Data Sharing Guidance for Public Transit Agencies—Now and in the Future (2020)

Below is the uncorrected machine-read text of this chapter, intended to provide our own search engines and external engines with highly rich, chapter-representative searchable text of each book. Because it is UNCORRECTED material, please consider the following text as a useful but insufficient proxy for the authoritative book pages.

CHAPTER 2 Guidance This chapter provides guidance to transit agencies for data sharing, based on insight gained from interviews and secondary sources, which is described and documented in Chapters 3 through 6. The guidance answers three sets of questions. 1. How can transit agencies maximize the value from sharing their own data? What data should be shared with whom? And what sharing model should be employed? 2. How can transit agencies access external data sources to meet their own transit agency goals? 3. What data must be shared? How should transit agencies respond to public records requests? The first two sets of questions should be considered in the context of broader transit agency objectives. Organizationally, answering these questions requires the development of staff and processes around data management and data analytics. Establishing staff who are responsible for data sharing is the first of a four-step process shown in Figure 2. Instructions for how transit agencies can achieve each of these steps to answer the first set of questions are provided in the corresponding sections (2.1 through 2.4). Section 2.5 provides guidance on accessing external data (addressing the second set of questions), which is a distinct process from transit agencies sharing their data. The third set of questions involves institutional and legal issues. Instructions for this process are included in Section 2.6. 2.1  Ensuring Data-Focused Staff The first step in improving data management processes that are critical for effective data sharing is to ensure your transit agency has staff with time and capabilities to make data sharing decisions. Transit agencies can use this Staffing checklist to determine if they have adequate staff to guide the data management and sharing process. 2.2  Establishing Goals and Objectives Establishing goals and objectives that can be achieved through data sharing requires working across departments and with leaders of your organization to understand needs and goals and how these may be supported by existing or potential data. Goals that depend on data and data sharing generally fall into the following categories: • Public transit system performance, including innovation, planning, and prioritization • Cost savings • Revenue generation (e.g., from advertising) • Customer information 11   

12   Data Sharing Guidance for Public Transit Agencies—Now and in the Future Staffing Checklist : Do you have a dedicated staff person or division focused on managing data? If not, consider your transit agency’s needs. Large transit agencies likely require a team of data-focused staff. For a small transit agency, a single staff person may be sufficient. For very small agencies, a staff member at a local government agency may play this role. Data management staff should include individuals with the following skills: : Database administration and maintenance, including understanding of security and permissions : Data analytics, including the ability to use scripts to automate data analysis processes and work with larger data sets, and an understanding of how analysis of different data sets can answer key questions and achieve transit agency goals : Knowledge of privacy risks and techniques that can be applied to preserve privacy of data pertaining to individuals, including personally identifiable information (PII) : Do you have a lawyer to help interpret legislation that pertains to data storage and sharing? Some transit agencies have a lawyer on staff. If not, there may be a lawyer at your state department of transportation (DOT) or local metropolitan planning organization (MPO) who can work with you. With the help of a lawyer, transit agencies should ensure they understand the following: : State-level data security laws : State-level data breach notification laws : State-level information disclosure (public records) laws and any exemptions that apply to transit agency data : State-level tort laws that could be applied in instances of mishandling of private data Our review of legislation indicated that, in general, federal legislation either does not apply to transit agencies or does not include specific legislation that applies to transit agency data. However, individual transit agencies should evaluate which laws apply to them and monitor changes to federal legislation. • Transparency • Facilitating multimodal travel and other community functions • Benchmarking Transit agency staff responsible for data management analysis should review their agency’s goals across these categories and identify goals that internal or external data can help achieve. Furthermore, they can identify opportunities in which data sharing may help achieve those goals. These opportunities can then be evaluated using the framework outlined in Section 2.4. 

Guidance  13   Establish data-focused staff or division and understand the legal context for data sharing. Identify transit agency goals and objectives that can be accomplished through data analysis and data sharing. Define data and analysis needs. Identify data sharing models that can best fill needs and meet goals, weighing benefts against costs, and assessing and responding to risks. Figure 2.   Organizational flow for data management and sharing. Action Plan: Develop a plan that demonstrates how specific data sharing opportunities can achieve broader transit agency goals and objectives. 2.3  Defining Data and Analysis Needs Effective data sharing depends on good internal data management. Achieving the goals iden- tified in the previous step may require changes to data collection, data processing, and data documentation to ensure data is used effectively and appropriately when shared. Transit agen- cies can begin by inventorying the data management and sharing processes they have in place, using the Data and Analysis Needs checklist. The Data Preparation Needs checklist can be used to evaluate data collection, processing, and documentation needs. 2.4  Evaluating and Selecting Data Sharing Models Once objectives and needs are clearly established, use these as a basis to evaluate potential data sharing models. Data can be shared publicly, often called open data, or data can be shared with a particular partner, often under a private data sharing agreement. To evaluate each potential model, consider the following: • Benefits • Costs • Risks Benefits Evaluating benefits of sharing data is directly linked to the established transit agency goals and objectives. It is useful to consider the same categories when evaluating expected benefits: • Public transit system performance, including innovation, planning, and prioritization • Cost savings 

14   Data Sharing Guidance for Public Transit Agencies—Now and in the Future Data and Analysis Needs Checklist : Do you have a data catalog? Is it complete? To check for completeness, consider the following: : Have you checked in with points of contact across departments to ensure that all data is included in the data catalog? : Are there other data types that are not collected but are needed to meet transit agency goals? This can inform data collection, data purchases, and external data requests. : Do you have data sharing protocols in place? Specifically: : Do you have a data sharing risk assessment methodology? : Do you have data privacy protection protocols? : Do you have a protocol for responding to information disclosure (public records) data requests? : Do you have a method for making data sharing decisions and forming data sharing agreements, including designated decisionmakers? Data Preparation Needs Checklist Data Quality : Is the data sufficiently accurate and precise to meet objectives? : Is it sufficiently clean (free of erroneous records)? Data Coverage : Does the data have sufficient coverage of transit users to draw insights? : Are there biases in which people or vehicles are included? Data Ownership : Does your transit agency own the data? If data pertains to individuals, is there a mechanism to get their permission to use the data? Data Processing : Do data sets need to merge to answer questions and meet objectives? : Is the data formatted to facilitate efficient analysis? : Does the data need to be aggregated to protect individual privacy or to suit a particular audience? Data Documentation : Is data documented? : Does each data set include a data dictionary? : Are important caveats or assumptions included with each data set? 

Guidance  15   Data Sharing Models Public Data Sharing (Open Data): Data is shared publicly in an online data repository or dashboard through an API or in a public-facing report. These sharing models promote transparency and can spur innovation, but they cede control over how the data is used. Private Data Sharing: In a private data sharing agreement, data is shared with a specific partner, often with a nondisclosure agreement. These types of sharing models enable transit agencies to meet targeted goals. For example, many transit agencies have research partnerships in which they share data with researchers who address transit agency planning and performance goals. Also consider: Is it more efficient or effective to perform the analysis and/or produce the data product internally? • Revenue generation (e.g., from advertising) • Customer information • Transparency • Facilitating multimodal travel and other community functions • Benchmarking Not all benefits can be quantified, but qualitative descriptions of expected benefits can guide data sharing decisions. For example, it may be useful to describe qualitatively what types of innovation may occur as the result of data sharing. How could public transit system performance improve? A key quantitative measure to include is how much internal effort can be saved. Consider how benefits vary under different sharing models. Benefits of open data can be uncertain, because they depend on how the data is used. In a research partnership, the expected benefits are more likely to be clearly defined. Costs Data sharing requires internal effort by transit agency staff. It is important to consider how much effort would be required under different data sharing models and how this compares with the effort that would be required to meet data-driven objectives internally. Public data sharing (open data) can require significant data preparation to ensure the data is usable by diverse audiences. Private data sharing relationships may require ongoing management. In some cases, research partners are paid, requiring additional outlays. Risks In conducting risk assessments of data sharing, it is important not only to have a procedure to evaluate risks but also to have a protocol for what do when risks are present. Generally, there are four types of risks related to sharing of transit agency data: • Privacy • Security • Misuse • Strategic 

16   Data Sharing Guidance for Public Transit Agencies—Now and in the Future According to transit agency interviewees, data privacy is a major concern. Each transit agency should develop a privacy risk assessment and protocol that it is comfortable with as an organiza- tion. Data privacy is an evolving topic. Legal definitions of data privacy vary and are expected to change over time. The Privacy Risk Assessment checklist can serve as a general guide for a privacy risk assessment. Privacy Risk Assessment Checklist : Does the data contain names, addresses, or other personal data, such as Social Security numbers? : Does the data contain individual records or records pertaining to a small sample of individuals that could be used to identify an individual based on their travel patterns? : Could the data be linked to other available data sets and used in combination with these other data sets to identify individuals? A privacy protocol consists of a set of actions or rules to follow if data presents a privacy risk based on the assessment. Depending on which privacy risks are present, actions could include the following: • Do not share data at all. • Do not share data publicly. • Process data before sharing. This could include censoring, aggregation, or adding noise (random variation). Specific processing protocols should be defined for different data types. Consider how processing impacts the potential to use the data to meet research and analysis goals (e.g., aggregation limits analysis of how individual users behave over time). • Share data with partners contingent on requirements, including the following: – Ensure data recipients are trained in using private data. – Ensure data recipients have a secure method to store data. – Require data recipients to sign a nondisclosure agreement, ensuring that they will not share the data. Security, misuse, and strategic risks should also be assessed. Each transit agency must deter- mine how important these risks are for data sharing decisions. Risks are likely to vary by data sharing model. The Other Risk Assessment checklist provides an example risk assessment method that could be tailored. Terms Once a sharing model is selected, consider attaching terms. When sharing data that poses privacy concerns or other risks, it is important to attach terms that restrict additional sharing or publishing, and mandate cybersecurity measures. Even with open data that does not pose privacy risks, terms can protect the data provider by including disclaimers about accuracy and use. At Transitland, an open data initiative 

Guidance  17   Other Risk Assessment Checklist : Is the data likely to be misinterpreted by users and what would be the conse- quences of misinterpretation? Can this be avoided through data processing and documentation? This risk is mostly limited to public data sharing, because private data sharing agreements can require public transit agency approval of products based on the data shared. : Could sharing the data harm public perception of the transit agency? Some transit agencies are hesitant to share data that reveals poor performance. However, this risk should be weighed against the benefit of transparency. : Could sharing the data create an information asymmetry, in which a competitor to public transit has more information than the transit agency? Given public records laws, this situation is often unavoidable. This risk must be weighed against the benefit of transparency and increased awareness of public transit through data sharing. Transit agencies can also try to access data from private mobility providers. : Does the data pose a security risk? Could it be used in an attack? Sharing any data on people’s and vehicles’ locations poses some security risk. Transit agencies must decide how much to weigh this risk against the benefits of data sharing. focused on General Transit Feed Specification (GTFS) data, they suggest using an open data license and provide a model license to use as a starting point (https://transit.land/an-open- project/#for-data-providers). 2.5  Accessing External Data Transit agencies may find that they need external data sources to achieve their established data-driven goals. Appendix A describes the types of external data sources that transit agency interviewees expressed interest in and their potential uses for transit agencies. In general, transit agencies acquire external data through four possible models: • As a direct purchase • Through a service agreement with a private mobility partner • Through a third party • By accessing public data sources (e.g., census or the National Transit Database data) As with decisions about sharing transit agency data, decisions about accessing external data should begin with definitions of objectives and needs. Transit agencies may need to spend signifi- cant effort engaging with external partners and finding a partner who will cooperate, particularly if transit agencies seek a cost-neutral solution. This effort should be considered when weighing the costs of acquiring external data. Transit agencies should consider working with cities and state DOTs to coordinate efforts to access external data and leverage the power of these public sector collaborators. 

18   Data Sharing Guidance for Public Transit Agencies—Now and in the Future When acquiring data, transit agencies should consider the following factors: • Sample size • Data collection biases and coverage across users and geographies • Data cleaning and processing methods applied • Data precision and aggregation • Frequency at which data is provided • Data format Transit agencies should consider involvement in the development of data standards for external data sets. Data standards, such as the Mobility Data Specification, which specify required data components and formats, can make it more efficient for transit agencies to use data from multiple providers. The Shared-Use Mobility Center released a white paper in 2019 that provides guidance to transit agencies seeking data sharing in a mobility partnership. The document includes a flowchart describing short-term actions and longer-term actions (Shared-Use Mobility Center 2019). Longer-term actions include working with lawmakers to modernize public records laws. This can be important in cases where external partners are hesitant to pro- vide data on individuals that could be accessible to the public under existing information disclosure laws. 2.6  Responding to Public Records Requests Understanding laws in your state is critical for responding to public records requests. Having a data-focused staff or division responsible for responding to public records requests pertaining to the transit agency’s data is helpful, because this person or division can ensure they are well- versed and up to date on legislation and can track repeated requests and requests that require significant effort. In general, information disclosure legislation contains exemptions to avoid releasing data that may pose privacy concerns or create other risks. However, legislation may not “keep up” with new data sets. Therefore it is important to consider risk assessment of public records requests. As shown in Figure 3, if public records requests pose risks, transit agencies may consider making internal changes about data storage or lobbying for changes to information disclosure legislation. Transit agencies should also consider information disclosure legislation when requesting data from external partners. As described in Section 2.5, information disclosure laws can pose a barrier to accessing external data. 

Guidance  19   Figure 3.   Flowchart for public records requests.