277-22 Exhibit(s)-Low Income Household Water Assistance Program.pdf

DATA SHARING AGREEMENT BETWEEN THE STATE OF NEW JERSEY, DEPARTMENT OF COMMUNITY AFFAIRS AND TOWNSHIP OF WEST ORANGE I. PARTIES This Data Sharing Agreement (“Agreement”) is made and entered into by and between the New Jersey Department of Community Affairs (“Department”) whose address is 101 South Broad Street, PO Box 800, Trenton, N.J. 08625-0037, and {Insert Utility Company} __________, serving as a participating vendor in the Low-Income Household Water Assistance Program (“LIHWAP”) (referred to as “Utility Company”), whose address is ______________________________. When executed by the Parties, this Agreement shall become effective as of the date of the last signature set forth below. II. PURPOSE The purpose of this Agreement is to establish the terms by which the Department and the Utility Company, will share customer information. As a participating vendor, Utility Company is eligible to receive direct payment based on customer’s eligibility for the LIHWAP, the Temporary Assistance for Needy Families (“TANF”) and/or Food Stamp programs and any other program where the customer’s eligibility has already been determined by the Department, or through an eligibility determination process for those customers who are not currently participating in a program administered by the Department. III. LEGAL AUTHORITY The Consolidated Appropriation Act 2021 (P.L. 116-260, 2020) and the American Rescue Plan Act of 2021 (P.L. 117-2, 2020) provided the Department with funding to provide relief to assist low-income households with water and wastewater bills. As a result, the Department implemented the LIHWAP Program, to provide relief in the form of benefits directly to water and waste water utility companies. The Department entered into a Grant Implementation Plan that was submitted to the United States Department of Health and Human Services, Administrative for Children and Families, that allows it to receive necessary customer data from the participating Utility Company. Page 1 of 7

IV. RESPONSIBILITIES OF THE PARTIES A. Warranties The Parties make no warranty, either express or implied, regarding the accuracy, reliability, completeness, or suitability of the information for any particular purpose. B. Access to Customer Data This Agreement covers the Department and the Utility Companies sharing of customer data for the purpose of implementing the LIHWAP Program. Customer data is defined as the customer’s name, mailing address, e-mail address, utility account numbers, phone number and amount owed (“Customer Data”). Neither Party is authorized to add to, amend, or delete information contained in the others Customer Data, in any manner whatsoever. C. Information Provided The Utility Company shall provide the Department with an up-to- date list on the 15th of every month of all Utility Company customers that are overdue on either their water or sewer bills in order to permit the Department to provide, by regular mail, to all such Utility Company customers notice of their possible eligibility to participate in the LIHWAP to assist in making outstanding payments for water and/or sewer bills. A list of eligible Utility Company customers seeking to participate in the LIHWAP will be provided to the appropriate Utility Company and the named customers shall be enrolled in the LIHWAP on the 15th of every month. D. Use of Information The Department agrees to collect individual Customer Data through an encrypted email or similar secure process. The Department shall restrict access to the Customer Data received to employees or workforce that need the Customer Data to perform their official duties in connection with the purpose of this Agreement. Any Department employee or workforce who access, disclose or use the Customer Data in a manner or for a purpose not authorized by the Agreement may be subject to civil or criminal sanctions contained in applicable federal or state statutes. Customer Data shall be processed so as to protect the confidentiality of the data, and in such a way that unauthorized persons cannot retrieved such records by means of computer, remote terminal, or any other means. Customer Data obtained under this Agreement shall not be disclosed to any third parties, unless otherwise specified in this

records by means of computer, remote terminal, or any other means. Customer Data obtained under this Agreement shall not be disclosed to any third parties, unless otherwise specified in this Agreement. The Department will limit access to the individual customer data to only those employees or authorized representatives required to determine LIHWAP eligibility and to make LIHWAP payments, and who are otherwise bound by the confidentiality obligations contained herein. The Utility Company agrees to limit access to the data to only those employees and officials who need it to perform their official duties in connection with the LIHWAP Program. Page 2 of 7

It is expressly understood and agreed by the Utility Company that no lists of LIHWAP recipients will be developed or maintained by any Utility Company and the identifying information contained on any LIHWAP check will be used solely for the purpose of applying the amount of the benefit to the recipient’s water/sewer utility account. E. Confidentiality The Utility Company understands and agrees that pursuant to statutes, regulations, and policies, certain information provided by the Department to the Utility Company is deemed confidential. The Utility Company understands and agrees that it is obligated to ensure that no confidential information shall be disclosed to any third party, except so as to effectuate the purpose as stated in this Agreement or as required by law. a. The Utility Company further agrees to maintain the same standard of confidentiality in accordance with 45 CFR 205:50(a) (2) (11); and b. To advise all Utility Company personnel who will have access to the data of the confidential nature of the information, the safeguards required, and the criminal and civil sanctions for non-compliance contained in Federal Statutes, such as Section 1106(a) of the Social Security Act, 5 U.S.C. 5522a(i), and Section 7217 of the Internal Revenue Code, and any other relevant State Statutes. F. Requests for Information Any receipt by a Utility Company of a request under the Open Public Records Act, N.J.S.A. 47:1A-1 to -13 (“OPRA”), by subpoena or any other manner of request for any records of individual recipients of assistance from the Department, shall be provided by the Utility Company to the Department within 24 hours of receipt in order to allow the Department to timely assert any privilege associated with a Utility Company customer’s participation in an assistance program. F. Liability The Department assumes no liability for the improper or illegal use of information obtained from the Department and provided to the Utility Company. The Utility Company assumes no liability for the improper or illegal use of information obtained from the Utility Company and provided to the Department. H. Compliance with Applicable Law The Parties agree that in the performance of this Agreement they shall comply with all applicable State, and Federal

ility Company and provided to the Department. H. Compliance with Applicable Law The Parties agree that in the performance of this Agreement they shall comply with all applicable State, and Federal laws and regulations, including, but not limited to, laws and regulations which address the confidentiality of the records/data and information contained in the Parties files. I. Parties’ Representatives The Department’s representative is _________, or the duly appointed successor. The Department representatives are authorized to receive correspondence, including notices referenced in this Agreement and/or otherwise pertaining to its subject matter. However, notifications as to data breaches or incidents shall be communicated as set forth in Subsection V of this Agreement. Page 3 of 7

The Utility Company’s representative is _______________________________________. The Department and the Utility Company’s representatives may agree to designate specific employee(s) as a contact person responsible to produce/receive the customer information. V. DATA BREACH OR INCIDENT NOTIFICATION A. The Parties agree to immediately, by telephone and email, notify the other Party upon the discovery of: a data breach or incident (suspected or actual) related to the Customer Data or participation in the LIHWAP Program, or a data breach or incident (suspected or actual) of a program having confidential Customer Data that has resulted in the disclosure of confidential Customer Data. Each Party reserves the right to conduct an assessment of and/or bring in a third party to work with the Utility Company or Department on any incident (suspected or actual), data breach, intrusion, loss or unauthorized use or disclosure of the Customer Data in violation of this Agreement. The Utility Company shall submit such notification to the Department of Community Affairs at __________________________. The Department shall submit such notification to the Utility Company at _______________________. B. Ensure that the initial notification includes contact and component information; a description of the incident and/or data breach, loss with scope, numbers of files or records, type of equipment or media, approximate time and location of incident and/or data breach or loss; description of how the data was physically stored, contained, or packaged (e.g., password protected, encrypted, locked briefcase, etc.); whether any individuals or external organizations have been contacted; and whether any other reports have been filed. C. Take prompt corrective action to mitigate any risks or damages involved with the incident and to protect the operating environment. D. Investigate the incident (suspected or actual) and produce a written incident report within two (2) business days of the incident, detailing what data elements were involved; a description of the unauthorized persons known or reasonably believed to have improperly used or disclosed customer information; a description of where the customer information and their participation in the LIHWAP is believed

sons known or reasonably believed to have improperly used or disclosed customer information; a description of where the customer information and their participation in the LIHWAP is believed to have been improperly transmitted, sent, or used; a description of the probable cause of the incident; a detailed corrective action plan including measures that were taken to halt and/or contain the incident. The Utility Company shall submit the incident report to the Department of Community Affairs at ___________________. The Department shall submit the incident report to the Utility Company at _______________________. The Party suffering from the breach will notify individuals of the incident (suspected or actual), data breach or unauthorized use or disclosure of the customer’s participation in the LIHWAP Program, when applicable state or federal law requires notification. The Utility Page 4 of 7

Company shall obtain the approval of the: Department of Community Affairs, Information Technology, John Harrison, John.Harrison@dca.nj.gov, for the time, manner and content of any such required notifications. The Department shall obtain the approval of the Utility Company _____________________. The Party that has experienced a breach shall be responsible for the cost of such notification to the extent that such data breach or unauthorized use or disclosure is due to the negligence or intentional misconduct of the Party. To the extent, such data breach or unauthorized use or disclosure is due to the negligence or intentional misconduct of the Party who experienced the breach that Party shall be responsible for notifying individuals and shall be responsible for any costs of notification. If there is any question as to whether the Department or the Utility Company is responsible for an incident, data breach or unauthorized use or disclosure of the customer information, the breached Party shall issue a notice and Utility Company and the Department shall subsequently determine responsibility for purposes of allocating the costs of such notices. E. In the case of an incident, data breach, theft, unauthorized use, disclosure, or crime related to the Customer Data maintained by either Party or the information contained therein, the Parties reserve the right to involve state and/or federal law enforcement officials in a data breach investigation, and/or involve a third party, including but not limited to specialists or subject matter experts, to help or conduct an independent investigation of any data breach or incident. The Parties agree to fully cooperate with any assessment or investigation related to a data breach or incident. In cases where notification to the other Party may compromise an ongoing assessment or criminal investigation of a data breach or incident, the Parties reserve the right to NOT provide notice. However, to the extent where such notice would not compromise an ongoing assessment or criminal investigation of an incident, data breach, theft, unauthorized use, disclosure, or crime related to the Customer Data, including their participation in the

going assessment or criminal investigation of an incident, data breach, theft, unauthorized use, disclosure, or crime related to the Customer Data, including their participation in the LIHWAP Program maintained by either Party, the investigating Party will provide written notice to the other Party regarding the existence of said assessment or criminal investigation. V. MISCELLANEOUS A. Termination This Agreement shall remain in effect until terminated as follows: • Unilaterally and immediately by the Department for any reason, upon 14- days’ written notice to the Utility Company; • Unilaterally and immediately by the Utility Company, for any reason, upon 14-days’ written notice to the Department; and • Mutually upon written agreement of the Department and the Utility Company, at any time. B. Subject to the Availability of Funding The Department’s obligations under this Agreement are subject to appropriations and the availability of funds. A failure by the Page 5 of 7

Department to make any payment required by this Agreement or to observe and perform any condition on its part to be performed under this Agreement as a result of the failure of the Legislature to appropriate necessary funds shall not in any manner constitute a breach or default by the Department and the Department shall not be held liable in any manner whatsoever because of the absence of available funding. C. Amendment/Waiver This Agreement cannot be amended, modified, or revised unless done so in writing signed by the Parties. No provision may be waived, except in a writing signed by the Parties. The failure of a Party to enforce any provision of this Agreement, or to require performance by the other Party, will not be construed to be a waiver, or in any way affect the right of either Party to enforce such provision thereafter. D. Assignment This Agreement may not be assigned, in whole or in part, by either Party without the prior written consent of the other Party. No permitted assignment shall relieve a Party of any of its responsibilities under this Agreement. Any assignment in violation of this Section shall be void. This Agreement shall be binding upon the Parties and their respective successors and assigns. E. Third Party Beneficiary Rights The Parties do not intend to create in any other individual or entity the status of a third-party beneficiary and this Agreement shall not be construed to create such status. The rights, duties, and obligations contained in this Agreement shall operate only between the Parties and shall inure solely to their benefit. The provisions of this Agreement are intended only to assist the parties in determining and performing their obligations under its terms. The parties intend and expressly agree that only they shall have any legal or equitable right to seek to enforce this Agreement, to seek any remedy arising out of a party’s performance of, or failure to perform, in accordance with any term or condition of this Agreement, or to bring an action for the data breach of this Agreement. F. Entirety of Agreement This Agreement, including any amendment executed by all parties and incorporated into this Agreement, is complete and contains the entire understanding among the parties relating to the subject matter contained herein, including all terms and