Washington State Department of Licensing (DOL) 5/16/2024

Attachment C - Subrecipient Requirements 2. CONTRACT WITH SUBRECIPIENT Prior to Licensee providing any Confidential Information directly to a Subrecipient, Licensee must have a written contract with the Subrecipient. The contract must minimally contain the following or substantially similar provisions, which must be equal in effect against the Subrecipient as DOL has applied them against the Licensee. Direct Subrecipients, and subsequent entities passing Confidential Information through to other Subrecipients, must have a written contract. The contract must minimally contain the items under this Attachment or substantially similar provisions, which must be equal in effect against each Subrecipient as DOL has applied them against the Licensee. Any Subrecipient contract that does not carry forward the required terms and conditions, or substantially similar, of this Agreement lacks the inherent authority to grant the Subrecipient access to any Confidential Information. If access to Confidential Information is provided to a Subrecipient without such proper authority, it is a violation of the conditions of this Agreement. a) All Data Security and Permissible Use terms, conditions and requirements set forth in Attachments A – Data Licensing Statement, B – Data Security Requirements, and D – Permissible Use Requirements, of this Agreement. Permissible Use(s) available to the Subrecipient are limited to the Permissible Uses available to the Licensee in Attachment A – Data Licensing Statement, of this Agreement. b) All Security Breach Notification and Non-Conforming Permissible Use Notification requirements included in Section 10, Data Security Breach and Misuse Notification, of this Agreement. c) All records access, inspections, Driver Privacy Protection Act (DPPA), and records maintenance requirements included in Section 34, Records Access, Inspection, and DPPA, of this Agreement. d) All allowances granting DOL, or DOL’s agent, the right to access, investigate, and audit records related to any Data provided under this Agreement. Such access must be afforded to DOL and the Parties will work in good faith to determine if information should be withheld on the basis of privilege or confidentiality. e) All audit and annual certification requirements in Section 16, Audits, and Section 17, Annual Internal Assessment, of this Agreement. f) Subrecipient to provide DOL with access to its product at no cost to DOL, in cooperation with Licensee when DOL has cause to request access. 3. SUBRECIPIENT DISQUALIFICATION If Licensee discovers that DOL has disqualified a Subrecipient from receiving Confidential Information, Licensee must immediately terminate and prevent the Subrecipient’s access to Confidential Information. 4. SUBRECIPIENT TRACKING a) Licensee must provide DOL with a complete list of all Subrecipients within ten (10) days of request. This information may be marked as being privileged or confidential, but may not be withheld from DOL on such basis. The list must be provided in Excel format, or other format approved by DOL without redactions. b) For each request for DOL Data, Licensee must provide information identifying the Subrecipient for whom the request was made. 5. GUIDANCE ON COMPLIANCE a) Licensee must audit Subrecipients for compliance with Data Security and Permissible Use requirements at least once in a three-year period. Licensee may accept current third-party audits. b) Licensee is responsible to obtain annual attestations of compliance from direct Subrecipients.