Agmt18 Raycom Data Technologies Inc.

Browse Search

measures, if necessary, and (3) document responsive actions taken related to the Data Breach, including any post-incident review of events and actions taken to make changes in business practices in providing the Services, if necessary. Unless otherwise stipulated , if a Data Breach is a direct result of Consultant's breach of its contractual obligation to encrypt Personal Data or otherwise prevent its release, Consultant shall bear the costs associated with (1 ) the investigation and resolution of the Data Breach; (2) notifications to individuals, regulators or others required by state (or federal) law; (3) a credit monitoring service required by state (or federal) law; (4) a website or a toll-free number and call center for affected individuals required by state law all not to exceed the average per record per person cost calculated for data breaches in the United States (currently $225 per record/person) in the most recent Cost of Data Breach Study: Global Analysis published by the Ponemon Institute at the time of the Data Breach; and (5) complete all corrective actions as reasonably determined by Consultant based on root cause. 17.6 Definitions. For purposes of this Agreement, the following definitions apply: "Data Breach" means the unauthorized access by a non-authorized person/s that results in the use, disclosure or theft of City's unencrypted Personal Data or Non-Public Data. ii. "Non-Public Data" means data, other than Personal Data, that is not subject to distribution to the public as public information. It is deemed to be sensitive and confidential by the City because it contains information that is exempt by statute, ordinance or administrative rule from access by the general public as public information. iii. "Personal Data" means data that includes information relating to a person that identifies the person by name and has any of the following personally identifiable information (PI1): government- issued identification numbers (e.g., Social Security, driver's license, passport); financial account information, including account number, credit or debit card numbers; or Protected Health Information (PHI ) relating to a person . iv. Protected Health Information" (PHi ) means individually identifiable health information transmitted by electronic media, maintained in electronic media, or transmitted or maintained in any other form or medium. PHI excludes education records covered by as amended, 20 U.S.C. 1232g, records described at 20 U.S .C. 1232g(a)(4)(B)(iv) REV: 06-19-18 PR Page 8 of 23 ATTY/AGR.2018. 132/Raycom Data Technologies, Inc.