Walsworth Publishing Walsworth, Inc. (“Walsworth”) is committed to following applicable law regarding the handling or protection of educational records, including personally identifiable information, “pupil records” as defined in California Education Code §§ 49061(b), 49073.1, and “covered information” as defined in California Business and Professions Code § 22584. To ensure compliance with California law, Walsworth offers its California customers an addendum to its standard yearbook contract. While subject to negotiation and modification, the form of addendum initially offered addresses the following points:
In order for Walsworth to prepare and publish Customer’s annual yearbook, Customer agrees to provide Walsworth with information that Customer has properly designated as “directory information” pursuant to California Education Code §§ 49061(c) and 49073, and the Family Education Rights and Privacy Act (“FERPA”), 20 U.S.C. § 1232g.
Customer does not intend to provide Walsworth with pupil records unless Customer determines that pupil records are necessary for the completion of its yearbook. To ensure that any pupil records provided to Company are properly handled, Customer and Walsworth agree to the following:
- At all times, pupil records continue to be the property of and under the control of Customer.
- As described in Customer’s policies, pupils may retain possession and control of their own pupil-generated content, including options by which a pupil may transfer pupil-generated content to a personal account.
- Walsworth will not use any information in a pupil record for any purpose other than those required or specifically permitted by the Agreement.
- Using the procedures described in Customer’s policies, a parent, legal guardian or eligible pupil may review personally identifiable information in the pupil’s records and correct erroneous information.
- Walsworth will limit access to the information provided by Customer, including any pupil records, by implementing reasonable protective security measures and training as required by relevant authorities and applicable laws and regulations. As part of these measures, Walsworth will maintain reasonable authentication access controls such as usernames and passwords to restrict unauthorized and unauthenticated access to student information. Walsworth will conduct regular reviews of its methods for protecting information received from Customer and regular audits of the performance its systems. Walsworth will store, process and maintain all information received from Customer solely on designated servers. Such information will not be transferred to any other storage medium unless such medium is used as part of the Walsworth’s backup or recovery processes or as permitted by agreement of the parties or applicable law.
- In addition to its employees, Walsworth may disclose copies or extracts of pupil records to its authorized subcontractors, agents, consultants and auditors who have a need for the data for a pre-approved reason and who have executed a confidentiality agreement with Walsworth.
- Walsworth has and will maintain a clear data breach response plan for addressing the unauthorized use or disclosure of pupil records. Walsworth also agrees to comply with all laws and regulations requiring notification of individuals in the event of any unauthorized use, access and/or release of pupil records.
- Upon the termination of the Agreement, Walsworth will within a reasonable time return to Customer a copy of any pupil records provided to Walsworth in connection with this Agreement. Except as permitted by the Agreement, Walsworth will then erase, destroy or render unreadable all student information on its servers in a manner that prevents its physical reconstruction through the use of commonly available file restoration utilities. At any time, Walsworth will delete a student’s “covered information,” as defined by California Business and Professions Code § 22584, if Customer requests deletion of data under the control of Customer.
- In order to ensure compliance with FERPA, Customer intends to limit the information provided to Walsworth to directory information. In the event that Customer determines that it has provided or needs to provide Customer with personally identifiable information in education records other than directory information, Walsworth will reasonably cooperate with Customer’s efforts to obtain the appropriate consents required by FERPA to release such information.
- Walsworth will not (a) engage in targeted advertising on its site, service or application, (b) target advertising on any other site, service or application based on any information Walsworth acquired because of use of its site, service or application, or (c) use any personally identifiable information in any pupil record to engage in targeted advertising.
- Walsworth will not use, sell or disclose covered information unless permitted by applicable law.