1331L520Q13500018 SOW.pdf

DEPARTMENT OF COMMERCE ENTERPRISE SERVICES

PERFORMANCE WORK STATEMENT – DOC STAFF AUGMENTATION

1 | P a g e

PERFORMANCE WORK STATEMENT:

PRIVACY SHIELD

FOR

OFFICE OF DIGITAL SERVICES INDUSTRIES,

INTERNATIONAL TRADE ADMINISTRATION

2 | P a g e

1.0 Task Order Overview

This is a non-personal services task order. The Government will not exercise any supervision or control over the task order service providers performing the services herein. Such task order service providers shall be accountable solely to the Contractor who, in turn is responsible to the Government as defined in this Performance Work Statement (PWS). The Contractor shall perform to the standards in this task order.

2.0 Background

The EU-U.S. and Swiss-U.S. Privacy Shield Frameworks were designed by the U.S.

Department of Commerce and the European Commission and Swiss Administration respectively to provide companies on both sides of the Atlantic with a mechanism to comply with data protection requirements when transferring personal data from the European Union and Switzerland to the United States in support of transatlantic commerce.

U.S.-based organizations apply to the Privacy Shield program to be able to transfer personal data from the European Union or Switzerland. To join, the U.S.-based organizations must self-certify via Privacyshield.gov and publicly commit to comply with the Framework requirements. While joining the Privacy Shield is voluntary, once an eligible organization makes the public commitment to comply with the Framework requirements, the commitment will become enforceable under U.S. law.

Annually, the Privacy Shield Team within the International Trade Administration (ITA) of the U.S. Department of Commerce reviews the functioning and enforcement of the program with European and interagency partners. One aspect of that review is to report on companies falsely claiming Privacy Shield participation. The Privacy Shield team’s current ability to search and locate these ‘false claims’ organizations is limited to organizations with expired Privacy Shield certifications, and referrals from involved third party actors. The Privacy Shield team needs outside assistance to identify additional organizations asserting Privacy Shield compliance.

2.1 Objective

The objective of this project is to cost-effectively identify organizations who assert Privacy Shield participation in their online privacy statements or on their website, and who are not current participants in the Privacy Shield program.

3 | P a g e

3.0 Requirement

3.1 The Contractor shall provide all personnel, equipment, supplies, facilities, transportation, tools, materials, supervision, and other items and non-personal services necessary to perform this requirement.

3.2 The Contractor shall monitor performance in accordance with the approved Quality Control Plan (QCP). The Contractor shall develop and implement procedures to identify, prevent, and ensure non-recurrence of defective services. The Contractor’s QCP is the means by which they will ensure work complies with the requirements of the task order.

3.3 The Contractor shall at all times maintain an adequate workforce for the uninterrupted performance of all tasks defined within this PWS when the Government facility is not closed for the above reasons. When hiring personnel, the Contractor shall consider the stability and continuity of the workforce are essential.

3.4 The Contractor shall search the websites, terms of service, and privacy policies of not less than 5,000 unique organizations not currently on the Privacy Shield list (https://www.privacyshield.gov/list) (or previously provided in the last 12 months) for references or allusions to Privacy Shield compliance. The Contractor shall provide the full list of website URLs searched in a Microsoft Excel compatible spreadsheet.

Additionally, the Contractor shall provide and clearly identify all URLs that refer or allude to compliance with Privacy Shield in that spreadsheet. The spreadsheet will be provided to the Privacy Shield Team no more than 10 business days after the search concludes.

4.0 Place of Performance

Contractor support shall perform at its own location.

5.0 Period of Performance

The total period of performance with all options exercised is for five years from date of award.

Base Period: Complete analysis and deliver report once after date of award.

Option Period I: Run report 3 times (quarterly) for the remainder of the year.

Option Period II: Run report 4 times (quarterly) for the year.

Option Period III: Run report 4 times (quarterly) for the year.

Option Period IV: Run report 4 times (quarterly) for the year.

6.0 Hours of Operation

Under this task order, the Contractor is responsible for interacting with the Privacy Shield Team Monday thru Friday between 9 am and 5 pm (eastern time) except Federal holidays.

https://www.privacyshield.gov/list

4 | P a g e

7.0 Government Furnished Resources

7.1 The Government shall provide no non-public resources to the Contractor

8.0 Qualifications

The Contractor is responsible for and shall ensure staff are properly trained to provide the services requested in a manner that complies with all relevant Federal and State law, and applicable terms of service for the scanned URLs.

9.0 Identification of Contractor Employees

All Contractor personnel attending meetings, answering Government telephones, and working in other situations where their Contractor status is not obvious to third parties are required to identify themselves as such to avoid creating an impression in the minds of members of the public that they are Government officials. They must also ensure that all documents or reports produced by Contractors are suitably marked as Contractor products or that Contractor participation is appropriately disclosed.

10.0 Travel

Travel ☐ is ☒ is not required under this task order.

If required, the Contractor shall travel as approved by the designated TM or COR during the performance of this task order to attend meetings, conferences or conduct other official business covered under this task order. Authorized travel is reimbursable in accordance with the contract. The Contractor shall ensure adequate funding is available for costs of travel prior to incurring costs.

Local travel to meetings, conferences or other official business covered under this task order is not reimbursable as a direct charge.

11.0 Conflicts of Interest

Contractor and subcontract personnel performing work under this task order may receive, have access to, or participate in the development of proprietary or source selection information (e.g., cost or pricing information, budget information or analyses, specifications or work statements, etc.), or perform evaluation services which may create a current or subsequent Organizational Conflict of Interests (OCI) as defined in FAR Subpart 9.5. The Contractor shall notify the CO immediately whenever he/she becomes aware that such access or participation may result in any actual or potential OCI and may merit the submittal of a plan to the CO to avoid or mitigate any such OCI.

This mitigation plan would be determined to be acceptable solely at the discretion of the CO. In the event the CO unilaterally determines that any such OCI cannot be satisfactorily avoided or mitigated, the Contracting Officer may employ other remedies

5 | P a g e as he or she deems necessary, including prohibiting the Contractor from participation in subsequent contracted requirements which may be affected by the OCI.

12.0 Data Rights

The Government has unlimited rights to all documents/material produced under this task order. All documents and materials, to include the source code of any software produced under this contract, shall be Government owned and the property of the Government with all rights and privileges of ownership/copyright belonging exclusively to the Government. These documents and materials may not be used or sold by the Contractor without written permission from the CO. All materials supplied to the Government shall be the sole property of the Government and may not be used for any other purpose. This right does not abrogate any other Government rights.

13.0 Applicable Publications (Current Editions)

☒ No publications are applicable for this task order.

☐ The following list of publications is applicable to this task order:

14.0 Reports and Deliverables

14.1 The Contractor shall attend progress meetings requested by the contracting activity or task order administration. The Contracting Officer, Contracting Officer’s Representative (COR), and other Government personnel, as appropriate, may meet periodically with the Contractor to review the Contractor's performance. At these meetings the CO will apprise the Contractor of how the government views the Contractor's performance and the Contractor will apprise the Government of problems, if any, being experienced. Appropriate action shall be taken to resolve outstanding issues. These meetings shall be at no additional cost to the government.

15.0 Attachment/Key Deliverables

15.1 Attachment 1/ Key Deliverables 1 - Performance Requirements Summary

Key Deliverables

Performance Requirements Summary relate directly to mission essential items. The performance threshold briefly describes the minimum acceptable levels of service required for each requirement. These thresholds are critical to mission success.

6 | P a g e

Performance Objective (The Service required— usually a shall statement)

Performance Standard Performance Threshold (This is the maximum error rate. It could possibly be “Zero deviation from standard”)

Method of Surveillance

PRS # 1.

The Contractor shall search the websites of U.S. companies and ensure, terms of service, and privacy policies of not less than 5,000 unique organizations not currently on the Privacy Shield list (https://www.privacyshield .gov/list) (or previously provided in the last 12 months) for references or allusions to Privacy Shield compliance.

The Contractor is to provide an excel spreadsheet of no less than 5,000 companies and their URL’s

Delivered information (spreadsheets) will be investigated by the PS Team of companies making PS claims, and comparison to prior lists to ensure this includes 5,000 unique companies.

PRS # 2

The Contractor shall provide the full list of website URLs searched in a Microsoft Excel compatible spreadsheet.

Upon approval of URLs, a scan of the homepages to find links which may correspond to privacy policies and terms of service documents will be carried out. Among those URL’s that are identified, further searches will be carried out to determine false claims.

May vary depending on method of third party selected.

PRS # 3

The Contractor shall provide and clearly identify all URLs that refer or allude to compliance with Privacy Shield in that spreadsheet.

The spreadsheet will be provided to the Privacy Shield Team no more than 10 business days after the search concludes.

Information will be reviewed and monitored by a Privacy Shield Team Member.

7 | P a g e

15.2 Attachment 2/ Key Deliverables 2 - Deliverables Schedule

Key Deliverables 2

DELIVERABLES SCHEDULE

This technical exhibit lists any reports or documentation that is required as a deliverable to include the frequency, # of copies, medium/format and who/where it is to be submitted. A deliverable is anything that can be physically delivered but may include non-physical things such as meeting minutes.

Deliverable Frequency # of Copies Medium/Format Submit To Progress Report (14.2)

Quarterly

N/A – Discussion with third party on progress and next steps.

Information must be sent digitally via compatible Excel Spreadsheets

Designated member of PS team