Appendix 9 - SOS Access Agreement.pdf

2 State of Illinois IFB Appendix 9

STATE OF ILLINOIS

SCOPE OF SERVICES APPENDICES

APPENDIX 9 – SOS ACCESS AGREEMENT

SOS will provide SOS database information access to EPA and seven (7) days a week. SOS will provide access to vehicle title and registration data to EPA and and EPA and will be authorized to retrieve SOS database information from, or submit data to, SOS, as described below:

a. From the Vehicle Services Department

i. SOS will provide to vehicle registration data on a weekly basis, limited to name, address, vehicle make, license plate and vehicle identification number for registration records that have had activity posted on them within the last week and reside in the “Affected Counties” as defined by 625 ILCS 5/13C-5. This data shall be transferred in batch via SFTP.

ii. SOS will provide to EPA and vehicle registration data on a weekly basis excluding name and address, and including zip code, vehicle make, license plate number and vehicle identification number for registration records that have had activity posted on them within the last week and which reside outside or move outside the “Affected Counties” as defined by 625 ILCS 5/13C-5. This data shall be transferred in batch via SFTP.

iii. SOS will provide to EPA and a file containing a list of all vehicle records currently in enforcement at SOS on a quarterly basis, that is, January, April, July, and October. This file shall be transferred in batch via SFTP. This file will contain the license plate number, vehicle identification number, and enforcement status of each vehicle that is currently flagged as needing to comply with the emissions test requirement prior to registration renewal. shall use this file to perform a comparison between the SOS and EPA vehicle emissions databases. EPA may also use this file to perform a comparison between the SOS and EPA vehicle emissions databases on an as-needed basis.

iv. EPA may access, through its online connection, vehicle title data including: Illinois titles surrendered to another state; salvage certificates; junker certificates; junking notifications; and destroyed titles. EPA may access the following specific databases: Registration Services Database PCS 3270 CICSPROD access to VSDB, RT with VSDB Return and access to the EPA Compliance Table in CICSPWEB.

Data retrieved by EPA may be provided to for the purposes of maintaining accurate records related to Illinois vehicles subject to emissions testing.

b. To the Vehicle Services Department

EPA and will provide to SOS vehicle emissions testing compliance data sent on a real time basis. EPA and will also send notification and enforcement files in batch via SFTP on a monthly basis.

In addition, after receives from SOS weekly vehicle registration data, EPA or will provide to SOS the following:

i. Any compliance data generated by changes to vehicle records; and

ii. An error file identifying any discrepancies or errors in such data; and

iii. An update file identifying any vehicles currently in enforcement that have had a registration plate transfer in the previous week.

5 State of Illinois IFB information.

g. Prior to execution of this Agreement, EPA, and shall each separately provide to SOS a “User List” which shall include the names, addresses and phone numbers of all persons responsible for managing SOS data or otherwise executing the provisions of this Agreement on behalf of the EPA, and Only persons whose names appear on a User List may view, handle or access SOS data. EPA, and must within forty-eight (48) hours notify SOS of any changes in personnel that would affect the User List.

h. EPA, and shall each separately identify all individuals that may view, access and/or handle any SOS data in any format. Furthermore, EPA and must issue individuals listed on their respective User List a distinct USER ID before the individual may access SOS data. Under no circumstances shall individuals issued a USER ID share an issued USER ID. When EPA, and/or no longer employ an individual listed on their respective User List, the respective Party must immediately terminate that individual’s USER ID.

i. All access to SOS data information must be logged and searchable at minimum by registration inquiry, customer information, USER ID of employee who conducted the search and time stamp of the search. If requested by SOS, EPA and must be able to search logs by registration inquiry and make available to the SOS by whom and when the search was done.

j. EPA, and agree that all persons listed on their respective User List(s) will be informed, in writing, of the limitations on the dissemination of this information and of the civil and criminal penalties for violating the DPPA. Each designated person shall certify, in writing, compliance with the DPPA. Said Confidentiality Certification and the DPPA are attached for EPA, and to copy and disseminate to all designated employees who will have access to said confidential information. Signed copies of the Confidentiality Certification shall be returned to: Office of the General Counsel, Illinois Secretary of State, 298 Howlett Building, Springfield, Illinois 62756.

k. SOS security policies and all data security standards contained therein, as amended, shall be incorporated into this Agreement by reference. All Parties shall adhere to the National Institute of Standards and Technology (“NIST”) NIST CSF or NIST 800-53.

Upon notice to EPA, and SOS reserves the exclusive right to add and/or modify these policies and data security requirements referenced in this Agreement at any time during its term, in accordance with industry standards.

l. Prior to the execution of this Agreement, shall provide its latest Service Organization Control SOC 2, Type II report completed by a certified auditing agency, as well as any gap letters required to cover stated controls for the applicable annual period not to exceed three (3) months, via mail or email, to the SOS Information Technology Security Administrator, 2701 S. Dirksen Parkway, Springfield, Illinois 62723, securityadministrator@ilsos.gov. During the term of this Agreement, shall provide a copy of its annual SOC 2 Type II report when said report is certified and published and upon request from SOS.

m. shall maintain a comprehensive data security program and shall design, implement and regularly test its safeguards. shall perform penetration testing

7 State of Illinois IFB authorizes SOS or its representative to audit EPA, and including any and all computer systems and documents to verify that the data is being used only in accordance with the Certified Statement of Use(s).

c. EPA, and agree to properly and timely dispose of the materials containing personal information in a manner that renders the personal information unreadable and undecipherable, in accordance with the PIPA. also agrees to destroy all SOS PI data provided by for the purpose of creating and distributing the post card notifications immediatley and no later than forty-eight (48) hours after mailing said post card notifications. Furthermore, a violation of the PIPA may subject EPA, and to monetary and civil penalties not to exceed $50,000 for each instance, respectively. (815 ILCS 530/40(d)).

d. EPA, and acknowledge that a violation of the PIPA constitutes an unlawful practice under the Consumer Fraud and Deceptive Business Practices Act.

(815 ILCS 505).

e. Without the prior express written consent of SOS, EPA, and agree that the data received shall not be made available to other persons, firms, corporations, partnerships, members of the public, persons outside the employ of the EPA, and or other entities, other than as indicated in the Certified Statement of Use(s) or in accordance with court discovery procedures.

f. EPA and SOS agree that this Agreement does not supersede the state or federal Freedom of Information Act (“FOIA”), that EPA is subject to FOIA, and that EPA and SOS shall work together as needed to respond to any request received by EPA pursuant to FOIA, also taking into consideration the provisions of subsection h. below.

g. Pursuant to 92 Illinois Administrative Code 1002.60, should EPA, or disclose any personal information obtained from SOS in any manner allowed under this Agreement, EPA, and shall, for a minimum of five (5) years, keep records identifying each person or entity that received such information and the permitted purpose per the Federal Driver’s Privacy Protection Act (18 USC § 2721 et. seq.)

(“DPPA”) and the Illinois Vehicle Code (625 ILCS 5/2-123) (“IVC”) for which the information was disclosed. Upon request by SOS, EPA, and shall make said records available.

h. EPA, and agree to abide by the Federal Fair Credit Reporting Act 15 USC 1681 et seq., the PIPA, and the Illinois Vehicle Code 625 ILCS 5/2-123 as the laws exist now or are hereafter amended in the use of the information received from SOS. While some of the information contained in such files is considered public information, some of the information to which EPA, and are authorized access to is considered personally identifying information, the dissemination of which is limited by the DPPA, IVC and Administrative Rule. EPA, and acknowledge that the improper dissemination of personally identifying information is a violation of the DPPA and the IVC; and that any individual who violates the DPPA is subject to criminal prosecution, fines and civil penalties of $2,500 for each improper disclosure of information Thus, all information whether displayed on the screen or in printed form is for the EXCLUSIVE use of EPA, and and shall not be provided to anyone not a party to this Agreement except as provided in the Certified Statement of Use(s). EPA, and agree that each of their respective

10 State of Illinois IFB

VIII. GOVERNING LAW AND JURISDICTION

This Agreement is subject to the rules outlined in 92 Illinois Administrative Code 1002, all relevant sections of the Illinois Vehicle Code, the Data Processing Confidentiality Act. (30 ILCS 585 et. seq.), the Personal Information Protection Act (815 ILCS 530), the Consumer Fraud and Deceptive Business Practices Act, (815 ILCS 505), the Federal Driver’s Privacy Protection Act (18 USC § 2721 et. seq.) the Federal Crimes and Criminal Procedure Act (18 U.S.C. § 2722, 2723, 2725, and 3571) and the Federal Fair Credit Reporting Act (15 USC § 1681 et. seq.) This Agreement shall be interpreted in accordance with the laws of the State of Illinois, U.S.A. EPA, and agree that any dispute arising under this Agreement which cannot be resolved amicably among the Parties shall be submitted to a court of competent jurisdiction in the State of Illinois, to which jurisdiction EPA, and hereby submit.

IX. TERM

a. Term. The effective date of this Agreement shall be one (1) year from the date of the last signature. This Agreement shall continue in effect unless terminated by any Party pursuant to the terms hereof, or until the breach of any of the terms and conditions of this Agreement, whichever comes first. In the event of such breach, this Agreement shall be terminated as to only the Party or Parties in breach.

b. Termination on Notice: A Party shall have the right to terminate this Agreement without cause upon five (5) days’ prior written notice to the other Parties.

c. Additional Basis for Termination: SOS shall have the right to terminate this Agreement immediately, as to the breaching party, if, at any time, EPA, or commit a material breach as described in this Agreement.

d. Survival of terms. The terms and conditions of Section II. Computer Equipment, Section III. Computer and Data Security, Section IV. Data Mining Prohibitions, Section V. Use of Information, Section VI, Insurance, and Section VIII. Governing Law and Jurisdiction, and this paragraph, are substantive provisions constituting the essence of the Agreement and the obligations of the Parties. These and all provisions of this Agreement that are reasonably intended to have effect after termination or expiration of this Agreement, including, without limitation, compliance, audit rights, privacy, data protection, confidentiality, dispute resolution and insurance requirements, shall survive such termination or expiration.

X. NOTICE

For a notice or other communication under this Agreement to be valid, it must be in writing and delivered via a national transportation company (with all fees prepaid), email, facsimile, or registered or certified mail, return receipt requested and postage prepaid. Any notice or other communication to a Party under this Agreement must be addressed using the information specified below for that Party. The Parties must maintain their current addresses, phone numbers, facsimile phone numbers, and email addresses with the other Parties. If a Party’s below information changes, that Party must notify the other Parties as soon as possible.

SOS: ILLINOIS ENVIRONMENTAL

PROTECTION AGENCY:

14 State of Illinois IFB

By:

Irene Lyons General Counsel