G-1
Exhibit G
Confidentiality and Data Security Requirements
Subject to the terms and conditions of the Agreement, current proprietary and confidential information of Authority regarding customers of Authority (“Authority Customers”) and/or other confidential information (collectively “Confidential Information”) may be disclosed to Consultant from time to time in connection herewith solely for the purposes set forth in the Agreement. Such disclosure is subject to the following legal continuing representations and warranties by Consultant:
1. The Confidential Information disclosed to Consultant in connection herewith may include the following information about Authority Customers: (a) names; (b) addresses; (c) telephone numbers and email addresses; (d) service agreement numbers and account numbers; (e) meter and other identification numbers; (f) Authority-designated account numbers; (g) electricity and gas usage (including monthly usage, monthly maximum demand, electrical or gas consumption, HP load, and other data detailing electricity or gas needs and patterns of usage); (h) billing information (including rate schedule, baseline zone, CARE participation, end use code (heat source) service voltage, medical baseline, meter cycle, bill cycle, balanced payment plan and other plans); (i) payment / deposit status; (j) number of units; and (k) other similar information specific to Authority Customers individually or in the aggregate. Confidential Information shall also include specifically any copies, drafts, revisions, analyses, summaries, extracts, memoranda, reports and other materials prepared by Consultant or its representatives that are derived from or based on Confidential Information disclosed by Authority, regardless of the form of media in which it is prepared, recorded or retained.
2. Except for electric and gas usage information provided to Consultant pursuant to this Agreement, Confidential Information does not include information that Consultant proves (a) was properly in the possession of Consultant at the time of disclosure; (b) is or becomes publicly known through no fault of Consultant, its employees or representatives; or (c) was independently developed by Consultant, its employees or representatives without access to any Confidential Information.
3. From the Effective Date, no portion of the Confidential Information may be disclosed, disseminated or appropriated by Consultant, or used for any purpose other than the purposes set forth in the Agreement.
4. Consultant shall, at all times and in perpetuity, keep the Confidential Information in the strictest confidence and shall take all reasonable measures to prevent unauthorized or improper disclosure or use of Confidential Information. Consultant shall implement and maintain reasonable security procedures and practices appropriate to the nature of the information, to protect the personal information from unauthorized access, destruction, use, modification, or disclosure and prohibits the use of the data for purposes not set forth in the Agreement. Specifically, Consultant shall restrict access to Confidential Information, and to materials prepared in connection therewith, to those employees, officers, directors, employees, agents, advisors and consultants (collectively “representatives”) of Consultant who have a “need to know” such Confidential Information in the course of their duties with respect to the Consultant program and who agree to be bound by the nondisclosure and confidentiality obligations of this Agreement. Prior to disclosing any Confidential Information to its employees or representatives, Consultant shall require such employees or representatives to whom Confidential Information is to be disclosed to review this Agreement and to agree to be bound by the terms of this Agreement. Consultant shall not disclose Confidential Item 6
Attachment 1
Draft Agreement: Franklin Energy Services, LLC and SVCE G-2
Information or otherwise make it available, in any form or manner, to any other person or entity that is not Consultant’s employee or representative (a “Third Party”), except where that Third Party has separately entered into a nondisclosure agreement with Authority. Without limiting Consultant’s obligation of confidentiality as further described herein, Consultant shall be responsible for establishing, maintaining, and providing a written description to Authority of, a data privacy and information security program, including physical, technical, administrative, and organizational safeguards, that comply with or are substantial similar to the security controls identified in the current version of NIST SP800-53, and that is designed to: (a) ensure the security and confidentiality of the Authority’s Data; (b) protect against any anticipated threats or hazards to the security or integrity of the Data; (c) protect against unauthorized disclosure, access to, or use of the Data; (d) ensure the proper disposal of Data; and, (e) ensure that all employees, agents, and subcontractors of Consultant, if any, comply with all of the foregoing. In no case shall the safeguards of Consultant’s data privacy and information security program used to protect Data be less stringent than the safeguards used by Consultant for its own data. If the services include handling credit card information, then the Consultant shall comply at all times with all applicable Payment Card Industry Data Security Standards (PCI-DSS). Consultant agrees and warrants that it is responsible for the security of “cardholder data” that Consultant possesses, stores, processes or transmits on behalf of the Authority, and for any impact on the security of Authority’s cardholder data environment adversely affected by any failure of Company to maintain compliance with provisions of the PCI-DSS applicable to the services. No less than annually, Consultant shall conduct a comprehensive independent third-party audit of its data privacy and information security program and provide such audit findings to Authority. The required audit shall be a SAS-70 (or successor standard) compliant audit, and Consultant shall provide the audit findings in the form of an SAS-70 Type II report.
5. Notwithstanding the above, Consultant may disclose Confidential Information to the extent required by an order, subpoena, or lawful process requiring the disclosure of such Confidential Information issued by a court or other governmental authority of competent jurisdiction, provided that Consultant notifies Authority immediately upon receipt thereof to allow Authority to seek protective treatment for such Confidential Information.
6. In the event of any act, error or omission, negligence, misconduct, or breach that permits any unauthorized access to, or that compromises or is suspected to compromise the security, confidentiality, or integrity of the Authority’s Data or the physical, technical, administrative, or organizational safeguards put in place by Consultant that relate to the protection of the security, confidentiality, or integrity of the Data, Consultant shall, as applicable: (a) notify Authority as soon as practicable but no later than seventy-two (72) hours of becoming aware of such occurrence; (b) cooperate with Authority in investigating the occurrence, including making available all relevant records, logs, files, data reporting, and other materials required to comply with applicable law or as otherwise required by Authority; (c) in the case of Confidential Information, at Authority’s sole election, (i) notify the affected individuals who comprise the Confidential Information as soon as practicable but no later than is required to comply with applicable law including, but not limited to, the provisions of California Civil Code Section 1798.82, or, in the absence of any legally required notification period, within five (5) calendar days of the occurrence; or, (ii) reimburse Authority for any costs in notifying the affected individuals; (d) in the case of Confidential Information, provide third-party credit and identity monitoring services to each of the affected individuals who comprise the Confidential Information for the period required to comply with applicable law, or, in the absence of any legally required monitoring services, for no less than twelve (12) months following Item 6
Attachment 1
Draft Agreement: Franklin Energy Services, LLC and SVCE G-3
the date of notification to such individuals; (e) perform or take any other actions required to comply with applicable law as a result of the occurrence; ; (f) be responsible for recreating lost Data in the manner and on the schedule set by Authority without charge to Authority; (g) provide to Authority a detailed plan within ten (10) calendar days of the occurrence describing the measures Consultant will undertake to prevent a future occurrence and (h) upon conclusion of the occurrence, or at Authority’s request, provide to Authority a comprehensive summary of the occurrence, including reason for occurrence, details of occurrence, how occurrence was addressed and any other information required by Authority, which shall be executed by Consultant and may be relied upon by Authority as a true and accurate account of the occurrence. Notification to affected individuals, as described above, shall comply with applicable law, be written in plain language, and contain, at a minimum: name and contact information of Consultant’s representative; a description of the nature of the loss; a list of the types of data involved; the known or approximate date of the loss; how such loss may affect the affected individual; what steps Consultant has taken to protect the affected individual; what steps the affected individual can take to protect himself or herself; contact information for major credit card reporting agencies; and, information regarding the credit and identity monitoring services to be provided by Consultant. This Section shall survive the termination of this Agreement.
7. It shall be considered a material breach of this Agreement if Consultant engages in a pattern or practice of accessing, storing, using, or disclosing the Confidential Information in violation of the contractual obligations described herein. Consultant understands that if Authority finds that Consultant is engaged in a pattern or practice of accessing, storing, using, or disclosing Confidential Information in violation of this Agreement Authority shall promptly cease all disclosures of Confidential Information to Consultant. Consultant further understands that if Authority receives a customer complaint about Consultant’s misuse of data or other violation of the Disclosure Provisions, Authority shall promptly cease disclosing that customer’s information to Consultant and shall notify the California Public Utilities Commission of the complaint.
8. Consultant shall be liable for the actions of, or any disclosure or use by, its employees or representatives contrary to this Agreement; however, such liability shall not limit or prevent any actions by Authority directly against such employees or representatives for improper disclosure and/or use. In no event shall Consultant or its employees or representativestake any actions related to Confidential Information that are inconsistent with holding Confidential Information in strict confidence. Consultant shall promptly notify Authority in writing if it becomes aware of the possibility of any misuse or misappropriation of the Confidential Information by Consultant or any of its employees or representatives. However, nothing in this Agreement shall obligate the Authority to monitor or enforce the Consultant’s compliance with the terms of this Agreement.
9. Consultant shall comply with the consumer protections concerning subsequent disclosure and use set forth in Attachment B to California Public Utilities Commission (CPUC) Decision No. 12-08-045.
10. In addition to any other requirements set forth in the Agreement, within ten (10) business days of receipt of Authority’s written request, and at Authority’s option, Consultant will either return to Authority all tangible Confidential Information, including but not limited to all electronic files, documentation, notes, plans, drawings, and copies thereof, or will provide Authority with written certification that all such tangible Confidential Information of Authority has been destroyed.
Item 6
Attachment 1
Draft Agreement: Franklin Energy Services, LLC and SVCE G-4
11. Consultant acknowledges that disclosure or misappropriation of any Confidential Information could cause irreparable harm to Authority and/or Authority Customers, the amount of which may be difficult to assess. Accordingly, Consultant hereby confirms that the Authority shall be entitled to apply to a court of competent jurisdiction or the California Public Utilities Commission for an injunction, specific performance or such other relief (without posting bond) as may be appropriate in the event of improper disclosure or misuse of its Confidential Information by Consultant or its employees or representatives. Such right shall, however, be construed to be in addition to any other remedies available to the Authority, in law or equity.
12. When Consultant fully performs the purposes set forth in the Agreement, or if at any time Consultant ceases performance or Authority requires Consultant cease performance of the purposes set forth in the Agreement, Consultant shall promptly return or destroy (with written notice to Authority itemizing the materials destroyed) all Confidential Information then in its possession at the direction of Authority. Notwithstanding the foregoing, the nondisclosure obligations of this Agreement shall survive any termination of this Agreement.
Item 6
Attachment 1
Draft Agreement: Franklin Energy Services, LLC and SVCE