WI-LNRSFI Ts-Cs GD 06122019_ (003).docx

LexisNexis Risk Solutions FL Inc.

Exhibit C LexisNexis Risk Solutions Government Application & Agreement The information submitted on this Application will be used to determine the applicant’s eligibility for accessing the services and products of LexisNexis Risk Solutions FL Inc. and its affiliates (hereinafter “LN”). To avoid delay, please provide all information requested. By submitting this Application, the applicant hereby authorizes LN to independently verify the information submitted and perform research about the individuals identified. Acceptance of this Application does not automatically create a business relationship between LN and the applicant. LN reserves the right to reject this Application with or without cause and to request additional information. Applicant acknowledges and understands that LN will only allow applicant access to the LN Services if applicant’s credentials can be verified in accordance with LN’s internal credentialing procedures.

Section I – Agency Information – please do not use abbreviations

*If this is a cell, additional documents may be required

Physical Address where LN services will be accessed – P.O. Box/Mail Drops cannot be accepted (street, city, state, zip):

Previous address if at the current address less than 6 mos:

Agency information:

Other (please explain):

Section II – Administrator and Main Contact Information (for additional administrators, please provide additional sheets)

Required for local and municipal agencies:

Section III – Billing Information

No Yes – please provide proof of exemption

Do you require a PO number on invoice:

No Yes If Yes, provide PO Number:

Section IV – Business-to-Business Vendor Reference

Required for local and municipal agencies:

LexisNexis Risk Solutions FL Inc.

LexisNexis Risk Solutions FL Inc.

Confidential

Section V – Site Visits

Site visits may be required to assure Applicant eligibility for LN products or services. By submitting this Application, Applicant agrees to authorize a site visit by LN or its approved third-party, and agrees to cooperate in its completion. If the contact for coordinating the site visit is not identified above as the Administrator, please provide the site visit contact’s information below:

Contact Email Address:

Section VI – Terms and Conditions

Terms and conditions governing the use of the LN Services are available on Contract 505505-S18-SPI0009-02 online at http://www.lexisnexis.com/risk/masterterms/government and are incorporated into this Application & Agreement by reference as if stated in full herein. By signing below Applicant expressly certifies it has read the additional terms and conditions and agrees to be bound by them.

Signature

I HEREBY CERTIFY that I am authorized to execute this Application & Agreement on behalf of the Agency listed above and that I have direct knowledge of the facts stated above.

FCRA PERMISSIBLE USE CERTIFICATION - GOVERNMENT

SECTION 1. FCRA PERMISSIBLE PURPOSE

Customer, as a “User” of LexisNexis Risk Solutions Bureau LLC Consumer Reports, hereby certifies as follows:

1. The nature of Customer’s business is: .

2. Customer’s orders Consumer Reports from LN for the following purpose(s) under the Fair Credit Reporting Act (15 U.S.C. Sec. 1681 et seq) (“FCRA”) and such reports will not be used for any other purpose:

Please check all that apply (not all uses are available in every product):

(A) the consumer report is needed for the purpose of establishing an individual’s capacity to make child support payments or determining the appropriate level of such payments;

(B) the paternity of the consumer for the child to which the obligation relates has been established or acknowledged by the consumer in accordance with State laws under which the obligation arises (if required by those laws);

(C) the Customer has provided at least 10 days’ prior notice to the consumer whose report is requested, by certified or registered mail to the last known address of the consumer, that the report will be requested; and

(D) the consumer report will be kept confidential, will be used solely for a purpose described in subparagraph (A), and will not be used in connection with any other civil, administrative, or criminal proceeding, or for any other purpose.

If you have selected “with express written instructions of the consumer” above, please specify intended use:

3. The FCRA imposes criminal penalties – including a fine, up to two years in prison, or both – against anyone who knowingly and willfully obtains information on a consumer from a consumer reporting agency under false pretenses, and other penalties for anyone who obtains such consumer information without a permissible purpose.

SECTION 2. QUALIFIED ACCESS

Customer may be able to obtain full social security numbers (nine (9) digits) and driver’s license numbers (collectively, “QA Data”), if LN deems it appropriate, through some LN Services.

|_| Customer is NOT requesting access to QA Data

|_| Customer is requesting access to QA Data.

SECTION 3. DEATH MASTER FILE

For access to Limited Access DMF Data only.

I. Definitions. For purposes of this Certification, these terms are defined as follows:

a. DMF Agreement: The Limited Access Death Master File Non-federal Licensee Agreement for Use and Resale executed by LexisNexis Risk Data Retrieval Services LLC, on behalf of itself, its affiliates and subsidiaries, and its and their successors, with the federal government (NTIS, as below defined). The DMF Agreement form is found at www.lexisnexis.com/risk/DMFDocuments.

b. Certification Form: The Limited Access Death Master File Subscriber Certification Form executed by LexisNexis Risk Data Retrieval Services LLC, on behalf of itself, its affiliates and subsidiaries, and its and their successors, with the federal government (NTIS, as below defined). The Certification Form is found at www.lexisnexis.com/risk/DMFDocuments.

c. DMF: The federal Death Master File.

d. NTIS: National Technical Information Service, U.S. Department of Commerce

e. Open Access DMF: The DMF product made available through LN, which obtains the data from NTIS, and which does not include DMF with respect to any deceased individual at any time during the three-calendar-year period beginning on the date of the individual’s death. Open Access DMF data should not be accessed pursuant to this Certification but should be accessed pursuant to a customer contract for such DMF data that is not Limited Access DMF.

f. Limited Access DMF: Limited Access DMF includes DMF data with respect to any deceased individual at any time during the three-calendar-year period beginning on the date of the individual’s death. Limited Access DMF is made available through LN as a Certified Person, by NTIS. This Certification governs Customer’s access to Limited Access DMF from LN (or the applicable LN affiliate), whether full or partial Limited Access DMF records or indicators of deceased status, and via any format, including online, XML feed, or in-house file processing through LN.

II. Certification.

Customer’s access to the Limited Access DMF requires certification of purpose, as required by 15 CFR Part 1110 and section 1001 of Title 18, United States Code. Customer hereby certifies that it has the indicated permissible purpose(s) under part (a) of this Section II (“Certification”) and that it meets the requirements of part (b) of this Section II:

(a) Such Customer has a legitimate fraud prevention interest, or has a legitimate business purpose pursuant to a law, governmental rule, regulation, or fiduciary duty, will use the Limited Access DMF only for such purpose(s), and specifies the basis for so certifying as (choose any applicable purposes that apply to Customer’s use):

|_| Legitimate Fraud Prevention Interest: Customer has a legitimate fraud prevention interest to detect and prevent fraud and/or to confirm identities across its commercial business and/or government activities.

|_| Legitimate Business Purpose Pursuant to a Law, Governmental Rule, Regulation, or Fiduciary Duty: Customer has one or more of the purposes permitted under 42 USC 1306c including fraud prevention and ID verification purposes. Customer’s specific purpose(s) for obtaining Limited Access DMF data under this Certification is:

and

(b) Customer has systems, facilities, and procedures in place to safeguard Limited Access DMF, and experience in maintaining the confidentiality, security, and appropriate use of such information, pursuant to requirements similar to the requirements of section 6103(p)(4) of the Internal Revenue Code of 1986, and

(c) Customer agrees to satisfy the requirements of such section 6103(p)(4) as if such section applied to Customer.

III. Flow-down Agreement Terms and Conditions The Parties agree that the following terms and conditions are applicable to Recipient and ordering, access to, and use of Limited Access DMF:

1. Compliance with Terms of Agreement and CFR. Recipient of Limited Access DMF must comply with the terms of the Agreement and the requirements of 15 CFR Part 1110, as though set forth as a Subscriber therein, and Recipients may not further distribute the Limited Access DMF.

2. Change in Status. Should Recipient’s status change such that it would no longer have a permissible purpose to access Limited Access DMF under this Addendum, Recipient agrees to immediately notify LN in writing in the manner and format required for notices under the Contract. Should Recipient cease to have access rights to Limited Access DMF, Recipient shall destroy all Limited Access DMF, and will certify to LN in writing that is has destroyed all such DMF.

3. Security and Audit. Recipient will at all times have security provisions in place to protect the Limited Access DMF from being visible, searchable, harvestable or in any way discoverable on the World Wide Web. Recipient understands that any successful attempt by any person to gain unauthorized access to or use of the Limited Access DMF provided by LN may result in immediate termination of Recipient’s access and this Addendum. In addition, any successful attempt by any person to gain unauthorized access may under certain circumstances result in penalties as prescribed in 15 CFR § 1110.200 levied on Recipient and the person attempting such access. Recipient will take appropriate action to ensure that all persons accessing the Limited Access DMF it obtains from LN are aware of their potential liability for misuse or attempting to gain unauthorized access. Any such access or attempted access is a breach, or attempted breach, of security and Recipient must immediately report the same to NTIS at dmfcert@ntis.gov; and to LN by written notification to the LN Information Assurance and Data Protection Organization at 1000 Alderman Drive, Alpharetta, Georgia 30005 and by email (security.investigations@lexisnexis.com) and by phone (1-888-872-5375). Recipient agrees to be subject to audit by LN and/or NTIS to determine Recipient’s compliance with the requirements of this Addendum, the Agreement, and 15 CFR Part 1110. Recipient agrees to retain a list of all employees, contractors, and subcontractors to which it provides Limited Access DMF and to make that list available to NTIS and/or LN as part of any audits conducted hereunder. Recipient will not resell or otherwise redistribute the Limited Access DMF.

4. Penalties. Recipient acknowledges that failure to comply with the provisions of paragraph (3) of the Certification Form may subject Recipient to penalties under 15 CFR § 1110.200 of $1,000 for each disclosure or use, up to a maximum of $250,000 in penalties per calendar year, or potentially uncapped for willful disclosure.

5. Law, Dispute Resolution, and Forum. Recipient acknowledges that this Addendum is governed by the terms of federal law. Recipient acknowledges that the terms of Section 14 of the Agreement govern disagreement handling, and, without limitation to the foregoing, that jurisdiction is federal court.

6. Liability. The U.S. Government/NTIS and LN (a) make no warranty, express or implied, with respect to information provided under the Agreement, including but not limited to, implied warranties of merchantability and fitness for any particular use; (b) assume no liability for any direct, indirect or consequential damages flowing from any use of any part of the Limited Access DMF, including infringement of third party intellectual property rights; and (c) assume no liability for any errors or omissions in Limited Access DMF. The Limited Access DMF does have inaccuracies and NTIS and the Social Security Administration (SSA), which provides the DMF to NTIS, and LN, do not guarantee the accuracy of the Limited Access DMF. SSA does not have a death record for all deceased persons. Therefore, the absence of a particular person in the Limited Access DMF is not proof that the individual is alive. Further, in rare instances, it is possible for the records of a person who is not deceased to be included erroneously in the Limited Access DMF. Recipient specifically acknowledges the terms of Attachment B to the Agreement, which terms apply to Recipient.

7. Indemnification. To the extent not prohibited required by law, Recipient shall indemnify and hold harmless LN and NTIS and the Department of Commerce from all claims, liabilities, demands, damages, expenses, and losses arising from or in connection with Recipient’s, Recipient’s employees’, contractors’, or subcontractors’ use of the Limited Access DMF. This provision will include any and all claims or liability arising from intellectual property rights.

8. Survival. Provisions hereof related to indemnification, use and protection of Limited Access DMF, audit, disclaimer of warranties, and governing law shall survive termination of this Addendum.

9. Conflict of Terms. Recipient acknowledges that the terms of this Addendum, in the event of conflict with the terms of the Contract, apply in addition to, and not in lieu of, such Contract terms, with respect to the Limited Access DMF only.

AUTHORIZATION AND ACCEPTANCE OF TERMS

I HEREBY CERTIFY that I have direct knowledge of the facts stated above and that I am authorized to execute this Certification on behalf of the Customer listed above.

CUSTOMER:

Signature

NON-FCRA PERMISSIBLE USE CERTIFICATION – GOVERNMENT

Law Enforcement Agencies Only: Review and, if appropriate, certify to the following: Customer represents and warrants that it will use the LN Services solely for law enforcement purposes, which comply with applicable privacy laws including, but not limited to the GLBA and the DPPA. To certify, check here: |_| Proceed to SECTION 3. QUALIFIED ACCESS

SECTION 1. GLBA EXCEPTION/PERMISSIBLE PURPOSE - NOT APPLICABLE TO LAW ENFORCEMENT Some LN Services use and/or display nonpublic personal information that is governed by the privacy provisions of the GLBA. Customer certifies it has the permissible purposes under the GLBA to use and/or obtain such information, as marked below, and Customer further certifies it will use such information obtained from LN Services only for such purpose(s) selected below or, if applicable, for the purpose(s) indicated by Customer electronically while using the LN Services, which purpose(s) will apply to searches performed during such electronic session:

(At least one (1) must be checked to be permitted access to GLBA data)

SECTION 2. DPPA PERMISSIBLE USES - NOT APPLICABLE TO LAW ENFORCEMENT

Some LN Services use and/or display personal information, the use of which is governed by the DPPA. Customer certifies it has a permissible use under the DPPA to use and/or obtain such information and Customer further certifies it will use such information obtained from LN Services only for one (1) or more of the purposes selected below or for the purpose(s) indicated by Customer electronically while using the LN Services, which purpose(s) will apply to searches performed during such electronic session:

(At least one (1) must be checked to be permitted access to DPPA data)

(A) to verify the accuracy of personal information submitted by the individual to the business or its agents, employees, or contractors; and

(B) if such information as so submitted is not correct or is no longer correct, to obtain the correct information, but only for the purposes of preventing fraud by, pursuing legal remedies against, or recovering on a debt or security interest against, the individual.

With regard to the information that is subject to the DPPA, some state laws’ permissible uses may vary from the permissible uses identified above. In such cases, some state information may not be available under each permissible use listed above and/or Customer may be asked to certify to a permissible use permitted by applicable state law to obtain information from a specific state.

Customer agrees and certifies it will use the information described above only in accordance with the permissible uses selected above or those selected subsequently in connection with a specific information request.

SECTION 3. QUALIFIED ACCESS

Certain users (“Authorized Users”) may be able to obtain full social security numbers (nine (9) digits) and driver’s license numbers (collectively, “QA Data”), when appropriate, through some LN Services. Only those users that are within the Authorized User List below, and that use QA Data for an Authorized Use identified below, may qualify. To potentially qualify as an Authorized User, Customer must certify that its business is within the Authorized User List below and its use of QA Data is within the Authorized Use List below.

|_| Customer is NOT requesting access to QA Data. Proceed to SECTION 4. DEATH MASTER FILE

|_| Customer is requesting access to QA Data. Complete the sections below.

SOCIAL SECURITY NUMBERS

1. AUTHORIZED USER (At least one (1) must be checked to receive Social Security Numbers)

2. AUTHORIZED USE (At least one (1) must be checked to receive Social Security Numbers)

By selecting above, the Customer certifies that it is an Authorized User, and that it will use Social Security Numbers only for the purpose(s) it designated on the Authorized Use List and for no other purpose(s).

DRIVER’S LICENSE NUMBERS

1. AUTHORIZED USER (At least one (1) must be checked to receive Driver’s License Numbers)

2. AUTHORIZED USE (At least one (1) must be checked to receive Driver’s License Numbers)

By selecting above, the Customer certifies that it is an Authorized User, and that it will use Driver’s License Numbers only for the purpose(s) it designated on the Authorized Use List and for no other purpose(s).

SECTION 4. DEATH MASTER FILE

For access to Limited Access DMF Data only.

IV. Definitions. For purposes of this Certification, these terms are defined as follows:

a. DMF Agreement: The Limited Access Death Master File Non-federal Licensee Agreement for Use and Resale executed by LexisNexis Risk Data Retrieval Services LLC, on behalf of itself, its affiliates and subsidiaries, and its and their successors, with the federal government (NTIS, as below defined). The DMF Agreement form is found at www.lexisnexis.com/risk/DMFDocuments.

b. Certification Form: The Limited Access Death Master File Subscriber Certification Form executed by LexisNexis Risk Data Retrieval Services LLC, on behalf of itself, its affiliates and subsidiaries, and its and their successors, with the federal government (NTIS, as below defined). The Certification Form is found at www.lexisnexis.com/risk/DMFDocuments.

c. DMF: The federal Death Master File.

d. NTIS: National Technical Information Service, U.S. Department of Commerce

e. Open Access DMF: The DMF product made available through LN, which obtains the data from NTIS, and which does not include DMF with respect to any deceased individual at any time during the three-calendar-year period beginning on the date of the individual’s death. Open Access DMF data should not be accessed pursuant to this Certification but should be accessed pursuant to a customer contract for such DMF data that is not Limited Access DMF.

f. Limited Access DMF: Limited Access DMF includes DMF data with respect to any deceased individual at any time during the three-calendar-year period beginning on the date of the individual’s death. Limited Access DMF is made available through LN as a Certified Person, by NTIS. This Certification governs Customer’s access to Limited Access DMF from LN (or the applicable LN affiliate), whether full or partial Limited Access DMF records or indicators of deceased status, and via any format, including online, XML feed, or in-house file processing through LN.

V. Certification.

Customer’s access to the Limited Access DMF requires certification of purpose, as required by 15 CFR Part 1110 and section 1001 of Title 18, United States Code. Customer hereby certifies that it has the indicated permissible purpose(s) under part (a) of this Section II (“Certification”) and that it meets the requirements of part (b) of this Section II:

(d) Such Customer has a legitimate fraud prevention interest, or has a legitimate business purpose pursuant to a law, governmental rule, regulation, or fiduciary duty, will use the Limited Access DMF only for such purpose(s), and specifies the basis for so certifying as (choose any applicable purposes that apply to Customer’s use):

|_| Legitimate Fraud Prevention Interest: Customer has a legitimate fraud prevention interest to detect and prevent fraud and/or to confirm identities across its commercial business and/or government activities.

|_| Legitimate Business Purpose Pursuant to a Law, Governmental Rule, Regulation, or Fiduciary Duty: Customer has one or more of the purposes permitted under 42 USC 1306c including fraud prevention and ID verification purposes. Customer’s specific purpose(s) for obtaining Limited Access DMF data under this Certification is:

and

(e) Customer has systems, facilities, and procedures in place to safeguard Limited Access DMF, and experience in maintaining the confidentiality, security, and appropriate use of such information, pursuant to requirements similar to the requirements of section 6103(p)(4) of the Internal Revenue Code of 1986, and

(f) Customer agrees to satisfy the requirements of such section 6103(p)(4) as if such section applied to Customer.

VI. Flow-down Agreement Terms and Conditions The Parties agree that the following terms and conditions are applicable to Recipient and ordering, access to, and use of Limited Access DMF:

10. Compliance with Terms of Agreement and CFR. Recipient of Limited Access DMF must comply with the terms of the Agreement and the requirements of 15 CFR Part 1110, as though set forth as a Subscriber therein, and Recipients may not further distribute the Limited Access DMF.

11. Change in Status. Should Recipient’s status change such that it would no longer have a permissible purpose to access Limited Access DMF under this Addendum, Recipient agrees to immediately notify LN in writing in the manner and format required for notices under the Contract. Should Recipient cease to have access rights to Limited Access DMF, Recipient shall destroy all Limited Access DMF, and will certify to LN in writing that is has destroyed all such DMF.

12. Security and Audit. Recipient will at all times have security provisions in place to protect the Limited Access DMF from being visible, searchable, harvestable or in any way discoverable on the World Wide Web. Recipient understands that any successful attempt by any person to gain unauthorized access to or use of the Limited Access DMF provided by LN may result in immediate termination of Recipient’s access and this Addendum. In addition, any successful attempt by any person to gain unauthorized access may under certain circumstances result in penalties as prescribed in 15 CFR § 1110.200 levied on Recipient and the person attempting such access. Recipient will take appropriate action to ensure that all persons accessing the Limited Access DMF it obtains from LN are aware of their potential liability for misuse or attempting to gain unauthorized access. Any such access or attempted access is a breach, or attempted breach, of security and Recipient must immediately report the same to NTIS at dmfcert@ntis.gov; and to LN by written notification to the LN Information Assurance and Data Protection Organization at 1000 Alderman Drive, Alpharetta, Georgia 30005 and by email (security.investigations@lexisnexis.com) and by phone (1-888-872-5375). Recipient agrees to be subject to audit by LN and/or NTIS to determine Recipient’s compliance with the requirements of this Addendum, the Agreement, and 15 CFR Part 1110. Recipient agrees to retain a list of all employees, contractors, and subcontractors to which it provides Limited Access DMF and to make that list available to NTIS and/or LN as part of any audits conducted hereunder. Recipient will not resell or otherwise redistribute the Limited Access DMF.

13. Penalties. Recipient acknowledges that failure to comply with the provisions of paragraph (3) of the Certification Form may subject Recipient to penalties under 15 CFR § 1110.200 of $1,000 for each disclosure or use, up to a maximum of $250,000 in penalties per calendar year, or potentially uncapped for willful disclosure.

14. Law, Dispute Resolution, and Forum. Recipient acknowledges that this Addendum is governed by the terms of federal law. Recipient acknowledges that the terms of Section 14 of the Agreement govern disagreement handling, and, without limitation to the foregoing, that jurisdiction is federal court.

15. Liability. The U.S. Government/NTIS and LN (a) make no warranty, express or implied, with respect to information provided under the Agreement, including but not limited to, implied warranties of merchantability and fitness for any particular use; (b) assume no liability for any direct, indirect or consequential damages flowing from any use of any part of the Limited Access DMF, including infringement of third party intellectual property rights; and (c) assume no liability for any errors or omissions in Limited Access DMF. The Limited Access DMF does have inaccuracies and NTIS and the Social Security Administration (SSA), which provides the DMF to NTIS, and LN, do not guarantee the accuracy of the Limited Access DMF. SSA does not have a death record for all deceased persons. Therefore, the absence of a particular person in the Limited Access DMF is not proof that the individual is alive. Further, in rare instances, it is possible for the records of a person who is not deceased to be included erroneously in the Limited Access DMF. Recipient specifically acknowledges the terms of Attachment B to the Agreement, which terms apply to Recipient.

16. Indemnification. To the extent required by not prohibited by law, Recipient shall indemnify and hold harmless LN and NTIS and the Department of Commerce from all claims, liabilities, demands, damages, expenses, and losses arising from or in connection with Recipient’s, Recipient’s employees’, contractors’, or subcontractors’ use of the Limited Access DMF. This provision will include any and all claims or liability arising from intellectual property rights. Comment by Worrall, James F. (LNSSI-DC): LN cannot agree to these changes see comment above these are flow down terms from NTIS Comment by Matschull, Susanne - DOA: That is fine.

17. Survival. Provisions hereof related to indemnification, use and protection of Limited Access DMF, audit, disclaimer of warranties, and governing law shall survive termination of this Addendum.

18. Conflict of Terms. Recipient acknowledges that the terms of this Addendum, in the event of conflict with the terms of the Contract, apply in addition to, and not in lieu of, such Contract terms, with respect to the Limited Access DMF only.

AUTHORIZATION AND ACCEPTANCE OF TERMS

I HEREBY CERTIFY that I have direct knowledge of the facts stated above and that I am authorized to execute this Certification on behalf of the Customer listed above.

CUSTOMER:

Signature

FCRA Addendum to the LexisNexis Master Terms and Conditions (form LNMTC)

This FCRA Addendum (the “FCRA Addendum”) is entered into as of (the “Effective Date”), by and between LexisNexis Risk Solutions Bureau LLC and its Affiliates (hereinafter, “LNRSB”), with its principal place of business located at 1000 Alderman Drive, Alpharetta, Georgia 30005 and (hereinafter, "Customer"), with its principal place of business located at , each individually referred to as the “Party” and collectively as the “Parties.”

WHEREAS, Customer has executed the LexisNexis Master Terms and Conditions (form LNMTC) Contract 505505-S18-SPI009-02 (the “Master Terms”) for the LN Services (as defined in the Master Terms); and

WHEREAS, the Parties wish to add certain terms and conditions to the Master TermsContract 505505-S18-SPI0009-02 to govern the provision of FCRA LN Services (as defined below).

NOW, THEREFORE, LNRSB and Customer agree to be mutually bound by the additional terms and conditions of this FCRA Addendum, and for other good and valuable consideration, the receipt and sufficiency of which is hereby acknowledged, do hereby agree as follows:

1. Fair Credit Reporting Act Obligations. Customer certifies that when using the LN Services provided under this FCRA Addendum and identified in a Schedule A (as defined in the Master Terms) as an FCRA service (the “FCRA LN Services”), it will comply with all applicable provisions of the Fair Credit Reporting Act (15 U.S.C. § 1681, et seq.) (“FCRA”) and all other applicable federal, state and local legislation, regulations and rules. Without limiting the generality of the foregoing, Customer certifies that (a) Customer will comply with all applicable provisions of the California Credit Reporting Agencies Act and any related regulations; and (b) Customer will comply with all Vermont Wisconsin statutes and regulations on fair credit reporting, including but not limited to, obtaining the consent of Vermont Wisconsin residents prior to obtaining any information on Wisconsin residents through these FCRA LN Services. In addition, Customer certifies it has a permissible purpose under the FCRA for obtaining a Consumer Report as provided by the Customer in a separate certification, and will re-certify such permissible purpose to LNRSB upon request. Customer acknowledges that LNRSB has provided the “Notice to Users of Consumer Reports”, attached hereto as Attachment A, which informs users of consumer reports of their legal obligations under the FCRA. Comment by Worrall, James F. (LNSSI-DC): We cannot delete the references to applicable state law when using data from those states. Note that this states “applicable” Comment by Matschull, Susanne - DOA: That is fine.

2. General. Customer and LNRSB agree that: (i) capitalized terms used herein but not otherwise defined herein shall have the meanings ascribed to them in the Master Terms; (ii) this FCRA Addendum modifies and amends only those specific terms of the Master Terms expressly referenced herein; and (iii) all terms of Contract 505505-S18-SPI0009-02the Master Terms are hereby restated as if written herein, shall remain in full force and effect, and shall constitute the legal valid, binding and enforceable obligations of the parties; and (iv) the LexisNexis Risk Solutions Application, the Master TermsContract 505505-S18-SPI0009-02, the FCRA Addendum and the applicable Schedules A are collectively referred to as the “Agreement” for purposes of governing the provision and use of the FCRA LN Services.

I HEREBY CERTIFY that I am authorized to execute this FCRA Addendum on behalf of the Customer listed above.

CUSTOMER:

Signature

Attachment A

All users of consumer reports must comply with all applicable regulations. Information about applicable regulations currently in effect can be found at the Consumer Financial Protection Bureau’s website, www.consumerfinance.gov/learnmore.

NOTICE TO USERS OF CONSUMER REPORTS:

OBLIGATIONS OF USERS UNDER THE FCRA

The Fair Credit Reporting Act (FCRA), 15 U.S.C. §1681-1681y, requires that this notice be provided to inform users of consumer reports of their legal obligations. State law may impose additional requirements. The text of the FCRA is set forth in full at the Consumer Financial Protection Bureau’s (CFPB) website at www.consumerfinance.gov/learnmore. At the end of this document is a list of United States Code citations for the FCRA. Other information about user duties is also available at the CFPB’s website. Users must consult the relevant provisions of the FCRA for details about their obligations under the FCRA.

The first section of this summary sets forth the responsibilities imposed by the FCRA on all users of consumer reports. The subsequent sections discuss the duties of users of reports that contain specific types of information, or that are used for certain purposes, and the legal consequences of violations. If you are a furnisher of information to a consumer reporting agency (CRA), you have additional obligations and will receive a separate notice from the CRA describing your duties as a furnisher.

I. OBLIGATIONS OF ALL USERS OF CONSUMER REPORTS

A. Users Must Have a Permissible Purpose

Congress has limited the use of consumer reports to protect consumers’ privacy. All users must have a permissible purpose under the FCRA to obtain a consumer report. Section 604 contains a list of the permissible purposes under the law. These are:

• As ordered by a court or a federal grand jury subpoena. Section 604(a)(1)

• As instructed by the consumer in writing. Section 604(a)(2)

• For the extension of credit as a result of an application from a consumer, or the review or collection of a consumer’s account. Section 604(a)(3)(A)

• For employment purposes, including hiring and promotion decisions, where the consumer has given written permission. Sections 604(a)(3)(B) and 604(b)

• For the underwriting of insurance as a result of an application from a consumer. Section 604(a)(3)(C)

• When there is a legitimate business need, in connection with a business transaction that is initiated by the consumer. Section 604(a)(3)(F)(i)

• To review a consumer’s account to determine whether the consumer continues to meet the terms of the account. Section 604(a)(3)(F)(ii)

• To determine a consumer’s eligibility for a license or other benefit granted by a governmental instrumentality required by law to consider an applicant’s financial responsibility or status. Section 604(a)(3)(D)

• For use by a potential investor or servicer, or current insurer, in a valuation or assessment of the credit or prepayment risks associated with an existing credit obligation. Section 604(a)(3)(E)

• For use by state and local officials in connection with the determination of child support payments, or modifications and enforcement thereof. Sections 604(a)(4) and 604(a)(5)

In addition, creditors and insurers may obtain certain consumer report information for the purpose of making “prescreened” unsolicited offers of credit or insurance. Section 604(c). The particular obligations of users of “prescreened” information are described in Section VII below.

B. Users Must Provide Certifications

Section 604(f) prohibits any person from obtaining a consumer report from a consumer reporting agency (CRA) unless the person has certified to the CRA the permissible purpose(s) for which the report is being obtained and certifies that the report will not be used for any other purpose.

C. Users Must Notify Consumers When Adverse Actions Are Taken

The term “adverse action” is defined very broadly by Section 603. “Adverse actions” include all business, credit, and employment actions affecting consumers that can be considered to have a negative impact as defined by Section 603(k) of the FCRA – such as denying or canceling credit or insurance, or denying employment or promotion. No adverse action occurs in a credit transaction where the creditor makes a counteroffer that is accepted by the consumer.

1. Adverse Actions Based on Information Obtained From a CRA

If a user takes any type of adverse action as defined by the FCRA that is based at least in part on information contained in a consumer report, Section 615(a) requires the user to notify the consumer. The notification may be done in writing, orally, or by electronic means. It must include the following:

• The name, address, and telephone number of the CRA (including a toll-free telephone number, if it is a nationwide CRA) that provided the report.

• A statement that the CRA did not make the adverse decision and is not able to explain why the decision was made.

• A statement setting forth the consumer’s right to obtain a free disclosure of the consumer’s file from the CRA if the consumer makes a request within 60 days.

• A statement setting forth the consumer’s right to dispute directly with the CRA the accuracy or completeness of any information provided by the CRA.

2. Adverse Actions Based on Information Obtained From Third Parties Who Are Not Consumer Reporting Agencies

If a person denies (or increases the charge for) credit for personal, family, or household purposes based either wholly or partly upon information from a person other than a CRA, and the information is the type of consumer information covered by the FCRA, Section 615(b)(1) requires that the user clearly and accurately disclose to the consumer his or her right to be told the nature of the information that was relied upon if the consumer makes a written request within 60 days of notification. The user must provide the disclosure within a reasonable period of time following the consumer’s written request.

3. Adverse Actions Based on Information Obtained From Affiliates

If a person takes an adverse action involving insurance, employment, or a credit transaction initiated by the consumer, based on information of the type covered by the FCRA, and this information was obtained from an entity affiliated with the user of the information by common ownership or control, Section 615(b)(2) requires the user to notify the consumer of the adverse action. The notice must inform the consumer that he or she may obtain a disclosure of the nature of the information relied upon by making a written request within 60 days of receiving the adverse action notice. If the consumer makes such a request, the user must disclose the nature of the information not later than 30 days after receiving the request. If consumer report information is shared among affiliates and then used for an adverse action, the user must make an adverse action disclosure as set forth in I.C.1 above.

D. Users Have Obligations When Fraud and Active Duty Military Alerts are in Files

When a consumer has placed a fraud alert, including one relating to identity theft, or an active duty military alert with a nationwide consumer reporting agency as defined in Section 603(p) and resellers, Section 605A(h) imposes limitations on users of reports obtained from the consumer reporting agency in certain circumstances, including the establishment of a new credit plan and the issuance of additional credit cards. For initial fraud alerts and active duty alerts, the user must have reasonable policies and procedures in place to form a belief that the user knows the identity of the applicant or contact the consumer at a telephone number specified by the consumer; in the case of extended fraud alerts, the user must contact the consumer in accordance with the contact information provided in the consumer’s alert.

E. Users Have Obligations When Notified of an Address Discrepancy

Section 605(h) requires nationwide CRAs, as defined in Section 603(p), to notify users that request reports when the address for a consumer provided by the user in requesting the report is substantially different from the addresses in the consumer’s file. When this occurs, users must comply with regulations specifying the procedures to be followed. Federal regulations are available at www.consumerfinance.gov/learnmore.

F. Users Have Obligations When Disposing of Records

Section 628 requires that all users of consumer report information have in place procedures to properly dispose of records containing this information. Federal regulations have been issued that cover disposal.

II. CREDITORS MUST MAKE ADDITIONAL DISCLOSURES

If a person uses a consumer report in connection with an application for, or a grant, extension, or provision of, credit to a consumer on material terms that are materially less favorable than the most favorable terms…