Appendix N - MEDALS Pilot Use Case and associated Data Use Agreement (DUA).docx

DEPARTMENT OF DEFENSE DEFENSE HUMAN RESOURCES ACTIVITY

DEFENSE MANPOWER DATA CENTER 4800 MARK CENTER DRIVE, SUITE 04E25-01 ALEXANDRIA, VA 22350-6000

DATA USE AGREEMENT BETWEEN DEFENSE MANPOWER DATA CENTER (DMDC)

AND

<<State>> EDUCATION AGENCY (SEA) FOR MEDALS DATA SHARING AGREEMENT NUMBER: <<nnnnn>> This is a Data Use Agreement (DUA) between the Defense Manpower Data Center (DMDC) and the <<State Name Education Agency>>, also referred to as the State Education Agency (SEA). When referred to collectively, the DMDC and the SEA are referred to as the “Parties.”

BACKGROUND:

In order to properly protect data containing information protected by the Federal Privacy Act and other laws, and to maintain the confidence of the American public regarding the confidentiality of information collected and maintained by the Federal government, DMDC requires requestors and recipients of information and data provided by DMDC to adhere to those laws and agree to comply with the conditions set forth in this DUA. These requirements apply to the use of the data file released or any data derived from such file.

The <<State Name>> Education Agency (SEA) is the state agency that oversees primary and secondary public education. It is headed by the <<commissioner/secretary>> of education and seeks to improve outcomes for all public school students in the state by providing leadership, guidance, and support to school systems. AUTHORITIES: DoDI 4000.19, Support Agreements, December 16, 2020; DMDC 02 DoD, Defense Enrollment Eligibility Reporting System (DEERS), December 2, 2019, 84 FR 65975; DMDC 01, Defense Manpower Data Center Data Base, October 16, 2019, 84 FR 55293; Family Educational Rights and Privacy Act (FERPA), 20 U.S.C. 1232g and its implementing regulations at 34 C.F.R. Part 99; <<Insert state specific regs as appropriate. >>

PURPOSE:

On April 1, 2024, the U.S. Department of Defense (DoD) officials led by Assistant Secretary of Defense for Manpower and Reserve Affairs Ronald Keohane met with representatives of the Council of Chief State School Officers (CCSSO), the national nonpartisan, nonprofit organization representing state and territorial leaders of elementary and secondary education, and the Kansas Department of Education. In this meeting, CCSSO committed to convene a collaborative working group. The purpose of the group was to bring together state educational agency leaders, DoD officials, and other relevant entities to advance voluntary data-sharing agreements and identify potential IT Solutions with the eventual outcome of producing a secure, replicable, common, and standardized methodology for sharing military affiliation data with state education agencies. The overall deliverable of the project will securely add state-specific enlistment and service data into state education data systems. The outcomes of the working group include the following:

· Ongoing Commitment Affirmation: Establishment of a clear commitment between the Department of Defense and K-12 state education agencies that reiterates the importance of military service as a viable postsecondary pathway, allows military readiness to be included in the state education accountability plans, and provides a safe, secure, ongoing data-sharing between state and federal agencies related to military service.

· Development of a data matching and sharing protocol: Co-creation of a protocol to securely enable the necessary data thereby allowing states and territories to count military service as a viable postsecondary pathway. The protocol would include required data elements and a data sharing/match methodology meeting applicable procedural, security, retention, and privacy regulations.

· Creation of a standardized/universal data sharing structure: Co-creation of a standardized sharing structure that allows any state or territory to match against DoD data and obtain information on their students.

The objective of this DUA is to provide a “proof of concept” and minimally viable uniform, multi-state approach to match and transfer data between the DMDC and multiple agencies. The <<SEA>> requires matched graduating student data from DMDC in order to confirm the number of high school graduates enlisting into the U.S. Armed Forces.

The initial proof of concept pilot use of this data is for demonstrative purposes to prove that multiple SEA’s can successfully match a prior year high school graduate cohort with DMDC datasets and receive military enlistment information for their state. The project goals are to (1) assist state education agencies in determining the number of students that enlist in the U.S. Armed Forces following high school, and (2) improve the state education agencies’ calculations of post-secondary success for accountability reporting.

STUDENT DATA PRIVACY:

In accordance with FERPA, 20 U.S.C. § 1232g(b)(1)(C), (b)(3), and (b)(5) and 34 C.F.R. §§ 99.31(a)(3) and 99.35, DMDC is an authorized representative of <<SEA >> for the purposes of an audit or evaluation of Federal or State supported education programs.

To avoid Privacy Act infringement, the <<SEA>> will send DMDC a file each prior year (annually), which will include the First, Middle, and Last Name, Date of Birth (DoB), of prior year K-12 state-wide high school graduates including a de-identified unique match id for use to reassociate the returned recordset at the SEA. For this DUA, a single SEA match file of 2023-2024 state graduates will be used for the match. To accomplish this action, DMDC will match the data received from the <<SEA>> against their internal enlistment source data, and will release either a yes or no for each entry listed on the file the SEA provides. Such purpose and approach is consistent with applicable authority.

UNDERSTANDINGS OF THE PARTIES:

Defense Manpower Data Center will:

Ensure that it is always DoDI 8500.01, DoDI 8510.01 and the Federal Information Security Modernization Act (FISMA 2014) compliant.

DMDC data management <<SEA>> will use either DoD SAFE, a DoD secure File Extract website that can upload files for retrieval by either DoD or Non-DoD agencies as long as the data is not Classified or use the DMDCRS system, a DMDC web server that houses data for retrieval for individual ad hoc or recurring data requests.

Provide protection of the data in accordance with the Privacy Act of 1974, 5 U.S.C. § 552a, as amended, and FERPA, 20 U.S.C. § 1232g and its implementing regulations in 34 C.F.R. Part 99, as amended, at all times.

Agree that in executing tasks on behalf of <<SEA>>, DMDC will not use any student-identifying information in any way that violates the provisions of applicable law and regulations, including without limitation, FERPA.

Acknowledge and agree that all data provided by <<SEA>> is owned by <<SEA>>. Not: (i) anonymize or de-identify any part of <<SEA>> data or create statistics or analysis of <<SEA>> data for any DMDC purpose, marketing or otherwise, except as necessary to meet its obligations to <<SEA>> under this agreement; (ii) use or distribute any part of <<SEA>> data by or to any third-party, except as necessary to meet its obligations to <<SEA>> under this agreement; and/or (iii) use such data for any other purpose not specifically set forth herein or as otherwise authorized in writing by <<SEA>>.

Return, destroy, or obliterate all data obtained under this agreement from <<SEA>> not later than one calendar month after the completion of the data matching authorized in this agreement. This term may be amended only by a written agreement that otherwise complies with 20 U.S.C. § 1232g and its implementing regulations in 34 C.F.R. Part 99.

<<SEA>> will:

Destroy all data complying with the National Institute of Standards and Technology Special Publication (NISTSP) 800-88 standards of data destruction and/or the National Archives and Records Administration (NARA) requirements for records retention and disposition.

Not disclose any aggregations of information or data from the file(s) covered by this agreement that is not documented in the Purpose section of this agreement, without express written authorization from DMDC.

Neither publish nor release any information that is derived from the file(s) that is not expressed in the Purpose section of this agreement, without prior DMDC written approval.

Not use the information or data subject to this Agreement for marketing or other unauthorized purposes.

Secure data received from DMDC upon receipt.

Abide by all applicable DoD security rules, regulations, policies, and guidance governing certification and accreditation, security management relating to the exchange of data, personnel identity protection, and proper disposition of IT equipment.

Provide protection of the data in accordance with the Privacy Act of 1974, 5 U.S.C. § 552a, as amended, at all times. Ensure that, if the data requested is to be used for human studies, the agency has gone through all the requirements for the Human Research Protection Program.

Ensure that any persons accessing Federal Privacy Act information complies with applicable DoD guidance from DoD Manual 5200.02.

Ensure data transmission and data storage are conducted in accordance with Federal law, including the provisions of the Office of Management and Budget (OMB) and National Institute of Standards and Technology guidance and make certain that its contractors and partners similarly comply.

Ensure and confirm that before a contractor is granted access to or otherwise handles the data, the contractor has been informed of and acknowledged the obligation to comply with the Privacy Act, applicable regulations, and DoD policies. The parties shall not share the data with any non-U.S. citizen contractors, or with any U.S. citizen contractors who cannot obtain proper clearance or meet the access and handling requirements. The data or information derived from the data shall not be disclosed, released, revealed, shown, sold, rented, leased, loaned, duplicated or disseminated to anyone outside of this agreement without the written consent of the agency that furnished the data except as described in the Purpose section of this agreement. Data and information derived from it may not be maintained outside the United States.

Follow the DoD Regulation 5400.11-R, “Department of Defense Privacy Program” Regulation, DoDI 5400.11 “DoD Privacy and Civil Liberties Programs.”; the Deputy Secretary of Defense Memorandum “Reporting of Breaches of Personally Identifiable Information in Accordance with the Department of Defense Breach Response Plan,” November 30, 2018; as well as Office of Management and Budget (OMB) Memorandum M-17-12, “Preparing for and Responding to a Breach of Personally Identifiable Information,” January 3, 2017, and OMB Memorandum M-21-02, “Fiscal Year 2020-2021 Guidance on Federal Information Security and Privacy Management Requirements,” November 9, 2020; and subsequent OMB guidance. <<SEA>> will use <<SEA>> OP 10-08 Information Resources Security Controls and <<SEA>>’s Privacy and Incident Response Redbook should <<SEA>> become aware of a breach or potential breach of data received from DMDC. In addition to the required reporting, <<SEA>> notify DMDC within one hour of discovering the breach or potential breach. Cybersecurity incidents discovered on DMDC systems or involved DMDC data will be reported to the DMDC Cybersecurity Incident Response <<SEA>>m via email and telephone (dodhra.dodc-mb.dmdc.list.ir- <<SEA>>m@mail.mil, (831) 583-4080).

UNAUTHORIZED DISCLOSURE:

The Parties will:

Ensure that only authorized personnel will have access to data provided under this agreement. Each Party shall advise its personnel accessing the data of the confidential nature of the information and the civil and criminal sanctions for noncompliance contained in the applicable Federal laws.

Agree to comply with the Family Educational Rights and Privacy Act, 20 U.S.C. § 1232g, and the implementing federal regulations, 34 C.F.R. Part 99. Each Party agrees to protect with reasonable data security procedures any confidential student information it receives or accesses that could make a student’s identity traceable. Each Party agrees that the data shall be treated as FERPA-confidential and in accordance with this agreement regardless of which Party possesses the data.

Ensure that the records matched and any records provided by DMDC will be processed in a manner that unauthorized persons cannot retrieve any such record via computer, remote terminal, or other means.

Ensure that information obtained from each other is used solely for the purposes described in this DUA, and in accordance with the Privacy Act, as amended, FERPA, as amended, and the Freedom of Information Act, as amended.

Ensure that any files provided by the Parties are not used to extract information concerning individuals for any purpose not specified in this DUA. These files will not be duplicated or disseminated without the written consent of the agency that furnished the data.

Ensure that there is no unauthorized disclosure of DMDC data or <<SEA>> data, provided under this DUA that is protected by the Privacy Act, and FERPA. In the event DMDC or <<SEA>> determines the other party (in this case, the “disclosing party”) has made an unauthorized disclosure of the data provided by that Party, the non-disclosing Party may: a) request a formal response from the disclosing Party to an allegation of an unauthorized disclosure; b) require the submission of a corrective action plan from the disclosing Party to the DMDC or <<SEA>> Information System Security Officer (ISSO), formulated to alleviate the possibility of any future unauthorized disclosure; c) require the removal of the data from the disclosing Party’s systems; and d) prohibit the further release of DMDC or <<SEA>> data to the disclosing Party.

Ensure that unclassified, sensitive data transmitted through a commercial or wireless network are encrypted and data storage is conducted in accordance with Federal law, including the provisions of the Office of Management and Budget (OMB) and National Institute of Standards and Technology (NIST) guidance, and make certain that its authorized contractors and partners similarly comply. For example, see Federal Information Processing Standards (FIPS) 140-2 and 140-3 certified cryptography, NIST SP 800-53, Revision 4, Security and Privacy Controls for Federal Information Systems and Organizations; and NIST SP 800-61, Revision 2, Computer Security Incident Handling Guide. The Parties agree that this also applies to all portable storage devices, including but not limited to, laptops, CDs, DVDs, and backup tapes. If cloud storage is used, then such storage must be compliant with DoD and Federal requirements (e.g., FedRAMP).

Pursue accountability from authorized contractors or partners, including making the Government whole, as necessary, through the recovery of the costs associated (e.g., notification, identity protection, credit monitoring, etc.) with any breaches or unauthorized misuses of the data by contractors and partners. To the extent permitted by the <<SEA Constitution and <<SEA>> statutory and regulatory law, <<SEA>> will be legally or financially responsible for any breaches or unauthorized misuses of data furnished by DMDC and will cooperate with any related investigations.

Ensure and confirm that before an authorized contractor is granted access to or otherwise handles the data, the contractor has been informed of and acknowledged the obligation to comply with the Privacy Act, FERPA, applicable regulations, and DoD policies. The parties shall not share the data with any non-U.S. citizen contractors, or with any U.S. citizen contractors who cannot obtain proper clearance or meet the access and handling requirements. The data or information derived from the data shall not be disclosed, released, revealed, shown, sold, rented, leased, loaned, duplicated or disseminated to anyone outside of this agreement without the written consent of the agency that furnished the data except as described in the Purpose section of this agreement. Data and information derived from it may not be maintained outside the United States. Any data files provided by the Parties will not be used to extract information concerning individuals for any purpose not specified in this DUA. These files will not be duplicated or disseminated without the written consent of the data provider.

Acknowledge that the criminal penalties contained in the Privacy Act may apply if it is determined that either Party, or any individual employed or affiliated therewith, knowingly and willfully obtained the file(s) or data under false pretenses.

PERSONNEL:

Each Party is responsible for all costs of its personnel, including pay and benefits, support, and travel. Each Party is responsible for supervision and management of its personnel.

GENERAL PROVISIONS:

POINTS OF CONTACT: The following points of contact will be used by the Parties to communicate the implementation of this DUA. Each Party may change its point of contact upon reasonable notice to the other Party.

For DMDC:

Primary: <<Name, Title, Department, Phone, Email>>

Alternate: <<Name, Title, Department, Phone, Email>> For <<SEA>>:

Primary: <<Name, Title, Department, Phone, Email>> Alternate: <<Name, Title, Department, Phone, Email>> Military Liaison: <<Name, Title, Department, Phone, Email>>

CORRESPONDENCE:

All correspondence to be sent and notices to be given pursuant to this DUA will be addressed, if to DMDC, to:

<<Address>> and, if to <<SEA>> to:

<<Address>>

FUNDS AND MANPOWER:

This DUA does not document nor provide for the exchange of funds or manpower between the Parties nor does it make any commitment of funds or resources. No provision in this DUA will be interpreted to require obligation or payment of funds.

MODIFICATION OF DUA:

This DUA may only be modified by the written Agreement of the Parties, duly signed by their authorized representatives.

DISPUTES:

Any disputes relating to this DUA will, subject to any applicable law, Executive order, directive, or instruction, be resolved by consultation between the Parties or in accordance with DoDI 4000.19.

TERMINATION OF UNDERSTANDING:

This DUA will terminate upon its expiration. This DUA may be voluntarily terminated, without cause, on an earlier date by either Party with 30 days’ written notice of termination to the other Party’s primary and alternate points of contact established.

TRANSFERABILITY:

This DUA is not transferable except with the written consent of the Parties.

ENTIRE UNDERSTANDING:

It is expressly understood and agreed that this DUA embodies the entire understanding between the Parties regarding the DUA’s subject matter, thereby superseding all prior understandings of the Parties with respect to such subject matter.

EFFECTIVE DATE:

This DUA takes effect beginning on the day after the last Party signs.

EXPIRATION DATE:

This DUA will expire 1 year from the date of last signature. Upon expiration, this DUA may be renewed in writing by the Parties as required.

NO THIRD PARTY BENEFICIARIES:

Nothing in this DUA, express or implied, is intended to give to, or will be construed to confer upon, any person not a party any remedy or claim under or by reason of this DUA. This DUA will be for the sole and exclusive benefit of the Parties.

APPROVAL:

Defense Manpower Data Center 4800 Mark Center Drive, Suite 04E25-01 Alexandria, VA 22350-6000 <<State>> Education Agency <<Address>>

<<Name>> <<Name>> <<Title>> <<Title>>

Attachment:

MEDALS Pilot Use Case defining project scope, definition, data elements, and workflow of the pilot process contemplated in this agreement.

The pilot process will initially return a basic enlistment indicator to a state education agency (SEA). Data from this pilot exercise will be used to prove that a collaborative and multi-state approach between states and the DoD to match and provide enlistment data to a SEA. This data can then be used to inform education agencies by verifying a minimally viable approach for matching and secure transfer of information.

Long-term project and data use objectives include informing K-12 and state institutions on preferences and interests of graduates, how to develop academic plans for students interested in military service, and post-graduation outcomes.

2. Available enlistment data from DoD for matching and payload delivery

3. Available 2023-2024 year matching K12 graduating student cohort data from SEA

4. SEA is legally able to send PII to DMDC for match

5. Secure transport and storage mechanism is established to move data from SEA to DoD

6. DMDC performs matching process for State Agencies

2. Individual SEA data provided by DoD will be for 2023-2024 school year graduates

2. DMDC performs matching

3. DMDC will provide SEAs with match statistics and any variations for evaluation purposes.

4. DMDC provides payload data to SEA for use in P20W longitudinal system

5. DMDC deletes SEA source and payload data after acceptance/sign-off by DMDC and SEA

Alternative Flows:

N/A.

1. DoD/DMDC and participating SEA must have individual data sharing agreements executed and in place for work to proceed.

2. Secure destination platform(s) and transport mechanisms must exist and have appropriate permissions for DMDC and SEA data transfer and use.

3. DMDC and SEA must adhere to all data platform, audit, privacy, security, and destruction terms outlined in individual data sharing agreements.

DoD/SEA Matching Data Field Information:

Required Elements

Match Student/Enlistee First Name

Match Student/Enlistee First Name

Match Student/Enlistee Member Last Name

Organizational Role

Optional Elements

Student/Enlistee Gender

Social Security Number

Sending State Abbreviation

Location identifier for return data

Cohort Definition For the purposes of the MVP pilot, the SEA cohort shall consist of statewide K12 high school graduates for the 2023-2024 school year.

Information Security, Data Retention, and Destruction Requirements As per DUA terms and conditions.

DoD Data Payload Field Information:

File Formats, Filtering, Searches:

CSV Flat File and/or SQL Table

Revision History

Appendix 1:

Mid-Point Review Due Date: [Enter date mid-point review due]

Mid-Point Review completed by:

Signature and Name of Reviewer

Appendix 2: References:

A. DoD Instruction 5400.11 DoD Privacy and Civil Liberties Program, January 29, 2019 Incorporating change 1, Effective December 8, 2020.

B. Title 45 Code of Federal Regulations Part 46 (45 CFR 46), “Protection of Human Subjects,” Revised January 15, 2009.

C. DoD Instruction 3216.02, “Protection of Human Subjects and Adherence to Ethical Standards in DoD-Conducted and -Supported Research,” April 15, 2020.

D. DoD Instruction 5200.02, “DoD Personnel Security Program (PSP),” March 21, 2014, Incorporating Change 3, September 24, 2020.

E. DoD Manual 5200.02, “Procedures For the DoD Personnel Security Program (PSP),” March 21, 2014, Incorporating Change 3, September 24, 2020.

F. DoD Instruction 8510.01, “Risk Management Framework (RMF) for DoD Information Technology (IT),” March 12, 2014, Incorporating Change 3, Effective December 29, 2020.

G. DoD Instruction 8500.01, “Cybersecurity,” March 14, 2014, Incorporating Change 1, Effective October 7, 2019.

H. DoD Policy Memorandum, “Safeguarding Against and Responding to the Breach of Personally Identifiable Information (PII),” June 5, 2009 Revised November 30, 2018.

I. Deputy Secretary of Defense Memorandum, “Reporting of Breaches of Personally Identifiable Information in Accordance with the Department of Defense Breach Response Plan,” November 30, 2018.

J. DoD Regulation 5400.11-R, “Department of Defense Privacy Program,” May 14, 2007.

K. Federal Information Processing Standards Publication FIPS PUB 140-3, “Security Requirements for Cryptographic Modules,” March 22, 2019.

L. Federal Information Security Management Act (FISMA) of 2002, 40 U.S.C. § 11331, as amended. See also Federal Information Security Modernization Act of 2014, P.L. 113-83.

M. Office of Management and Budget Circular No A-130, “Managing Information as a Strategic Resource,” November 28, 2000, Revised July 28, 2016.

N. OMB Memorandum M-17-12, “Preparing for and Responding to a Breach of Personally Identifiable Information,” January 3, 2017.

O. DoD Instruction 1000.30, “Reduction of Social Security Number (SSN) Use Within DoD,” August 1, 2012, Incorporating Change 1, Effective April 15, 2020.

P. The Freedom of Information Act, 5 U.S.C. 552.

Q. The Privacy Act of 1974, 5 U.S.C. 552a, as amended.

R. Family Educational Rights and Privacy Act (FERPA), 20 U.S.C. 1232g and its implementing regulations at 34 C.F.R. Part 99.

S. Federal Risk and Authorization Management Program (FedRAMP) T. DoD Policy Memorandum, “Safeguarding Against and Responding to the Breach of Personally Identifiable Information (PII),” June 5, 2009, revised November 30, 2018.

image1.png