5-I - Data Protection Provisions.docx

Request for Proposals for

Sports Video Technology

Issued by the State of Utah and Alpine School District

Solicitation Number DL27-100

Attachment I

DATA PROTECTION PROVISIONS

1. DEFINITIONS: The definitions of the Master Agreement shall apply to this Attachment I. In the event of a conflict, with respect to the treatment of Data, the definitions used in Attachment I shall prevail. The following terms shall have the meanings set forth below:

1.1. “Authorized Persons” means Contractor’s employees, officers, partners, Subcontractors or other agents of Contractor that require access to Data and have a legitimate interest in the Data to enable the Contractor to perform its responsibilities under this Contract.

1.2. “Confidential Information” means information that is deemed confidential and not subject to public distribution under applicable state and federal laws. Participating Entity reserves the right to identify, during and after this Master Agreement, additional reasonable types or categories of information that must be kept confidential under federal and state laws.

1.3. “Contract” means the Master Agreement and any applicable Participating Addenda. Contract shall include any Purchase Orders that result from this Master Agreement or Participating Addenda.

1.4. “Contractor” means the individual or entity providing the Products and Services being purchased by a Participating Entity or Purchasing Entity under the Contract.

1.5. “Data” means any piece of information suitable for use in electronic or print format. Data includes Student Personally Identifiable Information, Student Data, and Educator Data, and may also include Confidential Information.

1.6. “Data Breach” means the actual unauthorized access to Data that results in the unauthorized use, disclosure, or theft of Data, or the compromise of the confidentiality, integrity, or availability of Data in possession or control of Contractor or Subcontractor.

1.7. “Educator Data” includes, but is not limited to, the educator’s name; any unique identifiers, including Social Security Number, and other information that, alone or in combination, is linked or linkable to a specific educator.

1.8. “Incident” means the potentially unauthorized access to Data that could reasonably result in the unauthorized use, disclosure, or theft of Data or the compromise of the confidentiality, integrity, or availability of Data within the possession or control of Contractor or Subcontractor.

1.9. “Metadata” includes all information created manually or automatically to provide meaning or context to other data.

1.10. “Student Personally Identifiable Information”, or “PII” has the same meaning as that found in 34 CFR § 99.3 and includes both direct identifiers (such as a student’s or family member’s name, address, student number, or biometric record) and indirect identifiers (such as a student’s date of birth, place of birth, or mother’s maiden name). Indirect identifiers that constitute PII shall also include Metadata or other information that, alone or in combination, is linked or linkable to a specific student that would allow a person who does not have personal knowledge of the relevant circumstances, to identify the student with reasonable certainty. May also be referred to as “Student Data”.

2. COMPLIANCE WITH LAW. Participating Entity, Purchasing Entity, and Contractor shall comply with all applicable federal and state constitutions, laws, rules, codes, orders, and regulations. Pursuant to Appendix II to 2 Code of Federal Regulations (CFR) Part 200, Contract Provisions for Non-Federal Entity Contracts Under Federal Awards, Orders funded with federal funds may have additional contractual requirements or certifications that must be satisfied at the time the Order is placed or upon delivery. Contractor shall comply with all applicable data privacy laws, regulations, code, and rules including FERPA 20 U.S.C. § 1232g et seq., 34 CFR Part 99 et seq., the Individuals with Disabilities Education Act, 20 U.S.C §1400 et seq., and 34 CFR Part 300.

3. DATA OWNERSHIP. Participating and Purchasing Entities retain all rights, title, and interest, including all intellectual property and proprietary rights, in and to system data, Data, and all related data and content.

4. PARENT, LEGAL GUARDIAN, AND STUDENT ACCESS. The Purchasing Entity shall establish reasonable procedures by which a parent, legal guardian, or eligible student may review Student Data and request deletion or modification, and request delivery of a copy of the Student Data. In support of this, Contractor shall establish reasonable procedures by which the Purchasing Entity may access, and correct, if necessary, Student Data, and to make a copy of the data available to the Purchasing Entity or (at the Purchasing Entity’s direction) to the parent, legal guardian, or eligible student directly. In the event that a parent, legal guardian, or eligible student contacts the Contractor to delete, modify, correct, or request delivery of a copy of any Student Data, the Contractor shall refer that person to the Purchasing Entity who will follow the necessary procedures regarding the requested information.

5. CONTRACTOR ACCESS TO DATA.

5.1. Contractor shall limit access to Data to Authorized Persons only and shall require a non-disclosure agreement to be signed by all Authorized Persons prior to being granted access to Data.

5.2. Contractor shall maintain past and current lists of all Authorized Persons, maintain each non-disclosure agreement, and shall permit inspection of the same by a Purchasing or Participating Entity upon request.

5.3. Contractor shall maintain an audit trail for the duration of the Contract, which reflects the granting and revoking of access privileges to Authorized Persons. A copy of this audit trail may be requested by a Purchasing or Participating Entity from Contractor at any time and shall be provided within ten (10) days of the request.

5.4. Contractor shall have strong access controls in place. Contractor shall disable and/or immediately delete unused or terminated Authorized Persons’ accounts and shall periodically assess account inactivity for potential stale accounts.

5.5. Contractor shall provide annual mandatory privacy and security awareness training for all Authorized Persons, maintain past and current lists of Authorized Persons that have completed training, and permit inspection of such lists by Participating or Purchasing Entities upon request.

5.6. Participating and Purchasing Entities retain the right, in their sole discretion, to revoke access to any individual, group, or entity authorized by Contractor. Upon request by a Participating or Purchasing Entity, Contractor shall revoke access and provide written confirmation of the date that access was removed.

6. USE OF DATA.

6.1. Contractor’s collection or use of Data shall be limited to that necessary and directly related to Contractor’s responsibilities set forth in the Contract.

6.2. Contractor shall share Data with any person or entity outside of this Contract only if provided for in writing in the Scope of Work, with prior written consent of a Purchasing or Participating Entity, or with law enforcement agencies or individuals as authorized by law or court order. If Contractor receives a request for Data from law enforcement or a court order, Contractor shall notify Participating or Purchasing Entity of the request within two business days, as permitted by law.

6.3. Contractor shall not sell or otherwise monetize Data except Data transferred through the purchase of, merger with, or otherwise acquisition of Contractor provided that all parties remain in compliance with this Contract.

7. UNAUTHORIZED DISCLOSURE OF DATA. Unauthorized disclosure of Data by Contractor or Subcontractor may be cause for legal action by third parties against Contractor, Participating Entity, Purchasing Entity, or their respective agents. Contractor shall indemnify, save, and hold harmless Purchasing Entity, its employees, and agents against any and all claims, damages, liabilities, and court awards including costs, expenses, and attorney fees incurred as a result of any act or omission by Contractor, or its employees, agents, Subcontractors, or assignees pursuant to this Contract. Notwithstanding any other provision of this Contract, Contractor shall be liable to Purchasing Entity for all direct, consequential, and incidental damages arising from an Incident caused by Contractor or its Subcontractors.

8. DATA TRANSMISSION. Contractor shall ensure all transmission or exchange of Data takes place via secure means.

9. DATA STORAGE. Contractor shall store and maintain all Data in data centers located only within the United States. Contractor shall not use, store, or process Data on any unencrypted portable or laptop computing device or any portable storage medium, except for devices that are used and kept only at Contractor’s United States data centers.

10. ACCESS. Contractor shall permit its employees and Subcontractors to access Data remotely only via a secured manner, and only for authorized administrative or technical support tasks.

11. INCIDENT RESPONSE. In the event of an Incident which results in a Data Breach, Contractor shall notify Purchasing Entity within 24 hours in writing with sufficient information to allow Purchasing Entity to meet any obligations to report such a Data Breach under applicable data protection laws and regulations and shall cooperate with Purchasing Entity regarding remediation and the necessity to involve law enforcement if necessary. Such notification shall, at a minimum:

11.1. Describe the nature of the Data Breach and the categories and numbers of Data concerned;

11.2. Identify the name of the Contractor’s data protection officer or other relevant contact person(s) from whom more information about the Data Breach may be obtained;

11.3. Describe the likely consequences of the Data Breach; and

11.4. Describe the measures taken or proposed to be taken to address the Data Breach.

12. DATA BREACH NOTIFICATION. Contractor shall comply with all applicable laws that require the notification of individuals in the event of a Data Breach or other events requiring notification of individuals or the public. All communication shall be coordinated with Purchasing Entity. Contractor is responsible for all notification and remedial costs and damages.

ATTACHMENT I, DATA PROTECTION PROVISIONS

image1.png image2.png image3.jpeg