AgdaPkt 2020-11-23 Joint SA PFA - Laserfiche WebLink

Browse Search

6.D. - Page 129 of 179 shall bear the costs associated with (1) the investigation and resolution of the Data Breach; (2) notifications to individuals, regulators or others required by state law; (3) a credit monitoring service required by state (or federal) law; (4) a website or a toll-free number and call center for affected individuals required by state law — all not to exceed the average per record per person cost calculated for data breaches in the United States (currently $225 per record/person) in the most recent Cost of Data Breach Study: Global Analysis published by the Ponemon Institute at the time of the Data Breach; and (5) complete all corrective actions as reasonably determined by Vendor based on root cause. 5.5. Definitions. For purposes of this Purchase Agreement, the following definitions apply: • "Data Breach" means the unauthorized access by a non -authorized person/s that results in the use, disclosure or theft of City's unencrypted Personal Data or Non -Public Data. • "Non -Public Data" means data, other than Personal Data, that is not subject to distribution to the public as public information. It is deemed to be sensitive and confidential by the City because it contains information that is exempt by statute, ordinance or administrative rule from access by the general public as public information. • "Personal Data" means data that includes information relating to a person that identifies the person by name and has any of the following personally identifiable information (1311): government -issued identification numbers (e.g., Social Security, driver's license, passport, library account numbers); financial account information, including account number, credit or debit card numbers; or Protected Health Information (PHI) relating to a person. Personal Data also means any other information identified as "personal information" by California Civil Code Sections 1798.29, 1789.81.5 or 1798.82, as may be amended from time to time. • "Protected Health Information" (PHI) means individually identifiable health information transmitted by electronic media, maintained in electronic media, or transmitted or maintained in any other form or medium. PHI excludes education records covered by as amended, 20 U.S.C. 1232g, records described at 20 U.S.C. 1232g(a)(4)(B)(iv) and employment records held by a covered entity in its role as employer. • "City Data" means all data created or in any way originating with the City, and all data that is the output of computer processing of or other electronic manipulation of any data that was created by or in any way originated with the City, whether such data or output is stored on the City's hardware, Vendor's hardware or exists in any system owned, maintained or otherwise controlled by the City or by Vendor. City Data includes Cardholder data, including credit card account numbers, addresses, telephone numbers, CVV data, and other data related to a cardholder. • "City Identified Contact" means the person or persons designated in writing by the City to receive Security Incident or Data Breach notification. • "Security Incident" means the potentially unauthorized access by non -authorized persons to Personal Data or Non -Public Data Vendor believes could reasonably result in the use, disclosure or theft of City's unencrypted Personal Data or Non -Public Data within the possession or control of Vendor. A Security Incident may or may not turn into a Data Breach. O7P FORM 4000/2 168