CALIFORNIA EMPLOYMENT DEVELOPMENT DEPARTMENT (3)

Home Browse Search

the Subrecipient shall immediately report report the loss or breach to the Pass - through Entity. If the Pass -through Entity determines that notice to the individuals whose data has been lost or breached is appropriate, the Subrecipient will bear any and all costs associated with the notice or any mitigation selected by the Pass -through Entity. These costs include, but are not limited to, staff time, material costs, postage, media announcements, and other identifiable costs associated with the breach or loss of data. f. The Subrecipient shall provide for the management and control of physical access to information assets (including personal computer systems, computer terminals, mobile computing devices, and various electronic storage media) used in performance of this Subgrant. This shall include, but is not limited to, security measures to physically protect data, systems, and workstations from unauthorized access and malicious activity; the prevention, detection, and suppression of fires; and the prevention, detection, and minimization of water damage. g. At no time will confidential data obtained pursuant to this agreement be placed on a mobile computing device, or on any form of removable electronic storage media of any kind unless the data are fully encrypted. h. Each party shall provide its employees with access to confidential information with written instructions fully disclosing and explaining the penalties for unauthorized use or disclosure of confidential information found in Section 1798.55 of the California Civil Code, Section 502 of the California Penal Code, Section 2111 of the California Unemployment Insurance Code, Section 10850 of the California Welfare and Institutions Code and other applicable local, state and federal laws. I. Each party shall (where it is appropriate) store and process information in electronic format, in such a way that unauthorized persons cannot reasonably retrieve the information by means of a computer. j. All Subrecipient staff and subcontractors that are provided access to any data systems of the Pass -through Entity, excluding CalJOBS, are required to complete and sign an Employee Confidentiality Statement (DE 7410). k. Each party shall promptly return to the other party confidential information when its use ends, or destroy the confidential information utilizing an approved method of destroying confidential information: shredding, burning, or certified or witnessed destruction. Magnetic media are to be degaussed or returned to the other party. I. If the Pass -through Entity or Subrecipient enters into an agreement with a third party to provide WIOA services, the Pass -through Entity or Subrecipient agrees to include these data and security and confidentiality requirements in the agreement with that third party. In no event shall said information be disclosed to any individual outside of that third party's authorized staff, subcontractor(s), service providers, or employees. m. The Subrecipient may, in its operation of the America's Job Center of California (AJCC), permit an AJCC Operator to enter into a subcontract to manage confidential information. This subcontract may allow an individual to register for resume distribution services at the same time the individual enrolls in CaIJOBS. Subrecipient shall ensure that all such subcontracts comply with the intellectual property requirements of this subgrant agreement, the confidentiality requirements of this subgrant agreement and any other terms of this subgrant agreement that may be applicable. In addition, the following requirements must be included in the subcontracts: 1. All client information submitted over the internet to the subcontractor's databases must be protected, at a minimum, by 128-bit Secure Socket Layer (SSL) encryption. Clients' social security numbers must be stored in a separate database within the subcontractor's network of servers, and protected by a firewall and a secondary database server firewall or AES data encryption. If a subcontractor receives client social security numbers or other confidential information in the course of business, for example a resume -distribution service that provides enrollment in CaIJOBS, social security numbers must be destroyed within two days after the client registers for CaIJOBS. If a subcontractor obtains confidential information as an agent of the Subrecipient, the subcontract must specifically state the purpose for the data collection and the term of records retention must be stated, and directly related, to the purpose and use of the information. Social security numbers and other client specific information Page 15 of 16