Attachment-Y.-Data-Use-Agreement 4-26.docx

Attachment Y. Data Use Agreement

DATA USE AGREEMENT BETWEEN MSDE AND

This Data Use Agreement (this “Agreement”) is made between the Maryland State Department of Education, a unit of the State of Maryland Executive branch of government (the “State”), and (the “Contractor”) (each a “Party” and collectively, the “Parties”).

WHEREAS, the State and Contractor are Parties to the Event Management Platform contract dated ___________ (the “Underlying Contract”) pursuant to which the Contractor provides services for the legitimate government purpose described therein;

WHEREAS, pursuant to the Underlying Contract, the Contractor will Process certain Personal Information (“PI”) listed in Appendix A: Types of Personal Information to be Processed on behalf of the State as a Processor;

WHEREAS, the Parties desire to enter into this Agreement for the purposes of ensuring the confidentiality, privacy and security of data provided to or accessed by Contractor or exchanged between the Parties under and in connection with the Underlying Contract and in compliance with the Protection of Information by Government Agencies (“PIGA”) provisions in Title 10, Subtitle 13 of the State Government Article (“SGA”), Annotated Code of Maryland, and any other applicable State or federal privacy laws; and

WHEREAS, the Contractor is responsible for ensuring that all employees and Sub-Processors comply with requirements consistent with this Agreement.

NOW THEREFORE, for and in consideration of the mutual promises and of other good and valuable consideration herein contained, the Parties, intending to be legally bound, hereby agree as follows:

A. Definitions

1. Breach of the Security of a System means the unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of PI maintained by the Contractor or any Sub-Processors.

2. Data Subject means any individual person whose PI is provided to or accessed by Contractor or any Sub-Processor in connection with services provided under the Underlying Contract.

3. Entity means a person or organization possessing separate and distinct legal rights.

4. Genetic Data means data, in any format, that concerns the genetic characteristics of a consumer, as defined under Md. Code, Commercial Law Article § 14-4401.

5. Personal Information (PI) means:

a. An individual's first name or first initial and last name, personal mark, or unique biometric or genetic print or image, in combination with one or more of the following data elements:

i) A Social Security number, an Individual Taxpayer Identification number, a passport number, or other identification number issued by the federal government;

ii) A driver's license number or State identification card number;

iii) A financial or other account number, a credit card number, or a debit card number that, in combination with any required security code, access code, or password, would permit access to an individual’s account;

b. A username or email address in combination with a password or security question and answer that permits access to an individual's email account; or

c. Sensitive Data, means data revealing racial or ethnic origin, religious beliefs, consumer health data, sex life, sexual orientation, status as transgender or nonbinary, national origin, citizenship or immigration status, Genetic Data or biometric data, personal data of an individual that the controller (or data owner) knows or has reason to know is a child, or Precise Geolocation.

6. Precise Geolocation means information derived from technology that can precisely and accurately identify the specific location of an individual within a radius of 1,750 feet. Precise Geolocation includes latitude and longitude coordination of similar precision of those produced by a global positions system or a similar mechanism.

7. Privacy means the right of a party to maintain control over and confidentiality of information about itself.

8. Process means any operation or set of operations which is performed on or in connection with Personal Information manually or by automated means, including but not limited to the collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure or erasure. The terms “Process,” “Processing,” “Processes,” and “Processed” will be construed accordingly.

9. Processor means an Entity that Processes personal data. For the purposes of this Agreement, the Processor is the Contractor, including its employees, agents, and assigns.

10. Sub-Processor means any Entity contracted by the Contractor, including all subcontractors at any tier, to assist in fulfilling its obligations with respect to the Processing of PI under this Agreement and the Underlying Contract.

B. Permitted Uses and Disclosure of PI

1. The Contractor may only use or disclose PI as necessary to perform the services set forth in the Underlying Contract and must limit uses and disclosures to the minimum extent necessary to perform such services.

2. If the Contractor is requested or required by law enforcement or by any governmental body to disclose any PI covered by the Underlying Contract pursuant to a subpoena, search warrant, or other legal process, the Contractor shall, to the extent legally permissible, provide the State with prompt written notice of any such request or requirement. The State may seek a protective order or other appropriate remedy and/or waive compliance with the provisions of this Agreement. The Contractor shall reasonably cooperate with any such application for a protective order or other remedy. In the event that the State is unable to obtain a protective order or other appropriate remedy, or if it waives compliance, the Contractor shall furnish only that portion of PI that the Contractor is advised by written opinion of its counsel is legally required to be furnished by it and shall exercise its reasonable best efforts to obtain reliable assurance that confidential treatment shall be accorded such PI.

3. The Contractor may not sell or otherwise directly or indirectly receive remuneration, share or further disclose any confidential information (meaning information that is not made available or disclosed to unauthorized persons or processes) including but not limited to PI, or any derivation of data created therefrom, including but not limited to deidentified data, without the express consent of the Data Subject(s). For the avoidance of doubt, this provision shall not preclude the Contractor from receiving payment for the provision of services set forth in the Underlying Contract.

4. The Contractor may not use or disclose PI, or any derivation of data created therefrom, for the purposes of marketing a product or service unless necessary to perform the services set forth in the Underlying Contract or required by law. For the purposes of this provision, “marketing” shall mean a communication about a product or service that encourages recipients of the communication to purchase or use the product or service, including but not limited to targeted or behavioral advertising.

C. Contractor Duties Relative to PI

1. The Contractor shall use reasonable security measures to protect the privacy of PI including, but not limited to the following:

a. Limit disclosure of the information and details relating to PI only to those with a need to know and who are bound by confidentiality obligations at least as restrictive as those set forth in this Agreement.

b. While in Contractor’s possession, safeguard PI always, regardless of whether the Contractor’s employee, contractor, or agent is at their regular duty station.

c. Maintain a current and accurate list of job functions granted access to PI. Upon request, the Contractor shall provide a list of individuals and the dates their access to PI was provided and, if applicable, terminated.

d. Train individuals to whom access to PI is granted about privacy, IT Security, and confidentiality best practices, and require their signed acknowledgment of understanding of and abidance to the training prior to credentialing them to access PI and regularly thereafter.

e. Transmit PI using cryptographic mechanisms to Entities trusted and authorized to receive such information.

f. The Contractor is responsible for safeguarding PI. If the Contractor uses a Sub-Processor, the Contractor is responsible for ensuring that the Sub-Processor implements and maintains reasonable security measures no less stringent than those required in this Agreement. The Contractor’s Sub-Processors are listed in Appendix B: List of Sub-Processors Granted Authorized Access to State PI. The Contractor shall maintain an accurate and current list of Sub-Processors, including those no longer granted access to PI, and provide an updated list to the State upon request.

g. Regularly review privacy and IT security policies, procedures, and practices to ensure compliance with PIGA, other applicable State or federal privacy laws, and this Agreement.

h. Designate a person who addresses any issues or questions regarding the Contractor’s privacy practices.

D. Security Breach Detection and Investigation

1. Within 24 hours after the Contractor discovers, reasonably suspects, or is notified of a Breach of the Security of a System, the Contractor must notify the appropriate State-identified contact by telephone, and the Maryland Security Operations Center (MD-SOC) by email at mdsoc@maryland.gov, and provide information relating to the breach. Contractor must, at its own expense, cooperate with the State in seeking injunctive or other equitable relief with respect to any unauthorized use, misappropriation, or disclosure of any PI.

2. Once the Contractor discovers, reasonably suspects, or is notified that it incurred a Breach of the Security of a System, the Contractor must cooperate with the State to conduct in good faith a reasonable and prompt investigation to determine the likelihood that PI of a Data Subject has been or will be misused (e.g., identity theft). If the investigation shows that there is a reasonable chance that the data will be misused, the Contractor must abide by Sections E and F of this Agreement and any other applicable laws regarding responsibility to notify the affected Data Subjects.

3. With respect to PI in the possession or control of the Contractor, the Contractor shall bear the costs associated with (1) the investigation and resolution of the data breach; (2) notifications to Data Subjects, regulators or others required by State law; (3) a credit monitoring service required as requested by the State or as otherwise required by law; (4) a website or a toll-free number and call center for affected individuals required by State law; and (5) complete all corrective actions as reasonably determined by the Contractor based on root cause.

E. Security Breach Notification

1. The State may delegate the Contractor to provide security breach notification on its behalf. If so, as soon as reasonably practicable, but not later than 45 days of the Contractor’s discovery or notification of the Breach of the Security of a System, the Contractor must provide notice to affected Data Subjects that is given in writing and sent to the most recent address of the Data Subject or meet the obligations under SGA Title 10 §1305 (e) and (f).

2. The Contractor may delay notification if requested by a law enforcement agency or to determine the scope of the breach, identify all the affected Data Subjects, or restore the integrity of the system. However, the Contractor must send notification within 7 days after the law enforcement agency determines that it will not impede a criminal investigation and will not jeopardize homeland or national security if the original 45– day period has already elapsed or within 45 days of becoming aware of the Breach of the Security of a System.

3. Notice may be sent via email if a Data Subject has expressly consented to receive electronic notices, or the Contractor primarily conducts its business via the Internet.

4. The Contractor may provide notice of a security breach by email, posting on its website, and to statewide media if the cost of notice would exceed $100,000 or the number of Data Subjects to be notified exceeds 175,000 individuals.

5. In the event of a breach, notice to a Data Subject must include:

a. To the extent possible, a description of the categories of information that were, or are reasonably believed to have been, acquired by an unauthorized person, including which of the elements of PI were, or are reasonably believed to have been acquired;

b. Contact information for the Contractor’s designee who can address Data Subjects’ questions and concerns, including a toll-free number if the Processor has one;

c. Toll-free numbers and addresses for each of the three credit reporting agencies: Equifax, Experian, and TransUnion;

d. Toll-free numbers, addresses, and websites for the Federal Trade Commission (FTC) and the Maryland Office of the Attorney General (OAG); and

e. A statement that the Data Subject can obtain information from these sources about steps to avoid identity theft.

6. The Contractor must provide a draft of the notification to and receive approval from the State prior to sending the breach notification to the affected parties.

7. If the number of Data Subjects to be notified is 1,000 or more individuals, the Contractor shall notify the State in writing of the timing, distribution, and content of the notices to the Data Subjects without unreasonable delay in order for the State to notify each consumer reporting agency that compiles and maintains files on consumers on a nationwide basis, as defined by 15 U.S.C. § 1681a(p).

F. Term and Termination

1. Term

a. The Term of this Agreement shall be effective as of the date executed by the State below and expires coterminous with the Underlying Contract or when all of the PI provided to or created or received by the Contractor in connection with the Underlying Contract is destroyed or returned to the State, whichever is later.

b. Destruction of Records. The Contractor shall abide by the data retention or disposition schedule provided by the State. When, upon authorization by the State, the Contractor destroys records, the Contractor shall take reasonable steps consistent with industry standards to protect against unauthorized reidentification, access to, or use of PI.

2. Termination

This Agreement is subject to the termination provisions of the Underlying Contract.

3. Effect of Termination

Upon any termination of this Agreement, the Contractor shall return or, if agreed to by the State, destroy all PI that the Contractor created, maintained, or received from the State in connection with or pursuant to the Underlying Contract. The Contractor shall retain no copies of the PI. If the return or destruction of all PI is not possible, the Contractor shall maintain at least the same level of security to the data until such time as the data is destroyed or returned. This provision shall also apply to PI or confidential information that is in the possession of Sub-Processors. The Contractor shall attest to the return or destruction of PI and confidential information (see Appendix C: Certification of Data Destruction).

G. Survival

With respect to any PI remaining in the possession or control of the Contractor, the obligations of the Contractor under this Agreement shall survive the expiration or earlier termination of this Agreement.

H. General Provisions

The recitals (WHEREAS clauses) are incorporated herein as a substantive part of this Agreement. This Agreement shall be governed and construed in accordance with the laws of the State of Maryland, without regard to its choice of law provisions. This Agreement is not intended to modify the Parties’ respective obligations to comply with any applicable federal, State, and local laws, rules, and regulations, or any obligations under the Underlying Contract.

I. Ambiguity

Any ambiguity in this Agreement shall be resolved to permit the State to comply with PIGA and any other applicable state or federal privacy law or regulation with respect to the privacy and security of PI or personally identifiable information as defined by applicable law or regulation.

J. Regulatory References A reference in this Agreement to a section in PIGA, including any regulations promulgated thereto, means the section as in effect or as amended at the time of the effective date of the Underlying Contract.

K. Notices

All notices, requests, demands and other communications given under this Agreement shall be in writing, unless otherwise indicated, and shall be deemed to have been given as of the posted date and time in the named email inbox, as follows:

Notice to State

Agency Procurement Officer (or otherwise the State signatory of the Underlying Contract) Kenya DeCosta 200 West Baltimore Street Baltimore, MD 21201 410-767-2072 kenya.decosta@maryland.gov

Agency Contract Monitor Gifty Quarshie 200 West Baltimore Street Baltimore, MD 21201 410-281-2336 gifty.quarshie4@maryland.gov

For security or privacy incidents:

Maryland Security Operations Center (MD-SOC) mdsoc@maryland.gov

Notice to the Contractor

Notice shall be to the Contractor’s designee indicated in the Underlying Contract.

L. Entire Agreement

This Agreement sets forth the entire agreement and understanding of the Parties relating to the subject matter herein and supersedes all prior or contemporaneous discussions, understandings, and agreements, whether oral or written, between them relating to the subject matter hereof.

The Next Page is the Signature Page Attachment Y. Data Use Agreement effective date: April 2026

Attachment Y. Data Use Agreement Effective Date: April 2026 IN WITNESS WHEREOF, the Parties hereto have caused this Agreement to be executed by their duly authorized representatives.

Executed on this day of 202_ Executed on this day of 202_

[Name of Agency]

Appendix A: Types of Personal Information to be Processed Contract Number: R00B6600076 The listed types of PI are required for the Contractor to meet the service provisions written in the Underlying Contract. Alternatively, provide a schema of field names required to meet the stated service provisions.

Specific PI Type(s):

· First Name or Initial

· Last Name

· Address

· State or Government Issued Identification number (e.g., SSN, Driver’s License, Passport, Individual Tax ID, ) ☐ Financial or other Account Number, Bank Account Number, and any required Security Code, Access Code, or Password

· Unique Biometric or Genetic Print or Image

· Geospatial Location

· Sensitive Data:

☐ Racial or Ethnic Origin, ☐ Religious Beliefs ☐ Consumer Health Data ☐ Sex Life, Sexual Orientation, Status as Transgender or Nonbinary ☐ National Origin ☐ Citizenship or Immigration Status ☐ Genetic Data or Biometric Data ☐ Personal Information of an Individual that the Controller knows or has reason to know is a Child (under 18 years of age), ☐ Precise geolocation

· Other: (List)

In the event additional types of PI are processed in the future, a DUA modification that includes the new PI element(s) must be completed prior to processing the data.

Appendix B: List of Sub-Processors Granted Authorized Access to State PI

List of Sub-Processors No Longer Granted Access to State PI

Appendix C: CERTIFICATION OF DATA DESTRUCTION

Description of destroyed records, record series, or data sets – Include digital, tapes, hardware, paper

Inclusive Dates of Destroyed Data or Records:

Method of Destruction (check) (Must be NIST compliant)

Outsourced Vendor’s Name and Address

I attest that the above is true and accurate:

Authorized Signatory Name

Title

Authorized Signature

Date

Witness

Date