To: State Street Institutional Investment Trust From: David James Date: November 19, 2010 RE: Information Security Program Agreement
Exhibit (h)(11)
To:
|
State Street Institutional Investment Trust | |
From:
|
Xxxxx Xxxxx | |
Date:
|
November 19, 2010 | |
RE:
|
Information Security Program Agreement |
As you may know, the Commonwealth of Massachusetts adopted standards1 (the
“Standards”) governing the protection of “personal information” of Massachusetts residents
by entities who access such information, whether those entities are located in Massachusetts or
not. The Standards require any person who owns, licenses, stores or maintains “personal
information” about Massachusetts residents to adopt a comprehensive written information security
program and to take “reasonable steps to select and retain third-party service providers that are
capable of maintaining appropriate security measures to protect such personal information
consistent with [the Standards]...”
State Street Bank and Trust Company (“State Street”) may provide, accounting,
administration, transfer agency, recordkeeping and/or custody services to or for those products,
including U.S. registered investment companies (the “Products”), that are parties to or the
subject of one or more service agreements with State Street (collectively, the
“Agreement(s)”). As a provider of services to or for the Products, State Street may come
into possession of “personal information,” as that term is defined in the Standards, about the
Products’ shareholders, partners, directors and/or officers that are residents of Massachusetts.
Accordingly, State Street hereby undertakes as follows:
Subject to the relevant terms of the Agreement(s), State Street hereby agrees that during the
term of the Agreement(s) it will implement and maintain a comprehensive written information
security program that contains appropriate security measures to safeguard the personal information
of the Products’ shareholders, partners, directors and/or officers that State Street receives,
stores, maintains, processes or otherwise accesses in connection with the provision of services
hereunder. For these purposes, “personal information” shall mean (i) an individual’s name (first
initial and last name or first name and last name), address or telephone number plus (a)
social security number, (b) drivers license number, (c) state identification card number, (d) debit
or credit card number, (e) financial account number or (f) personal identification number or
password that would
1 | 201 CMR 17.00: Standards for the Protection of Personal Information of Residents of the Commonwealth of Massachusetts |
permit access to a person’s account or (ii) any combination of the foregoing
that would allow a person to log onto or access an individual’s account. Notwithstanding the
foregoing “personal information” shall not include information that is lawfully obtained from
publicly available information, or from federal, state or local government records lawfully made
available to the general public.
Please feel free to call Xxxxx Xxxxx at 000-000-0000 if you have any questions regarding the
efforts we have undertaken to assist the Products in complying with the Standards.
State Street Bank and Trust Company |
||||
By: | /s/ Xxxxx Xxxxx | |||
Xxxxx Xxxxx | ||||
Vice President and Managing Counsel | ||||