AB824: Bill Text

AB824,8,8 4. Establish and ensure compliance with internal policies and procedures related to auditing capabilities that require the data custodian to perform an audit of its systems at the request of the data owner.

AB824,8,10 (c) A data steward that uses or facilitates the use of sensitive information shall do all of the following:

AB824,8,12 1. Establish and ensure compliance with internal policies and procedures that reflect best practices of data handling on subjects including all of the following:

AB824,8,14 a. Standards, policies, procedures, and requirements for requesting, accessing, interpreting, and using data.

AB824,8,16 b. Identity and access management controls, including limiting the access to any data subject to a data agreement.

AB824,8,18 c. Verification of data outputs to meet quality, accuracy, and reliability specifications.

AB824,8,19 d. Establishment of data element definitions and lineage.

AB824,8,21 e. Establishment and maintenance of auditing policies, procedures, and reporting.

AB824,8,22 f. Policies and procedures regarding data retention and destruction.

AB824,8,24 g. Interpretation of new and changing business and regulatory requirements that may impact data solution organization.

AB824,8,25 h. Any other requirements established in a data agreement.

AB824,9,3 2. Establish and ensure compliance with policies and procedures regarding the handling of data agreement breaches, security incidents, in compliance with s. 134.98, and related disputes.

AB824,9,7 (3) Agreements between data controllers. Data agreements are required when sensitive information controlled by one data controller is to be shared with, accessed by, or used by another data controller. A data agreement shall contain all of the following provisions:

AB824,9,8 (a) Identification of the parties to the agreement.

AB824,9,9 (b) Identification of the data subject to the agreement.

AB824,9,13 (c) Identification of the permitted uses and restrictions of the data subject to the agreement, including whether the data owner permits the data controller to share with another entity any enhanced data that was based on the data owner's original data.

AB824,9,15 (d) Identification of any confidentiality requirements for the data subject to the agreement.

AB824,9,21 (e) Identification of the law governing the data subject to the agreement, such as the federal Family Educational Rights and Privacy Act, the federal Health Insurance Portability and Accountability Act, the federal Health Information Technology for Economic and Clinical Health Act, the federal Criminal Justice Information Services Security Policy, or the federal Children's Online Privacy Protection Rule.

AB824,9,23 (f) Identification of the governing law and venue that shall govern the validity, construction, enforcement, and interpretation of the agreement.

AB824,9,25 (g) Provisions governing the response to security incidents, in compliance with s. 134.98, including all of the following:

AB824,10,3 1. The name and contact information of one or more individuals who are authorized to provide and receive security incident communications pertaining to the data subject to the agreement.

AB824,10,5 2. An attestation from a data custodian that it has established and agrees to comply with security incident policies and procedures under sub. (2) (b) 3.

AB824,10,9 (h) Definition of the term of the data agreement. A data agreement under this section shall remain in effect until a mutually agreed upon termination date or until all data subject to the agreement is destroyed or returned to the data owner, whichever occurs first.

AB824,10,11 (i) Provisions regarding the right to terminate the agreement, including all of the following:

AB824,10,12 1. Conditions under which the agreement may be terminated.

AB824,10,13 2. The method of notification required before termination is effective.

AB824,10,14 3. The advance notice period required before termination is effective.

AB824,10,16 4. Any special circumstances under which immediate termination of the agreement may be pursued.

AB824,10,18 (j) Provisions regarding authorization for or prohibition of the collection and analysis of metadata.

AB824,10,25 (k) In a data sharing agreement between a data owner and a data custodian, provisions regarding auditing capabilities and the performance of audits. A data custodian shall attest that it has enabled appropriate capabilities to support compliance with the regulatory statutes identified in the agreement and shall agree, at the request of the data owner, to perform an audit of the data owner's data under its custodianship. Such an audit shall have a mutually agreed upon scope and shall be performed within a mutually agreed upon time frame.

AB824,11,1 (L) Any other requirements as established by any party to the agreement.

AB824,11,2 (End)