4-FERPA Agreement.pdf

GCPS FERPA AGREEMENT

This FERPA Agreement ("Agreement") attached hereto and incorporated into the [XXX Agreement] dated [month date, 20XX] (the “Agreement”) between _________ (the “Contractor”) and Gwinnett County Public Schools ("Customer" or "GCPS") (collectively, the "Parties"), and all subsequent purchase orders, service change requests, amendments and other agreements between the Parties.

The Contractor hereby agrees that it will comply with the Family Educational Rights and Privacy Act (FERPA, 20

U.S.C. 1232g), the federal regulations implementing FERPA (34 CFR § 99) and the Student Data Privacy, Accessibility, and Transparency Act (O.C.G.A. § 20-2-660 through O.C.G.A. § 20-2-668) in its handling of all educational records, student data, personally identifiable information (including, but not limited to, student names, the names of students' parent(s) or family members, the address of the student or the student's family, personal identifiers (social security numbers, student identification numbers, biometric records), date of birth, place of birth, mother's maiden name, medical information, and any other information regarded as private by state or federal law) as defined under the statutes above and provided to the Contractor by the District, District staff and/or agents, students, parents, guardians or individuals acting on behalf of any parent or student, or any combinations thereof, or any information derived therefrom. (“Transferred Data”). The Contractor shall at all times maintain the confidentiality of Transferred Data in accordance with this Addendum.

The Contractor is being provided with the Transferred Data for the purpose of providing [description of service] (the

“Service”). The Service is being provided as [an audit an evaluation service, a research study, a school function performed by Contractor as an agent of GCPS acting as a “School Official” for FERPA purposes, or {another reason}. (choose one or more)] [Include further description of service if necessary to clarify Contractor’s role/relationship with the district]

The Contractor's obligations shall include, but not be limited to, the following:

(1) The Contractor shall not impose any rights, duties, obligations, or terms inconsistent with those included in the Agreement, this addendum, or any other addenda through any process including but not limited to account creation or registration processes. To the extent that GCPS employees, agents, contractors, students, or students’ parents or guardians are required to agree to additional or different terms as part of the use or provision of the Service, those terms are expressly superseded by the terms contained in the Agreement and incorporated Addenda.

(2) The Contractor agrees not to disclose any Transferred Data concerning a student to any person, or entity other than the District, without the prior written consent of the parent or eligible student whose record is to be disclosed. The written consent must (a) specify the records that may be disclosed; (b) state the purpose of the disclosure; (c) identify the party or class of parties to whom the disclosure may be made; and (d) be signed and dated by the parent, guardian or the eligible student. Notwithstanding the foregoing, the Contractor may disclose personally identifiable information concerning a student where such disclosure is necessary to comply with a judicial order or lawfully issued subpoena. Prior to disclosing personally identifiable information concerning a student in compliance with a judicial order or lawfully issued subpoena, the Contractor must notify the District and make reasonable efforts to notify the parent(s) of the student(s) whose records are to be disclosed.

(3) The Contractor will only use Transferred Data contained in the records provided to the Contractor for the purpose of fulfilling its obligations under this Agreement.

(4) The Contractor agrees not to use Transferred Data to engage in any commercial activity including but not limited to, targeted advertising directed at students or their parents.

(5) The Contractor agrees not to sell or market any Transferred Data concerning a student without express parental consent.

(6) The Contractor agrees not to track the online behavior of any user of the Service under the age of 13.

(7) The Contractor agrees that GCPS has exclusive authority to determine user permissions, including who

GCPS FERPA AGREEMENT

specifically, and what type of users generally, can access, edit, process, download, or otherwise manipulate any Transferred Data stored or otherwise accessible on, in, or from the Contractor’s servers, databases, computers, or other information systems.

(8) The Contractor agrees to make available means for parents to access and challenge the accuracy of Transferred Data in accordance with FERPA.

(9) The Contractor agrees to use commercially reasonable methods to limit access to Transferred Data provided to the Contractor to those officers, employees, and agents of the Contractor who have a legitimate interest in accessing the records.

(10) The Contractor agrees to use commercially reasonable methods to ensure that the Contractor's officers, employees, and agents are only given access to Transferred Data in which they have a legitimate interest under this Agreement.

(11) The Contractor agrees to train all officers, employees, and agents granted access to Transferred Data concerning students on the confidentiality of such records, the limitations on access to such records, and the appropriate handling of such records. The Contractor shall also require that all officers, employees, and agents granted access to Transferred Data concerning students sign a confidentiality agreement agreeing to maintain the confidentiality of such records in accordance with FERPA and this paragraph.

(12) The Contractor agrees to use commercially reasonable methods to identify and authenticate the identity of parents, students, and District officials to whom the Contractor discloses personally identifiable information from Transferred Data.

(13) The Contractor agrees that GCPS shall have the right upon written notice to audit and inspect all facilities, systems, instruments, servers, databases, computers, and other assets used in the provision of the Service for compliance with the terms of the Agreement.

(14) The Contractor agrees to notify the District within twenty-four (24) hour of becoming aware of any improper disclosure or unauthorized access of Transferred Data. The Contractor further agrees to indemnify the District for any and all costs, judgments, fines, fees or other obligations incurred by the District as a result of any improper disclosure or unauthorized access of Transferred Data maintained by the Contractor or the Contractor's officers, employees, subcontractors or agents.

In the event the Contractor improperly discloses Transferred Data, such disclosure shall constitute a material breach of this Agreement. In addition, as a result of an improper disclosure the District may be prohibited from providing the Contractor with personally identifiable information from educational records for a period of five (5) years and this Agreement shall be voidable at the discretion of the District.

Contractor providing services: ____________________________

Name and Title Date

Party receiving services: Gwinnett County Public Schools

By:

Dr. Deborah Durrence, Chief Data Officer Date

By:

Kevin Kriews, Purchasing Director Date