10-8B. Non-IT DSA.pdf

VENDOR/PARTNER DATA SHARING AGREEMENT

THIS AGREEMENT is entered into on this the day of , by and between herein called “ ,” and the Dallas Independent School District, herein called “District” or “Dallas ISD” for the period through . The parties hereto agree as follows:

1. has entered into an Agreement with the District to provide the following services:

The Agreement is attached as Exhibit A. To complete the work required under the Agreement, will require access to District data.

2. The release of District employee information must be in compliance with all applicable laws and regulations, including but not limited to, the Texas Education Code, Section

21.355 and Texas Government Code, 552.117.

3. The release of personally identifiable information of students must be in compliance with the requirements of the Family Educational Rights and Privacy Act (FERPA).

4. FERPA permits the disclosure of personally identifiable information of students to school officials with legitimate educational interests in students’ education records. The term “school official” includes contractors, consultants, volunteers, or other parties to whom an educational agency or institution has outsourced institutional services or provided that the outside party—

(1) Performs a District service or function for which the District would otherwise use employees;

(2) Is under the direct control of the District with respect to the use and maintenance of education records; and

(3) Is subject to the requirements governing the use and redisclosure of personally identifiable information from education records. 20 U.S.C.

1232g(b)(1)(A).

5. Student Confidentiality. The Dallas ISD has a legal obligation to maintain the confidentiality and privacy of student records in accordance with applicable law and regulations, specifically the Family Educational Rights and Privacy Act (FERPA).

and its authorized representatives may only receive student information in compliance with the requirements and exceptions outlined in FERPA.

and its authorized representatives acknowledge that they must comply with said law and regulations and safeguard student information. and its authorized representatives may not re-disclose the information to a third party without prior written consent from the Dallas ISD, the parent or eligible student.

and its authorized representatives must destroy any student information received from the Dallas Independent School District when no longer needed for the purposes listed in this Agreement or upon expiration of the term of the Agreement.

Any extended use of the data must be specifically authorized in writing in advance of the expiration of the underlying Agreement and its authorized representatives must maintain the confidentiality of the student records according to commercially reasonable administrative, physical and technical standards that are no less rigorous than the standards by which protects its own confidential information.

6. Dallas ISD will provide the following information to the :

7. acknowledges that the educational records and personally identifiable information from education records provided by the Dallas ISD may only be used to meet the purpose stated in this Agreement. If desires to use the records or data obtained from the Dallas ISD to conduct further research not specifically authorized in the Agreement, the research proposal must be submitted to the District’s Research Review Board for approval.

8. If wants to conduct a survey of students, written permission must first be obtained from the District. acknowledges that all student surveys will be in compliance with the requirements of the Protection of Pupil Rights Amendment (PPRA). In the event that any Department of Education funding is used for this program, prior written parental consent will be obtained before surveying a student on any of the following topics:

1. Political affiliations

2. Mental and psychological problems potentially embarrassing to the student and his/her family;

3. Sex behavior and attitudes;

4. Illegal, anti-social, self-incriminating and demeaning behavior;

5. Critical appraisals of other individuals with whom respondents have close family relationships;

6. Legally recognized privileged or analogous relationships, such as those of lawyers, physicians, and ministers; or

7. Religious practices, affiliations, or beliefs of the student or parents; or

8. Income (other than that required by law to determine eligibility for participation in a program or for receiving financial assistance under such program).

The protected categories may also be expanded by future amendments to the PPRA. Parents will have the opportunity to inspect the survey created by a third party before the survey is administered or distributed to the student regardless of the funding source.

9. must destroy all education records and any data derived from personally identifiable information or records when the information is no longer needed to fulfill the services being performed under the Agreement.

must provide the Dallas ISD with evidence of the destruction of the records in compliance with this Agreement. The destruction must occur within 30 days of the expiration of the underlying Agreement. The parties may agree to amend the

Agreement to extend the time period if needed, but the Agreement must be in writing and include a time limit.

The Dallas ISD will provide input on the specific time period for destruction based on the facts and circumstances surrounding the disclosure and Agreement. The destruction must be in accordance with the Dallas ISD’s records retention policies and procedures. The Dallas ISD’s records retention policy and procedures are located in Board Policy CPC (LOCAL) and CPC (REGULATION) located online at:

https://pol.tasb.org/Policy/Code/361?filter=CPC. Dallas ISD policy does not mandate a specific methodology for destruction (overwriting, degaussing, or physical destruction), only that data must be rendered irrecoverable.

10. designates the following individual or entity as an authorized representative: . The authorized representative has authority to bind the entity to the requirements of this agreement. The authorized representative shall also require individuals accessing the personally identifiable information from education records to execute affidavits of nondisclosure or other documentation indicating their individual agreement to handle the personally identifiable information from education records properly.

11. must provide Dallas ISD with a copy of policies and procedures, consistent with FERPA and other Federal and State confidentiality and privacy provisions, that will be used to protect personally identifiable information from education records from further disclosure (except back to the Dallas ISD) and unauthorized use, including limiting the use of personally identifiable information from education records to only authorized representatives with legitimate interests in the study. A copy of the ’s confidentiality and privacy provisions are attached as “Exhibit B.”

12. Approval to use the personally identifiable information from education records for one Agreement does not confer approval to use the data for another Agreement. The personally identifiable information from education records may only be used for the activities described in this Agreement.

13. The points of contact and data custodians (the individuals directly responsible for managing the data in question) are:

District:

(NOTE: You will need to include name and contact information for both the District end-user department, District contact and Vendor)

Vendor/Partner:

14. The disclosure of personally identifiable information from education records to is not an assignment of ownership of the personally identifiable information or records to . The Dallas ISD retains ownership of all such records. Personally identifiable information from education records may only be redisclosed with the Dallas ISD’s permission or in compliance with FERPA and its regulations.

15. The Dallas ISD maintains the right to conduct audits or otherwise monitor the receiving personally identifiable information from education records to periodically affirm that the has appropriate policies and procedures in place to protect the personally identifiable information from education records.

16. The failure to comply with the requirements of FERPA will subject the third party to all allowable penalties under state and federal law. In the event that District data is compromised and/or released to an unauthorized individual, must alert IT Security (ITSecurity@dallasisd.org), at Dallas ISD upon notification of the breach as soon as practical. In the event of a breach, will follow the notification requirements outlined in Texas Business and Commercial Code, Section 521.053.

17. shall indemnify, defend and hold District harmless from all claims, liabilities, damages, or judgments involving a third party, including District's costs and attorney fees, which arise as a result of ’s failure to meet any of its obligations under this agreement.

18. This Agreement and all of the rights and obligations of the parties hereto and all of the terms and conditions hereof shall be construed, interpreted and applied in accordance with and governed by and enforced under the laws of the State of Texas, and the parties hereto agree that venue shall be in Dallas County, Texas.

By signing, I certify that I have read and agree with the terms of the Data Sharing Agreement and I am authorized to sign and execute on behalf of my institution.