Student Data Privacy: Third Party Vendor Agreement
Restriction on Use of Confidential Information Agreement for Juab School District
SECTION 1 - PARTIES INVOLVED
This Restriction on Use of Confidential Information Agreement (referred to herein as "Agreement") is made and entered into by and between: Independent Contractor / Vendor Name (Print) ________________________________________ and Juab School District
SECTION 2 - RECITALS
Independent Contractor desires to enter into a business relationship with Juab School District to provide services that may require accessing information from the District. The parties desire to enter into the Agreement to allow the Independent Contractor such access upon the terms and conditions set forth below.
SECTION 3 - AGREEMENT
The parties agree as follows:
1. Any and all personally identifiable student or employee information including but not limited to name, address, telephone number, teachers, classes, grades, digital media and any other student or employee information of any kind is deemed confidential and shall not be released or disclosed in any form or manner unless authorized by District in writing. This restriction against release or disclosure also precludes sharing of data by Independent Contractor with any affiliate of Independent Contractor unless such sharing is expressly permitted under the contract or is expressly granted in writing by District. In addition, all information the release of which is prohibited by state or federal law or regulation, including but not limited to the protections of the Family Educational Rights and Privacy Act (referred to herein as "FERPA") and the Government Records Management Act (hereafter GRAMA) and the Utah Student Data Protection Act which is obtained by Independent Contractor from District, its students, faculty, or staff in the performance of this Agreement constitutes Confidential Information. Independent Contractor agrees to hold the Confidential Information in strictest confidence. Independent Contractor shall not use or disclose Confidential Information received from or on behalf of District or any of its students, faculty, or staff except as permitted or required by this Agreement, or otherwise as agreed in writing by District.
2. Independent Contractor agrees that any personally identifiable student data it obtains from the District shall only be used for the purpose of providing the contracted product or service to the District according to the terms of the contract. Independent Contractor may not sell student data except as permitted by Utah Code § 53A-1-1410(5) (relating to national assessment providers). (This does not prevent transfer of student data by purchase or merger of the Independent Contractor, so long as the successor entity remains bound by and in compliance with the terms of this agreement.)
3. Independent Contractor may not use personally identified student data for any secondary purpose including targeted advertising as that is defined in Utah Code § 53A-1-1402 of the Utah Student Data Protection Act. Independent Contractor may (a) use student data for adaptive learning or customized student learning processes; (b) market an educational application to a student's parent or guardian if Independent Contractor did not use student data shared by or collected on behalf of the District to do so; (c) use a recommendation engine within Independent Contractor's internal application to recommend learning or employment related content or services to the student, but only if the recommendation is not motivated by consideration from another party; (d) respond to a student request for information or feedback, but only if the response is not motivated by consideration from another party; (e) use student data to allow or improve functionality of Independent Contractors' internal application; and (f) identify for the student nonprofit institutions of higher education or scholarship providers that are seeking students who meet specific criteria, but only if Independent Contractor obtains, through the District, the written consent of the student's parent or guardian (or the student if age 18 or older or emancipated). (Written consent may not be required in certain instances for an Independent Contractor which is a national assessment provider.)
4. Independent Contractor agrees that its collection of student data shall fully comply with District's Data Governance Plan and further acknowledges that it has received a copy of that Plan and any questions about that Plan have been answered to its satisfaction.
5. Independent Contractor agrees that it will protect the Confidential Information it receives according to commercially acceptable standards and no less rigorously than it protects its own Confidential Information. Specifically, Independent Contractor shall implement, maintain, and use appropriate administrative, technical, and physical security measures to preserve the confidentially, integrity, and availability of all electronically maintained or transmitted Confidential Information. Any data that is transmitted to/from District will be secure. Any electronic data stored by the vendor must be secure and backed up with a tested data recovery strategy in place as approved by District.
6. Within 30 days of termination, cancellation, expiration, or other conclusion of this Agreement, or within 30 days of a request by District with regard to any portion of the data, Independent Contractor shall return to District or if return is not feasible, destroy and not retain any copies of any and all Confidential Information that is in possession of Independent Contractor and certify in writing that all copies of the confidential information in its possession have been destroyed. This requirement shall not apply, and Independent Contractor may retain, personally identifiable student data if Independent Contractor has obtained written consent of the student's parent or guardian (or from the student if 18 or older or emancipated) and provides documentation of that consent to the District.
7. The obligations of this Agreement shall not apply to any information which (a) is already in the public domain through no breach of this Agreement, including but not limited to information available through schools' web site(s); (b) was lawfully in Independent Contractor's possession prior to receipt from an District school, its faculty staff or students; or (c) is received by Independent Contractor independently from a person or entity free to lawfully disclose such information other than an District school, its faculty, staff, or students.
8. Independent Contractor warrants and represents that it shall, at all times, comply with the terms of this Agreement and with FERPA, GRAMA, and the Utah Student Data Protection Act and further agrees not to disclose or re-disclose to any person or entity for any purpose whatsoever any personally identifiable student information as that term is defined by this agreement, FERPA, GRAMA, or the Utah Student Data Protection Act. Independent
9. Contractor agrees that District or its designee may, upon request, audit Independent Contractor with respect to this Agreement to verify compliance with the Agreement and with the applicable requirements of law.
10. The undersigned representative of Vendor represents and warrants that he or she is authorized to sign this Agreement on behalf of Vendor and to bind Vendor to the covenants of this Agreement.
11. This Agreement may not be modified except by the written consent of the district.
SECTION 4 - DATA ENTITIES
Vendor shall provide a list of all student data elements requested from District, eg. Student First Name, Student Last Name, Student Grades, etc..
SECTION 5 - SIGNATURE
I declare under criminal penalty of the State of Utah that the foregoing is true and correct and that I sign this agreement as the duly authorized representative of Vendor.
Signature: _____________________________________
Date: ________________________
Download Student Data Privacy: Third Party Vendor Agreement (.PDF)
Download Student Data Privacy: Third Party Vendor Agreement (.docx)