Agmt18 Brainfuse, Inc. - Laserfiche WebLink

Browse Search

12.5.2 Consultant, unless stipulated otherwise, shall promptly notify the appropriate City Identified Contact within 24 hours or sooner by telephone, unless shorter time is required by applicable law, if it confirms that there is, or reasonably believes that there has been a Data Breach. Consultant shall (1) cooperate with the City as reasonably requested by the City to investigate and resolve the Data Breach, (2) promptly implement necessary remedial measures, if necessary, and (3) document responsive actions taken related to the Data Breach, including any post -incident review of events and actions taken to make changes in business practices in providing the Services, if necessary. 12.5.3 Unless otherwise stipulated, if a Data Breach is a direct result of Consultant's breach of its contractual obligation to encrypt Personal Data or otherwise prevent its release, Consultant shall bear the costs associated with (1) the investigation and resolution of the Data Breach; (2) notifications to individuals, regulators or others required by state law; (3) a credit monitoring service required by state (or federal) law; (4) a website or a toll-free number and call center for affected individuals required by state law — all not to exceed the average per record per person cost calculated for data breaches in the United States (currently $225 per record/person) in the most recent Cost of Data Breach Study: Global Analysis published by the Ponemon Institute at the time of the Data Breach; and (5) complete all corrective actions as reasonably determined by Consultant based on root cause. 12.6 Definitions. For purposes of this Agreement, the following definitions apply: 12.6.1 "Data Breach" means the unauthorized access by a non -authorized person/s that results in the use, disclosure or theft of City's unencrypted Personal Data or Non -Public Data. 12.6.2 "Non -Public Data" means data, other than Personal Data, that is not subject to distribution to the public as public information. It is deemed to be sensitive and confidential by the City because it contains information that is exempt by statute, ordinance or administrative rule from access by the general public as public information. 12.6.3 "Participating Students" means students who use the Services made available pursuant to this Agreement. 12.6.4 "Personal Data" means data that includes information relating to a person that identifies the person by name and has any of the following personally identifiable information (PII): government -issued identification numbers (e.g., Social Security, driver's license, passport, library account numbers); financial account information, including account number, credit REV: 01-10-18 JS Page 8 of 18 ATTY/AGR.2018.007/Brainfuse 2018