University of Oregon (2020)

74j0 € adeg

Colchester Public Schools
127 Norwich Ave, Suite 202
Colchester, CT 06415

AGREEMENT

University of Oregon
And
Colchester Public Schools

This Agreement (“Agreement”) is entered into on as of the last date below, between the
Colchester Public School Name (the “Board”) and University of Oregon (“Contractor”) (collectively, the
“Parties”) for the purpose of identifying the obligations of the Parties relative to the confidentiality of
student data.

Article |. Definitions. For purposes of this Agreement, “directory information,” “de-identified student
information,” “personally-identifiable information,” “school purposes,” “student information,” “student
records,” “student-generated content,” and “targeted advertising,” shall be as defined by Public Act 16-
189. “Education records” shall be defined by the Family Educational Rights and Privacy Act of 1974
(“FERPA”), codified at 20 U.S.C § 1232g (as amended); and its implementing regulations, 34 CFR 99.1 -
99.67 (as amended).

nu,

Article ll. Purpose of Agreement: Contractor and School previously entered into the DIBELS Data
System Agreement ("DDS Agreement"). The Parties agree that the purpose of this Agreement is to detail
the obligations of both Parties relative to the safety and confidentiality of student information, student
records and student-generated content (collectively, “student data”), which student data may be
provided to the Contractor in connection with Contractor’s provision of one or more of the following
professional and non-instructional services (check those applicable) under the DDS Agreement:

U Medical consultation

O Special education consultation or audit

0 Academic program consultation or audit (non-special education)

L Behavior intervention/Positive behavior intervention supports consultation or audit

C1 information technology consultation or audit

X — Student data storage, maintenance, collection and/or analysis

(] other (explain):

 

Article Ill. General Provisions

A. All student data provided or accessed pursuant to this Agreement and the DDS Agreement is
and remains under the control of the Board. All student data are not the property of, or under
the control of, the Contractor.

B. The Contractor shall not use student data for any purposes other than those authorized in this
or the DDS Agreement, and may not use student data for any targeted advertising.


C. If the Contractor receives a request to review student data in the Contractor’s possession
directly from a student, parent, or guardian, the Contractor agrees to refer that individual to the
Board.

Article IV. Security and Confidentiality of Student Data.
A. The Contractor and the Board shall ensure that they each comply with the FERPA.

B. Further, the Contractor shall take actions designed to ensure the security and confidentiality of
student data, including but not limited to:

1. Using technologies and methodologies consistent with the guidance issued in the
American Recovery and Reinvestment Act of 2009, Public Law 111-5, § 13402(h)(2), 42
U.S.C. § 17932;

2, Maintaining technical safeguards relating to the possession of education records in a
manner consistent with 45 C.F.R. 164.312;

3. Otherwise meeting or exceeding industry standards relating to the safeguarding of
confidential information.

Article V. Prohibited Uses of Student Data

A. The Contractor shall not use student data for any purposes other than those authorized
‘pursuant to this Agreement or the DDS Agreement.

B. The Contractor shall not retain, and the Board shall not otherwise make available, any student
data upon completion of the contracted services unless a student, or parent or legal guardian of
a student chooses to establish or maintain an electronic account with the Contractor for the
purpose of storing student-generated content. Contractor does not provide accounts or services
for the purpose of storing student-generated content. Notwithstanding the foregoing,
Contractor may keep automatically generated electronic backup copies of the student
data until overwritten during the normal course of business.

C. The Contractor shall not collect, store, or use student data or persistent unique identifiers for
purposes other than the furtherance of school purposes, as determined by the Board or as
authorized by the DDS Agreement.

D. The Contractor shall not sell, rent or trade student data. In the event the Contractor merges or is
purchased by another entity, the Contractor must notify the Board in writing and receive written
approval from the Board prior to providing for any purpose any student data covered under this
Agreement to its successor.

Article VI. Data Breaches

A. Upon the discovery by the Contractor of a breach of security that results in the unauthorized
release, disclosure, or acquisition of student data, or the suspicion that such a breach may have
occurred, the Contractor shall provide initial notice to the Board as soon as possible, but not
more than thirty (30) days after such discovery (“Initial Notice”). The Initial Notice shall be


B.

c

delivered to the Board by electronic mail to jburt @colchester.org and shall include the following
information, to the extent known at the time of notification:

1. Date and time of the breach;
2. Names of student(s) whose student data was released, disclosed or acquired;
3. The nature and extent of the breach;

4. The Contractor’s proposed plan to investigate and remediate the breach.

Upon discovery by the Contractor of a breach, the Contractor shall conduct an investigation and
restore the integrity of its data systems and, without unreasonable delay, but not later than
thirty (30) days after discovery of the breach, shall provide the Board with a more detailed
notice of the breach, including but not limited to the date and time of the breach; name(s) of
the student(s) whose student data was released, disclosed or acquired; nature and extent of the
breach, to the extent available; and measures taken to ensure that such a breach does not occur
in the future.

The Contractor agrees to cooperate with the Board with respect to investigation of the breach.

Article Vill. Choice of Law, Choice of Forum, Merger, Severability

A.

Choice of Law. The laws of the state of Connecticut shall govern this Agreement. However, all
issues of law relating to the governmental authority, and the sovereign and governmental
immunities of the University of Oregon, as an entity of the State of Oregon, shall be resolved
and enforced according to the laws of the State of Oregon, USA, without resort to any
jurisdiction’s conflict of law rules doctrines. Nothing in this Agreement is a waiver of University
of Oregon’s sovereign or governmental immunities.

Amendment. This Agreement may be changed, amended, or superseded, only upon an
agreement in writing executed by both parties hereto.

Severability. A court finding of invalidity for any provision of this Agreement does not invalidate
other provisions or applications that are not affected by the finding.

Article VIil. Term

A.

The term of this Agreement shall be effective upon execution by both parties and shall
terminate when all of the student data collected, used, possessed or maintained by the
Contractor is properly and completely deleted or destroyed or returned to the Board, or, if
it is infeasible to return or completely delete or destroy the student data, protections are
extended to such student data in accordance with the provisions of Paragraph B within this
Article.

in the event that the Contractor determines that returning or completely deleting or
destroying the student data is infeasible, the Contractor shall provide to the Board
notification of the conditions that make return or complete deletion or destruction
infeasible, such as the retention of student data in a disaster recovery system that is
inaccessible to the public and unable to be used in the normal course of business by the
Contractor. The Contractor shall extend the protections of this Agreement to such student


data and limit further uses and disclosures of such student data to those purposes that make
the return or complete deletion or destruction infeasible. The Contractor shall not use or
disclose such student data and shall maintain its security pursuant to this Agreement for so
long as the Contractor possesses or maintains such student data. In the event a disaster
recovery system containing student data is used to repopulate the Contractor's databases
following the recovery from a disaster, the Contractor shall immediately delete all such
student data.

This Agreement is effective upon execution by both parties and shall continue until the end of the
contract period of the DDS Agreement.

[yore

Print Name Ore

Title: S f 4 :

 

Contractor: University of Oregon

ee Uis/ze

eine Name: Oct Merwi Y\
title: Assocrabe Director