9-8A. Educational Technology DSA template.pdf

STEPHANIE S. ELIZALDE ED.D.

SUPERINTENDENT OF SCHOOLS

EDUCATIONAL TECHNOLOGY

VENDOR DATA SHARING AGREEMENT

THIS AGREEMENT is entered into on this the day of , by and between herein called “ ” and the Dallas Independent School District, herein called “District” or “Dallas ISD” for the period of through . The parties hereto agree as follows:

1. has entered into an Agreement with the District to provide the following services:

The Agreement is attached as Exhibit A. To complete the work required under the Agreement, will require access to District data.

2. The release of District employee information must be in compliance with all applicable laws and regulations, including but not limited to, the Texas Education Code, Section 21.355 and Texas Government Code, 552.117.

3. The release of personally identifiable information of students must be in compliance with the requirements of the Family Educational Rights and Privacy Act (FERPA).

4. FERPA permits the disclosure of personally identifiable information of students to school officials with legitimate educational interests in students’ education records. The term “school official” includes contractors, consultants, volunteers, or other parties to whom an educational agency or institution has outsourced institutional services or provided that the outside party—

1. Performs a District service or function for which the District would otherwise use employees;

2. Is under the direct control of the District with respect to the use and maintenance of education records; and

3. Is subject to the requirements governing the use and redisclosure of personally identifiable information from education records. 20 U.S.C. 1232g(b)(1)(A).

5. Student Confidentiality. The Dallas ISD has a legal obligation to maintain the confidentiality and privacy of student records in accordance with applicable law and regulations, specifically the Family Educational Rights and Privacy Act (FERPA).

and its authorized representatives may only receive student information in compliance with the requirements and exceptions outlined in FERPA.

and its authorized representatives acknowledge that they must comply with said law and regulations and safeguard student information.

shall employ administrative, physical, and technical safeguards designed to protect usernames, passwords, and any other means of gaining access to the Services and/or hosted student data from unauthorized access, disclosure or acquisition by an unauthorized person. Any accounts that have access to District data must have Multi-factor Authentication (MFA) enabled.

and its authorized representatives may not re-disclose the information to a third party without prior written consent from the Dallas ISD, the parent or eligible student. and its authorized representatives must destroy any student information received from the Dallas Independent School District, when no longer needed for the purposes listed in this Agreement or within 30 days following the expiration of the term of the Agreement. Any extended use of the data must be specifically authorized in writing in advance of the expiration of the underlying Agreement and its authorized representatives must maintain the confidentiality of the student records according to commercially reasonable administrative, physical and technical standards that are no less rigorous than the standards by which protects its own confidential information.

6. Dallas ISD will provide the following minimum required data elements for to provide the services requested by the District:

6.1 Mitigation Required

Sensitive data that requires 256-bit AES encryption at REST and TLS 1.2 during transport, kept within the United States only

Non-sensitive data that does not require special encryption and are allowed to be stored and transported as Clear Text, kept within the United States only

7. acknowledges that the educational records and personally identifiable information from education records provided by the Dallas ISD may only be used to meet the purpose stated in this Agreement. If Desires to use the records or data obtained from the Dallas ISD to conduct further research not specifically authorized in the Agreement, the research proposal must be submitted to the District’s Research Review Board for approval

8. If wants to conduct a survey of students, written permission must be first obtained from the District.

acknowledges that all student surveys will be in compliance with the requirements of the Protection of Pupil Rights Amendment (PPRA). In the event that any Department of Education funding is used for this program, prior written parental consent will be obtained before surveying a student on any of the following topics:

1. Political affiliations

2. Mental and psychological problems potentially embarrassing to the student and his/her family;

3. Sex behavior and attitudes;

4. Illegal, anti-social, self-incriminating and demeaning behavior;

5. Critical appraisals of other individuals with whom respondents have close family relationships;

6. Legally recognized privileged or analogous relationships, such as those of lawyers, physicians, and ministers; or

7. Religious practices, affiliations, or beliefs of the student or parents; or

8. Income (other than that required by law to determine eligibility for participation in a program or for receiving financial assistance under such program).

The protected categories may also be expanded by future amendments to the PPRA. Parents will have the opportunity to inspect the survey created by a third party before the survey is administered or distributed to the student regardless of the funding source.

9. must destroy all education records and any data derived from personally identifiable information or records when the information is no longer needed to fulfill the services being performed under the Agreement.

must provide the Dallas ISD with evidence of the destruction of the records in compliance with this Agreement. The destruction must occur within 30 days of the expiration of the underlying Agreement. The parties may agree to amend the Agreement to extend the time period if needed, but the Agreement must be in writing and include a time limit. The Dallas ISD will provide input on the specific time period for destruction based on the facts and circumstances surrounding the disclosure and Agreement. The destruction must be in accordance with the Dallas ISD’s records retention policies and procedures. The Dallas ISD’s records retention policy and procedures are located in Board Policy CPC (LOCAL) and CPC (REGULATION) located online at: https://pol.tasb.org/Policy/Code/361?filter=CPC.The destruction procedures must be in compliance with NIST specification 800-88, Rev. 1, Guidelines for Media Sanitization, Minimum Sanitization Recommendations, available at www.nist.gov.

10. designates the following individual or entity as an authorized representative: . The authorized representative has authority to bind the entity to the requirements of this agreement. The authorized representative shall also require individuals accessing the personally identifiable information from education records to execute affidavits of nondisclosure or other documentation indicating their individual agreement to handle the personally identifiable information from education records properly.

11. must provide Dallas ISD with a copy of policies and procedures, consistent with FERPA and other Federal and State confidentiality and privacy provisions, that will be used to protect personally identifiable information from education records from further disclosure (except back to the Dallas ISD) and unauthorized use, including limiting the use of personally identifiable information from education records to only authorized representatives with legitimate interests in the study. A copy of the ’s Privacy Policy, as well as top-level Information Security Policy, are attached as “Exhibit B.”

12. Approval to use the personally identifiable information from education records for one Agreement does not confer approval to use the data for another Agreement. The personally identifiable information from education records may only be used for the activities described in this Agreement.

13. The points of contact and data custodians (the individuals directly responsible for managing the data in question) are:

District: Sean Brinkman, Chief Technology Officer, Educational Technology

5501 LBJ Freeway, Ste 1000, Dallas, TX 75240, (972) 925-5618

District:

9400 N. Central Expy, Dallas, TX 75231, Vendor:

14. The disclosure of personally identifiable information from education records to is not an assignment of ownership of the personally identifiable information or records to . The Dallas ISD retains ownership of all such records. Personally identifiable information from education records may only be redisclosed with the Dallas ISD’s permission or in compliance with FERPA and its regulations. Depersonalized data is data that has all personally identifiable information obfuscated. Dallas ISD does not allow the use of FERPA protected data (identifiable or depersonalized) without a DSA. Depersonalized data can never be used beyond the scope of a contract.

15. The Dallas ISD maintains the right to conduct audits or otherwise monitor the receiving personally identifiable information from education records to periodically affirm that the has appropriate policies and procedures in place to protect the personally identifiable information from education records.

16. The failure to comply with the requirements of FERPA will subject the third party to all allowable penalties under state and federal law. In the event that District data is compromised and/or released to an unauthorized individual, must alert IT Security, ITSecurity@dallasisd.org at Dallas ISD within 72 hours after becoming aware of a breach. In the event of a breach, any use or disclosure of information not authorized by this Agreement, shall identify (i) nature of breach, (ii) what information was used or disclosed, (iii) who or what was the cause of the breach. Information of what has done or shall do to mitigate any adverse effect of the breach, and what corrective action has taken or shall take to prevent future similar unauthorized use or disclosure as soon as practical.

In the event of a breach, will follow the notification requirements outlined in Texas Business and Commercial Code, Section 521.053.

17. shall defend and hold District harmless from all claims, indemnify, liabilities, damages, or judgments involving a third party, including District’s costs and attorney fees, which arise as a result of ’s failure to meet any of its obligations under this Agreement.

18. This Agreement and all of the rights and obligations of the parties hereto and all of the terms and conditions hereof shall be construed, interpreted and applied in accordance with and governed by and enforced under the laws of the State of Texas, and the parties hereto agree that venue shall be in Dallas County, Texas.

By signing, I certify that I have read and agree with the terms of the Data Sharing Agreement, and I am authorized to sign and execute on behalf of my institution.