Common use of CONFIDENTIALITY; RESTRICTIONS ON USE OF INFORMATION Clause in Contracts

CONFIDENTIALITY; RESTRICTIONS ON USE OF INFORMATION. 9.1 XXXX and Bank One each acknowledge that in the course of the operations contemplated by this Agreement, and in the course of communications relative to this Agreement, it has received and will receive information concerning the other's finances, business plans, business methods, and the like that is not generally known in the student loan industry ("Confidential Information"). Each party will respect and use all reasonable efforts to maintain the confidentiality of the other's Confidential Information unless and until such information becomes generally known through no fault of the receiving party. Without limiting the foregoing, XXXX may disclose any of Bank One's Confidential Information to any entity to which XXXX subcontracts its obligations under this Agreement pursuant to Section 6.7(b) hereof. 9.2 In accordance with the provisions of Title V of the Xxxxx-Xxxxx-Xxxxxx Act (the "GLB Act") and Federal Reserve Board Regulation P ("Regulation P"), XXXX agrees to respect and protect the security and confidentiality of any "nonpublic personal information" (as defined in the GLB Act and Regulation P) relating to applicants for Loans and to Borrowers, including, where applicable, the restrictions on the re-use and disclosure of such information set forth in the GLB Act and Regulation P. 9.3 Without limiting the foregoing, XXXX may retain as its own property and use for any lawful purpose any or all aggregated or de-identified data concerning Loan applicants and Borrowers which does not include the name, address or social security number of the Loan applicants or Borrowers. XXXX may sell, assign, transfer or disclose such information to third parties including, without limitation, FMC, who may also use such information for any lawful purpose. 14 <PAGE> 9.4 Both XXXX and Bank One have made and will continue throughout the term of this Agreement to make available to the other party confidential and proprietary materials and information ("Proprietary Information"). Prospectively, each party shall advise the other of material and information that is confidential and/or proprietary. All material and information provided by either party to the other relating to the business, policies, procedures, customs, forms, customers and strategies of the providing party or any of its affiliates, including information previously divulged or delivered to the other party regarding the aforementioned subject matter is hereby designated as confidential and proprietary and shall be considered to be Proprietary Information. It is understood that the obligations set forth in this Section do not apply to materials or information that: (i) are already, or otherwise become, generally known by third parties as a result of no act or omission of the receiving party; (ii) subsequent to disclosure hereunder are lawfully received from a third party having the right to disseminate the information without restriction on disclosure; (iii) are generally furnished to others by the disclosing party without restriction on disclosure; (iv) were already known by the receiving party prior to receiving them from the disclosing party and were not received from a third party in breach of that third party's obligations of confidentiality; or (v) are independently developed by the receiving party without the use of Proprietary Information of the disclosing party. 9.5 Each party shall maintain the confidentiality of the other party's Proprietary Information and will not use or disclose such Proprietary Information without the prior written consent of the other party. Notwithstanding the foregoing, either party may disclose the other's Proprietary Information to its affiliates, agents, and other third parties on a need-to-know basis, provided that such parties are under a similar obligation to maintain the confidentiality of such Proprietary Information. 9.6 Further, each party may disclose the other's Proprietary Information in a judicial or quasi-judicial proceeding when required to do so by law when responding to a subpoena, deposition notice or similar judicial or governmental demand; in such situations, however, the party being requested to disclose the other's Proprietary Information shall endeavor to provide notice to the other party whereby the other party may intervene in the proceeding, if it wishes, and endeavor to prevent such disclosure. Additionally, each party may disclose the other's Proprietary Information to the various regulatory agencies having jurisdiction over the disclosing party. 9.7 Notwithstanding any contrary provision of this Agreement, as long as each party protects the Proprietary Information of the other, neither the exposure to the other party's Proprietary Information, nor its ownership of work products, shall prevent either party from using ideas, concepts, expressions, know-how, skills and experience possessed by either party prior to its association with the other party or developed by either party during its association with the other party, so long as the Proprietary Information of the other party is not used. 9.8 All capitalized terms used in this subsection and not otherwise defined shall have the meanings set forth in the Federal "Privacy of Consumer Financial Information" Regulation (12 CFR Part 40), as amended from time to time (the "Privacy Regulation"), 15 issued pursuant to Section 504 of the Xxxxx-Xxxxx-Xxxxxx Act (15 U.S.C. 6801 et seq.). The parties acknowledge that the Privacy Regulation governs disclosures of nonpublic personal information about consumers. a. XXXX hereby represents and warrants as follows with respect to any Nonpublic Personal Information released to XXXX by Bank One (A) XXXX controls access to the network on which any such Nonpublic Personal Information is stored, through the compliance with and utilization of its information security measures which restrict access; and (B) TERI's information security measures are consistent with Bank One's Information Security Standards, a copy of which are attached hereto as Exhibit E. b. XXXX hereby agrees that it shall: (A) Comply with the terms and provisions of the Privacy Regulation, including, without limitation, the provisions regarding the sharing of Nonpublic Personal Information (as defined in the Privacy Regulation); (B) Not disclose or use any Nonpublic Personal Information that it obtains from Bank One except to carry out the purposes for which Bank One provided such Nonpublic Personal Information, or as otherwise permitted by the Privacy Regulation and other applicable laws; (C) Comply with Bank One's Information Security Standards; (D) Not make any changes to its security measures that would increase the risk of an unauthorized access; and (E) Not disclose any Nonpublic Personal Information disclosed to XXXX by Bank One to any other entity, except as follows: (1) To Bank One's Affiliates, with the prior consent of Bank One. (2) To TERI's affiliates, provided, that its affiliates may, in turn, disclose and use the information only to the extent that XXXX may disclose and use the information; (3) To an unaffiliated third party, in the ordinary course of business in order to carry out the activity for which the information was disclosed to XXXX pursuant to one of the following exceptions to the Privacy Regulation: (i) as necessary to effect, administer or enforce a transaction that a consumer requests or authorizes; (ii) in connection with servicing or processing a financial product or service that a consumer requests or authorizes, or maintaining or servicing the consumer's account with Bank One; (iii) with the consent or at the direction of the consumer; or (iv) to protect the confidentiality or security of Bank One's records pertaining to the consumer, service, product or transaction; to protect against or prevent actual or potential fraud, unauthorized transactions, claims or other liability; for required institutional risk control; for resolving consumer disputes or inquiries; to persons holding a legal or beneficial interest relating to the consumer, or acting in a fiduciary or representative capacity on behalf of the consumer; to provide information to insurance rate advisory organizations, guaranty funds or agencies, or Bank One's attorneys, accountants and auditors; to the extent specifically permitted or required under other provisions of law, to law enforcement agencies, a state insurance authority, self-regulatory organizations or for an investigation on a matter related to public safety; to a consumer reporting agency in accordance with the Fair Credit Reporting Act; to comply with Federal, State or local laws, rules and other applicable legal requirements, or a properly authorized civil, criminal or regulatory investigation, or subpoena or summons; or to respond to judicial process or government regulatory authorities having jurisdiction over Bank One for examination, compliance or other purposes as authorized by law. c. At any time, upon Bank One's request, XXXX shall return to Bank One all Nonpublic Personal Information in its possession to which it is not entitled in its capacity as guarantor or owner of the loan. XXXX agrees that money damages would not be a sufficient remedy for any breach of this Section and that Bank One shall be entitled to seek injunctive or other equitable relief to remedy or prevent any breach or threatened breach of this Section by XXXX. Such remedy shall not be the exclusive remedy for any breach of this Section, but shall be in addition to all other rights and remedies available to Bank One at law or in equity. Finally, Bank One shall be under no obligation to take any action which, within Bank One's reasonable judgment, would constitute a violation of the Privacy Regulation or its internal privacy policies. 17 <PAGE> d. XXXX shall permit Bank One to audit its operations for compliance with Bank One's Information Security Standards, upon reasonable notice from Bank One. e. Notwithstanding any other term to the contrary contained herein, this Section regarding Privacy of Consumer Financial Information shall survive any termination, cancellation, expiration and/or rescission of this Agreement. 9.9 Nothing herein will be construed to prohibit XXXX from making, during or after the term of this Agreement, any use or disclosure of information concerning applicants or Borrowers so long as the identity of the applicant or Borrower, and the identity of Bank One as the lender, cannot be discerned by any third party to which such disclosure is made. Without limitation of the foregoing, XXXX will be free to sell to The First Marblehead Corporation statistical abstracts of de-identified data based on the Loans guaranteed under this Agreement. 9.10 This Agreement may be executed in counterparts, all of which taken together shall constitute one and the same instrument. Section 10: INSURANCE XXXX shall maintain insurance coverage of the types and in the amounts as set forth in Exhibit F. THE REMAINDER OF THIS PAGE IS INTENTIONALLY LEFT BLANK. 18 <PAGE>

CONFIDENTIALITY; RESTRICTIONS ON USE OF INFORMATION. 9.1 XXXX and Bank One each acknowledge that in 8.1 During the course of negotiating this Agreement and hereafter during the operations contemplated by pendency of this Agreement, and in the course of communications relative parties from time to this Agreement, it has received and will receive time may have revealed or may hereafter reveal to each other certain information concerning the other's finances, their respective business plans, business methods, financial data and the like projections, and/or information that is not generally known in the student loan industry (industry, including, without limitation, the terms and conditions of this Agreement. All the foregoing is referred to herein as "Confidential Information")." In TERI's case, its Confidential Information also includes, but is not limited to, information concerning the operation of its telephone and on-line loan applications procedures, and its online credit scoring system. Each party will use reasonable efforts to preserve the confidentiality of Confidential Information contained herein or disclosed to it by the other party, such efforts to be not less vigilant than those that such party uses to protect its own proprietary information. The foregoing is subject to the following qualifications: a. No party will be so bound with respect to information that is or becomes public knowledge in the student loan industry 35 <PAGE> (but if it does so through any fault of such party that fault will be considered a material breach of this Agreement); b. No party will be so bound with respect to information that is now or hereafter comes into its possession by its own documented independent efforts or from a third party who, so far as the recipient party has reason to believe, is under no comparable restriction with respect to such information; c. Either party may disclose Confidential Information to its attorneys, auditors, agents, and consultants who are bound to maintain the confidentiality of such information; d. Either party may disclose Confidential Information in the context of any regulatory review of its operations or as compelled by law, regulation, or court order, provided that in the context of a court order the party required to disclose will (i) give the other party prompt written notice upon learning of the requirement so that the other party may take appropriate action to prevent or limit the disclosure, (ii) consult with the other party and use all reasonable efforts to maintain agree on the confidentiality nature, form, timing and content of the otherdisclosure, (iii) except as otherwise agreed under (ii), disclose no more than its counsel advises is legally required, and (iv) inform the Court and all counsel concerned that such information is and should be treated as confidential information of the other party; and e. Information concerning Loans and Borrowers that comes into TERI's possession shall not be considered Confidential Information unless and until such information becomes generally known through no fault of the receiving partyLender. f. Without limiting the foregoing, XXXX may disclose any of Bank Onethe LENDER's Confidential Information to any entity to which XXXX subcontracts its obligations under this Agreement pursuant to Section 6.7(b5.7(e) hereof. 9.2 8.2 In accordance with the provisions of Title V of the Xxxxx-Xxxxx-Xxxxxx Act (the "GLB Act") and Federal Reserve Board Regulation P ("Regulation P"), XXXX agrees agrees, as a financial institution subject to Regulation P, to respect and protect the security and confidentiality of any "nonpublic personal information" (as defined in the GLB Act and Regulation P) relating to applicants for Loans and to Borrowers, including, where applicable, the restrictions on the re-use and disclosure of such information set forth in the GLB Act and Regulation P. 9.3 36 <PAGE> 8.3 Without limiting the foregoing, XXXX may retain as its own property and use for any lawful purpose any or all aggregated or de-identified data concerning Loan applicants and Borrowers which that does not include the namenames, address addresses or social security number of the Loan applicants or Borrowersnumbers. XXXX may sell, assign, transfer or disclose such aggregated or de-indentified data concerning Loan applicants and Borrowers that does not include names, addresses, social security numbers, account numbers, or any other identifying information to third parties including, without limitation, FMC, who may also use such information for any lawful purpose. 14 <PAGE> 9.4 Both XXXX and Bank One have made and will continue throughout the term of this Agreement to make available to the other party confidential and proprietary materials and information ("Proprietary Information"). Prospectively, each party shall advise the other of material and information that is confidential and/or proprietary. All material and information provided by either party to the other relating to the business, policies, procedures, customs, forms, customers and strategies of the providing party or any of its affiliates, including information previously divulged or delivered to the other party regarding the aforementioned subject matter is hereby designated as confidential and proprietary and shall be considered to be Proprietary Information. It is understood that the obligations set forth in this Section do not apply to materials or information that: (i) are already, or otherwise become, generally known by third parties as a result of no act or omission of the receiving party; (ii) subsequent to disclosure hereunder are lawfully received from a third party having the right to disseminate the information without restriction on disclosure; (iii) are generally furnished to others by the disclosing party without restriction on disclosure; (iv) were already known by the receiving party prior to receiving them from the disclosing party and were not received from a third party in breach of that third party's obligations of confidentiality; or (v) are independently developed by the receiving party without the use of Proprietary Information of the disclosing party. 9.5 Each party shall maintain the confidentiality of the other party's Proprietary Information and will not use or disclose such Proprietary Information without the prior written consent of the other party. Notwithstanding the foregoing, either party may disclose the other's Proprietary Information to its affiliates, agents, and other third parties on a need-to-know basis, provided that such parties are under a similar obligation to maintain the confidentiality of such Proprietary Information. 9.6 Further, each party may disclose the other's Proprietary Information in a judicial or quasi-judicial proceeding when required to do so by law when responding to a subpoena, deposition notice or similar judicial or governmental demand; in such situations, however, the party being requested to disclose the other's Proprietary Information shall endeavor to provide notice to the other party whereby the other party may intervene in the proceeding, if it wishes, and endeavor to prevent such disclosure. Additionally, each party may disclose the other's Proprietary Information to the various regulatory agencies having jurisdiction over the disclosing party. 9.7 Notwithstanding any contrary provision of this Agreement, as long as each party protects the Proprietary Information of the other, neither the exposure to the other party's Proprietary Information, nor its ownership of work products, shall prevent either party from using ideas, concepts, expressions, know-how, skills and experience possessed by either party prior to its association with the other party or developed by either party during its association with the other party, so long as the Proprietary Information of the other party is not used. 9.8 All capitalized terms used in this subsection and not otherwise defined shall have the meanings set forth in the Federal "Privacy of Consumer Financial Information" Regulation (12 CFR Part 40), as amended from time to time (the "Privacy Regulation"), 15 issued pursuant to Section 504 of the Xxxxx-Xxxxx-Xxxxxx Act (15 U.S.C. 6801 et seq.). 8.4 The parties acknowledge that a breach of any of the Privacy Regulation governs disclosures terms of nonpublic personal information about consumers. a. XXXX hereby represents and warrants as follows with respect to any Nonpublic Personal Information released to XXXX by Bank One (A) XXXX controls access this Section 8 would cause irreparable harm to the network on which any such Nonpublic Personal Information is stored, through the compliance with and utilization of its information security measures which restrict access; and (B) TERI's information security measures are consistent with Bank One's Information Security Standards, a copy of which are attached hereto as Exhibit E. b. XXXX hereby agrees that it shall: (A) Comply with the terms and provisions of the Privacy Regulation, including, without limitation, the provisions regarding the sharing of Nonpublic Personal Information (as defined in the Privacy Regulation); (B) Not disclose or use any Nonpublic Personal Information that it obtains from Bank One except to carry out the purposes non-breaching party for which Bank One provided such Nonpublic Personal Informationit could not be adequately compensated by monetary damages. Accordingly, or as otherwise permitted by the Privacy Regulation and other applicable laws; (C) Comply with Bank One's Information Security Standards; (D) Not make any changes to its security measures that would increase the risk of an unauthorized access; and (E) Not disclose any Nonpublic Personal Information disclosed to XXXX by Bank One to any other entity, except as follows: (1) To Bank One's Affiliates, with the prior consent of Bank One. (2) To TERI's affiliates, provided, that its affiliates mayboth parties agree that, in turn, disclose and use the information only addition to all other remedies available to the extent that XXXX may disclose and use the information; (3) To non-breaching party in an unaffiliated third partyaction at law, in the ordinary course event of business in order to carry out the activity for which the information was disclosed to XXXX pursuant to one of the following exceptions to the Privacy Regulation: (i) as necessary to effect, administer or enforce a transaction that a consumer requests or authorizes; (ii) in connection with servicing or processing a financial product or service that a consumer requests or authorizes, or maintaining or servicing the consumer's account with Bank One; (iii) with the consent or at the direction of the consumer; or (iv) to protect the confidentiality or security of Bank One's records pertaining to the consumer, service, product or transaction; to protect against or prevent actual or potential fraud, unauthorized transactions, claims or other liability; for required institutional risk control; for resolving consumer disputes or inquiries; to persons holding a legal or beneficial interest relating to the consumer, or acting in a fiduciary or representative capacity on behalf of the consumer; to provide information to insurance rate advisory organizations, guaranty funds or agencies, or Bank One's attorneys, accountants and auditors; to the extent specifically permitted or required under other provisions of law, to law enforcement agencies, a state insurance authority, self-regulatory organizations or for an investigation on a matter related to public safety; to a consumer reporting agency in accordance with the Fair Credit Reporting Act; to comply with Federal, State or local laws, rules and other applicable legal requirements, or a properly authorized civil, criminal or regulatory investigation, or subpoena or summons; or to respond to judicial process or government regulatory authorities having jurisdiction over Bank One for examination, compliance or other purposes as authorized by law. c. At any time, upon Bank One's request, XXXX shall return to Bank One all Nonpublic Personal Information in its possession to which it is not entitled in its capacity as guarantor or owner of the loan. XXXX agrees that money damages would not be a sufficient remedy for any breach of this Section and that Bank One shall be entitled to seek injunctive or other equitable relief to remedy or prevent any breach or threatened breach by either party of the terms of this Section by XXXX. Such remedy shall 8, the non-breaching party shall, without the necessity of proving actual damages or posting any bond or other security, be entitled to temporary and permanent injunctive relief, including, but not be limited to, specific performance of the exclusive remedy for any breach terms of this Section, but shall be in addition to all other rights and remedies available to Bank One at law or in equity. Finally, Bank One shall be under no obligation to take any action which, within Bank One's reasonable judgment, would constitute a violation of the Privacy Regulation or its internal privacy policies. 17 <PAGE> d. XXXX shall permit Bank One to audit its operations for compliance with Bank One's Information Security Standards, upon reasonable notice from Bank One. e. Notwithstanding any other term to the contrary contained herein, this Section regarding Privacy of Consumer Financial Information shall survive any termination, cancellation, expiration and/or rescission of this Agreement. 9.9 Nothing herein will be construed to prohibit XXXX from making, during or after the term of this Agreement, any use or disclosure of information concerning applicants or Borrowers so long as the identity of the applicant or Borrower, and the identity of Bank One as the lender, cannot be discerned by any third party to which such disclosure is made. Without limitation of the foregoing, XXXX will be free to sell to The First Marblehead Corporation statistical abstracts of de-identified data based on the Loans guaranteed under this Agreement. 9.10 This Agreement may be executed in counterparts, all of which taken together shall constitute one and the same instrument. Section 10: INSURANCE XXXX shall maintain insurance coverage of the types and in the amounts as set forth in Exhibit F. THE REMAINDER OF THIS PAGE IS INTENTIONALLY LEFT BLANK. 18 <PAGE>8." II.

CONFIDENTIALITY; RESTRICTIONS ON USE OF INFORMATION. 9.1 8.1 XXXX and Bank One the LENDER each acknowledge that in the course of the operations contemplated by this Agreement, and in the course of communications relative to this Agreement, it has received and will receive information concerning the other's finances, business plans, business methods, and the like that is not generally known in the student loan industry ("Confidential Information"). Each party will respect and use all reasonable efforts to maintain the confidentiality of the other's Confidential Information unless and until such information becomes generally known through no fault of the receiving party. Without limiting the foregoing, XXXX may disclose any of Bank OneLENDER's Confidential Information to any 10 <PAGE> entity to which XXXX subcontracts its obligations under this Agreement pursuant to Section 6.7(b5.7(b) hereof. 9.2 8.2 In accordance with the provisions of Title V of the Xxxxx-Xxxxx-Xxxxxx Act (the "GLB Act") and Federal Reserve Board Regulation P ("Regulation P"), XXXX agrees to respect and protect the security and confidentiality of any "nonpublic personal information" (as defined in the GLB Act and Regulation P) relating to applicants for Loans and to Borrowers, including, where applicable, the restrictions on the re-use and disclosure of such information set forth in the GLB Act and Regulation P. 9.3 8.3 Without limiting the foregoing, XXXX may retain as its own property and use for any lawful purpose any or all aggregated or de-identified data concerning Loan applicants and Borrowers Borrowers, which does not include the name, address or social security number of the Loan applicants or Borrowers. XXXX may sell, assign, transfer or disclose such information to third parties including, without limitation, FMC, who may also use such information for any lawful purpose. 14 <PAGE> 9.4 Both XXXX and Bank One have made and will continue throughout the term of this Agreement to make available to the other party confidential and proprietary materials and information ("Proprietary Information"). Prospectively, each party shall advise the other of material and information that is confidential and/or proprietary. All material and information provided by either party to the other relating to the business, policies, procedures, customs, forms, customers and strategies of the providing party or any of its affiliates, including information previously divulged or delivered to the other party regarding the aforementioned subject matter is hereby designated as confidential and proprietary and shall be considered to be Proprietary Information. It is understood that the obligations set forth in this Section do not apply to materials or information that: (i) are already, or otherwise become, generally known by third parties as a result of no act or omission of the receiving party; (ii) subsequent to disclosure hereunder are lawfully received from a third party having the right to disseminate the information without restriction on disclosure; (iii) are generally furnished to others by the disclosing party without restriction on disclosure; (iv) were already known by the receiving party prior to receiving them from the disclosing party and were not received from a third party in breach of that third party's obligations of confidentiality; or (v) are independently developed by the receiving party without the use of Proprietary Information of the disclosing party. 9.5 Each party shall maintain the confidentiality of the other party's Proprietary Information and will not use or disclose such Proprietary Information without the prior written consent of the other party. Notwithstanding the foregoing, either party may disclose the other's Proprietary Information to its affiliates, agents, and other third parties on a need-to-know basis, provided that such parties are under a similar obligation to maintain the confidentiality of such Proprietary Information. 9.6 Further, each party may disclose the other's Proprietary Information in a judicial or quasi-judicial proceeding when required to do so by law when responding to a subpoena, deposition notice or similar judicial or governmental demand; in such situations, however, the party being requested to disclose the other's Proprietary Information shall endeavor to provide notice to the other party whereby the other party may intervene in the proceeding, if it wishes, and endeavor to prevent such disclosure. Additionally, each party may disclose the other's Proprietary Information to the various regulatory agencies having jurisdiction over the disclosing party. 9.7 Notwithstanding any contrary provision of this Agreement, as long as each party protects the Proprietary Information of the other, neither the exposure to the other party's Proprietary Information, nor its ownership of work products, shall prevent either party from using ideas, concepts, expressions, know-how, skills and experience possessed by either party prior to its association with the other party or developed by either party during its association with the other party, so long as the Proprietary Information of the other party is not used. 9.8 All capitalized terms used in this subsection and not otherwise defined shall have the meanings set forth in the Federal "Privacy of Consumer Financial Information" Regulation (12 CFR Part 40), as amended from time to time (the "Privacy Regulation"), 15 issued pursuant to Section 504 of the Xxxxx-Xxxxx-Xxxxxx Act (15 U.S.C. 6801 et seq.). The parties acknowledge that the Privacy Regulation governs disclosures of nonpublic personal information about consumers. a. XXXX hereby represents and warrants as follows with respect to any Nonpublic Personal Information released to XXXX by Bank One (A) XXXX controls access to the network on which any such Nonpublic Personal Information is stored, through the compliance with and utilization of its information security measures which restrict access; and (B) TERI's information security measures are consistent with Bank One's Information Security Standards, a copy of which are attached hereto as Exhibit E. b. XXXX hereby agrees that it shall: (A) Comply with the terms and provisions of the Privacy Regulation, including, without limitation, the provisions regarding the sharing of Nonpublic Personal Information (as defined in the Privacy Regulation); (B) Not disclose or use any Nonpublic Personal Information that it obtains from Bank One except to carry out the purposes for which Bank One provided such Nonpublic Personal Information, or as otherwise permitted by the Privacy Regulation and other applicable laws; (C) Comply with Bank One's Information Security Standards; (D) Not make any changes to its security measures that would increase the risk of an unauthorized access; and (E) Not disclose any Nonpublic Personal Information disclosed to XXXX by Bank One to any other entity, except as follows: (1) To Bank One's Affiliates, with the prior consent of Bank One. (2) To TERI's affiliates, provided, that its affiliates may, in turn, disclose and use the information only to the extent that XXXX may disclose and use the information; (3) To an unaffiliated third party, in the ordinary course of business in order to carry out the activity for which the information was disclosed to XXXX pursuant to one of the following exceptions to the Privacy Regulation: (i) as necessary to effect, administer or enforce a transaction that a consumer requests or authorizes; (ii) in connection with servicing or processing a financial product or service that a consumer requests or authorizes, or maintaining or servicing the consumer's account with Bank One; (iii) with the consent or at the direction of the consumer; or (iv) to protect the confidentiality or security of Bank One's records pertaining to the consumer, service, product or transaction; to protect against or prevent actual or potential fraud, unauthorized transactions, claims or other liability; for required institutional risk control; for resolving consumer disputes or inquiries; to persons holding a legal or beneficial interest relating to the consumer, or acting in a fiduciary or representative capacity on behalf of the consumer; to provide information to insurance rate advisory organizations, guaranty funds or agencies, or Bank One's attorneys, accountants and auditors; to the extent specifically permitted or required under other provisions of law, to law enforcement agencies, a state insurance authority, self-regulatory organizations or for an investigation on a matter related to public safety; to a consumer reporting agency in accordance with the Fair Credit Reporting Act; to comply with Federal, State or local laws, rules and other applicable legal requirements, or a properly authorized civil, criminal or regulatory investigation, or subpoena or summons; or to respond to judicial process or government regulatory authorities having jurisdiction over Bank One for examination, compliance or other purposes as authorized by law. c. At any time, upon Bank One's request, XXXX shall return to Bank One all Nonpublic Personal Information in its possession to which it is not entitled in its capacity as guarantor or owner of the loan. XXXX agrees that money damages would not be a sufficient remedy for any breach of this Section and that Bank One shall be entitled to seek injunctive or other equitable relief to remedy or prevent any breach or threatened breach of this Section by XXXX. Such remedy shall not be the exclusive remedy for any breach of this Section, but shall be in addition to all other rights and remedies available to Bank One at law or in equity. Finally, Bank One shall be under no obligation to take any action which, within Bank One's reasonable judgment, would constitute a violation of the Privacy Regulation or its internal privacy policies. 17 <PAGE> d. XXXX shall permit Bank One to audit its operations for compliance with Bank One's Information Security Standards, upon reasonable notice from Bank One. e. Notwithstanding any other term to the contrary contained herein, this Section regarding Privacy of Consumer Financial Information shall survive any termination, cancellation, expiration and/or rescission of this Agreement. 9.9 Nothing herein will be construed to prohibit XXXX from making, during or after the term of this Agreement, any use or disclosure of information concerning applicants or Borrowers so long as the identity of the applicant or Borrower, and the identity of Bank One as the lender, cannot be discerned by any third party to which such disclosure is made. Without limitation of the foregoing, XXXX will be free to sell to The First Marblehead Corporation statistical abstracts of de-identified data based on the Loans guaranteed under this Agreement. 9.10 This Agreement may be executed in counterparts, all of which taken together shall constitute one and the same instrument. Section 10: INSURANCE XXXX shall maintain insurance coverage of the types and in the amounts as set forth in Exhibit F. THE REMAINDER OF THIS PAGE IS INTENTIONALLY LEFT BLANK. 18 BLANK 11 <PAGE>

CONFIDENTIALITY; RESTRICTIONS ON USE OF INFORMATION. 9.1 XXXX and Bank One the LENDER each acknowledge that in the course of the operations contemplated by this Agreement, and in the course of communications relative to this Agreement, it has received and will receive information concerning the other's finances, business plans, business methods, and the like that is not generally known in the student loan industry ("Confidential Information"). Each party will respect and use all reasonable efforts to maintain the confidentiality of the other's Confidential Information unless and until such information becomes generally known through no fault of the receiving party. Without limiting The LENDER acknowledges that XXXX will disclose the foregoing, XXXX may disclose any of Bank OneLENDER's Confidential Information to any entity First Marblehead Education Resources, Inc. (FMER), to which XXXX subcontracts has subcontracted its obligations under this Agreement pursuant to Section 6.7(b) hereof, and with which the LENDER is contemporaneously entering into a confidentiality agreement. Except for such disclosure to FMER, XXXX will not disclose the LENDER's confidential information to any third party other than a subcontractor permitted under Section 6.7, an agent, or a consultant, and in any event only as necessary to assist XXXX in carrying out its functions under this Agreement, on a need-to-know basis, and under circumstances that require the disclosee to refrain from redisclosure to any other third party. 9.2 In accordance with XXXX will not disclose to any third party, other than FMER, the provisions of Title V of the Xxxxx-Xxxxx-Xxxxxx Act (the "GLB Act") and Federal Reserve Board Regulation P ("Regulation P")name, XXXX agrees to respect and protect the address, social security and confidentiality number, account number, or other personally identifiable information of any "nonpublic personal information" applicant or Borrower. Nothing herein, however, will prevent XXXX (as defined in the GLB Act and Regulation P) relating to applicants for Loans and to Borrowers, including, where applicable, the restrictions on the re-use and disclosure of such information set forth in the GLB Act and Regulation P. 9.3 Without limiting the foregoing, XXXX may retain or FMER as its own property subcontractor) from (i) retaining and use using such data as necessary for the operation of TERI's guaranty business, or (ii) retaining and using on a non-exclusive basis for any lawful purpose any or all aggregated or and de-identified data concerning Loan applicants and Borrowers which does not include the name, address or address, social security number number, account number, or other personally identifiable information of the Loan applicants any applicant or BorrowersBorrower. XXXX may sell, assign, transfer or disclose such aggregated and de-identified information to third parties including, without limitation, FMC, who may also use such information for any lawful purpose. 14 <PAGE> 9.4 Both XXXX and Bank One have made and will continue throughout the term of this Agreement to make available to the other party confidential and proprietary materials and information ("Proprietary Information"). Prospectively, each party shall advise the other of material and information that is confidential and/or proprietary. All material and information provided by either party to the other relating to the business, policies, procedures, customs, forms, customers and strategies of the providing party or any of its affiliates, including information previously divulged or delivered to the other party regarding the aforementioned subject matter is hereby designated as confidential and proprietary and shall be considered to be Proprietary Information. It is understood that the obligations set forth in this Section do not apply to materials or information that: (i) are already, or otherwise become, generally known by third parties as a result of no act or omission of the receiving party; (ii) subsequent to disclosure hereunder are lawfully received from a third party having the right to disseminate the information without restriction on disclosure; (iii) are generally furnished to others by the disclosing party without restriction on disclosure; (iv) were already known by the receiving party prior to receiving them from the disclosing party and were not received from a third party in breach of that third party's obligations of confidentiality; or (v) are independently developed by the receiving party without the use of Proprietary Information of the disclosing party. 9.5 Each party shall maintain the confidentiality of the other party's Proprietary Information and will not use or disclose such Proprietary Information without the prior written consent of the other party. Notwithstanding the foregoing, either party may disclose the other's Proprietary Information to its affiliates, agents, and other third parties on a need-to-know basis, provided that such parties are under a similar obligation to maintain the confidentiality of such Proprietary Information. 9.6 Further, each party may disclose the other's Proprietary Information in a judicial or quasi-judicial proceeding when required to do so by law when responding to a subpoena, deposition notice or similar judicial or governmental demand; in such situations, however, the party being requested to disclose the other's Proprietary Information shall endeavor to provide notice to the other party whereby the other party may intervene in the proceeding, if it wishes, and endeavor to prevent such disclosure. Additionally, each party may disclose the other's Proprietary Information to the various regulatory agencies having jurisdiction over the disclosing party. 9.7 Notwithstanding any contrary provision of this Agreement, as long as each party protects the Proprietary Information of the other, neither the exposure to the other party's Proprietary Information, nor its ownership of work products, shall prevent either party from using ideas, concepts, expressions, know-how, skills and experience possessed by either party prior to its association with the other party or developed by either party during its association with the other party, so long as the Proprietary Information of the other party is not used. 9.8 All capitalized terms used in this subsection and not otherwise defined shall have the meanings set forth in the Federal "Privacy of Consumer Financial Information" Regulation (12 CFR Part 40), as amended from time to time (the "Privacy Regulation"), 15 issued pursuant to Section 504 of the Xxxxx-Xxxxx-Xxxxxx Act (15 U.S.C. 6801 et seq.). The parties acknowledge that the Privacy Regulation governs disclosures of nonpublic personal information about consumers. a. XXXX hereby represents and warrants as follows with respect to any Nonpublic Personal Information released to XXXX by Bank One (A) XXXX controls access to the network on which any such Nonpublic Personal Information is stored, through the compliance with and utilization of its information security measures which restrict access; and (B) TERI's information security measures are consistent with Bank One's Information Security Standards, a copy of which are attached hereto as Exhibit E. b. XXXX hereby agrees that it shall: (A) Comply with the terms and provisions of the Privacy Regulation, including, without limitation, the provisions regarding the sharing of Nonpublic Personal Information (as defined in the Privacy Regulation); (B) Not disclose or use any Nonpublic Personal Information that it obtains from Bank One except to carry out the purposes for which Bank One provided such Nonpublic Personal Information, or as otherwise permitted by the Privacy Regulation and other applicable laws; (C) Comply with Bank One's Information Security Standards; (D) Not make any changes to its security measures that would increase the risk of an unauthorized access; and (E) Not disclose any Nonpublic Personal Information disclosed to XXXX by Bank One to any other entity, except as follows: (1) To Bank One's Affiliates, with the prior consent of Bank One. (2) To TERI's affiliates, provided, that its affiliates may, in turn, disclose and use the information only to the extent that XXXX may disclose and use the information; (3) To an unaffiliated third party, in the ordinary course of business in order to carry out the activity for which the information was disclosed to XXXX pursuant to one of the following exceptions to the Privacy Regulation: (i) as necessary to effect, administer or enforce a transaction that a consumer requests or authorizes; (ii) in connection with servicing or processing a financial product or service that a consumer requests or authorizes, or maintaining or servicing the consumer's account with Bank One; (iii) with the consent or at the direction of the consumer; or (iv) to protect the confidentiality or security of Bank One's records pertaining to the consumer, service, product or transaction; to protect against or prevent actual or potential fraud, unauthorized transactions, claims or other liability; for required institutional risk control; for resolving consumer disputes or inquiries; to persons holding a legal or beneficial interest relating to the consumer, or acting in a fiduciary or representative capacity on behalf of the consumer; to provide information to insurance rate advisory organizations, guaranty funds or agencies, or Bank One's attorneys, accountants and auditors; to the extent specifically permitted or required under other provisions of law, to law enforcement agencies, a state insurance authority, self-regulatory organizations or for an investigation on a matter related to public safety; to a consumer reporting agency in accordance with the Fair Credit Reporting Act; to comply with Federal, State or local laws, rules and other applicable legal requirements, or a properly authorized civil, criminal or regulatory investigation, or subpoena or summons; or to respond to judicial process or government regulatory authorities having jurisdiction over Bank One for examination, compliance or other purposes as authorized by law. c. At any time, upon Bank One's request, XXXX shall return to Bank One all Nonpublic Personal Information in its possession to which it is not entitled in its capacity as guarantor or owner of the loan. XXXX agrees that money damages would not be a sufficient remedy for any breach of this Section and that Bank One shall be entitled to seek injunctive or other equitable relief to remedy or prevent any breach or threatened breach of this Section by XXXX. Such remedy shall not be the exclusive remedy for any breach of this Section, but shall be in addition to all other rights and remedies available to Bank One at law or in equity. Finally, Bank One shall be under no obligation to take any action which, within Bank One's reasonable judgment, would constitute a violation of the Privacy Regulation or its internal privacy policies. 17 <PAGE> d. XXXX shall permit Bank One to audit its operations for compliance with Bank One's Information Security Standards, upon reasonable notice from Bank One. e. Notwithstanding any other term to the contrary contained herein, this Section regarding Privacy of Consumer Financial Information shall survive any termination, cancellation, expiration and/or rescission of this Agreement. 9.9 Nothing herein will be construed to prohibit XXXX from making, during or after the term of this Agreement, any use or disclosure of information concerning applicants or Borrowers so long as the identity of the applicant or Borrower, and the identity of Bank One as the lender, cannot be discerned by any third party to which such disclosure is made. Without limitation of the foregoing, XXXX will be free to sell to The First Marblehead Corporation statistical abstracts of de-identified data based on the Loans guaranteed under this Agreement. 9.10 This Agreement may be executed in counterparts, all of which taken together shall constitute one and the same instrument. Section 10: INSURANCE XXXX shall maintain insurance coverage of the types and in the amounts as set forth in Exhibit F. THE REMAINDER OF THIS PAGE IS INTENTIONALLY LEFT BLANK. 18 <PAGE>