infrared_sensor https://en.wikipedia.org/wiki/Smartphone

Radar Uses radio waves to detect objects, or measure how they are moving through a space, such as vehicles. Find out more here

RFID

Enables the identification of items using electromagnetic fields, commonly used to track inventory in stores, but not for identifying individual items. Find out more here

Soil Moisture

Sensor

Soil moisture sensors measures the water content in soil. Find out more here

Sound Level Meter Takes acoustic measurements, most typically for measuring noise pollution. Find out more here

System Screen People can interact with this digital system using the screen that is provided as part of device installation.

Thermometer

Measures the temperature of or changes of temperature in the physical environment, and quantifies those attributes according to a standardized scale such as Celsius or Fahrenheit. Find more more here

Ultrasonic Sensor

Uses ultrasonic waves to measure distances to objects. The sensor emits an ultrasonic wave and receives the wave reflected back from the object. The distance is calculated using the time between emission and reception. Find out more here.

Video camera -infrared

Collects video footage in the infrared portion of the electromagnetic spectrum.

Video camera Collects video footage. Find out more here.

https://en.wikipedia.org/wiki/Radar https://en.wikipedia.org/wiki/Radio-frequency_identification https://en.wikipedia.org/wiki/Soil_moisture_sensor https://en.wikipedia.org/wiki/Sound_level_meter https://en.wikipedia.org/wiki/Thermometer https://en.wikipedia.org/wiki/Ultrasonic_transducer https://en.wikipedia.org/wiki/Infrared_photography https://en.wikipedia.org/wiki/Video

Voice

Audio data is collected that does or can identify individuals, either through manual review or by technologies that can determine either what is being said, or who is saying it. Find out more about speech recognition or speaker recognition.

Water Quality

Measures various aspects of water quality, such as the amount of dissolved oxygen in water, pH, nitrates and dissolved oxygen.

Weather Station

A set of instruments for measuring atmospheric conditions such as temperature, precipitation, wind speed and direction, and barometric pressure. Find out more here

Weighing Scale A weighing scale is a device to measure weight or mass. No identifying data is collected in this case. Find out more here

Wireless Access

Point

Provides wireless access to a wired computer network, or to the internet. Find out more here https://en.wikipedia.org/wiki/Speech_recognition https://en.wikipedia.org/wiki/Speaker_recognition https://en.wikipedia.org/wiki/Water_quality https://en.wikipedia.org/wiki/Weather_station https://en.wikipedia.org/wiki/Weighing_scale https://en.wikipedia.org/wiki/Wireless_access_point

Data Type

Put an X beside the items below that best describe the type(s) of data collected by the technology.

X Icon Data Type Description Additional Information

Binary Compressed data into a binary format. Find out more here

Boolean Data that has one of two data values, for example true and false. Find out more here

Personal Information about identifiable individuals. Find out more here

Pixel-based Image A digital image is composed of a grid of individual pixels. Find out more at digital image

Spatial

Data that represents a location, such as an address, a place name or geographic coordinates; or a structure, such as a floorplan. Find out more about geospatial data and building information models

Tabular Data that is stored in a table, where values are stored in rows and columns. More here

Values / Time Measurements that are collected at regular intervals over a period of time. For example see time series data.

https://en.wikipedia.org/wiki/Binary_file https://en.wikipedia.org/wiki/Boolean_data_type https://en.wikipedia.org/wiki/Personal_data https://en.wikipedia.org/wiki/Digital_image https://en.wikipedia.org/wiki/Geographic_data_and_information https://en.wikipedia.org/wiki/Building_information_modeling https://en.wikipedia.org/wiki/Building_information_modeling https://en.wikipedia.org/wiki/Table_(information) https://en.wikipedia.org/wiki/Time_series

Processing

Put an X beside the items below that best describe how the data collected is processed.

X Icon Processing Description Additional Information

Aggregated

Data that has been grouped or summarized from individual measurements, for example to count up totals or to calculate an average. Find out more here

AI System

Data that is processed by automated, algorithmic or artificial intelligence systems to derive a new result or data point. Find out more about automated, algorithmic and artificial intelligence systems.

Bitmap manipulation

Bitmap manipulation is the process of altering pixels in a raster-based image, such as retouching a digital photograph.

Code signing

Code signing is the process of digitally signing executables and scripts to confirm the software author and guarantee that the code has not been altered or corrupted since it was signed. The process employs the use of a cryptographic hash to validate authenticity and integrity. Find out more here

Computer vision

Computer vision refers to computer science methodologies that enable computers to derive data from digital images or video.

https://en.wikipedia.org/wiki/Aggregate_data https://en.wikipedia.org/wiki/Automated_decision_support https://en.wikipedia.org/wiki/Algorithm https://en.wikipedia.org/wiki/Artificial_intelligence https://en.wikipedia.org/wiki/Code_signing https://en.wikipedia.org/wiki/Computer_vision

Cryptonets

Cryptonets are neural networks that can be applied to encrypted data. Due to this capability it is not required to decrypt the data during processing and because of this it is not necessary to even provide the application host with the keys to decrypt the data. Cryptonets are an implementation of Homomorphic

Encryption. Find out more here

De-identified

Data that is processed to remove identifying values, usually to protect privacy. De-identification can happen at any point in a data collection process, for example before it is stored in a database, or before it is published. Here we define it to mean after the data has already left a hardware device, or after it has been stored in a database. Find out more here

Differential privacy

Differential privacy is a system for publicly sharing information about a dataset by describing the patterns of groups within the dataset while withholding information about individuals in the dataset. Find out more here.

Encrypted at Rest

Encryption at Rest is the encryption of data when it is persisted to a storage medium like a drive or database. It protects the data against unauthorized access of the database itself.

Encrypted

Data has been encoded so that only authorized parties can access it, which can reduce risk related to handling private or sensitive information. Find out more here

Federated learning

Federated Learning involves both Edge Computing and a Cloud based process which allows machine learning to take place on a large body of decentralized de-identified data. Find out more here.

https://en.wikipedia.org/wiki/Homomorphic_encryption https://en.wikipedia.org/wiki/Differential_privacy https://en.wikipedia.org/wiki/Encryption https://en.wikipedia.org/wiki/Federated_learning

Hardware audits

3rd Party auditing specialists periodically examine the hardware

& firmware to identify security best practice vulnerabilities and/or gaps in disclosure when it comes to the type of data the device is capturing and how it is being processed.

Homomorphic encryption

Homomorphic encryption is a form of encryption that allows computation on ciphertexts, generating an encrypted result which, when decrypted, matches the result of the operations as if they had been performed on the plaintext. Find out more here

Immutable Query

Ledger

All interactions with the data throughout its lifecycle, including access and any transformations that are applied are registered in an immutable query ledger creating an auditable chain of accountability mediated by a distributed database.

K-Anonymity

K-Anonymity is used to ensure anonymity when disclosing otherwise personally identifiable data. Attributes of the data are suppressed or generalized until each row is identical with at least k-1 other rows. At this point the database is said to be k-anonymous. Find out more here.

Raw data

Data that has not been processed or altered from the point of collection - the data is effectively identical to how it was gathered from the original data source. Find out more here

RDUA Approved

Data activity has undergone a Responsible Data Use

Assessment and determined to provide a net benefit. The RDUA is a process that Sidewalk Labs conducts prior to the start of any data activity.

https://en.wikipedia.org/wiki/Homomorphic_encryption https://en.wikipedia.org/wiki/K-anonymity https://en.wikipedia.org/wiki/Raw_data

Regulated Depending on the jurisdiction and type of data, data is regulated in various ways

Reviewed Internally

Many organizations have internal review processes that consider the potential benefits, risks and implications for privacy for new technologies or data collection activities.

Secure Multi-Party

Computing

Secure multi-party computation is a subfield of cryptography with the goal of creating methods for parties to jointly compute a function over their inputs while keeping those inputs private. It allows participants to generate aggregated insights from data while keeping the individual items of data secret.

Transport Layer

Security

Transport Layer Security, or TLS, is a widely adopted security protocol designed to facilitate privacy and data security for communications over the Internet by encrypting data while it is in.

Trusted Execution

Environment

A TEE is an isolated environment created using special purpose hardware and software to protect the data stored inside. A TEE provides a “trusted environment” inside which a process can run while it is invisible to any other process on the processor, the operating system or any other type of privileged access.

Zero Knowledge

Proofs

A Zero Knowledge Proof is a method by which one party can prove to another party that they know a value, without conveying any additional information such as the value itself. Learn more https://en.wikipedia.org/wiki/Zero-knowledge_proof

Access

Put an X beside the items below that best describe who has access to the data collected.

X Icon Access Description Additional Information

Available for resale The data collected may be resold to other 3rd parties

Available to 3rd parties

Data is available to 3rd parties not involved in the data activity.

This does not always mean that data is being resold.

Available to download

Data that can be accessed and downloaded online, either for free or for a fee

Available to me

Available to me but not to other individuals. For example, as an individual you have access to all your electronic toll records for your car, but other individuals do not have access to that.

Available to the accountable organization

Data is available to the accountable organization

Available to vendor Data is available to the data collection or technology provider

Not available to me Not available to me or other individuals. As an individual, there isn't a way for you to access this data.

Not available to the accountable organization

Data is not available to the accountable organization

X Icon Access Description Additional Information

Not available to vendor

Data is not available to the data collection or technology provider.

Storage

Put an X beside the items below that best describe the retention and storage policies for the data collected. If the data is retained for a finite period of time, replace “[time period]” with the number of months/years it is retained for.

X Icon Storage Description Additional Information

Backed up internationally

Data is backed up outside the jurisdiction where it was collected.

Backed up locally Data is backed up with the jurisdiction where it was collected.

No data retained No data is kept or stored

Retained [time period]

Data is stored for [time period], and after this time period is deleted

Retained indefinitely Data is retained indefinitely

Shared storage and governance

In a shared data store model the data store is shared across multiple parties and because the infrastructure is shared it becomes possible to enforce governance around the retention, access and destruction of the data by policies built into the structure of the data itself. Find out more here https://en.wikipedia.org/wiki/Data_sovereignty https://en.wikipedia.org/wiki/Cooperative_storage_cloud

X Icon Storage Description Additional Information

Stored locally Data is stored in the jurisdiction where it was collected. Find out

Stored on 3rd Party

Cloud

Data is stored on behalf of the organization or the data collector in an off-site data centre, such as Amazon Web Services, Google Cloud and Microsoft Azure

Stored primarily internationally

Data is stored outside the jurisdiction where it was collected.

Stored primarily locally

Data is stored mainly in the jurisdiction where it was collected.