Coord App License Plate Collection Impact Report — File 211902

1 Template updated 9/30/2020 APPENDIX A: SURVEILLANCE TECHNOLOGY IMPACT REPORT Department or Division: OSPCD: Mobility & Parking Department Compliance Officer (name and position): Alan Inacio, Senior Accountant, OSPCD Submitted by: Brad Rawson, Director of Mobility & Suzanne Rinfret, Director of Parking Date: 5/7/2021 Surveillance Technology: Application Function for Collecting License Plate Images X Please identify the purpose(s) of the proposed surveillance technology. Select ALL that apply by entering “X” in the left column. Identifying and preventing threats to persons and property and preventing injury to persons or significant damage to property Identifying, apprehending, and prosecuting criminal offenders Gathering evidence of violations of any law in criminal, civil, and administrative proceedings Providing information to emergency personnel Documenting and improving performance of City employees Executing financial transactions between the City and any individual engaged in a financial transaction with the City Preventing waste, fraud, and abuse of City resources Maintaining the safety and security of City employees, students, customers, and City-owned or controlled buildings and property Enforcing obligations to the City Operating vehicles for City business Analyzing and managing service delivery Communicating among City employees, with citizens, or with third parties Surveying and gathering feedback from constituents X Other (Describe): To gather information on parking patterns in the city in order to improve parking policies. If the surveillance technology is used for a purpose not listed above, does the purpose comply

2 Template updated 9/30/2020 with the surveillance use policy? _X_ Yes ___ No

3 Template updated 9/30/2020 Complete ALL of the following items related to the proposed surveillance technology. Be as specific as possible. If an item is not applicable, enter “N/A.” Do NOT leave fields blank. 1. Information describing the surveillance technology and how it works: - The Coord Collection application takes photos of license plates during parking data collection - Photos are coded with a latitude and longitude, a distance along the block, and a date/time. - Photos are uploaded to Coord servers after the study is complete. - Computer generated coding of the license plate number occurs on Coord servers. - Computer generated comparison to other license plates collected in the same study occurs on Coord servers to determine parking turnover. - Data can be exported to city in tabular format. - Data exports can be sent to Conduent Transportation to be matched with city permit data, including street address, permit types, and permit number by Conduent Transportation, the city’s ticket and permit processing contractor. a. Authorized use – the uses that are authorized, the rules and processes required before that use, and the uses that are prohibited (10.64.b.2): - The license plate function of parking data collection is only used for city parking studies, including the Citywide Parking Inventory and the Citywide Parking Policy studies, and additional parking studies. - Use of the license plate function in any parking studies must be authorized by both the Director of Mobility and the Director of Parking. - The license plate collection technology is for parking studies and for no other purpose. - Not all parking studies will include the collection of license plates. b. Training – the training, if any, required for any individual authorized to use the surveillance technology or to access information collected by the surveillance technology, including whether there are training materials (10.64.b.9): - All staff and designated consultants working on behalf of the city receive a 45 min training on parking data collection from Coord staff or city staff. - The Citywide Parking Data Inventory includes a training program deliverable that will be used by city staff for training for future parking studies. - The city has designated contacts with Coord for additional training assistance as needed. - Staff will be instructed to avoid inadvertently taking identifiable photos of individuals during data collection. - Staff authorized to use the technology will be trained as required by the Surveillance Technology Use Policy. 2. Information on the proposed purpose(s) for the surveillance technology (10.64.b.1): - The purpose of collecting license plate numbers as a part of parking studies is to inform and enhance city parking policies. The data can be used to: o Determine the degree to which parking permits are used to park in different parking zones of the city versus parking at home locations. o Determine the degree of use of permit parking to access transit stations. o Determine the relative prevalence of different types of parking permits in different parking areas

4 Template updated 9/30/2020 across the city. o Establish average parking durations and turnover rates for different areas of the city. o Determine the prevalence of parking in permit areas by vehicles without permits. o Determine the prevalence of out of state vehicles use of city parking resources. 3. Information describing the kind of surveillance the surveillance technology is going to conduct and what surveillance data is going to be gathered (10.64.b.3): - Photos of license plates only, including partial images of the back of vehicles. - Photos will be geotagged and include reference distance along a block relative to a starting point - Photos will go through computer generated text recognition to determine a license plate number - Date and time of the photo will be recorded. - The collection of license plate data is to improve parking studies and parking policies and will not be used for surveillance purposes. a. Data access – the individuals who can access or use the collected surveillance data, and the rules and processes required before access or use of the information (10.64.b.4): - Coord staff will have access to the license plate data only when such access is necessary for their official duties such as arranging data exports for the city. - Conduent Transportation staff will have access to the license plate data only when such access is necessary for matching license plates to permit addresses, permit types, and permit numbers that they have on file. - City staff in OSPCD: Mobility and the Parking Department will have access to the data only when necessary for their official duties, such as analyzing license plate data that has been matched to city permits. - Consultants working on behalf of the city will have access to the data only when necessary for their work, such as analyzing license plate data that has been matched to city permits. b. Data protection – the safeguards that protect information from unauthorized access, including, but not limited to, encryption, access-control, and access-oversight mechanisms; (10.64.b.5) - On Coord apps and servers: o All data is stored and transferred using strong encryption o Data on servers is protected with a defense-in-depth approach including database permissions, firewalls, and server process isolation o Audit logs are retained for the database and servers that store and manage the data and inspected to detect unauthorized access o All access to servers and databases is authenticated - License plate data will be deleted from Coord servers after successful export is confirmed. - After export data will be stored in an access-controlled digital folder on city servers that allows access only by city employees, consultants, and contractors who require access for their official duties. c. Data retention – the time period, if any, for which information collected by the surveillance technology will be routinely retained, the reason that retention period is appropriate to further the purpose(s), the process by which the information is regularly deleted after that period has elapsed, and the conditions that must be met to retain information beyond that period (10.64.b.6): - License plate data will be deleted from Coord servers after successful export is confirmed at the

5 Template updated 9/30/2020 conclusion of each project. - Coord server logs and other metadata are routinely deleted within 30 days. - Collection devices will have data deleted at the conclusion of the project. - Data will remain on city servers for analysis of parking trends in the city. d. Public access – if and how collected surveillance data can be accessed by members of the public, including criminal defendants (10.64.b.7): - Individual records will not be made public. - Summary data will be published with trends such as turnover, parking out of zone, etc. - Summary data will not include license plate numbers or specific street addresses. e. Third-party data-sharing – if and how other city or non-city entities can access or use the surveillance data, including any required justification and legal standard necessary to do so, and any obligation(s) imposed on the recipient of the surveillance data (10.64.b.8): - Coord staff will have access to the license plate data only when such access is necessary for their official duties such as arranging data exports for the city. - Conduent Transportation staff will have access to the license plate data only when such access is necessary for matching license plates to permit addresses, permit types, and permit numbers they have on file. - Consultants working on behalf of the city will have access to the data only when necessary for their work, such as analyzing license plate data that has been matched to city permits. Data shared with third party’s will have license plate numbers removed. - Data gathered will not be shared with the Somerville Police Department. 4. The location(s) it may be deployed and when: - In on-street parking locations and municipal parking lots across the city - Parking studies occur multiple times per year and at multiple times during the day. 5. A description of the privacy and anonymity rights affected and a mitigation plan describing how the department’s use of the equipment will be regulated to protect privacy, anonymity, and limit the risk of potential abuse: - Photos are of license plates only, including partial images of the back of vehicles. - Staff will be instructed to avoid inadvertently taking identifiable photos of individuals during data collection. - Only the plate number and location are uploaded to Coord servers before they have been matched with permits - Matching with permits will not include the names of individuals and will be done by Conduent Transportation, a city contractor responsible for the city’s permit and ticketing system. 6. The potential impact(s) on privacy in the city; the potential impact on the civil rights and liberties of any individuals, communities or groups, including, but not limited to, communities of color or other marginalized communities in the city, and a description of whether there is a plan to address the impact(s): - The collection of license plate data is to improve parking studies and parking policies and will not be used for surveillance purposes. 7. An estimate of the fiscal costs for the surveillance technology, including initial purchase, personnel and other

6 Template updated 9/30/2020 ongoing costs, and any current or potential sources of funding: - The city pays an annual license fee for the full Coord Platform of $10,000 annually, subject to price changes. This includes a toolkit of parking data collection and visualization tools of which license plate data collection is a single feature. - OSPCD: Mobility staff and Parking staff manage parking data collection as a part of their job responsibilities. 8. An explanation of how the surveillance use policy will apply to this surveillance technology and, if it is not applicable, a technology-specific surveillance use policy: - The Surveillance Technology Use Policy applies to the use of this technology. a. Oversight – the mechanisms to ensure that the surveillance use policy is followed, including, but not limited to, identifying personnel assigned to ensure compliance with the policy, internal record keeping of the use of the technology or access to information collected by the surveillance technology, technical measures to monitor for misuse, any independent person or entity with oversight authority, and the sanctions for violations of the policy (10.64.b.10): - The Compliance Officer for OSPCD is Alan Inacio. - The cameras will be used in accordance with the Surveillance Technology Use Policy. - Individual parking studies that will collect license plates will be authorized by both the Director of Mobility or the Director of Parking.