Exhibit 103 — BofA Ca Unemployment (Dkt. 324.106)

Summary

Exhibit 103, filed August 29, 2024 as Document 324-106 in Case 3:21-md-02992-GPC-MSB, is a State of California standard agreement (STD 213), EDD Contract No. M6100352, between the Employment Development Department and Bank of America, NA. The contractor is to establish, operate and maintain a comprehensive Electronic Benefit Payment (EBP) service for the EDD. Its term runs 8/1/2016 through 7/31/2021, and EDD has the option to renew for two (2) additional two (2) year terms. The maximum amount is $0.00: "The contract is no cost for the EDD," and the contractor is to provide revenue shares to the EDD under Attachment VI.1 of its proposal. Exhibit E of the agreement sets confidentiality requirements for EDD information.

Summary drafted by a model from the document's text below and checked by script against that text before publication. It is a navigation aid, not a reading of what the document proves. Where AI is used

Full text

Text recognized from a scanned document; may contain errors.

Case 3:21-md-02992-GPC-MSB Document 324-106 Filed 08/29/24 PagelD.7143
Page 1 of 7

Exhibit 103
STATE OF CALIFORNIA
STD 213 (Rev 06/03)

Case 3:21-md-02992-GPC-MSB Document 324-106 Filed 08/29/24 PagelD.7144
Page 2 of 7
Dist QULe (ONS M6100352

REGISTRATION NUMBER

1. This Agreement is entered into between the State Agency and the Contractor named below:

STATE AGENCY'S NAME

Employment Development Department

CONTRACTOR'S NAME

Bank of America, NA

2. The term of this
Agreement is:

8/1/2016 through 7/31/2021, or five (5) years from final approval.
In addition, EDD has the option to renew for two (2) additional two (2) year terms.

3. The maximum amount
of this Agreement is:

$0.00 No Dollars No Cents. The contract is no cost for the EDD. The Contractor is to
provide revenue shares to the EDD in accordance with Attachment VI.1 of their Proposal.

4. The parties agree to comply with the terms and conditions of the following exhibits which are by this reference made a

part of the Agreement.

Exhibit A ~ Scope of Work

Exhibit B * - General Terms and Conditions

Exhibit C — Request for Proposal (RFP) #65466 (incorporated by reference)
Exhibit D - Bank of America’s response to RFP 65466 (Incorporated by reference)
Exhibit E- Confidentiality Requiremenis

2 Pages
GTC 610

3 Pages

Items.shown with an Asterisk (*), are hereby incorporated by reference and made part of this agreement as if attached hereto.

These docurnents can be viewed at http://jwww.dgs.ca.

IN WITNESS WHEREOF, this Agreement has been executed by the parties hereto.

gov/ols/Resources/StandardContractLanquage.aspx

CONTRACTOR

CONTRACTOR'S NAME (if other than an individual, state whether a corporation, partnership, etc.)
Bank of America, NA

BY (Authorized Signature) ~ DATE SIGNED(De,nat type)

PRINTED NAME AND TITLE OF PERSON SIGNING
Dawn Haddock, Director, Senior Treasury Solutions Officer

ADDRESS
555 Capitol Mall, Suite 765
Sacramento, CA 95814-4503

STATE OF CALIFORNIA

AGENCY NAME
Employment Development Department

DATE SJONED/ io nat type)

fo / £3, mS

BY (Authorized Signature) . Vy A f

PRINTED NAME AND TITLEOF PERSON SIGNING’
Xochitl Montano, Manager, Contract Services Group

ADDRESS
800 Capitol Mall, MIC 62-C, Sacramento, CA 95814

California Department of General
Services Use Only

[>] Exempt per:
DGS Exemption Letter No. 54.4

BANA_EDD_MDL-00518186
Case 3:21-md-02992-GPC-MSB Document 324-106 Filed 08/29/24 PagelD.7145

Page 3 of 7
EDD Contract No. M6100352
EDD/Bank of America
Page 1 of 2

EXHIBIT A

SCOPE OF WORK

1. This Agreement is entered into by and between the Employment Development Department,
hereinafter referred to as EDD, and Bank of America, hereinafter referred to as Contractor,
and is for the purpose of the Contractor establishing, operating and maintaining a
comprehensive Electronic Benefit Payment (EBP) service for the EDD.

2. The project representatives during the term of this agreement shall be:

Employment Development Department Bank of America

Cindy Kakutani Dawn Haddock

Information Technology Branch Director, Senior Treasury Sales Officer
751 N Street, Solar 4 555 Capitol Mall

Sacramento, CA 95814 Sacramento, CA 95814

(916) 654-9217 (916) 326-7825

Natalie Mack

Disability Insurance Branch
800 Capitol Mall, MIC 29
Sacramento, CA 95814
(916) 654-7723

Regina Luster-Shaw
Disability Insurance Branch
800 Capitol Mall, MIC 29
Sacramento, CA 95814
(916) 657-3984

Michael Greenlow
Unemployment Insurance Branch
800 Capitol Mall, MIC 4
Sacramento, CA 95814

(916) 651-6187

3. The services shall be provided in accordance with the following sections of the RFP and the
Contractor's response to EDD’s Request for Proposal #65466:

a. Section IV, Administrative Requirements, including Attachment IV.3, Staff Roles and
Qualifications Matrix, Attachment IV.8, Employee Confidentiality Statement and IV-9,
Indemnity Agreement.

b. Section V, EBP Service Requirements, including Attachment V.1, Statement of Work;
Attachment V.2, Statement of Work EBP Service Requirements and V.3, Fee Schedule.

BANA_EDD_MDL-00518187
Case 3:21-md-02992-GPC-MSB Document 324-106 Filed 08/29/24 PagelD.7146

Page 4 of 7
EDD Contract No. M67100352
EDD/Bank of America
Page 2 of 2
EXHIBIT A

c. Section VI, Revenue Share Model, including VI.1, Revenue Share.

d. Exhibit B, Confidentiality Requirements.

BANA_EDD_MDL-00518188
Case 3:21-md-02992-GPC-MSB Document 324-106 Filed 08/29/24 PagelD.7147

Page 5 of 7 EDD Contract No. M6100352
EDD/Bank of America
Page 1 of 3

EXHIBIT E

CONFIDENTIALITY REQUIREMENTS

PROTECTION OF CONFIDENTIALITY

Federal and state confidentiality laws, regulations, and administrative policies classify all the Employment
Development Department (EDD) information provided under this Agreement as confidential. The federal and
state laws prohibit disclosure of the EDD’s confidential information to the public and mandate its protection
against loss and against unauthorized access, use, disclosure, modification, or destruction.

The Contractor must therefore, agree to the following security and confidentiality requirements:

I. ADMINISTRATIVE SAFEGUARDS

a.

Adopt policies and procedures to ensure use of the EDD’s confidential information solely for purposes
specifically authorized under this Agreement that meet the requirements of Title 20, Code of Federal
Regulations §603.10.

Warrant by execution of this Agreement, that no person or selling agency has been employed or
retained to solicit or secure this Agreement upon agreement or understanding for a commission,
percentage, brokerage, or contingent fee. In the event of a breach or violation of this warranty, the
EDD shall have the right to annul this Agreement without liability, in addition to other remedies provided
by law.

Warrant and certify that in the performance of this Agreement the Contractor will comply with all
applicable statutes, rules and/or regulations, and Agreement information security requirements,
including but not limited to the following:

e California Unemployment Insurance Code §1094 (Disclosure Prohibitions)

e Title 20, Code of Federal Regulations §603.9 and §603.10 (Federal Unemployment Compensation
Safeguards and Security Requirements)

e California Civil Code §1798, et seq. (Information Practices Act)

® California Penal Code §502 (Computer Fraud Act )

e Title 5, U.S. Code §552a (Federal Privacy Act Disclosure Restrictions)
e Title 42, U.S. Code §503 (Social Security Act)

® Title 18, U.S. Code §1905 (Disclosure of Confidential Information)

Except for state agencies, agree to indemnify the EDD against any loss, cost, damage or liability
resulting from violations of these applicable statutes, rules and/or regulations, and Agreement
information security requirements.

Protect the EDD’s information against unauthorized access, at all times, in all forms of media. Access
and use the information obtained under this Agreement only to the extent necessary to assist in the
valid administrative needs of the program receiving such information, and only for the purposes defined
in this Agreement.

Keep ail the EDD’s confidential information completely confidential. Make this information available to
authorized personnel on a "need-to-know" basis and only for the purposes authorized under this
Agreement. “Need-to-know’ refers to those authorized personnel who need information to perform their
official duties in connection with the use of the information authorized by this Agreement.

Confidentiality Requirements STD. [Rev 05/08/14]

BANA_EDD_MDL-00518189
Case 3:21-md-02992-GPC-MSB Document 324-106 Filed 08/29/24 PagelD.7148

Page 6 of 7 EDD Contract No. M6100352
EDD/Bank of America
Page 2 of 3

EXHIBIT E

CONFIDENTIALITY REQUIREMENTS

g. Notify the EDD Information Security Office (ISO) at (916) 654-6231, immediately upon discovery, that
there may have been a breach in security which has or may have resulted in compromise to the
confidential information. For purposes of this section, immediately is defined within 24 hours of
discovery of the breach. The notification shall be by phone and the caller shall speak directly with a
person in the EDD ISO. it is not sufficient to simply leave a message. The notification must include
a detailed description of the incident (such as time, date, location, and circumstances) and identifying
responsible personnel (name, title and contact information). The verbal notification shall be followed
with an email notification to <InformationSecurityOffice@edd.ca.gov>.

ll. MANAGEMENT SAFEGUARDS

a. Acknowledge that the confidential information obtained by the Bidder under this Agreement remains the
property of the EDD.

b. Instruct all personnel assigned to work with the information provided under this Agreement regarding
the following:

e Confidential nature of the EDD information.
e Requirements of this Agreement.

e Sanctions specified in federal and state unemployment compensation laws and any other relevant
statutes against unauthorized disclosure of confidential information provided by the EDD.

c. Require that all personnel assigned to work with the information provided by the EDD complete the EDD
Confidentiality Agreement (Attachment D1):

d. Return the following completed documents to the EDD Contract Services Group:

o The EDD Indemnity Agreement (Attachment V 9): Required to be completed by the
Contractor Chief Financial Officer or authorized Management Representative, unless the
Bidder is a State Agency.

o The EDD Statement of Responsibility Information Security Certification (Attachment V
10): Required to be completed by the Information Security Officer or authorized
Management Representative.

e. Permit the EDD to make on-site inspections to ensure that the terms of this Agreement are being met.
Make available to the EDD staff, on request and during on-site reviews, copies of the EDD
Confidentiality Agreement (Attachment D1) completed by personnel assigned to work with the EDD’s
confidential information, and hereby made a part of this Agreement.

f. Maintain a system of records sufficient to allow an audit of compliance with the requirements under
subsection (d) of this part. Permit the EDD to make on-site inspections to ensure that the requirements
of federal and state privacy, confidentiality and unemployment compensation statutes and regulations
are being met including but not limited to Social Security Act §1137(a)(5)(B).

Hl. USAGE, DUPLICATION, AND REDISCLOSURE SAFEGUARDS

a. Use the EDD’s confidential information only for purposes specifically authorized under this Agreement.
The information is not admissible as evidence in any action or special proceeding except as provided
under §1094(b) of the California Unemployment Insurance Code (CUIC). Section 1095(u) of the CUIC
does not authorize the use of the EDD’s confidential information by any private collection agency.

Confidentiality Requirements STD. [Rev 05/08/14]

BANA_EDD_MDL-00518190
b.

Case 3:21-md-02992-GPC-MSB Document 324-106 Filed 08/29/24 PagelD.7149

Page 7 of 7 EDD Contract No. M6100352
EDD/Bank of America
Page 3 of 3

EXHIBIT E

CONFIDENTIALITY REQUIREMENTS

Extraction or use of the EDD information for any purpose outside the purposes stated in this Agreement
is strictly prohibited. The information obtained under this Agreement shall not be reproduced, published,
sold, or released in original or any other form not specifically authorized under this Agreement.

Disclosure of any of the EDD information to any person or entity not specifically authorized in this
Agreement is strictly prohibited. Personnel assigned to work with the EDD’s confidential information
shall not reveal or divulge to any person or entity any of the confidential information provided under this
Agreement except as authorized or required by law.

IV. PHYSICAL SAFEGUARDS

a.

Take precautions to ensure that only authorized personnel are given access to physical, electronic and
on-line files. Store electronic and hard copy information in a place physically secure from access by
unauthorized persons. Process and store information in electronic format, such as magnetic tapes or
discs, in such a way that unauthorized persons cannot retrieve the information by means of computer,
remote terminal, or other means.

Secure and maintain any computer systems (network, hardware, and software applications) that will be
used in the performance of this Agreement. This includes ensuring that all security patches, upgrades,
and anti-virus updates are applied as appropriate to secure data that may be used, transmitted, or
stored on such systems in the performance of this Agreement.

Store all the EDD’s confidential documents in a physically secure manner at all times to prevent
unauthorized access.

Store the EDD's confidential electronic records in a secure central computer facility. Where in-use on a
shared computer system or any shared data storage system, ensure appropriate information security
protections are in place. The Bidder shall ensure that appropriate security access controls, storage
protections and use restrictions are in place to keep the confidential information in the strictest
confidence and shall make the information available to its own personnel on a "need-to-know’ basis
only.

A cloud computing environment cannot be used to receive, transmit, store, or process the EDD’s
confidential data.

Store the EDD’s confidential data in encrypted format when recorded on removable electronic storage
media, or on mobile computing devices, such as a laptop computer.

Maintain an audit trail and record data access of authorized users and authorization level of access
granted to the EDD's data, based on job function.

Direct all personnel permitted to use the EDD’s data to avoid leaving the data displayed on their
computer screens where unauthorized users may view it. Personnel should retrieve computer printouts
as soon as they are generated so that the EDD’s data is not left unattended in printers where
unauthorized personnel may access them.

Dispose of confidential information obtained from the EDD, and any copies thereof made by the
Contractor, after the purpose for which the confidential information is disclosed is served. Disposal
means return of the confidential information to the EDD or destruction of the information utilizing an
approved method of confidential destruction, which includes electronic deletion (following Department
of Defense specifications) shredding, burning, or certified or witnessed destruction.

Confidentiality Requirements STD. [Rev 05/08/14]

BANA_EDD_MDL-00518191


File and source

File

gov.uscourts.casd.709615.324.106.pdf

Size

396,853 bytes

SHA-256

8700b60092aa0b53a278e3f8c212ee7b659d9bad4ab2200f12badc6d930b4fd5

Our copy

gov.uscourts.casd.709615.324.106.pdf

Original

PACER (login required)