Attachment_G.docx

Attachment G

Data Sharing Agreement

This data sharing agreement (Agreement) between the State of Minnesota, Minnesota Department of Natural Resources (State) 500 Lafayette Road, St. Paul, MN 55155 and (Contractor) applies to data created, collected, stored, and maintained as a part of the Professional/Technical Contract (Contract).

Data Covered by this Agreement The State will provide the Contractor with customer data in order to provide fulfillment and database management services to the State for the Minnesota Conservation Volunteer magazine. The fulfillment service Contract includes data entry, customer service, payment processing, e-commerce, and marketing. The Contractor will receive and generate customer data that includes name, address, telephone number, email address, internet protocol, and financial information including credit card information and bank routing data.

In carrying out its duties, the Contractor will be handling data classified as not public data and data on individuals under the Minnesota Government Data Practices Act (MGDPA). For purposes of the Contract and this Agreement the following data are Protected Data:

• Private data (as defined in Minn. Stat. § 13.02, subd.12)

• Credit card and financial institutional data (Minn. Stat. § 13.37)

• Personal Contact and Online Account Information (Minn. Stat. § 13.356)

• Personally identifiable information, including data about minors (Minn. Stat. § 13.05, subd.5)

• Other data governed by the MGDPA (Minn. Stat. Ch. 13)

• Data subject to applicable state and federal statutes, rules, and regulations affecting the collection, storage, use or dissemination of not public data.

Duties Relating to Data Proper Handling of Information Protected Data and any other data (DATA) regarding any person shall be protected from unauthorized use and disclosure under this Agreement. The Contractor shall be responsible for ensuring secure and proper handling by its employees, subcontractors and authorized agents of all DATA created, collected, used, maintained, or disclosed on behalf of the State. Nothing in this Agreement relieves the Contractor of any liability for the secure protection and handling of DATA released under this Agreement. All DATA electronically transferred, including email and web-based platforms, between the State and the Contractor will be transmitted on secure and encrypted or password protected technologies.

Necessary Access for Business Purpose The Contractor and its employees, subcontractors and authorized agents shall ensure that access to the DATA is the minimum necessary and that the DATA is only accessed by those with a business need. The collection, creation, use, maintenance, and disclosure of DATA shall be limited to that necessary for the administration of the Contract and fulfillment services of the Minnesota Conservation Volunteer magazine.

Release of Information The Contractor will not release, use, or sell the DATA for any purpose other than described in the Contract and this Agreement. The Contractor will notify the State immediately upon receiving a request for the DATA. Any request will be handled by the State in accordance with the MGDPA. In response to a request, the Contractor is obligated to provide to the State any and all data created, collected, maintained, or stored as a part of the Contract.

Contractor’s Use of Information The Contractor shall:

• Not use the DATA for any purpose or further disclose or share the DATA collected, stored, or maintained other than as permitted or required by the Contract and this Agreement or as required by law. Contractor agrees not to copy, reproduce, or transmit DATA obtained pursuant to the Contract and this Agreement except as necessary to complete the obligations of Contract. The Contractor may maintain backup files as part of its standard operational procedures as required for the duration of the Contract.

• Use appropriate security safeguards to prevent the use or disclosure of the DATA by its employees, subcontractors and agents other than as provided for by the Contract and this Agreement. This includes, but is not limited to, having implemented administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of any electronic data or hardcopy documents. The Contractor’s employees and agents will handle DATA under the Contract and this Agreement in a controlled and secure environment.

• Verify compliance with Payment Card Industry (PCI) Compliance security standards as required by the Contract.

• Limit access to the DATA obtained under the Contract and this Agreement to those employees who have a direct business need.

• By signing the Contract, the Contractor certifies that all employees and agents having access to and/or using DATA under this Agreement:

· Have been instructed and trained regarding the governing privacy and data practices provisions.

· Will maintain DATA in locked room or on a secure computer and guarantee limited access only by those who have undergone personnel screening or a criminal background check as deemed appropriate by the Contractor.

· Have signed a confidentiality agreement as deemed appropriate by the Contractor.

· Have undergone all necessary training regarding standards of ethics, data protections, and the collection and management of data on individuals.

• Mitigate risks associated with the unauthorized access or data breach and report to the State any real or perceived privacy or security incident or breach regarding the DATA. For purposes of this Agreement, security incident means the attempted or successful unauthorized access, use, disclosure, modification, or destruction of DATA or interference with information system operations. Privacy incident means violation of the MGDPA including, but not limited to, improper or unauthorized use or disclosure of DATA, and incidents in which the confidentiality of any information maintained by the Contractor has been breached.

• Be liable for all expenses to notify subscribers of any data breach. In the case of beaches involving credit card or other personal financial data, the Contractor shall pay for any required credit monitoring services and pay full restitution for damages.

State Disclosure of Data The State shall:

• Only release DATA that it is authorized by law or regulation to share with the Contractor in order to fulfill the requirements of the Contract.

• Notify the Contractor of limitations, restrictions, changes, or revocation of permission by an individual to use or disclose DATA.

• Respond to any requests for the DATA under the MGDPA.

• Not request the Contractor to use or disclose DATA in any manner that would not be permitted under law.

Disposition of Data Credit card and financial DATA will be destroyed as soon as reasonably possible in a prompt and secure manner and on a regular basis as defined by the Contractor. Upon completion, expiration, or termination of the Contract, the Contractor will return all other DATA received or maintained on behalf of the State for purposes of the Contract. A written certification stating that all DATA has been returned must be provided to the State Authorized Representative within 30 days of project completion.

Remedies Violation of the laws and protections described in this Agreement could result in an investigation and civil and criminal penalties under Minnesota Statutes, sections 13.08 and 13.09.