Attachment_Y.pdf

Attachment Y. Data Usage Agreement Effective Date: July 2024

DATA USE AGREEMENT BETWEEN [NAME OF AGENCY] AND _________________

This Data Use Agreement (this “Agreement”) is made between the Maryland [NAME OF AGENCY], a unit of the State of Maryland Executive branch of government (the “State”), and _______________________________

(the “Processor”) (each a “Party” and collectively, the “Parties”).

WHEREAS, the State and Processor are Parties to [Identify the Contract] dated _________ __, ____ pursuant to which Processor provides the services described therein [or perhaps briefly describe here the services it provides]

(the “Underlying Contract”) and, in the performance thereof, receives from the State certain personal information about one or more individuals;

WHEREAS, the Protection of Information by Government Agencies (PIGA) provisions in Title 10, Subtitle 13 of the State Government Article, Annotated Code of Maryland, were enacted to protect personal information from unauthorized access, use, modification, or disclosure, and requires (1) “a unit that collects personal information of an individual to implement and maintain reasonable security procedures and practices that are appropriate to the nature of the personal information collected and the nature of the unit and its operations”; and (2) “a unit that uses a nonaffiliated third party [such as the Processor] as a service provider to perform services for the unit and discloses personal information about an individual under a written contract or agreement with the third party [to] require by written contract or agreement that the third party implement and maintain reasonable security procedures and practices that: (i) are appropriate to the nature of the personal information disclosed to the nonaffiliated third party;

and (ii) are reasonably designed to help protect the personal information from unauthorized access, use, modification, disclosure, or destruction”;

WHEREAS, [List governing authority] authorizes the State to process Personal Information (PI) for the purpose(s) [insert list of authorized purpose (s)] (“Authorized Purpose”);

WHEREAS, pursuant to the Underlying Contract, the State provides to Processor PI listed in APPENDIX A, only for the Authorized Purpose for Processor to fulfill the services specified in the Underlying Contract;

WHEREAS, the Parties desire to enter into this Agreement for the purposes of ensuring the confidentiality, privacy and security of data provided to or accessed by Processor or exchanged between the Parties under and in connection with the Underlying Contract and in compliance with the PIGA and any other applicable State or federal privacy laws.

NOW THEREFORE, for and in consideration of the mutual promises and of other good and valuable consideration herein contained, the Parties, intending to be legally bound, hereby agree as follows:

Attachment Y. Data Use Agreement

Attachment Y. Data Usage Agreement Effective Date: July 2024

A. Definitions

1. Confidentiality means the protection of data from unauthorized access, use, and disclosure, including means for protecting personal privacy and proprietary information.

2. Data subject means any individual person whose Personal Information is provided to or accessed by

Processor or exchanged between the Parties in connection with services provided by Processor under the

Underlying Contract.

3. Entity means a person or organization possessing separate and distinct legal rights.

4. Personal Information (PI) means:

a. an individual's first name or first initial and last name, personal mark, or unique biometric or genetic print or image, in combination with one or more of the following data elements:

i) A Social Security number, an Individual Taxpayer Identification number, a passport number, or other identification number issued by the federal government;

ii) A driver's license number or state identification card number;

iii) A financial or other account number, a credit card number, or a debit card number that, in combination with any required security code, access code, or password, would permit access to an individual’s account; or

b. Username or email address in combination with a password or security question and answer that permits access to an individual's email account.

5. Privacy means the right of a party to maintain control over and confidentiality of information about itself.

6. Processor means a person that processes personal data by manual or automated means, including collecting, using, storing, disclosing, analyzing, deleting or modifying personal data.

7. Reasonable security measures means data security procedures and practices developed, in good faith, and set forth in a written information security policy that are (i) appropriate to the nature of the Personal

Information disclosed to the Processor; and (ii) are reasonably designed to protect the Personal Information from unauthorized access, use, modification, disclosure, or destruction.

8. Security Breach means the unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of Personal Information maintained by the Processor.

B. Permitted Uses and Disclosure of Personal Information

1. The Processor may only use or disclose PI as necessary to perform the services set forth in the Underlying

Agreement and must limit uses and disclosures to the minimum extent necessary.

2. If the Processor is requested or required by law or by any governmental body to disclose any Personal

Information, the Processor shall, to the extent legally permissible, provide the State with prompt written notice of any such request or requirement so that the State may seek a protective order or other appropriate remedy and/or waive compliance with the provisions of this Agreement. In the absence of such protective order or waiver, the receiving party may disclose only such portion of the PI as is legally required or requested.

Attachment Y. Data Usage Agreement Effective Date: July 2024

3. The Processor may not sell the PI of any data subject or otherwise directly or indirectly receive remuneration in exchange, thereof. For the avoidance of doubt, this provision shall not preclude Processor from receiving payment for the provision of services set forth in the Underlying Agreement.

4. The Processor may not use or disclose PI for the purposes of marketing a product or service unless necessary to perform the services set forth in the Underlying Agreement or required by law. For the purposes of this provision, “marketing” shall mean a communication about a product or service that encourages recipients of the communication to purchase or use the product or service.

C. Processor Duties Relative to PI

1. The Processor shall use reasonable security measures to protect the privacy of PI including, but not limited to the following:

a. Limit disclosure of the information and details relating to a PI loss only to those with a need to know and who are bound by confidentiality obligations at least as restrictive as those set forth in this Agreement.

b. Safeguard PI always, regardless of whether the Processor’s employee, contractor, or agent is at their regular duty station.

c. Train individuals to whom access to PI is granted about privacy, IT Security, and confidentiality best practices and require their signed acknowledgment of understanding of and abidance to the training prior to credentialing them to access PI data and regularly, thereafter. (See Appendix

B: List of Processor personnel with Access to State PI)

d. Send emails containing PI only if encrypted and being sent to and being received by email addresses of persons authorized to receive such information.

e. If Processor uses a non-affiliated third party to perform services and discloses personal information to the third party, the contract must require the third party to implement and maintain reasonable security procedures no less stringent than those required in this Agreement;

f. Regularly review privacy and IT security policies, procedures, and practices to ensure compliance with PIGA and this Agreement; and,

g. Designate a person who addresses any complaints or questions data subjects may have pursuant to Processor’s privacy practices.

h. Promptly provide written notice to the State if it learns of any unauthorized use, misappropriation, or disclosure of any PI. Processor must, at its own expense, cooperate with the State in seeking injunctive or other equitable relief with respect to any unauthorized use, misappropriation, or disclosure of any Personal Information.

D. Security Breach Detection and Investigation

1. The Processor must give written notice to the State within one (1) - business day after the Processor discovers or is notified of the breach of the security of a system involving unauthorized use or disclosure of PI and provide information relating to the breach.

Attachment Y. Data Usage Agreement Effective Date: July 2024

2. Once it discovers or is notified that it incurred a breach of the security of a system, Processor must conduct in good faith a reasonable and prompt investigation to determine the likelihood that PI of a data subject has been or will be misused, i.e., for identity theft. If the investigation shows that there is a reasonable chance that the data will be misused, that Processor must abide by the underlying agreement’s requirement regarding responsibility to notify the affected data subjects.

E. Security Breach Notification

1. As soon as reasonably practicable, but not later than 45 days of the business’ discovery or notification of the breach of the security of a system, Processor must provide Notice to affected data subjects that is given in writing and sent to the most recent address of the data subject or meet the obligations under Title 10

§1305 (e) and (f).

2. A Processor may delay notification if requested by a law enforcement agency or to determine the scope of the breach, identify all the affected data subjects, or restore the integrity of the system. However, the

Processor must send notification within 7 days after the law enforcement agency determines that it will not impede a criminal investigation and will not jeopardize homeland or national security if the original 45– day period has already elapsed or within 45 days of becoming aware of the breach of the security of a system.

3. Notice may be sent via email if a data subject has already consented to receive electronic notices, or the

Processor primarily conducts its business via the Internet.

4. The Processor may provide notice of a security breach by email, posting on its website, and to statewide media if the cost of notice would exceed $100,000 or the number of data subjects to be notified exceeds

175,000 individuals.

F. In the Event of a Breach - Notice to Consumer Must Include:

1. To the extent possible, a description of the categories of information that were, or are reasonably believed to have been, acquired by an unauthorized person, including which of the elements of personal information were, or are reasonably believed to have been, acquired;

2. Contact information for the Processor’s designee who can address data subjects’ questions and concern, including a toll-free number if the Processor has one;

3. Toll-free numbers and addresses for each of the three credit reporting agencies: Equifax, Experian, and

TransUnion;

4. Toll-free numbers, addresses, and websites for the Federal Trade Commission (FTC) and the Maryland

Office of the Attorney General (OAG);

5. A statement that the data subject can obtain information from these sources about steps to avoid identity theft.

6. The Processor must provide a draft of the notification to and receive approval from the State prior to sending the notification to the OAG.

Attachment Y. Data Usage Agreement Effective Date: July 2024

G. Processor Notice to the Attorney General

1. Prior to sending notification to affected data subjects notify the Office of Attorney General.

a. At a minimum, the notice must include the number of affected Maryland residents, a description of the breach, including when and how it occurred, any steps the business has taken (or plans to take) relating to the breach of the security of a system, and the form of notice that will be sent to affected individuals and a sample notice.

b. All notifications shall be deemed to have been duly given (i) if delivered by hand or overnight courier service, mailed by certified or registered mail, or sent by email, as follows:

The OAG’s notification:

By U.S. Mail:

Office of the Attorney General

Attn: Security Breach Notification

200 St. Paul Place

Baltimore, MD 21202

With a copy to:

Attn: Security Breach Notification

(410) 576-6566

By Email:

Idtheft@oag.state.md.us

H. Term and Termination

1. Term

a. The Term of this Agreement shall be effective as of the date executed by the State below and shall terminate when all of the PI provided to or created or received by Processor in connection with the Underlying Agreement, is destroyed or returned to the State, in accordance with the termination provisions of sub (3) of this Section.

b. Destruction of Records. Processor shall have and abide by a data retention schedule. When, upon authorization by the State, Processor destroys records, Processor shall take reasonable steps to protect against unauthorized access to or use of personal information.

c. If it is impossible to return or destroy all the PI provided to, or created or received by Processor, Processor’s obligations under this Agreement shall be ongoing with respect to such information, unless and until a separate written agreement regarding that information is entered into with the

State.

2. Termination

a. The State may, by written notice to the Processor, terminate this Agreement in the event the Processor is in breach of any of its obligations herein or in the Underlying Contract and such breach is not cured to the State’s reasonable satisfaction within 15 days after receipt of notice from the State of the breach.

mailto:Idtheft@oag.state.md.us

Attachment Y. Data Usage Agreement Effective Date: July 2024

Notwithstanding anything to the contrary, the State may terminate this Agreement immediately if it determines that a cure is not possible.

3. Effect of Termination

a. Upon any termination of this Agreement, Processor shall return or, if agreed to by the State, destroy all

PI received from the State in connection with the Underlying Contract, or pursuant thereto the Processor created, maintained, or received on behalf of the State, Processor shall retain no copies of the PI. This provision shall apply to PI that is in the possession of Processor’s subcontractors or agents. If the return or destruction of all PI is not possible, the Processor shall maintain at least the same level of security to the data until such time as the data is destroyed or returned. The Processor shall attest to the return or destruction of PI. (See Appendix C: Certification of Data Destruction.)

b. In the event of any intentional, willful, or grossly negligent material breach by Processor of any obligation of this Agreement or applicable law, the State shall have the right to immediately terminate any contract then in force between the Parties, including but not limited to the Underlying Contract.

I. Survival

The obligations of the Processor under this Agreement shall survive its expiration or earlier termination.

J. Unfair or Deceptive Trade Practices.

A violation of the Maryland Personal Information Privacy Act is an unfair or deceptive trade practice as defined by the Maryland Consumer Protection Act.

K. General Provisions

This Agreement shall be governed and construed in accordance with the laws of the State of Maryland, without regard to its choice of law provisions. This Agreement is not intended to modify the Parties’ respective obligations to comply with any applicable federal, State, and local laws, rules, and regulations, or any obligations under the

Underlying Contract.

L. Ambiguity.

Any ambiguity in this Agreement shall be resolved to permit the State to comply with the PIGA [and any applicable state or federal privacy regulation(s))] and its provisions with respect to the privacy and security of personally identifiable information.

M. Regulatory References

A reference in this Agreement to a section in the PIGA, including any regulations promulgated thereto, means the section as in effect or as amended.

Attachment Y. Data Usage Agreement Effective Date: July 2024

N. Notices

All notices, requests, demands and other communications given under this Agreement shall be in writing and shall be deemed to have been given as of the posted date and time in the named email inbox, as follows:

Notice to State

Designated Agency Privacy Officer

Phone

Email Address

Notice to State

Agency Contract Monitor

With a Copy to:

Agency AAG Name

Notice to the Processor

Processor Designee

Mailing Address

Attachment Y. Data Usage Agreement Effective Date: July 2024

O. Entire Agreement

This Agreement sets forth the entire agreement and understanding of the Parties relating to the subject matter herein and supersedes all prior or contemporaneous discussions, understandings, and agreements, whether oral or written, between them relating to the subject matter hereof.

IN WITNESS WHEREOF, the parties hereto have caused this Agreement to be executed by their duly authorized representatives.

Executed on this day of 2024 Executed on this day of 2024

By: _________________________________ By: _______________________________

[Authorized Signatory] Processor Authorized Signatory

[Name of Agency]

Approved as to form and legal sufficiency this day of 2024.

By: _____________________________

Assistant Attorney General

[Name of Agency]

Attachment Y. Data Usage Agreement Effective Date: July 2024

DUA Appendix A: Types of Personal Information to Be Processed

Contract Number:

The listed types of personal information are required for the Processor to meet the service provisions written in the underlying contract. Alternatively, provide a schema of field names required to meet the stated service provisions.

Specific PI Type(s):

☐ First Name or Initial

☐ Last Name

☐ Address

☐ State or Government Issued Identification number (e.g., SSN, Driver’s license, passport, individual tax ID, …)

☐ Financial or other Account Number, Bank Account number, and any required security code, access code, or password

☐ Unique Biometric or Genetic print or image

☐ Geospatial Location

☐ Other:

In the event additional types of PI are processed in the future, a DUA modification that includes the new PI element(s) must be completed prior to processing the data.

Attachment Y. Data Usage Agreement Effective Date: July 2024

DUA Appendix B: List of Processor Personnel with Access to State PI

The Processor shall maintain a current list of personnel (similar to the format below) who are granted access to

Personal Information. The Processor shall provide the list to the State upon request.

Last Name, First Name, MI Job Position Date Granted Access Date Removed

Access

Attachment Y. Data Usage Agreement Effective Date: July 2024

DUA Appendix C: CERTIFICATION OF DATA DESTRUCTION

Vendor/Processor’s Name Processor’s Contact Name:

Pursuant to State Contract Number Processor’s Contact Phone:

Date(s) of Destruction State Representative Authorizing destruction

Description of Destroyed records, record series, or data sets – Include digital, tapes, hardware, paper

Inclusive Dates of Destroyed data or records

Method of Destruction (check) (Must be NIST compliant)

☐ Cross Shred ☐ Block Erase ☐ Degauss ☐ Incinerate

☐ Pulverize ☐ Cryptographic Erase ☐ Melt ☐ List Other:

Outsourced Data Destruction Vendor Name (attach certificate of destruction)

Outsourced Vendor Address

Do the destroyed records listed above constitute all records containing Personal Information/Personally

Identifiable Information provided to the Processor as part of the State Contract? ☐ Yes ☐ No

If Processor retains any PI/PII related to State Contract number ____________________, the Processor is bound by contract to maintain reasonable security measures to protect the data until the Processor securely returns the data to the State or destroys the data.

I attest that the above is true and accurate:

Authorized Signatory Name Title

Authorized Signature Date

Attachment Y. Data Usage Agreement Effective Date: July 2024

Witness Date