2-824-25-26 APPENDIX D - PUPIL RECORDS RIDER.pdf

Elk Grove Unified School District RFQ/P #824-25/26 Appendix D – Pupil Records Rider for Digital Records Storage Page 1 of 5

ELK GROVE UNIFIED SCHOOL DISTRICT

RFQ/P #824-25/26 INTERSESSION SUMMER EDUCATION

APPENDIX D

PUPIL RECORDS RIDER FOR DIGITAL RECORDS STORAGE AND/OR

DIGITAL EDUCATIONAL SOFTWARE CONTRACTS

Elk Grove Unified School District (“District”) and ________________________ (“Contractor”) have entered into that certain ____________________________ (collectively, the “Contract”) as of ____________. The Contract includes the digital storage, management, and retrieval of pupil records and/or digital educational software through which the Contractor accesses, stores, and uses pupil records. This Pupil Records Rider (“Rider”), executed by the District and Contractor as of _________________, is intended to supplement the terms of the Contract, as set forth below.

This Rider concerns pupil records, as that term is defined by Education Code section 49073.1 (“Pupil Records”) and/or covered information, which means personally identifiable information or materials as defined by Business and Professions Code section 22584 (“Covered Information”).

District and Contractor agree that District is subject to the requirements of Education Code section 49073.1, and a contract that is not compliant with Education Code section 49073.1 may be voided if not brought into compliance with the terms of that statute, in addition to any other penalties provided by law.

1. Pupil Records Property of District. All Pupil Records are and will continue to be the property of and under the control of the District. The parties agree that, as between them, all rights, including all intellectual property rights in and to Pupil Records, shall remain the exclusive property of the District, and Contractor has a limited, nonexclusive license to such Pupil Records.

The Contract and Rider do not give the Contractor any rights, implied or otherwise, to Pupil Records, District content, or intellectual property, except as expressly stated in the Contract and this Rider.

2. Pupil-Generated Content. Notwithstanding the provisions of section 1, pupils shall retain ownership and control of pupil-generated content, if any (as that term is defined by Education Code section 49073.1(d)(4)). The contractor shall make all pupil-generated content, if any, available to the pupil who created it and provide a process by which a pupil can transfer his or her pupil-generated content to a personal account. Within thirty (30) days of the execution of this Rider, the Contractor shall provide the District with a written description of the process it will provide to pupils in compliance with this section.

3. Use of Information in Pupil Records. The contractor may not and will not use any Pupil Record or information in a Pupil Record for any purpose other than those required or specifically permitted by the Contract and this Rider.

Appendix D – Pupil Records Rider for Digital Records Storage Page 2 of 5

4. Personally Identifiable Information. The contractor shall provide a process by which a pupil’s parent, legal guardian, or the eligible pupil can review personally identifiable information in the pupil’s records and correct erroneous information. Within thirty (30) days of the execution of this Rider, the Contractor shall provide the District with a written description of the process it will provide to pupils and their parents/legal guardians in compliance with this section 4.

5. Security and Confidentiality of Pupil Records. The contractor will access, store, and use Pupil Records in accordance with commercial best practices, including appropriate administrative, physical, and technical safeguards, to secure such data from unauthorized access, disclosure, alteration, and use. Such measures will be no less protective than those used to secure the Contractor’s own data of a similar type. Without limiting the foregoing, Contractor warrants that all Pupil Records will be encrypted in transmission via web interface using SSL (Secure Socket Layer) (including via web interface) and stored at no less than 128-bit level encryption.

In addition, the Contractor will use industry standards and up-to-date security tools and technologies, such as anti-virus protections and intrusion detection methods, in providing services under the Contract and/or this Rider.

The contractor will designate employees or agents it holds and will hold primarily responsible for meeting the Contractor’s duties to securely maintain and protect Pupil Records. The contractor will ensure that the designated persons have or will receive all training and information necessary to meet the Contractor’s duties to securely protect and maintain Pupil Records. The designation of employees or agents required under this section does not relieve the Contractor of any of its duties under the law or the Contract and/or this Rider, nor relieve the Contractor of any liability for any breach thereof.

6. Unauthorized Disclosure. Immediately upon becoming aware of an unauthorized disclosure of Pupil Records or of circumstances that could have resulted in unauthorized access to or disclosure or use of Pupil Records, Contractor will notify the District, fully investigate the incident, and cooperate fully with the District’s investigation of and response to the incident.

Except as otherwise required by law, the Contractor will not provide notice of the incident directly to parents, legal guardians, or pupils whose personally identifiable information was involved, to regulatory agencies, or to other entities, without prior written permission from the District. The district may, by written request, direct the Contractor to provide notice of the incident directly to parents, legal guardians, or pupils whose personally identifiable information was involved or to regulatory agencies or other entities.

Appendix D – Pupil Records Rider for Digital Records Storage Page 3 of 5

7. Retention of Pupil Records. The Contractor hereby certifies that Pupil Records shall not be retained or available to the Contractor, including any subcontractors, partners, or associated entities of the Contractor, upon completion of the terms of the Contractor and this Rider.

Notwithstanding the foregoing, Contractor may maintain pupil-generated content (as that term is defined by Education Code section 49073.1(d)(4)), if any, upon completion of the term of the Contract and this Rider if, and only if, the parent, legal guardian, or eligible pupil chooses to establish or maintain an account with the Contractor for the purpose of storing the pupil-generated content and the Contractor receives the written permission of a pupil’s parent or legal guardian to establish or maintain the pupil’s account.

In furtherance of the foregoing, upon termination or expiration of the Contract and this Rider, the Contractor will ensure that all Pupil Records are securely returned or destroyed as directed by the District. Transfer to the District or a third party designated by the District shall occur within a reasonable period of time and without significant interruption in service. The contractor shall ensure that such transfer/migration uses facilities and methods that are compatible with the relevant systems of the District or its transferee, and to the extent technologically feasible, that the District will have reasonable access to Pupil Records during the transition. In the event that the District requests destruction of any Pupil Records, the Contractor agrees to securely destroy all Pupil Records in its possession and in the possession of any subcontractors or agents to which the Contractor might have transferred Pupil Records. The Contractor agrees to provide documentation of data destruction to the District.

8. Federal Educational Rights and Privacy Act. Contractor agrees to assist District in maintaining the privacy of Pupil Records as may be required by State and Federal law, including but not limited to the Protection of Pupil Rights Amendment (PRRA), the Children’s Online Privacy Protection Act (COPPA), the Family Educational Rights and Privacy Act (FERPA), and the Student Online Personal Information Protection Act (SOPIPA).

The contractor will provide access to Pupil Records, including deidentified information, only to its employees and subcontractors who need to access the data to fulfill Contractor obligations under the Contract and/or this Rider. The contractor will ensure that employees and subcontractors who perform work under the Contract and/or this Rider have read, understood, and received appropriate instruction as to how to comply with the data protection provisions of this Rider. Contractor will use the education records only for the purpose of fulfilling its duties under the Contract and/or this Rider for the District’s and its pupils’ benefit and will not share such data with or disclose it to any third party except as provided for in this Rider, required by law, or authorized in writing by the District.

Appendix D – Pupil Records Rider for Digital Records Storage Page 4 of 5

If Contractor will have access to “education records” for the District’s students as defined under FERPA, Contractor acknowledges that, for the purposes of the Contract and/or this Rider, it will be designated as a “school official” with “legitimate educational interests” in the District education records, as those terms have been defined under FERPA and its implementing regulations, and the Contractor agrees to abide by the FERPA limitations and requirements imposed on school officials. Contractor will use the education records only for the purpose of fulfilling its duties under the Contract and/or this Rider for the District’s and its pupils’ benefit, and will not share such data with or disclose it to any third party except as provided for in this Rider, required by law, or authorized in writing by the District.

9. No Targeted Advertising. The contractor will not use Pupil Records for advertising or marketing purposes unless such use is specifically authorized by this Contract or otherwise authorized in writing by the District. The contractor will not use Pupil Records to engage in targeted advertising. The contractor is prohibited from mining Pupil Records for any purposes other than those agreed to by the parties.

10. Covered Information. To the extent Contractor is an operator of an Internet website, online service, online application, or mobile application, with actual knowledge that the site, service, or application is used primarily for K-12 school purposes and was designed and marketed for K-12 school purposes, Contractor agrees to comply with all of the requirements of Business and Professions Code section 22584. The contractor agrees not to engage in targeted advertising as described in section 22584. The contractor agrees not to use information, including persistent unique identifiers, created or gathered by the Contractor’s site, service, or application, to amass a profile about a student except in furtherance of the District’s purposes. The contractor further agrees that it will not sell, disclose, or otherwise use Covered Information without the prior written consent of the District. The contractor will implement and maintain reasonable security procedures to protect Covered Information and fulfill all other requirements of Business and Professions Code section 22584.

11. Compliance with Law. In the event of a conflict between this Rider and the Contract, the terms of this Rider shall govern. This Rider is intended to comply with Education Code section

49073.1 and Business and Professions Code section 22584. In addition to any other penalties, if the Contract and this Rider, taken together, fail to comply with Education Code section 49073.1 and Business and Professions Code section 22584, the Contract shall be rendered void if, upon notice and a reasonable opportunity to cure, the noncompliant party fails to come into compliance and cure any defect. Written notice of noncompliance may be provided by any party to the Contract. All parties subject to a Contract voided in accordance with this paragraph and Education Code section 49073.1 or Business and Professions Code section 22584 shall return all Pupil Records and Covered Information in their possession to the District. The term of this Rider is coextensive with the term of the Contract.

Appendix D – Pupil Records Rider for Digital Records Storage Page 5 of 5

IN WITNESS WHEREOF, the parties have, by their duly authorized representatives, executed this Rider, as of the day and year first above written.

ELK GROVE UNIFIED SCHOOL DISTRICT _________________________________

Signature Signature

Printed Name Printed Name

Title Title

Date Date