13-Exhibit V - Information Technology and Data Special Conditions.docx

Cook County Government Information Technology and Data Special Conditions Addendum

Together the Professional Services Agreement (“PSA”) Cook County contract (#xxxxxxx), including any attachments thereto, and this Information Technology and Data Special Conditions Addendum (“Addendum”), form the “Agreement.” County and Consultant agree that, with respect to County Data and/or County Intellectual Property, including any Consultant obligations, representation, or warranties related thereto, in the event of conflict between this Addendum and any other terms in the Agreement, this Addendum takes precedent over, controls and supersedes any term or clause to the contrary.

I. Definitions

a. “AI System(s)” means a machine-based framework that, for explicit or implicit objectives, infers, from the input it receives, how to generate outputs such as predictions, content, recommendations, or decisions influencing physical or virtual environments. “AI System” includes machine-based frameworks utilizing generative pre-trained transformers and large language models.

b. “Applicable Data Security and Privacy Law(s)” means any applicable and relevant US laws, regulations, industry self-regulatory standards, and codes of practice in connection with the processing of Personally Identifiable Information, including but not limited to the Health Insurance Portability and Accountability Act of 1996 (42 U.S.C. § 1320(d) et seq.); the Health Information Technology for Economic and Clinical Health Act of 2009 (42 U.S.C. § 17921 et seq.); FBI CJIS Security Policy; the Illinois Biometric Privacy Act, 740 ILCS 14/1, et seq.; the Illinois Personal Information Protection Act, 815 ILCS 530/1, et seq.; the Payment Card Industry Data Security Standard, including any subsequent updates, amendments and implementing regulations to the above laws, that may be applicable to the provision of the Services, Software, use of AI System, and/or this Agreement.

c. "Biometric Identifier" means a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry, and includes any expansion of this definition as enacted by the relevant legislative body and/or related case law. Additionally, photographs, videos, and voice recordings are included only to the extent utilized to capture such scans or prints.

d. “Biometric Information” means any information, regardless of how captured, converted, stored, or shared, based on an individual's Biometric Identifier that is used to identify an individual. Biometric information does not include information derived from items or procedures excluded under the definition of Biometric Identifiers. Biometric Information includes the most recent meaning or binding judicial interpretation of the term “biometric information” as defined in the Illinois Biometric Privacy Act, 740 ILCS 14/10.

e. “Business Associate Agreement” means an agreement that meets the requirements of 45 C.F.R. 164.504(e).

f. “Cardholder Data” means data that meets the definition of “Cardholder Data” in the most recent Payment Card Industry Data Security Standard.

g. “Consultant” means the same as “Contractor” as both terms are defined in County Professional Services Agreement, or as defined in County Instruction to Bidders and General Conditions, if either document forms the basis of this Agreement. “Contractor” and “Consultant” may be interchangeably used. “Consultant” includes employees, representatives, subcontractors, and agents of Consultant.

h. “Consultant Confidential Information” means all non-public proprietary information of Consultant that is marked confidential, restricted, proprietary, or with a similar designation, provided that Consultant Confidential Information excludes County Data or information that may be subject to disclosure under Illinois Freedom of Information Act, 5 ILCS 140/1 et seq. or other law.

i. “County” has the same meaning as defined in the Cook County Procurement Code, located at Chapter 1, Sec. 1-3, of the Cook County Code of Ordinances as amended.

j. “County Confidential Information” means all non-public proprietary information of the County, including Personally Identifiable Information and any information exempt from public disclosure under the Illinois Freedom of Information Act, 5 ILCS 140/1 et seq. or under the Cook County Code of Ordinances.

k. “County Data” means any and all information, in any form, that the County provides access to or shares with Consultant.

County Data also includes, without limitation, all information provided by County employees and representatives, as well as information provided by any third party on the County’s behalf, to Consultant, and any information owned, created, and/or maintained by County that Consultant encounters during the term of this Agreement.

County Data does not include any data or intellectual property owned or created by Consultant, including proprietary or trade secret data, except for any data or intellectual property that the County is commissioning or purchasing from Consultant or that Consultant has been hired to create for the County.

l. “County Intellectual Property” or “County IP” means all Intellectual Property owned or licensed by the County, including Developed IP.

m. “Criminal Justice Agency(ies)” means a court, governmental agency (federal, state, local or tribal), or any subunit of governmental agency, that administers criminal justice pursuant to a statute or executive order and allocates a substantial part of its annual budget to administering criminal justice. Criminal Justice Agency includes state and federal Inspector General Offices and Sheriff’s Offices.

n. “Criminal Justice Information” or “CJIS Information” means data or information, in virtual or hard copy form, collected by Criminal Justice Agencies regarding individuals consisting of identifiable descriptions and notations of arrests, detentions, indictments, informations, or other formal criminal charges, and any disposition arising therefrom, including acquittal, sentencing, correctional supervision, and release. The term does not include identification information such as fingerprint records if such information does not indicate the individual's involvement with the criminal justice system.

Criminal Justice Information also means any data that meets the definition of “Criminal Justice Information” in the most recent version of FBI CJIS Security Policy as well as data that meets the definition of “Criminal History Record Information” at 28 C.F.R. 20.

o. “Cyber Incident” means an occurrence of any kind that is reasonably likely to threaten or compromise, or does threaten or compromise, the security, integrity, availability, and confidentiality of, or access to, an information system, computer system, and/or the cyber security tools, controls, or procedures put in place to secure Consultant’s systems, endpoints, servers, and/or its cloud environment, and has the potential to cause a Data Breach. Cyber Incident includes, but is not limited to, a ransomware event; a large scale failure of Consultant’s Information Security System; any configuration problems which cause data to be stored or shared in violation of either Consultant’s or Consultant’s Third Party Vendor’s Information Security Program; and any mistake or unintentional issue that causes cybersecurity protections to fail or otherwise not protect County Data and/or allows for the unauthorized access to or exfiltration of County Data.

p. “Data Breach” means (a) the loss or misuse (by any means) of any County Confidential Information; (b) the unauthorized or unlawful access, use, modification, destruction, corruption, or disclosure of any County Confidential Information; or (c) any other act or omission that compromises the security, confidentiality, integrity, or availability of any County Confidential Information.

q. “Data Subject” and any variation of that word mean the same as defined in Applicable Data Security and Privacy Laws.

r. “Data Subject Request” means a request made by a Data Subject to exercise any rights of Data Subjects under the Applicable Data and Security Privacy Laws.

s. "Deliverable" means the same as defined in the Professional Services Agreement or as defined in County Instruction to Bidders and General Conditions, if either document forms the basis of this Agreement.

t. “Developed Intellectual Property” or “Developed IP” means Intellectual Property conceived, developed, authored, or reduced to practice in the course of or in connection with the provision of the Services, including, but not limited to: (a) modifications to, or enhancements (derivative works) of, the County IP; (b) Developed Software; and (c) modifications to, or enhancements (derivative works) of, third party Intellectual Property to the extent not owned by the licensor of the third party IP under the terms of the applicable license.

u. “Evolution Data” means data created by, incorporated into, and a component of the AI System’s evolution during training and subsequent use by County during the Term, including retained portions of any training data, production data, or Output Data as provided, directly or indirectly, by County.

v. “Information Security Program” means a detailed set of policies, procedures, and principles that describe how an organization protects its data and systems from unauthorized access, use, disclosure, disruption, modification, or destruction.

w. “Input Data” means data, regardless of form, that is entered into an AI System for processing.

x. “Open Source Materials” means any Software that: (a) contains, or is derived in any manner (in whole or in part) from, any Software distributed as free Software, open source Software, shareware (e.g., Linux), or similar licensing or distribution models; and (b) is subject to any agreement with terms requiring that such Software be (i) disclosed or distributed in source code or object code form, (ii) licensed for the purpose of making derivative works, and/or (iii) redistributable. Open Source Materials includes without limitation “open source” code as defined by the Open Source Initiative and “free” code as defined by the Free Software Foundation.

y. “Output Data” means generated outputs such as predictions, information, content, recommendations, or decisions provided by an AI System in response to processing Input Data.

z. “Personally Identifiable Information” means personal data or information that relates to a specific, identifiable, individual person, including County personnel, and includes all variations of that term as defined in the Applicable Data and Security Privacy Laws. For the avoidance of doubt, Personally Identifiable Information includes: (a) any government-issued identification numbers (e.g., Social Security, driver’s license, passport); (b) any financial account information, including account numbers, credit card numbers, debit card numbers, and other Cardholder Data; (c) Criminal Justice Information; (d) Protected Health Information; (e) Biometric Information; (f) passwords or other access-related information associated with any user account; and (g) any other personal data defined as Personally Identifiable Information under Data Breach Notification Laws.

aa. “Personal Health Information” means information relating to the past, present, or future physical or mental health or condition of an individual; to the provision of health care to an individual; or to payment (whether past, present, or future) for health care ; and either (i) Identifies the individual; or (ii) provides sufficient information that could reasonably be used to identify the individual, but that is not included in the definition of Protected Health Information under 45 C.F.R. 160.103.

ab. “Protected Health Information” or “PHI” has the same meaning as the term “Protected Health Information” in 45 C.F.R. 160.103.

ac. “Services” means the same meaning as defined in Article 3 of the County Professional Services Agreement or “Deliverables” as defined in the County Instruction to Bidders and General Conditions, if either document forms the basis of this Agreement.

ad. “Software” means computer programs, whether in source code or object code form (including any and all software implementation of algorithms, models and methodologies), databases and compilations (including any and all data and collections of data), and all documentation (including user manuals and training materials) related to the foregoing.

ae. “Third-Party Vendor” means any subcontractor, company, independent contractor, or vendor of any kind that is not a direct employee or corporate division of Consultant. Third Party Vendors includes Subconsultants as may be defined in the Underlying Contract.

II. Data Storage and Access

a. Data Storage: Consultant agrees to store all County Data in compliance with Section III Privacy and Data Security of this document. Consultant agrees to ensure that County Data it receives and stores is kept in the same technical format (not including the application of encryption) and is organized in the same manner (as close to a 1 to 1 storage as possible) as it was received by Consultant.

Consultant also agrees to minimize storing or transferring County Data on portable media devices and will only store or transfer County Data on portable media devices with prior written approval from County. Should it be necessary to store or transfer County Data via a portable media device, Consultant agrees to secure the same with commercially available cybersecurity tools (i.e., requiring multi-factor authentication to access such portable media device), and to track in a security log all instances of downloads of County Data to a portable media device and the chain of custody of such media device until County Data is securely deleted from same. Consultant further agrees that any such portable media device will fully encrypt the data, and that authority to access or remove the portable media device containing County Data is granted only with demonstrated need. Consultant will only utilize portable media devices with the ability to be remotely wiped

b. Approved Facilities: Consultant will perform Services and host County Data only within the continental United States and only from locations owned or leased by Consultant and its Subcontractors.

c. Data Minimization: Consultant must implement procedures to minimize collection of Personally Identifiable Information and Personal Health Information. If Personally Identifiable Information must be collected or processed by Consultant on County’s behalf, or is shared with Consultant by County for any reason, Consultant will only use such Personally Identifiable Information: (i) as directed by the County; (ii) as needed to provide contracted services to the County; and (iii) for no other purpose. If Personally Identifiable Information must be shared with a third party, Consultant will only share portions of such information necessary to accomplish the purpose of sharing and that it will comply with all requirements of Section V before sharing with such third party.

d. Data Access and E-Discovery: The County may access and copy any County Data in Consultant’s possession at any time for any reason, without limitation. Consultant shall reasonably facilitate such access and copying promptly after the County’s request.

Consultant agrees to only delete County Data in compliance with applicable law and the Data Deletion section of this Agreement. Consultant also agrees to halt any deletion of County Data promptly, including directing its Third-Party Vendors to do the same, if the County informs Consultant in writing that such data must be preserved.

e. Compliance with Applicable Data Applicable Data Security and Privacy Law(s): If the County is required to respond to a Data Subject Request, Consultant agrees to reasonably cooperate with the County to the full extent necessary to respond in compliance with Applicable Data Security and Privacy Laws. If Consultant receives a Data Subject Request related to this Agreement, Consultant will notify County of such request as soon as reasonably practicable and will reasonably cooperate with the County to the full extent necessary to respond in compliance with Applicable Data Security and Privacy Laws.

f. County Confidential Information. All County Confidential Information shall remain the property of the County, and no license or other rights to the Consultant is granted or implied hereby. Consultant shall not disclose or allow disclosure of any of the County’s Confidential Information to any third party, except to Consultant’s employees and representatives, who are subject to written and enforced obligations to keep such Confidential Information confidential, and shall only use and disclose such County Confidential Information (i) for purposes of performing its obligations under this Agreement, and/or (ii) in connection with any SOW/Order Form (including in the course of discussions or exploration of a potential SOW/Order Form which may or may not ultimately be executed). Consultant remains responsible for any breach of this section by its employees and representatives.

i. In the event that Consultant is required to disclose County Confidential Information in accordance with a judicial or governmental requirement or order, Consultant shall limit disclosure of such data in compliance with Section III(c)(iii) of this Addendum.

ii. County Confidential Information shall be subject to the confidentiality obligations of this Section III(f) for ten years following Consultant’s return or destruction of County Confidential Information in accordance with subsection iv below.

iii. Injunctive Relief. Consultant acknowledges that disclosure of any County Confidential Information by it or its employees or representatives may give rise to irreparable injury to the County not adequately compensated by damages. Accordingly, the County may be entitled to equitable relief, including injunctive relief and specific performance against the breach or threatened breach of the undertakings in this section, in addition to any other legal remedies that may be available.

iv. Return or Destruction of County Confidential Information. Unless otherwise provided in this Agreement, upon the earlier of the County’s request or termination or expiration of this Agreement, Consultant shall, at the County’s option, promptly destroy or return all County Confidential Information, including all copies in any form or medium, in its possession or control, in compliance with Section III(e) of this Addendum.

g. Information Access: Consultant may not permit access to any County Confidential Information by any unauthorized individual or entity. Consultant must provide its personnel only such access as is minimally necessary for such persons/entities to perform the tasks and functions for which they are responsible. Consultant will, upon request from the County, provide the County with an updated list of its personnel with access to County Data and the level of such access.

h. Public Records Laws: Consultant will comply with all laws governing public records located at 50 ILCS 205/1 et seq. and at 44 Ill. Admin. Code 4500.10 et seq. Specifically, and without limitation, Consultant must: (a) store County Data such that each record is individually accessible for the length of the County’s scheduled retention; (b) retain a minimum of two copies of all County Data according to industry best practices for geographic redundancy, such as NIST Special Publication 800-34 as revised; (c) store and access County Data in a manner allowing individual records to maintain their relationships with one another; (d) capture relevant structural, descriptive, and administrative metadata to County Data at the time a record is created or enters the control of Consultant.

III. Privacy and Data Security

a. General Requirement of Confidentiality and Security: Consultant will maintain the confidentiality and security of all County Data that it has copies of or access to. Without limiting Consultant’s other obligations under this Agreement, Consultant must use commercially available and state-of-the-art cybersecurity tools and controls meeting this Section III’s requirements to provide reasonably appropriate security protection to County Data proportionate to the type and sensitivity of County Data at issue. Similarly, Consultant must provide and perform all Services and Software securely in compliance with the requirements of this Section III using security technologies and techniques in accordance with industry-leading practices and County security policies, procedures and other requirements made available to Consultant in writing. This includes network management and maintenance applications and tools, appropriate fraud prevention and detection and encryption technologies to protect County Confidential Information. Consultant must secure all Personally Identifiable Information with the highest level security commercially available, and must also encrypt all Personally Identifiable Information and Personal Health Information in transit, during processing, and at rest. The requirements of this Section III shall apply to all of Consultant’s Systems and the facilities where such Consultant Systems are used to collect, store, handle, process, backup, dispose, and/or access County Data.

b. Applicable Data Security and Privacy Laws: Consultant agrees to comply with and abide by all Applicable Data Security and Privacy Laws, including those applicable to the Consultant if it, rather than the County, were the owner or data controller of any County Data in its possession or under its control in connection with the Services.

c. Data Ownership: Consultant recognizes and agrees that the County possesses and retains all right, title, and interest in and to County Data, and that Consultant’s use, access to and possession thereof is solely to fulfill its obligations under this Agreement and that any processing and use of County Data by the Consultant is done solely on the County’s behalf and for the County’s benefit.

i. Consultant further recognizes and agrees that:

1. County Data is valuable property of the County and may include proprietary, sensitive, private and/or trade secret information; and

2. County Data may include original compilation pursuant to copyright laws of the United States and other jurisdictions; and

3. The County has dedicated substantial resources to collecting, managing, securing and compiling County Data; and

4. County may suffer irreparable harm or loss in the event of such information being disclosed or used otherwise than in accordance with this Agreement; and

5. Without the County’s express written consent, no County Data, or any part thereof, may be disclosed, assigned, destroyed, altered, withheld, or otherwise restricted by Consultant or commercially exploited by or on behalf of Consultant.

ii. The County grants Consultant a limited, non-transferrable and royalty free license to use and access County Data solely as necessary to fulfill Consultant’s duties under this Agreement. Without County’s prior written consent, Consultant shall not:

1. access or use any County Data for any purpose other than to fulfill its duties and obligations under this Agreement; or

2. give third party access to or copies of County Data, unless in compliance with the Third-Party Vendor section below.

iii. In the event that Consultant is required to disclose County Data in accordance with a judicial or governmental requirement or order, Consultant will, except to the extent prohibited by law:

1. give the County reasonable prior notice and opportunity to object or seek a protective order or other appropriate remedy;

2. Cooperate with the County so the County may object to or seek a protective order or other appropriate remedy;

3. disclose only portion(s) of the County Data that it is legally required to disclose.

d. Consultant as a Data Processor: Consultant understands and acknowledges that, to the extent that performance of its obligations hereunder involves or necessitates processing Personally Identifiable Information, it will act only on direction from the County.

e. Data Deletion: Consultant agrees that at the conclusion of this Agreement or upon the written request of the County, it will promptly:

i. return all versions and copies of County Data to the County in such a format that the County may reasonably request and;

1. provide County with adequate bandwidth and other resources to remove County Data from Consultant servers; and

2. provide sufficient information requested by the County about the format and structure of the County Data to enable such data to be used in substantially the same manner as used by Consultant.

ii. after returning all County Data to the County, delete all versions or copies of County Data from any location and all systems under Consultant’s control, including but not limited to Consultant’s servers, systems and any backups; and

iii. direct and ensure secure erasure of County Data by any and all of Consultant’s Third-Party Vendors with copies of or access to County Data.

Consultant also agrees that in deleting County Data as required by this Agreement, Consultant shall leave no data readable, decipherable, or recoverable on its computers, servers, or other media, or those of its Third-Party Vendors, in accordance with NIST Special Publication 800-88 as revised. Promptly after Consultant has completed its deletion of County Data and has directed its Third-Party Vendors to do the same, and no later than 30 days after termination of this Agreement, Consultant shall certify such deletion to County in writing in compliance with NIST Special Publication 800-88.

f. Data Security: Without limiting any of its other obligations and promises elsewhere in the Agreement, Consultant shall prevent unauthorized access to, sharing, disclosure, modification, or destruction of County Data. Consultant represents and warrants that:

i. it will not permit any unauthorized access to or allow its actions or inactions to cause any loss or damage to County Data or County IP;

ii. it will comply with any and all County security policies in place during the term of this Agreement;

iii. it will not use any system that is dependent on software or hardware without appropriate security updates available;

iv. it will only store County data within the Continental United States;

v. it will appropriately vet using, at a minimum, criminal background checks, identity verification of physical person to a government issued id card, and employment history verification of all employees and representatives working with or provided access to County Data and County IP and ensure that such employees and representatives are legally bound to maintain the security and confidence of County Data, County IP, and County Confidential Information; and

vi. it will not allow any foreign government or foreign owned organizations or other third parties access to any County Data, County IP, or County Confidential Information.

g. Information Security Program: Consultant agrees to maintain, implement, and comply with a written Information Security Program requiring industry standard administrative, technical, and physical safeguards appropriate to:

i. protect the security and confidentiality of County Data;

ii. identify and protect against threats and hazards to the security or integrity of County Data; and

iii. protect against unauthorized access, taking, sharing, destruction, modification, or use of County Data.

Consultant’s administrative, technical, and physical safeguards must provide a level and scope of security not less than the level and scope required under (a) the County Policies as updated; (b) Federal Information Processing Standard 200; (c) then-current NIST 800-series standard and successors thereto; or (d) an equivalent, generally accepted, industry-standard and state-of-the-art security standards series.

Consultant shall also ensure that the Information Security Program addresses the following:

i. Proper disposal of County Data once it is no longer needed to carry out the purposes of this Agreement and in compliance with the Data Deletion section of this Agreement;

ii. Access controls on systems and servers used to maintain, access, or transmit County Data;

iii. Access restrictions and appropriate security controls at physical locations containing County Data, including at servers and/or data banks;

iv. Multi-Factor Authentication on all systems, accounts, and endpoints, with access to store or maintain County Data;

v. Encryption of electronic County Data, at rest and in transit, in a manner that, at a minimum, adheres to NIST SP 800-111, NIST SP 800-52, NIST SP 800-77 and NIST SP 800-113 encryption standards. Consultant must not deviate from this encryption requirement without the advance, written approval of the County’s Information Security Office.

vi. Application of least privilege principles for access to County Data, which is supplemented either by dual control procedures or segregation of duties;

vii. Regular testing and monitoring of electronic systems accessing or storing County Data; and

viii. Procedures to detect actual and attempted attacks on or intrusions into the end points, systems, or servers, containing or accessing County Data.

h. Regular Review of Security Program: Consultant shall review the Information Security Program and all other County Data Security precautions regularly, but no less than annually, and update them to comply with applicable laws, regulations, technology changes, and best practices.

i. Cyber Incident: Consultant represents and warrants that it maintains the cybersecurity of its Services and Software and takes proactive and consistent action and to prevent a Cyber Incident from affecting any County IT environment at any time. If Consultant discovers that a Cyber Incident has impacted its own environment and has or has the potential to impact the County’s IT environment, Consultant must, at no additional charge, (a) immediately undertake to address the Cyber Incident to mitigate damage and restore any affected Service, Software or equipment; (b) notify the County in writing within 24 hours of discovery of the incident; and (c) use reasonable efforts to correct and repair any damage to County Data or Software and otherwise assist the County in mitigating such damage and restoring any affected Service, Software or equipment.

j. Data Breach: In the event that Consultant suffers a Data Breach of any kind, it agrees to:

I. Notify County promptly and without unreasonably delay, but no later than 24 hours after discovery or suspicion of the Data Breach. Notification shall be sent to databreach@cookcountyil.gov;

II. Notify County promptly and without unreasonably delay, but no later than 24 hours after receiving notification from a Third-Party Vendor, of a Data Breach suffered by such vendor, if that Vendor had copies of or access to County Data. Notification shall be sent to databreach@cookcountyil.gov;

III. If the Data Breach concerns County Data:

1. Consultant will provide County with meaningful access to the forensic investigation, including details regarding method of compromise, identity of the attackers if known and progress of remediation;

2. Consultant will assist the County as it seeks to comply with any data breach notification requirements. Such assistance shall include not be limited to, providing the County with access to data, personnel and information relating to the County Data that may have been exposed, and, if applicable, information about any persons whose Personally Identifiable Information may have been affected or exposed;

3. Consultant will notify any affected persons solely at the County’s direction, including review and approval of all notices, and governmental regulators, as applicable;

4. Consultant will recover affected data or information to the extent possible;

5. Consultant will provide County with a corrective action plan acceptable to County;

6. Consultant will not make any public announcements relating to such Data Breach without the County’s prior written approval; and

7. Consultant agrees that County has the sole right to (a) determine whether notice of any Data Breach involving County Data is to be provided and to whom; and (b) approve the contents of such notice, whether any type of remediation may be offered to affected persons, and the nature and extent of any such remediation.

IV. In the event of a Data Breach attributable to an act or omission of Contractor, including without limitation those of Consultant’s Third-Party Vendors, subcontractors or other agents, Consultant shall also:

1. reimburse County for any and all reasonable expenses related to data breach notifications, including the provision of credit monitoring services to affected persons;

2. indemnify and defend the County from any and all legal actions that arise from such data breach; and

3. compensate the County for any and all other related costs or expenses, such as recreating lost or compromised data.

V. Nothing in this section is meant to limit or restrict any of the County’s other rights or potential remedies stemming from such data breach.

k. Data Integrity and Loss of County Confidential Information. Consultant must implement and maintain strong, industry standard measures, as detailed in Section III(g) of this Addendum, to maintain accuracy of County Data. Without limiting any rights and responsibilities under this Section III in the event of any disclosure, inaccuracy, or loss of, or inability to account for, any County Confidential Information, Consultant must promptly, at its own expense: (a) notify the County in writing within 24 hours; (b) take such actions as necessary or reasonably requested by the County to minimize the violation; and (c) cooperate in all reasonable respects with the County to minimize any damage resulting from the violation.

l. Biometric Data Security and Breach: If Consultant will receive, handle, manage, store, review, collect, access, or otherwise process any Biometric Information as a part of this Agreement:

i. Consultant will provide its written policies related to the retention schedule and permanent deletion of Biometric Information to County prior to Consultant’s receipt of the Biometric Information.

ii. If this Agreement requires Consultant to collect Biometric Information on behalf of the County, Consultant agrees to obtain appropriate consent, as required by the Illinois Biometric Information Privacy Act (740 ILCS 14/1, et seq.), from the person who the Biometric Information is being collected from, on behalf of both Consultant and the County.

iii. Consultant agrees that under no circumstances will it sell, lease, trade, or otherwise profit from Biometric Information in connection with this Agreement, regardless of whether received from the County or collected directly from the person.

iv. Consultant shall ensure that its Information Security Program, as required via this Section III, provides for and includes protection of Biometric Information. Additionally, Consultant agrees to implement any additional data security policies and controls for Biometric Information as necessary to ensure full compliance with applicable privacy laws.

v. Consultant shall notify County promptly and without unreasonably delay, but no later than 24 hours after discovery, of any Data Breach affecting Biometric Information. Notification shall be sent to databreach@cookcountyil.gov.

m. Payment Card Data Security and Breach: If the Underlying Contract requires or permits Consultant to receive, handle, manage, store, review, collect, access, or otherwise process any Cardholder Data, Consultant agrees:

i. to provide the County with a copy of its most recent Attestation of Compliance and Report on Compliance establishing that Consultant has been PCI-DSS Certified. Consultant also agrees to provide updated compliance documents should its certification be renewed during the pendency of this Agreement.

ii. to ensure that its Information Security Program, as required via this Section III, provides for and includes the protection of Cardholder Data. Additionally, to the extent necessary, Consultant agrees to implement any additional data security policies and controls for Cardholder Data as may be required by the PCI Security Standards Council.

iii. If a Data Breach occurs and involves Cardholder Data, Consultant agrees to:

1. Notify County promptly and without unreasonable delay, but no later than 24 hours after discovery, of any Data Breach affecting Cardholder Data. Notification shall be sent to databreach@cookcountyil.gov.

2. Work with the County as described above in Section III(j) to provide notification to affected Card Holders and Card Companies as necessary, including but not limited to, the provision of documents and testimony, during any resulting PCI investigation or audit of the County, at the Consultant’s own expense.

n. PHI Data Security and Breach: If the Underlying Contract requires or permits Consultant to receive, handle, manage, store, review, collect, access, or otherwise process any PHI, then Consultant agrees:

i. that in addition to this Agreement, it must enter into a Business Associate Agreement with the County entity or division providing Consultant with copies of or access to the PHI.

ii. that its Information Security Program, as required via this Section III, provides for and includes the protection of PHI. Additionally, to the extent necessary, Consultant agrees to implement any additional data security policies and controls for PHI to ensure full compliance with both the Health Insurance Portability and Accountability Act of 1996 (Pub. L. 104-191, 110 Stat. 1936, 45 CFR 160, et. seq.) and the Health Information Technology for Economic and Clinical Health Act (Pub. L. No. 111-5, Title XIII, 123 Stat 226).

iii. to notify the County promptly and without unreasonably delay, but no later than 24 hours after discovery, of any Data Breach affecting PHI. Notification shall be sent to databreach@cookcountyil.gov.

o. CJIS Data Security and Breach: If the Underlying Contract requires or permits that Consultant receive, handle, manage, store, review, collect, access, or otherwise process any CJIS Information, then Consultant agrees:

i. to sign and return to the County, in paper or electronic copy, the CJIS Data Security Acknowledgement Receipt after the County provides Consultant with a copy of this Addendum and the CJIS Security Policy.

ii. that its Information Security Program, as required via Section III(f) of this Addendum, provides for and includes the protection of CJIS Information. Additionally, to the extent necessary, Consultant agrees to implement any additional data security policies and controls for CJIS Information to ensure full compliance with both the Criminal Justice Information Services Security Policy and the policies and standards established by the Criminal Justice Information Services Advisory Policy Board.

iii. to sign and abide by an Information Exchange Agreement with the County prior to any exchange of CJIS Information.

iv. Notify County promptly and without unreasonable delay, but no later than 24 hours after discovery, of any Data Breach affecting CJIS Information. Notification shall be sent to databreach@cookcountyil.gov.

p. Privacy Notice: Consultant shall provide effective notice to the public and to individuals regarding:

i. Its activities that impact privacy, including its collection, use, sharing, safeguarding, maintenance, and disposal of personally identifiable information (PII); and

1. Authority for collecting PII; and

2. The choices, if any, individuals may have regarding how Consultant uses PII and the consequences of exercising or not exercising those choices; and

3. The ability to access and have PII amended or corrected if necessary.

ii. The Consultant’s privacy notice shall describe:

1. The PII collected and the purpose(s) for which it collects that information; and

2. How the Consultant uses PII internally; and

3. Whether individuals have the ability to consent to specific uses or sharing of PII and how to exercise any such consent; and

4. How individuals may obtain access to their PII; and how PII will be protected.

IV. Consultant Personnel: Consultant will oblige its personnel to comply with applicable Data Protection Laws and to undertake only to collect, process or use County Data necessary to perform the Services, and will not make it available to any Third Parties except as specifically authorized hereunder. Consultant must ensure that, prior to performing any Services or accessing any County Data or other County Confidential Information, all Consultant personnel who may have access to the aforementioned must execute agreements concerning access protection and data/software security consistent with this Agreement.

V. Third-Party Vendors: Consultant agrees that if it is to utilize third party vendors for this Agreement that require access to or copies of County Data in order to perform its work, that it will:

a. Ensure that all such vendors and their employees are located within the Continental United States, unless approved in writing in advance by County;

b. Ensure that no such vendor is owned in part or in whole by a foreign government, unless approved in writing in advance by County;

c. Provide a written list of such vendors to the County, along with a link to or copy of the vendors’ privacy and data security policy;

d. Ensure that Consultant’s contracts with such vendors contain the appropriate data security and privacy protections for County Data that are the same or at least as stringent as the provisions contained within this Agreement;

e. Ensure that each vendor is required to promptly notify Consultant of any Data Breach suffered by the vendor that concerns County Data;

f. Notify County immediately upon receiving notification from a vendor of any Data Breach that concerns County Data;

g. Remain responsible for any resulting costs, liability, charges or expenses incurred by the County and stemming from the action or inaction of such Third-Party Vendor; and

h. In the event of a Data Breach stemming from such vendor, assist the County with obtaining information, documents, and access to persons necessary to investigate such Data Breach and provide necessary legal notifications.

VI. Audit Rights

a. Data Security Audit: Consultant agrees to have a Security Audit Service Organization Control (SOC 2), Type II Audit performed at least annually, and, at its sole cost and expense, to provide the County and its auditors with the SOC 2, Type II report, or its equivalent, for all locations at which the County Data is processed or stored. Additionally, Consultant agrees to allow the County to directly audit its Information Security Program and related controls within 30 days of receiving an official request from the County.

Further, Consultant agrees that that it will promptly make available to the County the results of any reviews or audits conducted by Consultant (including Consultant’s internal and external auditors) or the results related to a SOC-2 audit, relating to Consultant’s and its Third Party Vendor’s operating practices and procedures, even if not directly requested by the County, if the results are relevant to Consultant’s provision of Services or to Consultant’s obligations under the Agreement.

b. Third Party Vendor Audits: Consultant must ensure that all agreements with its Third Party Vendors performing Services under this Agreement include the right for County to audit. Consultant agrees to facilitate a County audit of its third party vendors, or (if agreed by the County as an alternative) to obtain and provide the results of any SOC 2 Audit of its Third Party Vendors. Consultant also agrees that if needed, it will directly conduct an audit of its Third Party Vendors and provide the County with the results.

c. CJIS Information Audits: To the extent that this Agreement concerns CJIS Information, Consultant agrees that, in addition to the County’s audit rights, the FBI may also be authorized to perform a security audit of Consultant’s and/or Consultant’s vendor’s systems during the pendency of this Agreement and a final audit at the termination of this Agreement.

VII. Intellectual Property

a. Consultant Intellectual Property Warranty: Consultant represents and warrants that it owns, or is authorized to use, all Consultant IP, and Consultant-provided third-party IP.

b. Open Source Material: Consultant represents and warrants that all open source materials (OSM) included in Deliverables or Software are obtained from a trusted distributor. Consultant represents and warrants that all OSM materials provided to County or used on County’s behalf comply with their license agreements. Unless otherwise specified in this Agreement, Consultant must maintain OSM support, including required patching and security updates, which will be provided promptly after release. Consultant must not use any materials allowing users to modify or incorporate open source code into larger programs on the condition that the software containing the source code is publicly distributed without restrictions, commonly known as “copyleft.”

c. Developed Intellectual Property: With regards to any Intellectual Property specifically developed for the County by Consultant under the terms of this Agreement, Consultant hereby irrevocably and unconditionally assigns, transfers, and conveys to the County, without further consideration, all of its right, title, and interest in such Developed Intellectual Property. This transfer will take place immediately upon the creation and completion of such works without need for further documentation or action on the part of the Parties. Consultant agrees to perform any actions as may reasonably be necessary, or as the County may reasonably request, to perfect the County’s ownership of any such Developed Intellectual Property.

d. Software Licenses: This Agreement contains all terms and conditions relating to any and all licenses in Consultant-Provided Software and Consultant Intellectual Property. Except as explicitly set forth elsewhere in this Agreement, all licenses that Consultant grants in Consultant-Provided Software include: (a) the right of use by Third Party Consultant for the benefit of the County, (b) the right to make backup copies, and (c) the right to reasonably approve the procedures by which Consultant may audit the use of license entitlements.

e. County Intellectual Property: Consultant acknowledges that County retains all right, title and interest in and to all County IP. Consultant will not be permitted to use any County IP for the benefit of any entities other than the County. Upon expiration or termination of this Agreement, Consultant must cease all use of County IP and must return to the County all County IP.

f. Residual Knowledge: Consultant acknowledges that nothing contained in this Agreement restricts either Party from the use of ideas, concepts, know-how, or techniques relating to the Services which either Party, individually or jointly, develops or discloses under this Agreement, provided that in doing so (a) such information is solely retained in the unaided memory of the Parties’ employees performing or using such Services, (b) the Party does not breach its respective obligations under Section III relating to confidentiality and non-disclosure, and (c) such use does not infringe the Intellectual Property rights of other parties who have licensed or provided materials to the other. Except for the license rights contained in this Section VII, neither this Agreement nor any disclosure made hereunder grants any license to either Party under any Intellectual Property rights of the other.

g. Export Laws: Consultant will comply with all laws governing the export of intellectual property, including the Export Administration Regulations, 15 CFR 730, et seq.

VIII. Other Provisions

a. Processing by an AI System: To the extent that the Software and/or Services allow for County Data to be processed by an AI System, any Input Data that is entered into the AI System by County will be considered County Data, and County will have the same right to use and display any Output Data that has been generated in response to the Input Data entered into the AI System by the County. Consultant remains the owner of all Evolution Data, but only to the extent that it can establish that the Evolution Data does not contain any Personally Identifiable Information or County Confidential Information.

b. Accessibility Requirements under the Americans with Disabilities Act: If this contract includes information technology systems that are required by federal law to be “accessible,” consultant must sign an Americans with Disabilities Act (ADA) Accessibility Addendum. See Americans with Disabilities Act – Cook County Accessibility Requirements Exhibit, attached hereto and incorporated by this reference, which further describes Consultant’s accessibility obligations and must be submitted to the County to reflect compliance. Except as specifically set forth in Exhibit XXX, Consultant acknowledges the County is relying upon Contractor to ensure compliance with Title II of the Americans with Disabilities Act (ADA), its implementing regulations adopted by the federal government, and the accessibility standards set forth in the Web Content Accessibility Guidelines (WCAG) 2.1, level AA published by the World Wide Web Consortium (W3C).

c. Removal of Consultant Materials: Consultant is responsible, at its own expense, for de-installation and removal of any equipment, software, or hardware, owned, licensed, or leased by Consultant, and provided to the County, to facilitate the provision of Services under this Agreement, and that is not being transferred to the County under the Agreement.