In compliance with P.A. 16-189, An Act Concerning Student Data Privacy
This Connecticut Student Data Privacy Contract (the “Contract”) is between Intrado Interactive Services Corporation (“Contractor”) and the Client who purchases Services (each as defined in the underlying agreement(s) (the “Agreement”) between Contractor and Client) (“Client”) from Contractor. This Contract is incorporated herein by reference into the Agreement.
Article I. Definitions. For purposes of this Agreement, “directory information,” “de-identified student information,” “personally-identifiable information,” “school purposes,” “student information,” “student records,” “student-generated content,” and “targeted advertising,” shall be as defined by Public Act 16-189. “Education records” shall be defined by the Family Educational Rights and Privacy Act of 1974 (“FERPA”), codified at 20 U.S.C § 1232g (as amended); and its implementing regulations, 34 CFR 99.1 - 99.67 (as amended).
Article II. Purpose of Agreement: The Parties agree that the purpose of this Agreement is to detail the obligations of both Parties relative to the safety and confidentiality of student information, student records and student-generated content (collectively, “student data”), which student data may be provided to the Contractor in connection with Contractor’s provision the following professional and non-instructional services:
X Student data storage, maintenance, collection and/or analysis
Article III. General Provisions
A. All student data provided or accessed pursuant to this Agreement is and remains under the control of the Client. All student data are not the property of, or under the control of, the Contractor.
B. The Client may request that the Contractor delete student data in the Contractor’s possession by sending such request to the Contractor by electronic mail. The Contractor will delete the requested student data within two (2) business days of receiving such a request.
C. The Contractor shall not use student data for any purposes other than those authorized in this Agreement, and may not use student data for any targeted advertising.
D. If the Contractor receives a request to review student data in the Contractor’s possession directly from a student, parent, or guardian, the Contractor agrees to refer that individual to the Client and to notify the Client within two (2) business days of receiving such a request. The Contractor agrees to work cooperatively with the Client to permit a student, parent, or guardian to review personally identifiable information in student data that has been shared with the Contractor, and correct any erroneous information therein, by following the amendment procedures outlined in the Client’s Records / Confidentiality Policy, [5180.1].
Article IV. Security and Confidentiality of Student Data. The Contractor and the Client shall ensure that they each comply with the FERPA. Further, the Contractor shall take actions designed to ensure the security and confidentiality of student data, including but not limited to:
A. Using technologies and methodologies consistent with the guidance issued in the American Recovery and Reinvestment Act of 2009, Public Law 111-5, § 13402(h)(2), 42 U.S.C. § 17932;
B. Maintaining technical safeguards relating to the possession of education records in a manner consistent with 45 C.F.R. 164.312;
C. Otherwise meeting or exceeding industry standards relating to the safeguarding of confidential information.
Article V. Prohibited Uses of Student Data
A. The Contractor shall not use student data for any purposes other than those authorized pursuant to this Agreement.
B. The Contractor shall not retain, and the Client shall not otherwise make available, any student data upon completion of the contracted services.
C. During the entire effective period of this Agreement, the Client shall have control of any and all student data provided to or accessed by the Contractor. If a student, parent or guardian requests deletion of student data, the Contractor agrees to notify the Client immediately, but no later than two (2) business days after receiving such a request, and agrees to not delete such student data because it is controlled by the Client. The contractor shall destroy any and all student data within a reasonable period of time if the Client requests the deletion of such student data.
D. The Contractor shall not collect, store, or use student data or persistent unique identifiers for purposes other than the furtherance of school purposes, as determined by the Client.
Article VI. Data Breaches
A. Upon the discovery by the Contractor of a breach of security that results in the unauthorized release, disclosure, or acquisition of student data, the Contractor shall provide initial notice to the Client without unreasonable delay, but not later than thirty (30) days after such discovery (“Initial Notice”). The Initial Notice shall be delivered to the Client by electronic mail, and shall include the following information, to the extent known at the time of notification:
1. Date and time of the breach;
2. Names of student(s) whose student data was released, disclosed or acquired;
3. The nature and extent of the breach;
4. The Contractor’s proposed plan to investigate and remediate the breach.
B. Upon discovery by the Contractor of a breach, the Contractor shall conduct an investigation and restore the integrity of its data systems and, without unreasonable delay, but not later than sixty (60) days after discovery of the breach, shall provide the Client with a more detailed notice of the breach, including but not limited to the date and time of the breach; name(s) of the student(s) whose student data was released, disclosed or acquired; nature and extent of the breach; and measures taken to ensure that such a breach does not occur in the future.
C. The Contractor agrees to cooperate with the Client with respect to investigation of the breach.
D. Notwithstanding the breach notifications required in this Article, the Contractor shall provide the Client with a copy of the notification that it provides to a student or the parents or guardians of such student pursuant to Public Act 16-189. The copy of such notice shall be provided to the Client by electronic mail on the same date that it is provided to the student or parents or guardians of such student. The Parties agree that the following information shall be included in the Contractor’s notice of breach to a student or parent or guardian of a student:
1. Name of the student being notified whose student data was released, disclosed or acquired, which shall not include the names of other students;
2. Date and time of the breach.
Article VIII. Choice of Law, Choice of Forum, Merger, Severability
A. Choice of Law. The parties agree that this agreement and any disputes arising from or relating to this Agreement, including its formation and validity, shall be governed by the laws of the State of Connecticut.
B. Amendment. This Agreement may be changed, amended, or superseded, only upon an agreement in writing executed by both parties hereto.
C. Severability. A court finding of invalidity for any provision of this Agreement does not invalidate other provisions or applications that are not affected by the finding.