Enclosure 1G-Privacy Act Notif-25-SEP-2020.PDF

Argonne National Laboratory PD-163 (September 25, 2020)

PRIVACY ACT NOTIFICATION (APR 1984)

The Contractor will be required to design, develop, or operate a system of records on individuals to accomplish an agency function subject to the Privacy Act of 1974, Public Law 93-579 December 31, 1974 (5 U.S.C. 552a) and applicable agency regulations. Violation of the Act may involve the imposition of criminal penalties.

Contractor shall implement commercially reasonable measures that meet or exceed industry standards relative to the protection of any computing, data transmission or storage or any other information technology components, clients, hardware or systems, software, health or personally identifiable information (“PII”), data or content. Contractor shall comply with all applicable data privacy, data security and other laws, which shall be deemed incorporated by reference to the extent required by such laws. Some examples of such laws may include, without limitation, the following: Gramm-Leach-Bliley Act (“GLB”); Fair Credit Reporting Act (FCRA), 15 U.S.C. § 1681 et seq.; The Privacy Act of 1974, 5 USC 552a and rules and regulations thereunder; Health Insurance Portability and Accountability Act of 1996 ("HIPAA"); Illinois' Personal Information Protection Act - 815 ILCS 530/1; California's Security of Personal Information law - Civil Code Section 1798.81.5; California’s Consumer Privacy Act – Civil Code Section 1798.100;

Massachusetts' Standards for the Protection of Personal Information of Residents of the Commonwealth 201 CMR 17.00; and other laws, as applicable. Contractor shall promptly notify the Laboratory in writing in the event Contractor has reason to believe there has been or may be a violation of applicable law or, without the express and specific authorization of Argonne, access or introduction to, or destruction or compromise of, any computing, data transmission or storage or any other information technology components, clients, hardware or systems, software, PII, data or content owned, leased, licensed, operated or otherwise controlled by DOE, Argonne or any of its contractors/subcontractors, employees or agents (“Argonne Property”) as a result of anything supplied by Contractor to Argonne. No rights, title or interests in or to Argonne Property are assigned, transferred or granted, except the limited, temporary, revocable non-exclusive right to access or use the extent necessary for Contractor to fulfill its responsibilities, duties and liabilities owed to Argonne under an agreement. Contractor shall promptly provide Argonne with information and assistance reasonably necessary for Argonne to eliminate or mitigate such occurrences upon Argonne's request and, if such an occurrence is the result of anything supplied by Contractor to Argonne, without additional cost. Upon reasonable written request by Argonne, and subject to Contractor's duties to maintain confidentiality, Contractor shall supply Argonne with a description of the policies and procedures it employs to maintain PII and other information technology and data privacy and security measures as well as compliance with applicable laws.

Contractor shall provide any additional information reasonably requested by Argonne regarding the information technology and data privacy and security and legal compliance measures Contractor implements in relation to anything it supplies Argonne. Contractor shall comply with common security configurations available from the National Institute of Standards and Technology's website at http://checklists.nist.gov to the extent applicable, and all Argonne information technology and data privacy and security policies, which shall be made available to Contractor. Contractor shall reasonably assist Argonne in transitioning or migrating to or otherwise utilizing alternate technologies. Contractor shall not supply to Argonne counterfeit or used items or other things with misleading labeling, specifications or descriptions. Contractor shall not sell, assign release, disclose, disseminate, make available, transfer, communicate (orally, in writing or by other means) any data or personally identifiable information provided by Argonne.

Additionally, Contractor shall not use any data or personally identifiable information for any other purpose than satisfying its obligations under this contract; all other purposes, including cross-selling, soliciting or advertising to any individuals whose personally identifiable information is disclosed under this contract, is expressly prohibited without Argonne’s express written consent.

http://checklists.nist.gov/