Common use of Data Breach; Loss of City Data Clause in Contracts

Data Breach; Loss of City Data. In the event of any Data Breach, act, error, omission, negligence, misconduct, or breach that compromises or is suspected to compromise the security, confidentiality, or integrity of City Data or the physical, technical, administrative, or organizational safeguards put in place by FIRST PARTY that relate to the protection of the security, confidentiality, or integrity of City Data, FIRST PARTY shall, as applicable: i. Notify City immediately following discovery, but no later than twenty- four (24) hours, of becoming aware of such occurrence or suspected occurrence. FIRST PARTY’S report shall identify: 1. the nature of the unauthorized access, use or disclosure; 2. the Confidential Information accessed, used or disclosed; 3. the person(s) who accessed, used and disclosed and/or received protected information (if known); 4. what FIRST PARTY has done or will do to mitigate any deleterious effect of the unauthorized access, use or disclosure; and 5. what corrective action FIRST PARTY has taken or will take to prevent future unauthorized access, use or disclosure. ii. In the event of a suspected Breach, FIRST PARTY shall keep the City informed regularly of the progress of its investigation until the uncertainty is resolved; iii. FIRST PARTY shall coordinate with the City in its breach response activities including without limitation: 1. immediately preserve any potential forensic evidence relating to the breach, and remedy the breach as quickly as circumstances permit; 2. Promptly (within 2 business days) designate a contact person to whom the City will direct inquiries, and who will communicate FIRST PARTY responses to City inquiries; 3. As rapidly as circumstances permit, apply appropriate resources to remedy the breach condition, investigate, document, restore City service(s) as directed by the City, and undertake appropriate response activities;

Data Breach; Loss of City Data. In the event of any Data Breach, act, error, omission, negligence, misconduct, or breach that compromises or is suspected to compromise the security, confidentiality, or integrity of City CITY Data or the physical, technical, administrative, or organizational safeguards put in place by FIRST PARTY that relate to the protection of the security, confidentiality, or integrity of City CITY Data, FIRST PARTY shall, as applicable: i. Notify City CITY immediately following discovery, but no later than twenty- four (24) hours, of becoming aware of such occurrence or suspected occurrence. FIRST PARTY’S report shall identify: 1. the nature of the unauthorized access, use or disclosure; 2. the Confidential Information accessed, used or disclosed; 3. the person(s) who accessed, used and disclosed and/or received protected information (if known); 4. what FIRST PARTY has done or will do to mitigate any deleterious effect of the unauthorized access, use or disclosure; and 5. what corrective action FIRST PARTY has taken or will take to prevent future unauthorized access, use or disclosure. ii. In the event of a suspected Breach, FIRST PARTY shall keep the City CITY informed regularly of the progress of its investigation until the uncertainty is resolved; iii. FIRST PARTY shall coordinate with the City CITY in its breach response activities including without limitation: 1. immediately preserve any potential forensic evidence relating to the breach, and remedy the breach as quickly as circumstances permit; 2. Promptly (within 2 business days) designate a contact person to whom the City CITY will direct inquiries, and who will communicate FIRST PARTY responses to City CITY inquiries; 3. As rapidly as circumstances permit, apply appropriate resources to remedy the breach condition, investigate, document, restore City service(s) as directed by the City, and undertake appropriate response activities;

Data Breach; Loss of City Data. In the event of any Data Breach, act, errorSaaS Software Error, omission, negligence, misconduct, or breach that compromises or is suspected to compromise the security, confidentiality, or integrity of City Data or the physical, technical, administrative, or organizational safeguards put in place by FIRST PARTY Contractor that relate to the protection of the security, confidentiality, or integrity of City Data, FIRST PARTY Contractor shall, as applicable: i. Notify City immediately following discovery, but no later than twenty- twenty-four (24) hours, of becoming aware of such occurrence or suspected occurrence. FIRST PARTY’S Contractor’s report shall identify: 1. the nature of the unauthorized access, use or disclosure; 2. the Confidential Information accessed, used or disclosed; 3. the person(s) who accessed, used and used, disclosed and/or received protected information (if known); 4. what FIRST PARTY Contractor has done or will do to mitigate any deleterious effect of the unauthorized access, use or disclosure; , and 5. what corrective action FIRST PARTY Contractor has taken or will take to prevent future unauthorized access, use or disclosure. ii. In the event of a suspected Breach, FIRST PARTY Contractor shall keep the City informed regularly of the progress of its investigation until the uncertainty is resolved; iii. FIRST PARTY Contractor shall coordinate with the City in its breach response activities including without limitation: 1. immediately Immediately preserve any potential forensic evidence relating to the breach, and remedy the breach as quickly as circumstances permit; 2. Promptly (within 2 business days) designate a contact person to whom the City will direct inquiries, and who will communicate FIRST PARTY Contractor responses to City inquiries; 3. As rapidly as circumstances permit, apply appropriate resources to remedy the breach condition, investigate, document, restore City service(s) as directed by the City, and undertake appropriate response activities;; Provide status reports to the City on Data Breach response activities, either on a daily basis or a frequency approved by the City; Make all reasonable efforts to assist and cooperate with the City in its Breach response efforts; Ensure that knowledgeable Contractor staff are available on short notice, if needed, to participate in City-initiated meetings and/or conference calls regarding the Breach; and Cooperate with City in investigating the occurrence, including making available all relevant records, logs, files, data reporting, and other materials required to comply with applicable law or as otherwise required by City. In the case of personally identifiable information (PII) or protected health information (PHI), at City’s sole election, (a) notify the affected individuals as soon as practicable but no later than is required to comply with applicable law, or, in the absence of any legally required notification period, within five (5) calendar days of the occurrence; or, (b) reimburse City for any costs in notifying the affected individuals; In the case of PII, provide third-party credit and identity monitoring services to each of the affected individuals who comprise the PII for the period required to comply with applicable law, or, in the absence of any legally required monitoring services, for no fewer than twenty-four (24) months following the date of notification to such individuals; Perform or take any other actions required to comply with applicable law as a result of the occurrence; Recreate lost City Data in the manner and on the schedule set by City without charge to City; and Provide to City a detailed plan within ten (10) calendar days of the occurrence describing the measures Contractor will undertake to prevent a future occurrence. Notification to affected individuals, as described above, shall comply with applicable law, be written in plain language, and contain (at the City’s election) information that may include: name and contact information of Contractor’s (or City’s) representative; a description of the nature of the loss; a list of the types of data involved; the known or approximate date of the loss; how such loss may affect the affected individual; what steps Contractor has taken to protect the affected individual; what steps the affected individual can take to protect himself or herself; contact information for major credit card reporting agencies; and, information regarding the credit and identity monitoring services to be provided by Contractor. Contractor shall retain and preserve City Data in accordance with the City’s instruction and requests, including without limitation any retention schedules and/or litigation hold orders provided by the City to Contractor, independent of where the City Data is stored. City shall conduct all media communications related to such Data Breach, unless in its sole discretion, City directs Contractor to do so. Proprietary or Confidential Information Proprietary or Confidential Information of City. Contractor understands and agrees that, in the performance of the work or services under this Agreement may involve access to City Data that is Confidential Information. Contractor and any subcontractors or agents shall use Confidential Information only in accordance with all applicable local, state and federal laws restricting the access, use and disclosure of Confidential Information and only as necessary in the performance of this Agreement. Contractor’s failure to comply with any requirements of local, state or federal laws restricting access, use and disclosure of Confidential Information shall be deemed a material breach of this Agreement, for which City may terminate the Agreement. In addition to termination or any other remedies set forth in this Agreement or available in equity or law, the City may bring a false claim action against Contractor pursuant to Chapters 6 or 21 of the Administrative Code, or debar Contractor. Contractor agrees to include all of the terms and conditions regarding Confidential Information contained in this Agreement in all subcontractor or agency contracts providing services under this Agreement.