8-WK2706-CNS - Attachment B FERPA Standard Terms.pdf

E x c e l l e n c e a n d E q u i t y : e v e r y s t u d e n t , e v e r y c l a s s r o o m , e v e r y d a y . w ww. s lc sch o ols .org

INFORMATION TECHNOLOGY

995 W. Beardsley Place Salt Lake City, Utah 84119 p 801.578.8224 f 801.578.8442

FERPA – STUDENT LEVEL DATA PROTECTION STANDARD TERMS AND CONDITIONS OR REQUIRED

ATTACHMENT

The services or functions included in the Contract involve the CONTRACTOR obtaining or using education records or personally identifiable information provided by Salt Lake City School District (“SLCSD”) or any of its schools or employees. SLCSD is subject to the Family Educational Rights and Privacy Act (“FERPA”) 20 U.S.C.

§ 1232g, and its implementing regulations, 34 C.F.R. Part 99, as well as Utah’s Student Privacy and Data Protection Act (“SPDPA”), Utah Code. Ann. §53E-9-101 et. seq., both of which generally requires written consent for disclosure of educational record or personally identifiable information to third parties.

Written consent is not required for school officials. FERPA provides a contractor, consultant, volunteer, or other outside party may be treated as a school official if the contracting party is: (a) providing services or functions that the SLCSD would otherwise use employees, (b) under the direct control of SLCSD with respect to the use and maintenance of education records and personally identifiable information, (c) subject to the requirements of 34 C.F.R. 99.33(a), and (d) limiting access within the Vendor’s organization to those who have a legitimate educational interest. 34 C.F.R 99.31(a)(1)(i)(B).

CONTRACTOR is hereby designated as a School Official and an entity acting for SLCSD in its performance of functions that an SLCSD employee otherwise would perform; and (b) establish procedures for the protection of PII, including procedures regarding the collection, use, storage, protection and sharing of PII.

CONTRACTOR, as SLCSD’s School Official, shall comply with all applicable laws and regulations including but not limited to FERPA, SPDPA, and the Individuals with Disabilities Educational Act, 30 U.S.C. §1400 et seq.

and 34 C.F.R. Part 300 (“IDEA”).

The Parties agree as follows:

1. The term of this Attachment shall remain in effect through the duration of the Contract.

2. The following definitions apply to the Attachment:

a. “Education records” includes all information accessed, collected, stored, processed, disclosed, de-identified, created, or used by Vendor, including metadata and personally identifiable information, in relation to the Agreement.

b. “Data” includes Student Personally Identifiable Information and Educator Data, and may also include Confidential Information.

c. "Destroy" means to remove data or a record: (a) in accordance with current industry best practices; and (b) rendering the data or record irretrievable in the normal course of business of an LEA or a third-party contractor.

d. "Disclosure" includes permitting access to, revealing, releasing, transferring, disseminating, or otherwise communicating all or any part of any individual record orally, in writing, electronically, or by any other communication method.

e. “Educator Data” includes, but is not limited to, the educator’s name; any unique identifier, including social security number; and other information that, alone or in combination, is linked or linkable to a specific educator.

f. “Incident” means the potentially unauthorized access to Data that CONTRACTOR believes could reasonably result in the use, disclosure or theft of Data within the possession or control of CONTRACTOR or CONTRACTOR’s Subcontractors.

Data Privacy Contract Attachment Salt Lake City School District

Information Technology Page 2 of 5 995 W. Beardsley Place, Salt Lake City, Utah 84119 | www.slcschools.org | Phone: 801.578.8224 | Fax: 801.226.8932

Rev. 6/4/2025

g. “Metadata” includes all information created manually or automatically to provide meaning or context to other data.

h. “Student Personally Identifiable Information” or “PII” has the same meaning as that found in Utah Code Ann. § 53E-9-301, and includes both direct identifiers (such as a student’s or other family member’s name, address, student number, or biometric number) and indirect identifiers (such as a student’s date of birth, place of birth, or mother’s maiden name). Indirect identifiers that constitute PII also include metadata or other information that, alone or in combination, is linked or linkable to a specific student that would allow a reasonable person in the school community, who does not have personal knowledge of the relevant circumstances, to identify the student with reasonable certainty.

i. “Targeted Advertising” means presenting advertisements to a student or student’s parent where the advertisement is selected based on information obtained or inferred over time from that student's online behavior, usage of applications, or student data. This includes information collected or received under this Contract.

3. Data disclosed by SLCSD to CONTRACTOR includes records that: (1) may directly relate to a student; (2) may contain personally identifiable information, and (3) are maintained by an educational agency or institution or by a party acting for the agency or institution.

4. CONTRACTOR agrees that all data files, including derivative files, and all data files resulting from merges, matches, or other uses of education records provided or obtained pursuant to the Contract are subject to this agreement.

5. CONTRACTOR is a party acting for SLCSD, who has direct control of the use and maintenance of education records. All education records are in the legal and rightful custody and control of SLCSD.

6. CONTRACTOR acquires no rights or licenses to use the education records for any other purpose than for performing the services set forth in the Contract.

7. CONTRACTOR has a legitimate educational interest in the education records based upon the Contract.

8. During the term of this Contract, if SLCSD requests the destruction of PII collected, generated or inferred as a result of this Contract, CONTRACTOR shall Destroy the information within five (5) calendar days, or other mutually agreed upon timeframe, after the date of the request. CONTRACTOR shall provide SLCSD with written confirmation of the date the data was destroyed.

9. CONTRACTOR shall allow SLCSD or its’ designee to audit CONTRACTOR to verify compliance with the Contract.

10. Upon termination or expiration of this Contract, CONTRACTOR will ensure that all SLCSD data is securely returned or destroyed as directed by the SLCSD in its sole discretion. Transfer to the SLCSD or a third party designated by the SLCSD shall occur within five (5) calendar days, or other mutually agreed upon timeframe. CONTRACTOR shall ensure that such transfer/migration uses facilities and methods that are compatible with the relevant systems of the SLCSD or its transferee, and to the extent technologically feasible, that the SLCSD will have reasonable access to SLCSD data during the transition. In the event that the SLCSD requests destruction of its data, CONTRACTOR agrees to securely destroy all data in its possession and in the possession of any subcontractors or agents to which the CONTRACTOR might have transferred SLCSD data. The CONTRACTOR agrees to provide documentation of data destruction to the

SLCSD.

Information Technology Page 3 of 5 995 W. Beardsley Place, Salt Lake City, Utah 84119 | www.slcschools.org | Phone: 801.578.8224 | Fax: 801.226.8932

Rev. 6/4/2025

11. Notices required by this Attachment shall be provided to: Chief Information Officer, who is currently Sam Quantz at sam.quantz@slcschools.org.

ACCESS TO DATA

1. CONTRACTOR shall limit access within its organization to individuals whom CONTRACTOR has determined to have legitimate educational interests in the education records.

a. CONTRACTOR shall limit access to Data to Authorized Persons only and shall require a non-disclosure agreement be signed by all Authorized Persons prior to being granted access to Data.

b. CONTRACTOR shall maintain past and current lists of all Authorized Persons, maintain each non-disclosure agreement, and shall permit inspection of the same by SLCSD upon request.

c. CONTRACTOR shall maintain an audit trail for the duration of this Contract, which reflects the granting and revoking of access privileges. A copy of this audit trail may be requested by SLCSD from CONTRACTOR at any time and shall be provided within 10 days of the SLCSD request.

d. CONTRACTOR shall have strong access controls in place. CONTRACTOR shall disable and/or immediately delete unused and terminated Authorized Persons’ accounts and shall periodically assess account inactivity for potential stale accounts.

e. CONTRACTOR shall provide annual, mandatory privacy and security awareness and training for all Authorized Persons, maintain past and current lists of Authorized Persons that have completed training, and permit inspection of the same by SLCSD upon request.

f. CONTRACTOR shall not disclose the education records to individuals within CONTRACTOR who have not been determined to have a legitimate educational interest, who have not received training, and who have not signed a nondisclosure agreement.

USE AND DISCLOSURE OF DATA

1. CONTRACTOR shall only access, collect, store, process, or use the education records, as necessary to provide the services set forth in the Contract for its legitimate educational interest in the education records. Therefore, CONTRACTOR will not access, collect, store, process, sell, disclose, de-identify or use the education records for any other purpose.

2. CONTRACTOR shall not re-disclose the education records to any other party without the prior consent of the parent or eligible student.

3. CONTRACTOR shall share Data only for the purposes of carrying out the CONTRACTOR’s responsibilities listed in the Statement of Work and only with the following entities:

a. Law enforcement agencies or individuals only as authorized by law or court order. CONTRACTOR receives such a request, CONTRACTOR shall notify SLCSD within two (2) business days of the receipt of the request, as permitted by law.

b. Any mutually agreed upon entities; such agreement must be in writing.

4. If CONTRACTOR seeks to publicly release Data, CONTRACTOR must aggregate the Data by totaling the

Data and reporting it at the group, cohort, school, school district, region, or state level. CONTRACTOR shall, upon request of SLCSD, provide SLCSD with a document that lists the steps and methods the CONTRACTOR shall use to de-identify the information. Any aggregate data that is publicly released

Information Technology Page 4 of 5 995 W. Beardsley Place, Salt Lake City, Utah 84119 | www.slcschools.org | Phone: 801.578.8224 | Fax: 801.226.8932

Rev. 6/4/2025 without being redacted using the methods in this section shall be considered an Incident. The following methods shall be used on any aggregated reports:

a. Aggregate data shall be reported publicly only if there is a sufficient number of individuals represented in any demographic or subgroup so that an individual cannot be identified.

b. Aggregated reports shall redacted using complementary suppression methods that remove the risk of Data being identifiable using simple mathematics or formulas.

5. CONTRACTOR shall not use Data for the purposes of Targeted Advertising except under the following conditions:

a. For adaptive learning or customized student learning purposes.

b. To market an educational application or product to a parent or legal guardian of a student if

CONTRACTOR did not use Data, shared by or collected per this Contract, to market the educational application or product.

c. To use a recommendation engine to recommend to a student (i) content that relates to learning or employment, within the third-party contractor's internal application, if the recommendation is not motivated by payment or other consideration from another party; or (ii) services that relate to learning or employment, within the third-party contractor's internal application, if the recommendation is not motivated by payment or other consideration from another party;

d. To respond to a student request for information or feedback, if the content of the response is not motivated by payment or other consideration from another party.

e. To use Data to allow or improve operability and functionality of the third-party contractor's internal application.

6. CONTRACTOR shall not sell or otherwise monetize Data except Data transferred through the purchase of, merger with, or otherwise acquisition of CONTRACTORs provided that all parties remain in compliance with this Contract.

SECURITY AND PROTECTION OF DATA

1. CONTRACTOR shall store and maintain all education records separately from the information of any other records.

2. CONTRACTOR shall store and maintain all Data in data centers located in the United States.

3. CONTRACTOR will store and process SLCSD data in accordance with commercial best practices, including appropriate administrative, physical, and technical safeguards, to secure such data from unauthorized access, disclosure, alteration, and use. Such measures will be no less protective than those used to secure CONTRACTOR’s own data of a similar type, and in no event less than reasonable in view of the type and nature of the data involved.

4. CONTRACTOR shall only transmit or exchange Data via secure means (ex. HTTPS or FTPS).

5. CONTRACTOR shall not use, store or process Data on any unencrypted portable or laptop computing device or any portable storage medium.

6. CONTRACTOR shall permit its employees and Subcontractors to access Data remotely only via a secured manner, such as Virtual Private Networks (VPN).

7. CONTRACTOR shall store all Data, as well as any backups made of that data, in encrypted form using no less than 128 bit key and include all Data as part of a designated backup and recovery process.

Information Technology Page 5 of 5 995 W. Beardsley Place, Salt Lake City, Utah 84119 | www.slcschools.org | Phone: 801.578.8224 | Fax: 801.226.8932

Rev. 6/4/2025

8. CONTRACTOR shall enforce strong password protections on all devices and networks with access to or that store Data.

9. CONTRACTOR will use industry-standard and up-to-date security tools and technologies such as anti-virus protections and intrusion detection methods in providing Services under this Attachment.

10. CONTRACTOR shall notify SLCSD if there are any changes that will affect the system where all education records are stored and maintained, and ensure the system is in compliance with industry standards for the security and privacy of education records.

INCIDENTS

1. If CONTRACTOR becomes aware of an Incident involving Data by either CONTRACTOR or any of CONTRACTOR’s Subcontractors, CONTRACTOR shall notify SLCSD within one (1) calendar day, or other mutually agreed upon time, and cooperate with SLCSD regarding recovery, remediation, and the necessity to involve law enforcement, if any.

2. CONTRACTOR shall produce a written remediation plan that includes information about the cause and extent of the Incident and the actions CONTRACTOR will take to remediate the Incident and to reduce the risk of incurring a similar type of Incident in the future. CONTRACTOR shall present its analysis and remediation plan to SLCSD within ten (10) calendar days, or other mutually agreed upon time, of notifying SLCSD of an Incident. SLCSD reserves the right to adjust this plan, in its sole discretion. If CONTRACTOR cannot produce its analysis and plan within the allotted time, SLCSD, in its sole discretion, may perform such analysis and produce a remediation plan, and CONTRACTOR shall reimburse SLCSD for the reasonable costs thereof.

3. In the event of an Incident, CONTRACTOR shall provide SLCSD or its designated representatives with access seven (7) days a week, twenty-four (24) hours a day, for the purpose of evaluating, mitigating, or resolving the Incident.

4. Unless CONTRACTOR can establish that CONTRACTOR or any of its subcontractors is not the cause or source of the Incident, CONTRACTOR shall be responsible for the cost of notifying each person whose personal information may have been compromised by the Incident.

5. Disclosure of Data by CONTRACTOR or any subcontractor for any reason may be cause for legal action by third parties against CONTRACTOR, SLCSD, or their respective agents. CONTRACTOR shall indemnify, save, and hold harmless SLCSD, its employees, and agents against any and all claims, damages, liability, and court awards including costs, expenses, and attorney fees incurred as a result of any act or omission by CONTRACTOR, or its employees, agents, subcontractors, or assignees pursuant to this Contract.

Notwithstanding any other provision of this Contract, CONTRACTOR shall be liable to SLCSD for all direct, consequential and incidental damages arising from an Incident caused by CONTRACTOR or its Subcontractors.

SLCSD Data Manager Approval: __________________ Date: ___________________