CALIFORNIA EMPLOYMENT DEVELOPMENT DEPARTMENT (3)

Home Browse Search

program files, and databases. These data and information are confidential when they define an individual or an employing unit or when the disclosure is restricted or prohibited by any provision of law. Confidential information requires special precautions to protect it from unauthorized use, access, disclosure, modification, and destruction. The sources of information may include, but are not limited to, the EDD, the California Department of Social Services, the California Department of Education, the California Department of Corrections and Rehabilitation, the County Welfare Department(s), the County IV-D Directors Office of Child Support, the Office of the District Attorney, the California Department of Mental Health, the California Office of Community Colleges and the Department of Alcohol and Drug Programs. The Pass -through Entity and Subrecipient agree that: a. Each party shall keep all information that is exchanged between them In the strictest confidence and make such information available to their own employees only on a "need -to -know" basis. b. Each party shall provide security sufficient to ensure protection of confidential information from improper use and disclosures, including sufficient administrative, physical, and technical safeguards to protect this information from reasonable unanticipated threats to the security or confidentiality of the information. c. The Subrecipient agrees that information obtained under this subgrant agreement will not be reproduced, published, sold or released in original or in any other form for any purpose other than those specifically identified in this agreement. 1. Aggregate Summaries: All reports and/or publications developed by the Subrecipient based on data obtained under this agreement shall contain confidential data in aggregated or statistical summary form only. "Aggregated" refers to a data output that does not allow identification of an individual or employer unit. 2. Publication: Prior to publication, Subrecipient shall carefully analyze aggregated data outputs to ensure the identity of individuals and/or employer units cannot be inferred pursuant to California Unemployment Insurance Code Section 1094(c). Personal identifiers must be removed. Geographic identifiers should be specified only in large areas and as needed, and variables should be recorded in order to protect confidentiality. 3. Minimum Data Cell Size: The minimum data cell size or derivation thereof shall be three participants for any data table released to outside parties or to the public. d. Each party agrees that no disaggregate data, identifying individuals or employers, shall be released to outside parties or the public. e. The Subrecipient shall notify Pass -through Entity's Information Security Office of any actual or attempted information security incidents, within 24 hours of initial detection, by telephone at (916) 654-6231. Information security incidents include, but are not limited to, any event (intentional or unintentional), that causes the loss, damage, or destruction, or unauthorized access, use, modification, or disclosure of information assets. The Subrecipient shall cooperate with the Pass -through Entity in any investigation of security incidents. The system or device affected by an information security incident and containing confidential data obtained in the administration of this program shall be immediately removed from operation upon confidential data exposure or a known security breach. It shall remain removed from operation until correction and mitigation measures are applied. If the Subrecipient learns of a breach in the security of the system which contains confidential data obtained under this Subgrant, then the Subrecipient must provide notification to individuals pursuant to California Civil Code Section 1798.82. The Subrecipient shall be responsible for all costs incurred by the Pass -through Entity due to a security incident resulting from the Subrecipient's failure to perform or negligent acts of Its personnel, and resulting in an unauthorized disclosure, release, access, review, or destruction; or loss, theft or misuse of an information asset. If the Subrecipient experiences a loss or breach of data, Page 14 of 16