2018/08/08 Council Agenda Packet

Attachment B Permissible Use Requirements 1. DATA USE Licensee must institute and maintain written policies and procedures to ensure Data is only used as authorized herein. At a minimum the policies and procedures will include, training requirements for all personnel with access to Confidential Information on the Permissible Use(s) of Data. Licensee must be capable of demonstrating the training and education was delivered to all applicable personnel who have are an Authorized User, employees and agents. 2. APPROPRIATE USE DECLARATION Licensee must require all Authorized Users to sign an Appropriate Use Declaration prior to accessing DRIVES. The Declaration must include a statement that the Authorized User understands and acknowledges: 1. His/her obligations and responsibility to use Confidential Information only to accomplish his/her official job duties; 2. He/she will maintain the confidentiality and privacy of the information accessed; 3. He/she will not share Confidential Information with unauthorized persons; 4. He/she will not use Data access for personal reasons or benefit; and 5. Misuse of any Confidential Information may be considered a felony and may be punishable by fine or imprisonment. Licensee must maintain the signed declaration. Licensee must provide copies of signed Appropriate Use Declaration upon request by DOL. 3. PERMISSIBLE USE EVALUATIONS • At least annually, Licensee must conduct a review of all Authorized Users' access and use of Confidential Information to ensure that such access and use is within official job duties. 4. SECURE USE Licensee must maintain and support administrative, technical or physical methods used to monitor compliance with the Permissible Use(s) authorized in this Agreement across all Licensee business practices. Methods may include any of the following: a) View only access to Data b) System limitations or controls c) Confidentiality agreements 5. NON-CONFORMING PERMISSIBLE USE NOTIFICATION Licensee shall notify DOL personnel in the event of confirmed unauthorized use of Data. Licensee must perform the following: a) Notify the DOL by e-mail at DataServices(c�dol.wa.gov of such an event within 24 hours of discovery Identify the Data and non-conforming use of the Data. b) if the misuse is a criminal offense requiring notification to individuals, cooperate and facilitate with the notification of all affected individuals. At DOL's discretion, Licensee may be required to directly perform notification requirements, or if DOL elects to perform the notifications, Licensee may have to reimburse DOL for all costs associated with the notification. • Page 12 21