§5725 Contracts for data processing or maintenance

Summary

When the Department hires a contractor who will see sensitive personal information, the contract must say the contractor cannot share that information with anyone else unless the law allows it and the contract specifically permits the sharing. The contractor and any subcontractor must quickly tell the Secretary if a data breach happens. The contract must also require the contractor to pay pre-set damages if a breach occurs. Any money collected must go back into the same Department account that paid the contractor and can be used, without fiscal year limits, only for credit protection services under section 5724(b).