2-FCS Data Sharing Agreement.pdf

PPAB 11549527v1

FULTON COUNTY SCHOOL SYSTEM

DATA SHARING AGREEMENT

This Data Sharing Agreement (“DSA” or “Agreement”) is between the Fulton County School

System (“FCS” or “District”) and _________________ (insert full Legal Entity Name)

(“Organization”). Collectively, FCS and Organization will be referred to as “the Parties.” The DSA governs the sharing of FCS Data with Company and shall supplement any other Agreement between FCS and Company. In case of an inconsistency between the terms of the DSA and any other terms and conditions between the Parties, the terms of the DSA shall control. This Agreement is effective as of the date of signing by Organization (“Effective Date”).

Section 1. Data Sharing and Definitions

1.1 Scope and Purpose. FCS agrees to share the FCS Data listed in Exhibit A, which may be updated by the Parties from time to time with mutual consent, with Company for the purposes described in Exhibit A.

1.2 Data Collection. Data will be provided within a reasonable time upon request in a manner deemed appropriate by FCS as outlined in Appendix II.

1.3 FCS Student Data. FCS Student Data includes any data, whether gathered by

Organization or provided by FCS or its users, employees, students, or students’ parents/guardians, that is descriptive of the student including, but not limited to, information in the student’s educational record, first and last name, home address, telephone number, email address, or other information allowing online contact, gender, student race/ethnicity, language preferences, birth date, parent contact information, student grade level, school ID, school name, teacher name, teacher ID, course ID, section ID, course name, discipline records, videos, test results, special education data, Section 504 information, English Language Learner information, homeless or foster care information, juvenile dependency records, grades, evaluations, criminal records, medical records, health records, social security numbers, biometric information, disabilities, socioeconomic information, food purchases, political affiliations, religious information, text messages, documents, search activity, photos, voice recordings, or geolocation information. FCS

Student Data also includes content generated by the student through use of Organization’s products and/or services.

1.4 Personally Identifiable Information (PII). PII is any FCS Student Data that contains identifiers (such as student name, student ID number, social security number) that, alone or in combination, is linked or linkable to a specific student that would allow the student to be identified with reasonable certainty. In order to receive PII from FCS, Organization must either obtain written consent from the parent, guardian, or eligible student or qualify under a recognized exception pursuant to the Family Educational Rights and Privacy Act

(“FERPA”), 20 U.S.C § 1232g.

1.5 FCS Employee Data. FCS Employee Data includes any data, whether gathered by

Contractor or provided by FCS or its users or employees, that is descriptive of the employee including, but not limited to, employee first and last name, gender, birth date, home

PPAB 11549527v1 2 address, telephone number, email address, race/ethnicity, social security number, driver license number and information, evaluations, medical records, medical information, insurance information, disabilities, financial information, credit card information, debit card information, bank account information, mother’s birth name, worker’s compensation information, and the identity of the employee’s immediate family members or dependents.

1.6 De-identified Data. De-identified data is data that has been anonymized to remove or obscure any personally identifiable information in a way that makes re-identification of that data impossible. De-identification should ensure that any information when put together cannot indirectly identify the student or employee, not only from the viewpoint of the public, but also from the vantage of those who are familiar with the individual.

1.7 FCS Data. FCS Data includes FCS Student Data, PII, FCS Employee Data, and any other data provided by FCS to Organization under this Agreement. FCS Data does not include de-identified data.

Section 2. Use of FCS Data

2.1 Authorized Use. Organization may only collect, gather, use, and maintain FCS Data for the purposes authorized by Subsection 1.1 and Exhibit A of this Agreement and as permitted by applicable state and federal law. De-identified information, as defined in

Subsection 1.6 may be used by Organization for the purposes of development, research, and improvement of educational sites, services, or applications, or any other permitted use of de-identified data under applicable state and federal law.

2.2 Maintaining Student and Employee Privacy. All results of any Organization data analysis will be reported in aggregate, and no individual student or employee will ever be identified or identifiable in formal reporting or publications.

2.3 Publication Advance Notice. Organization shall furnish FCS with copies of any proposed publication or presentation incorporating FCS Data in advance. Organization shall not publish or present FCS Data or information identifying FCS without FCS's prior written approval.

2.4 Data Reporting. Organization will report any data analysis outcomes to FCS on a regular basis for the purposes of determining program effectiveness.

2.5 Ownership of Data. All FCS Data transmitted to Organization is and will continue to be the property of and under the control of FCS, or the property of the party who provided the data (such as the student or the student’s parent/guardian, or employee). The Parties agree that as between them, all rights, including intellectual property rights, in and to

FCS Data shall remain the exclusive property of FCS.

2.6 Requesting Data. All requests for FCS Data shall be in writing and shall specify the data elements requested. To prevent FCS from receiving several requests in a month, the

Organization shall limit its requests to only one time during an academic semester (twice during the academic year).

PPAB 11549527v1 3

2.7 Third Party Request. Should a third party, including, but not limited to law enforcement and government entities, contact Organization with a request for data held by

Organization pursuant to this Agreement, Organization shall redirect the third party to request the data directly from FCS and shall cooperate with FCS to collect the required information. Organization shall notify FCS in advance of a compelled disclosure to a third party, unless legally prohibited.

2.8 Data Location. Organization shall not store or transfer FCS Data outside of the United

States. This includes back-up data and disaster recovery locations. Remote access to FCS

Data from outside the continental United States is prohibited unless approved in advance in writing by FCS.

2.9 Disposition of FCS Data. Organization shall destroy, dispose of, and/or delete all FCS

Data, including, but not limited to, FCS Data transmitted to Organization under this

Agreement within forty-five (45) days after the termination of this Agreement or after it ceases to provide services to FCS (unless required to dispose of earlier under Subsection

3.3 Research and Studies). Organization shall destroy FCS Data in accordance with acceptable industry standards for secure and comprehensive destruction of sensitive data.

No later than fifty (50) days after termination of the Agreement, Organization shall provide FCS written confirmation that all FCS Data has been securely destroyed.

Section 3. Legal Compliance

3.1 Federal and State Law. Organization shall comply and shall assist FCS in compliance, in all material respects, with federal and state laws and regulations regarding privacy of information and confidentiality of student and employee data, including, without limitation, FERPA, the Protection of Pupil Rights Amendment (“PPRA”), 20

U.S.C. § 1232h, the Children's Online Privacy Protection Act (“COPPA”), 15 U.S.C. §

6501, and the Georgia Student Data Privacy, Accessibility, and Transparency Act

(O.C.G.A. §§ 20-2-660 et seq.) (“SDA”).

3.2 School Official. To the extent Organization has a legitimate educational interest in student educational records and information and must access such records and information in order to provide services to or on behalf of FCS and its employees, agents, teachers, and students, FCS designates Organization a “school official” pursuant to FERPA. Organization will be under the direct control of FCS with respect to the use and maintenance of PII and FCS Student Data. Organization shall use PII and

FCS Student Data only for the purpose of performing its obligations under the Agreement and as authorized by all applicable state and federal laws. Organization may, but is not required to, obtain consent from the parent, guardian, or eligible student to authorize the release of PII and FCS Student Data from FCS to Organization. Organization is required to obtain consent from the parent, guardian, eligible student, or FCS to authorize

Organization’s release of PII beyond what is permitted by this Agreement and applicable state and federal law.

3.3 Research and Studies. To the extent that Organization is performing research or studies for or on behalf of FCS for the purposes of improving instruction, FCS will share PII and

FCS Student Data with Organization pursuant to FERPA and this Agreement.

Organization can only share PII and FCS Student Data with Organization’s employees or

PPAB 11549527v1 4 subcontractors with a legitimate pedagogical interest in performing the research or conducting the studies as described in this Agreement. Organization must destroy all PII and FCS Student Data shared when the research or study is completed. Organization may, but is not required to, obtain consent from the parent, guardian, or eligible student to authorize the release of PII and FCS Student Data from FCS to Organization.

3.4 Consent. If Organization does not qualify for an applicable exception under FERPA, Organization must obtain appropriate consent from the parent, guardian, or eligible student prior to requesting and receiving PII from FCS. Organization will provide and use a release form for parents, guardians, and eligible students that will, at a minimum, specify the purpose for collecting the data, who the data will be shared with, and specifically permit FCS to release the PII listed in Section 1.2. The release form must be approved by FCS prior to its use.

3.5 Disclosure Prohibited. Notwithstanding any other term of this Agreement, Organization will not disclose FCS Data to any third party except as permitted by FCS and 34 C.F.R.

99.33(a). Organization shall limit access to FCS Data to only those representatives of

Organization with legitimate interests to carry out the Agreement. Organization will provide

FCS with access to FCS Data maintained by Organization with ten business days’ notice to Organization at no charge to FCS.

3.6 SDA Compliance. Organization shall comply with the SDA to the extent Organization is an “operator” as defined by the SDA. Specifically, Organization shall not: (1) use student data to engage in behaviorally targeted advertising based on any student data and state-assigned student identifiers or other persistent unique identifiers that

Organization has acquired because of a student’s use of Organization’s website, service, or application; (2) use information created or gathered by Organization's website, service, or application to amass a profile about a student except in furtherance of K-12 school purposes; (3) sell a student’s data except as authorized by O.C.G.A. § 20-2-666;

or, (4) disclose student personally identifiable data without explicit written or electronic consent from the student over the age of 13 or a student’s parent or guardian, given in response to clear and conspicuous notice of the activity, unless disclosure is made for a purpose authorized under O.C.G.A. § 20-2-666.

3.7 Audit Rights. FCS may audit the records and systems of Organization to ensure compliance with the terms of this Agreement. FCS will notify Organization in writing at least ten business days prior to any such audit. Any such audit will be conducted during

Organization’s regular business hours at Organization’s location and will not interfere unreasonably with Organization’s business activities. If an audit reveals that Organization is using FCS Data beyond the scope of the Agreement, then, in addition to any other remedies available to FCS, Organization shall reimburse FCS for the cost of such audit.

Upon request by FCS, Organization will provide a copy of its most recent Statement on

Standards for Attestation Engagements (SSAE) No. 18 audit, SOC2 audit report, or equivalent audit of any data center in which FCS Data is stored.

Section 4. Data Security

4.1 Privacy, Confidentiality, and Security. Organization understands and agrees that it is imperative to protect FCS Data in order to protect public resources and to prevent identity

PPAB 11549527v1 5 theft or other malicious and damaging acts. Organization shall meet all applicable industry standards concerning data privacy, data protection, confidentiality, and data security. Organization agrees to take appropriate administrative, technical, and physical safeguards reasonably designed to protect the security, privacy, confidentiality, and integrity of FCS Data. Organization agrees to maintain security protocols and practices that, at a minimum, are designed to protect FCS Data from unauthorized access, destruction, use, modification, or disclosure; meet industry standards for protection during the transfer or transmission of any FCS Data; and ensure that all FCS Data obtained or generated pursuant to this Agreement are kept in a secure computer environment. Organization agrees that, as a minimum, it will comply with the requirements of Appendix 1, Technical and Organizational Security Measures.

4.2 Security Incident. A Security Incident means any incident, including a breach of data security, leading to the accidental or unlawful destruction, loss, alteration, damaging, or unauthorized disclosure or acquisition of, or access to FCS Data that Organization maintains, uses, stores, or otherwise processes in the course of providing the products or services under this Agreement, and any other event which would have to be notified to a data privacy authority and/or individuals under applicable state or federal law. For the avoidance of doubt, “Security Incident” does not include unsuccessful attempts or activities that do not compromise the security of FCS Data, including unsuccessful login attempts, pings, port scans, denial of service attacks, and other network attacks on firewalls or networked systems.

4.3 Notice of Security Incident. Organization shall give prompt written notice to FCS without unreasonable delay, but no later than ten (10) days after the determination that a

Security Incident that may or does impact FCS Data has occurred, or of any unauthorized use, release, or disclosure of FCS Data. Organization shall assist FCS in remedying each unauthorized use or disclosure at Organization's expense. Such notice shall include, at a minimum, the following information: 1) A list of the types of FCS Data that were or are reasonably believed to have been the subject of the Security Incident; 2) the date or estimated date of the Security Incident, if known; 3) whether law enforcement has been engaged; 4) a description of the Security Incident; 5) information on the current state or containment of the Security Incident; 6) the name and contact information for an employee of the Organization who shall serve as the Organization’s primary security contact with FCS. Giving assistance does not waive any breach of this Agreement by

Organization, nor does acceptance of the assistance constitute a waiver of any breach of this Agreement. Organization agrees to comply with the terms of this provision regardless of whether the unauthorized use, release, or disclosure of FCS Data is the result of or constitutes a material breach of this Agreement.

4.4 Costs of Security Incident. Organization shall reimburse and indemnify FCS for all costs imposed on FCS or reasonably undertaken by FCS at its discretion associated with a

Security Incident, including but not limited to reimbursement of costs associated with notifying individuals whose information was compromised and notifying required regulatory agencies; fees paid to provide credit monitoring to impacted individuals; legal fees, audit costs, fines, and any other fees or damages reasonably undertaken by or imposed against the FCS as a result of the Security Incident; and any other notifications, PPAB 11549527v1 6 legally mandated responses, or responses reasonably undertaken by FCS in response to the Security Incident.

Section 5. Miscellaneous

5.1 Agreement Breach. Organization acknowledges and agrees that an award of money damages is inadequate for any breach of this Agreement by Organization, or any of its respective agents, representatives, administrators, employees, officers, directors, attorneys, successors and assigns; and that any breach causes FCS irreparable harm.

Therefore, in the event of any breach or threatened breach of this Agreement by

Organization or any of its representatives, FCS is entitled to equitable relief, including injunctive relief and specific performance, without proof of actual damages and without the posting of a bond.

5.2 Indemnification. Organization agrees to indemnify and defend FCS against and hold

FCS harmless from any liability, loss, damage, cost or expense (including attorney fees) based upon any claim, demand, suit or action by any person or entity with respect to any personal injury (including death) or property damages, from any cause whatsoever related to implementation of this Agreement, to the fullest extent permitted by law. Organization shall indemnify and hold FCS, the Fulton Board of Education, and its current, future, and past board members, employees, agents, volunteers, and contractors harmless from any and all claims, suits, actions, damages, liability and expenses including attorney fees in connection with claims, demands, or lawsuits that arise with respect to services rendered by Organization under this Agreement. Organization's obligation shall not be limited by, or in any way to, any insurance coverage or by any provision in or exclusion of omission from any policy of insurance.

5.3 Insurance. The following is the minimum insurance and limits that the Organization must maintain. If the Organization maintains higher limits than the minimums shown below, FCS requires and shall be entitled to the coverage and for the higher limits maintained by the Organization. Any available insurance proceeds in excess of the specified minimum limits of insurance and coverage shall be available to FCS.

Organization shall maintain the following minimum insurance limits during the term of the Agreement: (a) $1 million Commercial General Liability; (b) $1 million Cyber

Liability; and (c) $1 million Professional Liability or Errors and Omissions coverage.

5.4 Term. The Term of this Agreement is from __________ to ____________. The Parties may agree to renew the Agreement for additional one-year terms. If any changes to the data collected by Organization or its use of that data will occur during a renewal term, the

Parties should amend this Agreement to include the details of those changes.

5.5 Termination. Either Party may terminate this Agreement with ten (10) days’ notice to the other Party. The following sections shall survive termination: 2.1, 2.5, 3.1, 4.2, 4.3, 4.4, 5.1, 5.2, 5.8.

5.6 Amendment. FCS and the Organization may amend this Agreement by mutual consent, in writing, at any time through each party’s authorized representative.

PPAB 11549527v1 7

5.7 Signatures. By the signatures of their duly authorized representatives below, FCS and the Organization intend to be legally bound and agree to all of the provisions of this

Agreement.

5.8 Choice of Law and Venue. This Agreement shall be governed by the laws of the State of

Georgia, and all disputes arising under this Agreement or in connection to this Agreement will be submitted to the exclusive jurisdiction of the Courts of Fulton County, Georgia.

IN WITNESS WHEREOF, the Parties through their duly authorized representatives signing below, executed and agree to be legally bound by the terms, conditions, and provisions of this Agreement.

“Organization” “FCS”

FULTON COUNTY

SCHOOLS

Address:

By:__________________________ By:_________________________

Name:________________________ Date:_______________________

Title:_________________________

Date:_________________________

PPAB 11549527v1 8

Appendix I

Technical and Organizational Security Measures

This Appendix details the minimum Technical and Organizational security measures which

Organization must implement to ensure the security of FCS Data.

1. Authentication and Access Control. Organization must have a documented process in place for granting and revoking access to all systems that process or store FCS Data using adequate security measures that are consistent with industry standards and technology best practices.

2. Encryption. All FCS Data transmitted by Organization and/or its subcontractors, processors, and sub-processors will be protected with a transmission encryption solution that complies, as appropriate, with NIST Special Publications 800-77, Guide to IPsec VPNs; or 800-

113, Guide to SSL VPNs, or others that are Federal Information Processing Standards (“FIPS”)

140-2 validated. All FCS Data stored by Organization shall be protected with a data-at-rest encryption product utilizing a validated FIPS 140-2 Cryptographic Module with a 128-bit key or higher, whatever the industry standards for encryption are at that time, if better.

3. System Security and Vulnerability Management. Organization must:

a. Have a documented patch management and distribution process that ensures security patches are applied to all systems (to include servers, workstations, laptops) that process and/or store FCS Data;

b. Employ network security architectural components (to include, at a minimum, firewalls and network intrusion detection/prevention solutions) to adequately protect all systems processing or storing FCS Data that are accessible from the

Internet or other public network;

c. Employ an anti-virus solution with real-time protection and automatic updates on all systems that store or process FCS Data; and

d. Engage in regular vulnerability assessments and focused penetration testing on all

Organization computers and network devices. Implement a documented regular testing schedule and procedures for any necessary remediation.

4. Physical Security. Organization must employ physical safeguards and visitor access controls to prevent unauthorized access to all systems and media used to process or store FCS

Data.

5. Audit Trail. All systems that process or store FCS Data must maintain an electronic audit trail that documents system security events. Organization must ensure that users receive regular security awareness training.

6. Disaster Recovery Process. Organization must maintain a disaster recovery process.

7. Personnel Training. Organization must implement a security awareness program to train personnel about their security obligations. This program includes training about data

PPAB 11549527v1 9 classification obligations; physical security controls; security practices and security incident reporting.

8. Incident Response. Organization must have in place a cyber security incident response plan to ensure a timely, effective, and orderly response to information security incidents.

9. Organization Oversight. Organization shall implement, test, and continually monitor the administrative, physical, and technical controls necessary to protect FCS Data. Organization shall complete periodic security assessments to ensure compliance with FCS data security requirements.

10. Contractor Compliance. Organization shall periodically conduct or review compliance monitoring and assessments of Organization’s contractors, subcontractors, processors, and/or subprocessors to determine their compliance with the privacy, use, and security requirements of this Agreement.

Appendix II

Data Transmission Procedures

1. Transmission of FCS Data. Organization may send and receive FCS Data by a secure file transfer protocol (SFTP) connection or a secure internet site transfer using an HTTPS web address. FCS will not provide data to Organization through spreadsheets sent by email. All FCS

Data transmitted by Organization and/or its contractors, subcontractors, processors, and subprocessors will be protected with a transmission encryption solution that complies, as appropriate, with NIST Special Publications 800-77, Guide to IPsec VPNs; or 800-113, Guide to

SSL VPNs, or others that are Federal Information Processing Standards (FIPS) 140-2 validated.

2. FCS Procedures. The FCS SFTP server will only be used to facilitate the dropping off (PUT) and/or picking up (GET) of information by the Organization. FCS will neither perform data delivery (PUT), nor retrieval (GET) functions on the SFTP server of the Organization.

PPAB 11549527v1 10

Exhibit A

Proposed Use of FCS Data Requested

(list types of data requested, whether it includes identifiers, and use of that data)