13-Data Security and Confidentiality Agreement - Tolleson to Vendor.pdf

Tolleson Union High School District #214

DATA SECURITY AND CONFIDENTIALITY AGREEMENT

This DATA SECURITY AND CONFIDENTIALITY AGREEMENT (“Data Agreement”) dated ______________________, by and between Tolleson Union High School District #214 (the “District’) and _______________________, and its subcontractors and agents (the “Service Provider”).

RECITALS

A. In providing services to the District, Service Provider may have access to confidential records, data and information concerning students and employees of the District.

B. Service Provider agrees to the provisions of this Data Agreement and to the requirements of state and federal law with respect to the receipt, review, storage and transmission of information received from the District.

C. This Data Agreement shall be in addition to any underlying agreement for goods and services entered into between the parties.

NOW THEREFORE, THE PARTIES HEREBY AGREE AS FOLLOWS:

1. Covered Data and Information. All records, information, and data of the District to which Service Provider has access are hereafter referred to as “CDI”. CDI includes, but is not limited to, all paper and electronic student education records, information and data supplied by the District, as well as any such records, information and data provided by students of the District, all personally identifiable records, information and data concerning students and employees of the District, and all personally identifiable information and other non-public information supplied, including but not limited to student data, employee data, and user content.

2. Data De-Identification. De-identified information may be used by the Provider for purposes of development, research and improvement of educational sites, services or applications as any other member of the public would be able to use de-identified data pursuant to 34 CFR 99.31(b). Provider agrees not to attempt to re-identify de-identified Student data and not to transfer de-identified Student Data to any party unless (a) that party agrees in writing not to attempt re-identification and (b) prior written notice has been given to the District who has provided prior written consent to such transfer.

3. Compliance with all Applicable Laws. Service Provider agrees to comply with the requirements of The Family Educational Rights and Privacy Act (FERPA), the Pupil Protection Rights Act (PPRA), and any other federal and/or state law governing the privacy of CDI. If Service Provider processes data outside of the United States, Service Provider specifically agrees to be bound by A.R.S. § 18-551. and -552, as amended, A.R.S. § 15-241, FERPA, PPRA and any other applicable Arizona or federal law governing CDI.

4. Access to CDI. Service Provider hereby acknowledges that the Service Provider has access to CDI and that such shall be subject to the terms and conditions of this Data Agreement.

Service Provider will only collect CDI as necessary to fulfill its duties as agreed to in any underlying agreement for goods or services.

5. Use of CDI. Service Provider will use CDI only for the purpose of fulfilling its duties and providing services as agreed to in any underlying agreement for goods or services.

6. Data Mining. Service Provider is prohibited from mining CDI for any purposes other than as agreed to in writing between the parties. Data mining or scanning of user content for the purpose of advertising or marketing to anyone is prohibited. Service Provider will not use any CDI to advertise or market to anyone without express written permission of the District.

7. Confidentiality of CDI. Service Provider agrees to hold CDI in strict confidence. Service Provider shall not use or disclose CDI received from or on behalf of the District except as permitted or required by this Data Agreement, as required by law, or as otherwise authorized in writing by the District. Service Provider agrees that it will protect CDI it receives from or on behalf of the District according to commercially acceptable standards and no less rigorously than it protects its own confidential information.

8. Reporting Student CDI. Service Provider may at times have reason to report CDI of District students to third parties as provided by express written permission from the District or as required by law. In reporting aggregated, de-identified data containing CDI, Service Provider shall:

a. Not disclose data about categories of 10 or fewer students;

b. Not report a total count of students;

c. Not report percentages of 0% or 100%; and

d. Report data in ranges rather than specific numbers.

9. Return or Destruction of CDI. Upon termination, cancellation, expiration or other conclusion of the work or services provided to the District by Service Provider, Service Provider shall return all CDI to the District. If the return of CDI is not feasible, Service Provider shall destroy any and all CDI and represent in writing to the District that it has destroyed all CDI and no longer has any CDI in its possession or control. Service Provider shall ensure that all CDI it is possession or the possession of any subcontractors or agents is destroyed or returned to the District when no longer needed for the specified purposes as authorized by the District.

10. Security of Electronic Information. Service Provider shall develop, implement, maintain and use appropriate administrative, technical and physical security measures and technical safeguards to preserve the confidentiality, integrity and availability of all electronically maintained or transmitted CDI received from or on behalf of the District or its students or employees. Service Provider shall store and process CDI in accordance with industry best practices to secure CDI from unauthorized access, disclosure and use. These security measures and technical safeguards shall be extended by express written agreement to all subcontractors and third parties used by Service Provider. Service Provider shall at a minimum:

a. Protect and maintain the confidentiality of passwords used to access CDI;

b. Notify the District when Service Provider’s access to CDI is no longer necessary;

c. Notify the District within two days of discovery if passwords used to access CDI by Service Provider, a subcontractor, or other third party are lost, stolen, or otherwise obtained or potentially obtained by unauthorized users.

Service Provider will conduct periodic risk assessments and remediate any identified security vulnerabilities in a timely manner.

11. Reporting of Disclosure or Misuse of CDI. Service Provider shall, within two days of discovery, report to the District any and all use or disclosure of CDI not authorized by this Data Agreement or authorized in writing by the District. Service Provider’s report shall identify:

a. The nature of the unauthorized use or disclosure;

b. The CDI used or disclosed;

c. The identity of the person or entity who made the unauthorized use or received the unauthorized disclosure;

d. What Service Provider has done or shall do to mitigate any deleterious effect of the unauthorized use or disclosure; and

e. What corrective action Service Provider has taken or shall take to prevent further similar unauthorized use or disclosure.

Service Provider shall provide such other information, including a written report, as reasonably requested by the District. Service Provider shall have a plan for responding to a breach of data security developed pursuant to best practices in the industry and shall share that plan with the District upon request.

12. District Access. Any CDI held by Service Provider will be made available to the District upon request.

13. Rights to Intellectual Property. This Data Agreement does not give Service Provider any rights, implied or otherwise, to CDI, data, content or intellectual property except as expressly stated in any underlying agreement between the parties. This includes but is not limited to the right to share, sell or trade CDI. The District acknowledges that this agreement does not convey any intellectual property right in any of Service Provider’s materials or content, including any revisions of derivative work or material. Service Provider-owned materials shall remain the property of the Service Provider. All rights, including copyright, trade secrets, patent and intellectual property rights shall remain the sole property of the Service Provider.

14. Indemnity. Service Provider shall defend and hold the District, its Board Members, officers, agents and employees, harmless from all claims, liabilities, damages or judgments involving a third party, including the District’s costs and reasonable attorneys’ fees, which arise as a result of Service Provider’s failure to meet any of its obligations under this Data Agreement.

Service Provider shall also comply with the breach notification requirements under applicable law that arise from the result of Service Provider’s failure to meet any of its obligations under this Data Agreement.

15. Remedies. If the District determines in good faith that Service Provider has materially breached any of its obligations under this Data Agreement, the District shall have the right to require Service Provider to submit to a plan of monitoring and reporting; to provide Service Provider with a fifteen (15) day period to cure the breach; or to terminate the work or services of Service Provider for the District immediately. Prior to exercising any of these options, the District shall provide written notice to Service Provider describing the violation and the action the District intends to take. The remedies described herein may be exercised by the District in its sole discretion and are in addition to any remedies permitted by law or pursuant to any other agreement between the parties.

16. Subcontractors. Service Provider shall require that any subcontractor or agent receiving CDI is authorized by the District to receive CDI and that the subcontractor or agent expressly agrees to be bound to the terms of this Data Agreement.

17. Modifications. Service Provider will not modify or change how CDI is collected, used or shared under the terms of this Data Agreement in any way without advance notice to and consent from the District.

18. Arizona Law. This Data Agreement is made in the State of Arizona and shall be interpreted by the laws of the State of Arizona. Any dispute arising out of or relating to this Data Agreement shall be brought in the Maricopa County Superior Court or the United States District Court, District of Arizona.

19. Cancellation. The District reserves all rights that it may have to cancel this Data Agreement for possible conflicts of interest under A.R.S. § 38-511, as amended.

20. No Israel Boycott. The Parties agree that they are not currently engaged in, and agree that for the duration of this Agreement they will not engage in a boycott of Israel, as that term is defined in A.R.S. § 35-393.

21. Arbitration. To the extent permitted by A.R.S. §§12-1518 and 12-133, the parties agree to resolve any dispute arising out of this Agreement by arbitration.

22. Amendments. All references to provisions of statutes, codes and regulations include any and all amendments thereto.

23. Miscellaneous. The provisions of this Data Agreement shall survive the termination, cancellation or completion of all work, services, performance or obligations by Service Provider to the District. This Data Agreement shall be binding upon the parties hereto, their officers, employees and agents. Time is of the essence of this Data Agreement. Except as expressly modified by the provisions of this Data Agreement, any underlying agreement for goods or services shall continue in full force and effect. In the event any inconsistencies exist between the terms of this Data Agreement and any underlying agreement, this Data Agreement shall control.

IN WITNESS WHEREOF, the parties hereto have caused this Agreement to be duly executed by its authorized parties on its behalf.

Tolleson Union High School District #214 VENDOR NAME ______________________

Signature: ___________________________ Signature: ___________________________

Printed Name: _______________________ Printed Name: _______________________

Title: _______________________________ Title: _______________________________

Date: _______________________________ Date: ______________________________