AR 1.91 requires that any contract with a third party where the City may share data, including personal identifying information and restricted City information, shall have provisions providing for data security safeguards. The AR does not require specific language and this is the Law Department's recommended language.

Confidentiality and Data Security

All data, regardless of form, including originals, images and reproductions, prepared by, obtained by, or transmitted to Contractor/Consultant in connection with this Agreement is confidential, proprietary information owned by the City. Except as specifically provided in this Agreement, the Contractor/Consultant shall not disclose data generated in the performance of the service to any third person without the prior written consent of the City Manager, or his/her designee.

Personal identifying information, financial account information, or restricted City information, whether electronic format or hard copy, must be secured and protected at all times to avoid unauthorized access. At a minimum, Contractor/Consultant must encrypt and/or password protect electronic files. This includes data saved to laptop computers, computerized devices or removable storage devices.

When personal identifying information, financial account information, or restricted City information, regardless of its format, is no longer necessary, the information must be redacted or destroyed through appropriate and secure methods that ensure the information cannot be viewed, accessed, or reconstructed.

In the event that data collected or obtained by the Contractor/Consultant in connection with this Agreement is believed to have been compromised, Contractor/Consultant shall notify the City Privacy Officer immediately.

Contractor/Consultant agrees to reimburse the City for any costs incurred by the City to investigate potential breaches of this data and, where applicable, the cost of notifying individuals who may be impacted by the breach. Contractor/Consultant agrees that the requirements of this Section shall be incorporated into all subcontractor/subconsultant agreements entered into by the Contractor/Consultant. It is further agreed that a violation of this Section shall be deemed to cause irreparable harm that justifies injunctive relief in court. A violation of this Section may result in immediate termination of this Agreement without notice. The obligations of

Contractor/Consultant under this Section shall survive the termination of this Agreement.