Information Sharing Agreement

To Support Operations of the Debt Liberation Laboratory, Its Lodges, and Participants

(Click headings to jump the linked area)

toc

SUMMARY SHEET

Title of Agreement: Debt Liberation Laboratory Data Sharing Agreement

Purpose:

To facilitate the sharing of personal and debt-related information between individuals and the organizations listed below.

The purpose of the information sharing is to facilitate the collective repayment of undergraduate student debt and necessary reporting.

Partners: Debt Liberation Laboratory, Member Lodges, Individual Participants of the Lodges

Date Agreement comes into force: March 1, 2018

Date of Agreement review: January 31, 2022

Agreement owner: Debt Liberation Laboratory

Agreement drawn up by: Debt Liberation Laboratory

VERSION RECORD

1/31/21

Version Number	Amendments Made	Date of Change	Changes By
0.1	First Draft	2/18/18	Christopher L. Dennis
0.2	Incorporating feedback	3/27/18	Christopher L. Dennis
0.3	Finalizing signature lines	3/29/18	Christopher L. Dennis
1.0	Printing for adoption by Lodge 1	3/30/18	Christopher L. Dennis
2.0	Greater clarity, new material for authorized payer	2/8/21	Christopher L. Dennis, John Lawson, Lauren Brady
2.1	Tuned up for web site	Christopher L. Dennis

INTRODUCTION

1. Objectives. The goals of lodge participants sharing information with Debt Liberation Laboratory are to:

1.1. Enable the accelerated, collective repayment of undergraduate student debt.
1.2. Enable the required reporting, to appropriate government agencies and lodge participants, of the activities of the Debt Liberation Laboratory.

2. In order to meet these objectives, it is necessary for partners to share selected information.

PURPOSE AND POLICY STATEMENTS

3. Purpose. The purpose of this agreement is to enable information to be shared between the below-named organizations in support of the following objective(s):

3.1. Debt Liberation Laboratory
3.2. Lodges of the Debt Liberation Laboratory
3.3. Participants in each lodge of the Debt Liberation Laboratory
3.4. Service providers to the Debt Liberation Laboratory

4. Benefits. The parties see the following benefits of sharing information:

4.1. Electronic payment to debt servicers. Debt Liberation Laboratory would be able to make payments on behalf of debt-carrying lodge participants with minimal effort and cost.
4.2. Government-required reporting. Debt Liberation Laboratory would be able to make required government reports on behalf of debt-carrying lodge participants with minimal effort and cost.
4.3. Transparency. Participants of lodges would be able to understand the activities of Debt Liberation Laboratory with minimal effort and cost.

5. Limits. The parties recognize the following limits to this data sharing agreement:

5.1. Internal data. Data generated by the operations of Debt Liberation Laboratory are not included in this agreement. Only data shared by participants is covered.

5.2. Provider agreements. This document describes the data shared between lodges, lodge participants, and Debt Liberation Laboratory. It does not describe specific limits between Debt Liberation Laboratory and its service providers.

PARTNERS

6. This agreement is between the partners listed in Appendix 1, from the following organizations:

6.1. Debt Liberation Laboratory
6.2. Member lodges

7. If a new partner joins the agreement, a new version of the information sharing agreement will be issued as soon as possible, certainly within one month, and circulated to all participating parties.

8. If a partner leaves the agreement, a new version of the information sharing agreement will be issued as soon as possible, certainly within one month, to all participating parties.

8.1. Partners must refer to Section 28 and Section 30 regarding retention and deletion of information that has been shared.

BASIS FOR SHARING

9. Any information sharing is for the purposes of the primary business of the Debt Liberation Laboratory.

10. Any information shared and the processes used to share such information will be compliant with relevant legislation.

PROCESS

11. This agreement has been formulated to facilitate the exchange of information between the parties. It is, however, incumbent on all partners to recognize that any information shared must be justified on the merits of the agreement. The balance, between an individual’s Human Rights and the need to disclose information, must be assessed to ensure the information shared between agencies is proportionate to the purpose. Anyone in doubt should consult their existing agreements before proceeding.
INFORMATION TO BE SHARED

12. Table 1 summarizes the types of information to be shared, the source of the information, and the intended uses of the information.

	Contact Data	Loan Servicing Data	Government Identifiers	Loan Balance Data	Lodge Data	Lodge Financial Data	Debt Liberation Lab Financial Data
Example Data	Name, mailing address, e-mail address	Loan servicer address, loan account number	Social security number	Individual loan balance	Meeting minutes, activity log	Dues dates and values, boost payment dates and values	Donation dates and values, total boost payments, total lodge loan balance
Data Source	Lodge participant, donors	Debt-carrying lodge participant	Debt-carrying lodge participant	Debt-carrying lodge participant	Lodge participants	Debt Liberation Lab	Debt Liberation Lab, donors
Intended Use	Communications	Accelerated repayment	Required reporting	Transparency	Compliance, transparency	Transparency, promotions	Transparency, promotions
Owner	Lodge participant, donors	Debt-carrying lodge participant	Debt-carrying lodge participant	Debt-carrying lodge participant	Debt Liberation Lab	Debt Liberation Lab	Debt Liberation Lab
Marking	Confidential	Individual	Individual	Confidential	Confidential	Confidential	Public

13. Experimentation and additional sharing. The information sharing needs of Debt Liberation Laboratory and its stakeholders may evolve over time. This agreement is intended to support the evolution of data sharing and may be explicitly amended.

13.1. New Required Sharing. If additional information is required on a repeated basis over and above what is defined in this agreement, to enable the agreement to achieve its aims, the parties should agree an addition to the sharing agreement, ensuring that the new information meets the same consent basis as the original. This addition should be added to the agreement and all parties should sign it.

13.2. Ad Hoc Sharing. If there is a need to share additional information on a one-off-basis, the parties concerned should consider whether the sharing is necessary to the agreement and document their considerations/findings, including any additional consents sought (and if not sought, an explanation as to why).

CONSENT

14. Consent in Writing. Consent to participate in Debt Liberation Laboratory’s information sharing program will be obtained in writing. The parties recognize that e-mailed documents fulfill the intent of gaining written consent.

15. Refusal. Parties who refuse to participate in the information sharing Agreement cannot be participants-in-good-standing of a lodge.

16. Withdrawal. Parties may withdraw from the information sharing Agreement with five days written notice to Debt Liberation Laboratory.

16.1. Withdrawal from the information sharing Agreement means the withdrawing party cannot be a participant-in-good-standing of a lodge.

RIGHT TO SHARE ANONYMISED AND PSEUDONYMISED INFORMATION

17. For the purposes of promotion and fund raising, Debt Liberation Laboratory and its lodges may share anonymized and pseudonymized information about debts and debt repayment.

PRIVACY IMPACT ASSESSMENT / RISK ASSESSMENT

18. Assessment. All the parties recognize risks associated with sharing information.

18.1. Identify Theft. The personal and government identification data shared with Debt Liberation Laboratory could be used to impersonate any of the participants.

18.2. Unintentional Disclosure. Any of the parties may accidentally disclose any of the shared information.

18.3. Negative Publicity. Disclosure of the shared information might result in an unwanted change in the reputation of a participant.

HOW INFORMATION WILL BE TRANSFERRED

19. The parties will use a number of methods to transfer information. They will take appropriate care to ensure information is transferred with high integrity and fidelity.

19.1. E-mail. Parties may share most information by e-mail. Parties will use commonly recommended security practices in their e-mail communications such as strong passwords and Transport Layer Security (TLS) to safeguard their communications. Information may be shared in e-mail attachments.

19.1.1. No Government IDs Via E-Mail. None of the parties will share government IDs by e-mail.

19.2. Text Message. Parties may share most information by text message. Parties will use commonly recommended security practices in their text communications such as strong passwords on their texting device or text application, or texts with limited lifetimes.

19.2.1. No Government IDs Via Text. None of the parties will share government IDs by text message.

19.3. Telephony. Parties may share information by phone or voice-mail. Parties will use commonly recommended security practices in their telephonic communications such as avoiding the use of speaker phones or holding conversations in public when discussing sensitive information.

19.3.1. Government IDs Via Phone. The parties may share government IDs by live telephone conversation. The parties are discouraged from sharing government IDs via voice mail.

19.4. Teleconference. Parties may share information by teleconference software or services such as Rabb.it and Skype. Parties will use commonly recommended security practices in their teleconference communications such as avoiding the use of speaker phones or holding conversations in public when discussing sensitive information.

19.4.1. Government IDs Via Teleconference. The parties may share government IDs by live teleconference.

19.5. Post. Parties may share information by post, including the US Postal Service. Parties will use commonly recommended security practices in their postal communications such as using security envelopes.

19.5.1. Government IDs Via Post. The parties may share government IDs by post. For example, some government reporting may require postal notification that includes social security numbers.

20. Markings. The parties will use protective markings such as “Confidential” and “Public” to ensure that the sensitivity of information is understood.

20.1. “Public.” The information marked “Public” can be shared with anyone.

20.2. “Confidential.” The information marked “Confidential” is only to be shared with lodge participants, the Debt Liberation Laboratory, and appropriate business partners.

20.3. “Individual.” The information marked “Individual” is only to be shared with the specific parties to whom it refers, the Debt Liberation Laboratory, and appropriate business partners.

20.4. Unmarked. Unmarked information is assumed to be marked “Individual” until it is classified differently by the sharing party or by the Debt Liberation Laboratory.

20.5. Typical markings are shown in Table 2.

Table 2. Markings for typical data used in Debt Liberation Laboratory operations.

	Contact Data	Loan Servicing Data	Government Identifiers	Loan Balance Data	Lodge Data	Lodge Financial Data	Debt Liberation Lab Financial Data
Example Data	Name, mailing address, e-mail address	Loan servicer address, loan account number	Social security number	Individual loan balance	Meeting minutes, activity log	Dues dates and values, boost payment dates and values	Donation dates and values, total boost payments, total lodge loan balance
Intended Use	Communications	Accelerated repayment	Required reporting	Transparency	Compliance, transparency	Transparency, promotions	Transparency, promotions
Owner	Lodge participant, donors	Debt-carrying lodge participant	Debt-carrying lodge participant	Debt-carrying lodge participant	Debt Liberation Lab	Debt Liberation Lab	Debt Liberation Lab
Marking	Confidential	Individual	Individual	Confidential	Confidential	Confidential	Public

21. Ownership. Different data has different owners. Whomever is accepting shared data is responsible for returning or destroying the data if the owning party decides to withdraw from the Agreement.

21.1. Contact Data. Contact data is owned by the party sharing the data.

21.2. Loan and Government ID Data. Loan and government ID data is owned by the party sharing the data.

21.3. Lodge and Debt Liberation Laboratory Data. Data generated by operating a lodge or by operation the Debt Liberation Laboratory is the property of the Debt Liberation Laboratory.

ENSURING DATA QUALITY

22. Quality Starts With the Owner. Everyone sharing data under this Agreement is responsible for the quality of the data they are sharing.

23. Operational Accuracy. Before sharing data, parties will check that the information being shared is accurate and up to date to the best of their knowledge. If sensitive data is being shared, which could harm the data subject if it was inaccurate, then particular care must be taken.

24. Ensuring Meaning is Understood. Where a data set is being shared (i.e. structured data), it will be accompanied by a table providing definitions of the data fields.

25. Stale Data. The owner of the data is responsible for ensuring that shared data is updated within a week. For example, changes in address or name or loan status should be shared within a week.

25.1.1. A party who does not update their data in a timely fashion cannot be a participant-in-good-standing of a lodge.

26. Complaints. If a complaint is received about the accuracy of personal data which affects datasets shared with partners in this Agreement, an updated replacement dataset will be communicated to the partners. The partners will replace the out of date data with the revised data.

INFORMATION USE, REVIEW, RETENTION AND DELETION

27. Limited Use. Parties to this Agreement undertake that information shared under the Agreement will only be used for the specific purpose for which it was shared, in line with this Agreement. It must not be shared for any other purpose outside of this Agreement.

28. Retention Periods. Different records will be retained for different periods of time. Table 3 records expected retention periods.

Table 3. The record retention scheme for data shared via the Debt Liberation Laboratory.

	Contact Data	Loan Servicing Data	Government Identifiers	Loan Balance Data	Lodge Data	Lodge Financial Data	Debt Liberation Lab Financial Data
Example Data	Name, mailing address, e-mail address	Loan servicer address, loan account number	Social security number	Individual loan balance	Meeting minutes, activity log	Dues dates and values, boost payment dates and values	Donation dates and values, total boost payments, total lodge loan balance
Expected Retention	Until the lodge dissolves or the participant withdraws	Until the lodge dissolves or the participant withdraws	Until the lodge dissolves or the participant withdraws or the participant’s debt is paid off	Until the lodge dissolves or the participant withdraws or the participant’s debt is paid off	Until the lodge dissolves	Until Debt Liberation Lab dissolves	Until Debt Liberation Lab dissolves

29. Additional Release. Recipients will not release the information to any third parties without obtaining the express written authority of the party who provided the information.

30. Destruction. The following destruction processes will be used when the information is no longer required:

30.1. Paper. Any retained paper records will be shredded and recycled.

30.2. Electronic. Any retained electronic records will be deleted according to best practices in place at the time of destruction.

31. Voluntary Withdrawal or Loss of Standing. A party who withdraws the Agreement or loses their status as a participant-in-good-standing with a lodge, must destroy all the records that have been shared with them by other parties.

ROLES AND RESPONSIBILITIES UNDER THIS AGREEMENT

32. Limits and Security Measures. Table 4 clarifies who will have access to information shared under this Agreement and expected security measures used for safeguarding the information.

Table 4. Access rights and expected safeguards for data shared with the Debt Liberation Laboratory.

	Contact Data	Loan Servicing Data	Government Identifiers	Loan Balance Data	Lodge Data	Lodge Financial Data	Debt Liberation Lab Financial Data
Example Data	Name, mailing address, e-mail address	Loan servicer address, loan account number, loan balance	Social security number	Individual loan balance	Meeting minutes, activity log	Dues dates and values, boost payment dates and values	Donation dates and values, total boost payments, total lodge loan balance
Extent of Sharing	Lodge participants in good standing, the lodge, Debt Liberation Laboratory	Data owner, Debt Liberation Laboratory	Data owner, Debt Liberation Laboratory, necessary business partners/ government agencies	Lodge participants in good standing, the lodge, Debt Liberation Laboratory	Lodge participants in good standing, the lodge, Debt Liberation Laboratory	Lodge participants in good standing, the lodge, Debt Liberation Laboratory	Web site visitors
Security Measures	Password protected access	Password protected access	Encrypted storage, password protected access	Password protected access	Password protected access	Password protected access	Open access

33. Point of Contact. All parties to this Agreement must appoint Specific Points of Contact (SPOC) – see Appendix 1.

34. Responsibility of the SPOC. The SPOC for each party will be the first point of call for questions about the Agreement. If there is a problem such as a potential information security breach, relevant SPOCs must be contacted.

35. Everyone’s Responsibility. It is the responsibility of everyone sharing information and accessing and using the information that has been shared to take appropriate decisions, then hold the information securely, in accordance with the standards set out in this Agreement. Any person who is not sure of the requirements on them should read this Agreement, then, if necessary, contact their SPOC.

36. Limits of Sharing. Only appropriate and properly authorized persons will have access to the information specified in this Agreement. If in doubt, a person intending to share or access information should contact their SPOC.

37. Additional Disclosure. Information shared between partners must not be disclosed to any third party without the written consent of the partner that provided the information. For the purposes of this Agreement, approval for such sharing lies with the SPOC of the party.

REVIEW OF THE INFORMATION SHARING AGREEMENT

38. Yearly Review. This Information Sharing Agreement will be reviewed twelve months after its launch and every twelve months thereafter. The person responsible for initiating this process is the operations lead for Debt Liberation Laboratory.

39. Exceptional Review. If a significant change takes place which means that the agreement becomes an unreliable reference point, then the agreement will be updated as needed and a new version circulated to replace the old.

40. Ongoing Ownership. If the operations lead for Debt Liberation Laboratory or any SPOC departs their role, an alternative must be identified as soon as possible.

INDEMNITY

41. Each party covered under this Agreement who receives information covered under this Agreement, will accept total liability for a breach of this Information Sharing Agreement should legal proceedings be served in relation to the breach.

SIGNATURES

By signing this agreement, all signatories accept responsibility for its execution and agree to ensure that participants and staff are trained so that requests for information and the process of sharing itself are sufficient to meet the purpose of this agreement.

Signed on behalf of Debt Liberation Laboratory:

Name: Christopher L. Dennis

Title: Treasurer, Debt Liberation Laboratory

Date: January 31, 2022