AgdaPkt 2020-11-23 Joint SA PFA - Laserfiche WebLink

Browse Search

6.D. - Page �58 of 179 DocuSign Env pe D: C4AD8365-4748-4C7A-957C-BDF25F9BOF3E 5.4. Breach Responsibilities. This section only applies when a Data Breach occurs with respect to Personal Data or Non -Public Data within the possession or control of Vendor. • Vendor, unless stipulated otherwise, shall immediately notify the appropriate City Identified Contact by telephone in accordance with the agreed upon security plan or security procedures if it reasonably believes there has been a Security Incident. • Vendor, unless stipulated otherwise, shall promptly notify the appropriate City Identified Contact within 48 hours or sooner by telephone, unless shorter time is required by applicable law, if it confirms that there is, or reasonably believes that there has been a Data Breach. Vendor shall (1) cooperate with the City as reasonably requested by the City to investigate and resolve the Data Breach, (2) promptly implement necessary remedial measures, if necessary, and (3) document responsive actions taken related to the Data Breach, including any post -incident review of events and actions taken to make changes in business practices in providing the Services, if necessary. ■ Unless otherwise stipulated, if a Data Breach is a direct result of Vendor's breach of its contractual obligation to encrypt Personal Data or otherwise prevent its release, Vendor shall bear the costs associated with (1) the investigation and resolution of the Data Breach; (2) notifications to individuals, regulators or others required by state law; (3) a credit monitoring service required by state (or federal) law; (4) a website or a toll-free number and call center for affected individuals required by state law — all not to exceed the average per record per person cost calculated for data breaches in the United States (currently $225 per record/person) in the most recent Cost of Data Breach Study: Global Analysis published by the Ponemon Institute at the time of the Data Breach; and (5) complete all corrective actions as reasonably determined by Vendor based on root cause. 5.5. Definitions. For purposes of this Purchase Agreement, the following definitions apply: • "Data Breach" means the unauthorized access by a non -authorized person/s that results in the use, disclosure or theft of City's unencrypted Personal Data or Non -Public Data. • "Non -Public Data" means data, other than Personal Data, that is not subject to distribution to the public as public information. It is deemed to be sensitive and confidential by the City because it contains information that is exempt by statute, ordinance or administrative rule from access by the general public as public information. • "Personal Data" means data that includes information relating to a person that identifies the person by name and has any of the following personally identifiable information (1311): government -issued identification numbers (e.g., Social Security, driver's license, passport, library account numbers); financial account information, including account number, credit or debit card numbers; or Protected Health Information (PHI) relating to a person. Personal Data also means any other information identified as "personal information" by California Civil Code Sections 1798.29, 1789.81.5 or 1798.82, as may be amended from time to time. • "Protected Health Information" (PHI) means individually identifiable health information transmitted by electronic media, maintained in electronic media, or transmitted or maintained in any other form or medium. PHI excludes education records covered by as amended, 20 U.S.C. 1232g, records described at 20 U.S.C. 1232g(a)(4)(B)(iv) and employment records held by a covered entity in its role as employer. REV: 11-19-2020 EI ATTY/AGR.2020.266/Axon (Page 15 of 36) 197