Laserfiche WebLink
Data Sharing Addendum - 6 <br />6.20.23 <br />b. If the Receiving Party does not have full details about the incident, it will <br />report what information it has and provide full details within 15 business <br />days of discovery. To the extent possible, these initial reports must include <br />at least: <br />The nature of the unauthorized use or disclosure, including a brief <br />description of what happened, the date of the event(s), and the <br />date of discovery; <br />A description of the types of information involved; <br />The investigative and remedial actions the Receiving Party or its <br />subcontractor took or will take to prevent and mitigate harmful <br />effects and protect against recurrence; <br />Any details necessary for a determination of whether the incident <br />is a breach that requires notification under RCW 19.255.010, <br />RCW 42.56.590, or any other applicable breach notification law or <br />rule; and <br />Any other information City reasonably requests. <br />c. Receiving Party must also take actions to mitigate the risk of loss and <br />comply with any notification or other requirements imposed by law or the <br />City. <br />d. If notification to individuals must, in the sole judgement of City, be made, <br />the Receiving Party will further cooperate and facilitate notification to <br />required parties, which may include notification to affected individuals, the <br />media, the Attorney General’s Office, or other authorities based on <br />applicable law. At the City’s sole discretion, Receiving Party may be <br />required to directly fulfill notification requirements, or if the City elects to <br />perform the notifications, the Receiving Party must reimburse the City for <br />all associated costs. <br />e. Receiving Party is responsible for all costs incurred in connection with a <br />security incident, privacy breach, or potential compromise of Confidential <br />Information, including: <br />Computer forensics assistance to assess the impact of a <br />Confidential Data Breach, determine root cause, and help <br />determine whether and the extent to which notification must be <br />provided to comply with breach notification laws; <br />Notification and call center services for individuals affected by a <br />security incident or privacy breach, including fraud prevention, <br />credit monitoring, and identify theft assistance; and <br />Regulatory defense, fines, and penalties from any claim in the <br />form of a regulatory proceeding resulting from a violation of any <br />applicable privacy or security law(s) or regulation(s).