Okaloosa County BOCC — January 3, 2017 — DAVID MOU — reading text

may be subject to criminal sanctions and civil liability. The Parties mutually agree to the following: A. Information exchanged will not be used for any purposes not specifically authorized by this MOU. Unauthorized use includes, but is not limited to, queries not related to a legitimate business purpose, personal use, or the dissemination, sharing, copying, or passing of this information to unauthorized persons. B. The Requesting Party shall not indemnify and shall not be liable to the Providing Agency for any driver license or motor vehicle information lost, damaged, or destroyed as a result of the electronic exchange of data pursuant to this MOU, except as otherwise provided in Section 768.28, Florida Statutes. C. Any and all DAVID-related information provided to the Requesting Party as a result of this MOU, Page 4 of 9 DAVID (Government Entity) Data Exchange MOU (Rev. 11-2016) Vi. particularly data from the DAVID system, will be stored in a place physically secure from access by unauthorized persons. The Requesting Party shall comply with Rule 71A-1.005, Florida Administrative Code, and with Providing Agency’s security policies, and employ adequate security measures to protect Providing Agency’s information, applications, data, resources, and services. The applicable Providing Agency’s security policies shall be made available to Requesting Party. When printed information from DAVID is no longer needed, it shall be destroyed by cross-cut shredding or incineration. The Requesting Party shall maintain a list of all persons authorized within the agency to access DAVID information, which must be provided to the providing agency upon request. Access to DAVID-related information, particularly data from the DAVID System, will be protected in such a way that unauthorized persons cannot view, retrieve, or print the information. Under this MOU agreement, access to DAVID shall be provided to users who are direct employees of the Requesting Party and shall not' be provided to any non-employee or contractors of the Requesting Party. By signing this MOU, the Parties, through their signatories, affirm and agree to maintain the confidentiality of the information exchanged through this Agreement. Compliance and Control Measures Quarterly Quality Control Review Report — Must be completed, utilizing Attachment I, Quarterly Quality Control Review Report, within 10 days after the end of each quarter and maintained for two years. Internal Control Attestation — This MOU is contingent upon the Requesting Party having appropriate internal controls in place at all times that data is being provided/received pursuant to this MOU to ensure that the data is protected from unauthorized access, distribution, use, modification, or disclosure. The Requesting Party must submit an Attestation Statement from their Agency's Internal Auditor, Inspector General, Risk Management IT Security Professional, or a currently licensed Certified Public Accountant, on or before the third and sixth anniversary of the agreement or within 180 days from receipt of an Attestation review request from the Providing Agency. The Attestation Statement shall indicate that the internal controls over personal data have been evaluated and are adequate to protect the personal data from unauthorized access, distribution, use, modification, or disclosure. The Attestation Statement shall also certify that any and all deficiencies/issues found during the review have been corrected and measures enacted to prevent recurrence. The Providing Agency may extend the time for submission of the Attestation Statement upon written request by the Requesting Party for good cause shown by the Requesting Party. The Attestation Statement must have an original signature of the Agency Head or person designated by Letter of Delegation to execute contracts/agreements on their behalf, and may be sent via U.S. Mail, facsimile transmission, or e-mailed to the Providing Agency's Bureau of Records at the following address: Department of Highway Safety and Motor Vehicles Bureau of Records 2900 Apalachee Parkway, MS 89 Tallahassee, Florida 32399-0500 Fax: (850) 617-5168 Page 5 of 9 DAVID (Govemment Entity) Data Exchange MOU (Rev. 11-2016) E-mail: DataListingUnit@flhsmv.gov C. Annual Certification Statement - The Requesting Party shall submit to the Providing Agency an annual statement indicating that the Requesting Party has evaluated and certifies that it has adequate controls in place to protect the personal data from unauthorized access, distribution, use, modification, or disclosure, and is in full compliance with the requirements of this MOU. The Requesting Party shall submit this statement annually, within 45 days after the anniversary date of this MOU. (NOTE: During any year in which an Attestation Statement is provided, submission of the Internal Control Attestation will satisfy the requirement to submit an Annual Certification Statement.) Failure to timely submit a certification statement may result in an immediate review request and, based upon the findings of the review, suspension or termination of Requesting Party’s access to DAVID information as indicated in subsection B., above. In addition, prior to expiration of this MOU, if the Requesting Party intends to enter into a new MOU, a certification statement attesting that appropriate controls remained in place during the final year of the MOU and are currently in place shall be required to be submitted to the Providing Agency prior to issuance of a new MOU. D. Misuse of Personal Information — The Requesting Party must notify the Providing Agency in writing of any incident where determination is made that personal information has been compromised as a result of unauthorized access, distribution, use, modification, or disclosure, by any means, within 30 days of such determination. The statement must be provided on the Requesting Agency's letterhead and include each of the following: a brief summary of the incident; the outcome of the review; the date of the occurrence(s); the number of records compromised; the name or names of personnel responsible; whether disciplinary action or termination was rendered; and whether or not the owners of the compromised records were notified. The statement shall also indicate the steps taken, or to be taken, by the Requesting Agency to ensure that misuse of DAVID data does not continue. This statement shall be mailed to the Bureau Chief of Records at the address indicated in VI.B., above. (NOTE: If an incident involving breach of personal information did occur and Requesting Party did not notify the owner(s) of the compromised records, the Requesting Party must indicate why notice was not provided, for example “Notice not statutorily required”.) In addition, the Requesting Party shall comply with the applicable provisions of Section 501.171, Florida Statutes, regarding data security and security breaches, and shall strictly comply with the provisions regarding notice provided therein. VIl. Agreement Term This MOU shall take effect upon the date of last signature by the Parties and shall remain in effect for six (6) years from this date unless sooner terminated or cancelled in accordance with Section IX, Termination. Once executed, this MOU supersedes all previous agreements between the parties regarding the same subject matter. ViIll. Amendments This MOU incorporates all negotiations, interpretations, and understandings between the Parties regarding the same subject matter, and serves as the full and final expression of their agreement. This MOU may be amended by written agreement executed by and between both Parties. Any change, alteration, deletion, or addition to the terms set forth in this MOU, including to any of its attachments, must be by written agreement executed by the Parties in the same manner as this MOU was initially executed. If there are any conflicts in the amendments to this MOU, the last-executed amendment shall prevail. All Page 6 of 9 DAVID (Government Entity) Data Exchange MOU (Rev. 11-2016) provisions not in conflict with the amendment(s) shall remain in effect and are to be performed as specified in this MOU. IX. Termination A. This MOU may be unilaterally terminated for cause by either party upon finding that the terms and conditions contained herein have been breached by the other party. Written notice of termination shall be provided to the breaching party; however, prior-written notice is not required and notice may be provided upon cessation of work under the agreement by the non-breaching party. B. In addition, this MOU is subject to unilateral termination by the Providing Agency without notice to the Requesting Party for failure of the Requesting Party to comply with any of the requirements of this MOU, orwith any applicable state or federal laws, rules, or regulations, including Section 119.0712(2), Florida Statutes. C. This MOU may also be cancelled by either party, without penalty, upon 30 days’ advanced written notice to the other party. All obligations of either party under the MOU will remain in full force and effect during the thirty (30) day notice period. X. Notices Any notices required to be provided under this MOU may be sent via U.S. Mail, facsimile transmission, or e-mail to the following individuals: For the Providing Agency: Chief, Bureau of Records 2900 Apalachee Parkway Tallahassee, Florida 32399 Fax: (850) 617-5168 E-mail: DataListingUnit@flhsmv.gov For the Requesting Party: Agency Point-of-Contact listed on the signature page. XI. Additional Database Access/Subsequent MOU's The Parties understand and acknowledge that this MOU entitles the Requesting Party to specific information included within the scope of this agreement. Should the Requesting Party wish to obtain access to other personal information not provided hereunder, the Requesting Party will be required to execute a subsequent MOU with the Providing Agency specific to the additional information requested. All MOU’s granting access to personal information will contain the same clauses as are contained herein regarding audits, report submission, and the submission of Certification and Attestation statements. The Providing Agency is mindful of the costs that would be incurred if the Requesting Party was required to undergo multiple audits and to submit separate certifications, attestations, and reports for each executed MOU. Accordingly, should the Requesting Party execute any subsequent MOU with the Providing Agency for access to personal information while the instant MOU remains in effect, the Requesting Party may submit a written request, subject to Providing Agency approval, to submit one of each of the following covering all executed MOU'’s: Quarterly Quality Control Review Report; Certification; and Attestation; and/or to have conducted one comprehensive audit addressing internal controls for all executed MOU’s. The Providing Agency shall have the sole discretion to approve or deny such request in whole or in part or to subsequently rescind an Page 7 of 9 DAVID (Government Entity) Data Exchange MOU (Rev. 11-2016) approved request based upon the Requesting Party's compliance with this MOU and/or any negative audit findings. Xll. Application of Public Records Law The Requesting Party agrees to comply with the following requirements of Florida's public records laws: 1. Keep and maintain public records required by the Department to perform the service. 2. Upon request from the Department’s custodian of public records, provide the Department with a copy of the requested records or allow the records to be inspected or copied within a reasonable time at a cost that does not exceed the cost provided in Chapter 119, Florida Statutes, or as otherwise provided by law. 3. Ensure that public records that are exempt or confidential and exempt from public records disclosure requirements are not disclosed