1025-00008 · Quorum Insurance Holdings · Transaction Documents/Data Security & Privacy

data-processing-agreement-draft.docx DOCUMENT M&A / Corporate

53 / 76 ← → ✕

Contract analysis Extract to table

PRIVILEGED & CONFIDENTIAL ATTORNEY WORK PRODUCT

DATA PROCESSING AGREEMENT

CCPA/CPRA Compliance Addendum to the Master Data License Agreement

Prepared by: Lisa Johannsen, Associate Data Privacy & Cybersecurity Practice Group Calderwood & Harkness LLP

Reviewed by: David Cartwright, Partner Data Privacy & Cybersecurity Practice Group Calderwood & Harkness LLP

March 2023

C&H Matter No. 1025-00008

This DPA is intended to be attached as an addendum to the Master Data License Agreement ("MDLA") between Quorum Insurance Holdings Corp. and Meridian Credit intelligence, Inc. This document constitutes attorney work product and is protected by the attorney-client privilege. Distribution is limited to authorized representatives of the client. This draft is subject to further revision and client review and does not constitute a final agreement or binding commitment of any party.

Right-click to update Table of Contents

PREAMBLE AND RECITALS

This Data Processing Agreement (this "DPA") is entered into as of the date set forth on the signature page hereto (the "Effective Date"), by and between:

Quorum Insurance Holdings Corp., a corporation organized and existing under the laws of the State of Delaware, with its principal place of business at 1200 Atlantic Street, Suite 3400, Stamford, Connecticut 06901 (hereinafter referred to as "Licensee" or "Business" or "Quorum");

and

Meridian Credit intelligence, Inc., a corporation organized and existing under the laws of the State of Georgia, with its principal place of business at 3300 Peachtree Road NE, Suite 2100, Atlanta, Georgia 30326 (hereinafter referred to as "Licensor" or "Data Provider" or "Meridian").

Quorum and Meridian are each referred to herein individually as a "Party" and collectively as the "Parties."

RECITALS

WHEREAS:

A. The Parties are engaged in negotiations with respect to a Master Data License Agreement (the "MDLA") pursuant to which Meridian will license to Quorum certain consumer credit-file data, commercial credit data, and alternative-data feeds, including, without limitation, the following proprietary data products: (i) the MCI Consumer Credit File™, which encompasses approximately 310 million consumer credit records; (ii) MCI CommercialView™, which encompasses approximately 42 million business credit records; and (iii) MCI AltSignal™, which encompasses approximately 85 million consumer alternative-data records derived from utility payment, telecommunications payment, and rental payment histories (collectively, the "Licensed Data" as further defined below);

B. Quorum will process consumer personal information received from Meridian under the MDLA for purposes of automated underwriting models, claims-fraud detection algorithms, and customer propensity scoring across Quorum's property and casualty ("P&C"), life, and specialty insurance lines of business, and for such other operational and analytical purposes as are specified in the MDLA and in Schedule 1 to this DPA;

C. The Parties intend this DPA to establish their respective obligations with respect to the processing of consumer personal information under the California Consumer Privacy Act of 2018, Cal. Civ. Code §§ 1798.100 et seq., as amended by the California Privacy Rights Act of 2020 (collectively, the "CCPA/CPRA"), and the implementing regulations adopted by the California Privacy Protection Agency (the "CPPA"), as such regulations may be amended, supplemented, or superseded from time to time;

D. This DPA supplements and is incorporated into the MDLA and the Data Security Addendum to the MDLA (the "DSA"). In the event of any conflict or inconsistency between the terms of this DPA and the terms of the MDLA or the DSA, the provision imposing the more restrictive data-protection obligation on the applicable Party shall control with respect to the subject matter of such conflict or inconsistency;

E. The Parties acknowledge and agree that the Licensed Data processed under the MDLA is also subject to the requirements of the Fair Credit Reporting Act, 15 U.S.C. §§ 1681 et seq. (the "FCRA"), the Gramm-Leach-Bliley Act, 15 U.S.C. §§ 6801 et seq. (the "GLBA"), and applicable state insurance data-security regulations, including, without limitation, the New York Department of Financial Services Cybersecurity Regulation, 23 NYCRR Part 500 (the "NY DFS Cybersecurity Regulation"), and that compliance with this DPA does not diminish, supersede, or otherwise affect either Party's obligations under such statutes and regulations.

NOW, THEREFORE, in consideration of the mutual covenants, agreements, and obligations set forth herein, and for other good and valuable consideration, the receipt and sufficiency of which are hereby acknowledged, the Parties agree as follows:

SECTION 1: DEFINITIONS

For purposes of this DPA, the following terms shall have the meanings set forth below. Capitalized terms used but not defined in this DPA shall have the meanings ascribed to them in the MDLA.

1.1 "Business" means Quorum Insurance Holdings Corp. and its controlled affiliates that determine the purposes and means of processing Personal Information under this DPA. The term "Business" is used in this DPA consistent with the definition set forth in Cal. Civ. Code § 1798.140(d), as amended by the CPRA. For the avoidance of doubt, Meridian also constitutes a "business" within the meaning of CCPA/CPRA with respect to its own collection and processing of consumer Personal Information, as further described in Section 2.1 of this DPA.

1.2 "Business Purpose" means the specific operational purposes for which Personal Information is processed under the MDLA, as enumerated in Schedule 1 to this DPA, which include, without limitation: (a) insurance underwriting and risk assessment; (b) claims-fraud detection and investigation; (c) customer propensity scoring and segmentation; (d) development, training, testing, and validation of predictive models, including QuorumScore™, Quorum's proprietary predictive underwriting model (United States Patent and Trademark Office application pending, Serial No. 97/482,116); (e) regulatory compliance and reporting; (f) internal audit, quality assurance, and data-integrity verification; and (g) responding to verified consumer requests under applicable privacy laws. The term "Business Purpose" is used in this DPA consistent with the definition set forth in Cal. Civ. Code § 1798.140(e), as amended by the CPRA, and shall be construed to include such additional categories of business purposes as may be specified by the CPPA in implementing regulations.

1.3 "Consumer" means a California resident as defined under CCPA/CPRA, Cal. Civ. Code § 1798.140(i). For purposes of this DPA, the term "Consumer" refers specifically to natural persons who are California residents and whose Personal Information is included in the Licensed Data.

1.4 "Contractor" means a person to whom a business makes available a consumer's Personal Information and with whom the business enters into a written contract that includes the terms and conditions required by CCPA/CPRA, Cal. Civ. Code § 1798.140(j), as amended by the CPRA. To the extent Quorum's receipt and processing of Personal Information under this DPA satisfies the requirements for classification as a "contractor" under CCPA/CPRA, the contractual obligations set forth in this DPA are intended to satisfy the written-contract requirements applicable to contractors.

1.5 "Data Provider" means Meridian Credit intelligence, Inc., in its capacity as the licensor and provider of the Licensed Data under the MDLA.

1.6 "De-identified Information" means information that cannot reasonably be used to infer information about, or otherwise be linked to, a particular consumer or household, provided that the requirements of Cal. Civ. Code § 1798.140(m) are met, including, without limitation, the following conditions: (a) the business that possesses the information has implemented technical safeguards that prohibit re-identification of the consumer to whom the information may pertain; (b) the business has implemented business processes that specifically prohibit re-identification of the information; (c) the business has implemented business processes to prevent inadvertent release of de-identified information; and (d) the business makes no attempt to re-identify the information. De-identified Information is not Personal Information for purposes of this DPA.

1.7 "Derived Data" means, as defined in Article VII of the MDLA (which definition remains subject to ongoing negotiation between the Parties), data, models, scores, indices, analytics outputs, and other informational products or work product created by Quorum using Licensed Data from Meridian as an input, whether alone or in combination with Quorum's own first-party data or data from other sources. For the avoidance of doubt, Derived Data includes, without limitation, QuorumScore™ outputs, statistical models, risk scores, and analytical insights generated through Quorum's processing of Licensed Data. The treatment of Derived Data under CCPA/CPRA is addressed in Section 7 of this DPA.

1.8 "Licensed Data" means the MCI Consumer Credit File™, MCI CommercialView™, and MCI AltSignal™ data feeds, and any updates, supplements, corrections, or modifications thereto, made available to Quorum under the MDLA.

1.9 "Personal Information" means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household, as defined under CCPA/CPRA, Cal. Civ. Code § 1798.140(v). For purposes of this DPA, Personal Information includes, without limitation, consumer credit tradeline data, payment history, account balances, account status information, identifying information (including consumer name, address, Social Security number, and date of birth), public record information, alternative data (including utility payment history, telecommunications payment history, and rental payment history), and any other information within the Licensed Data that meets the foregoing definition. Personal Information does not include De-identified Information or aggregate consumer information, as those terms are defined in this DPA and under CCPA/CPRA.

1.10 "Processing" means any operation or set of operations performed on Personal Information, or on sets of Personal Information, whether or not by automated means. Processing includes, without limitation, the collection, recording, organization, structuring, storage, adaptation, alteration, retrieval, consultation, use, disclosure by transmission, dissemination, or otherwise making available, alignment, combination, restriction, erasure, destruction, analysis, modeling, scoring, or modification of Personal Information. This definition is consistent with the broad construction of "processing" under CCPA/CPRA and its implementing regulations.

1.11 "Sale" has the meaning set forth in Cal. Civ. Code § 1798.140(ad), as amended by the CPRA, and means selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer's Personal Information by the business to a third party for monetary or other valuable consideration. For the avoidance of doubt, the term "Sale" does not include the disclosure of Personal Information to a service provider or contractor for a business purpose pursuant to a written contract that includes the restrictions required by CCPA/CPRA, provided that the service provider or contractor does not further collect, sell, or use the Personal Information except as necessary to perform the business purpose.

1.12 "Sensitive Personal Information" has the meaning set forth in Cal. Civ. Code § 1798.140(ae), as amended by the CPRA. As applicable to the Licensed Data, Sensitive Personal Information includes, without limitation, Social Security numbers, driver's license numbers, state identification card numbers, financial account numbers (including account numbers, debit card numbers, or credit card numbers in combination with any required security code, access code, or password that would permit access to a consumer's financial account), and such other categories of information as may be specified in CCPA/CPRA or its implementing regulations.

1.13 "Service Provider" means a person that processes Personal Information on behalf of a business and to which the business discloses a consumer's Personal Information for a business purpose pursuant to a written contract, as defined under CCPA/CPRA, Cal. Civ. Code § 1798.140(ag), as amended by the CPRA. The written contract must prohibit the person receiving the Personal Information from (i) selling or sharing the Personal Information, (ii) retaining, using, or disclosing the Personal Information for any purpose other than for the business purposes specified in the contract, including retaining, using, or disclosing the Personal Information for a commercial purpose other than providing the services specified in the contract, and (iii) retaining, using, or disclosing the information outside of the direct business relationship between the person and the business.

1.14 "Sharing" has the meaning set forth in Cal. Civ. Code § 1798.140(ah), as amended by the CPRA, and means sharing, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer's Personal Information by the business to a third party for cross-context behavioral advertising, whether or not for monetary or other valuable consideration, including transactions between a business and a third party for cross-context behavioral advertising for the benefit of a business in which no money is exchanged.

1.15 "Sub-processor" means any third party engaged by either Party to process Personal Information in connection with the performance of obligations under the MDLA and this DPA. Sub-processors include, without limitation, Quorum's data-engineering contractors, cloud-infrastructure providers, and analytics service providers, as well as Meridian's data-delivery service providers, data-hosting providers, and technology vendors that have access to or process Personal Information on Meridian's behalf.

1.16 "Third Party" has the meaning set forth in Cal. Civ. Code § 1798.140(ai), as amended by the CPRA, and means a person who is not any of the following: (a) the business with whom the consumer intentionally interacts and that collects Personal Information from the consumer as part of the consumer's current interaction with the business; or (b) a service provider to the business; or (c) a contractor.

SECTION 2: ROLES AND RELATIONSHIP OF THE PARTIES

2.1 Meridian as Business / Data Provider. Meridian collects and maintains consumer Personal Information through its credit-bureau operations, consumer reporting activities, and alternative-data collection programs. For purposes of CCPA/CPRA, Meridian acts as a "business" within the meaning of Cal. Civ. Code § 1798.140(d) with respect to the Personal Information it has collected from and about consumers and that is included in the Licensed Data. Meridian independently determines the purposes and means of its collection and processing of such Personal Information. Meridian's disclosure of Personal Information to Quorum under the MDLA is made for a "business purpose" as defined in Section 1.2 of this DPA and Cal. Civ. Code § 1798.140(e), and such disclosure does not constitute a "sale" or "sharing" of Personal Information within the meaning of CCPA/CPRA, provided that the requirements of this DPA are satisfied and that Quorum complies with the restrictions and obligations set forth herein. Nothing in this DPA shall limit Meridian's independent obligations as a business under CCPA/CPRA with respect to the Personal Information it collects and maintains.

2.2 Quorum as Service Provider / Contractor. For purposes of CCPA/CPRA, Quorum receives Personal Information from Meridian and processes such Personal Information as a "service provider" within the meaning of Cal. Civ. Code § 1798.140(ag), or, to the extent applicable under the CPRA, as a "contractor" within the meaning of Cal. Civ. Code § 1798.140(j), with respect to the Licensed Data received from Meridian. Quorum shall process Personal Information received from Meridian solely for the Business Purposes specified in Schedule 1 to this DPA and as otherwise expressly permitted under this DPA and the MDLA. Quorum shall not retain, use, or disclose such Personal Information for any purpose other than the Business Purposes, except as otherwise expressly permitted by CCPA/CPRA. The Parties intend that this DPA satisfies the written-contract requirements applicable to service providers and contractors under Cal. Civ. Code § 1798.140(ag) and § 1798.140(j), respectively, as well as the corresponding provisions of the CPPA implementing regulations.

2.3 Independent Business Activities. The Parties acknowledge that Quorum collects and processes its own first-party data — including, without limitation, claims data, policy data, telematics data, and customer-relationship data — independently of and in addition to the Licensed Data received from Meridian. To the extent Quorum combines Licensed Data from Meridian with Quorum's own first-party data for purposes of its internal underwriting, fraud-detection, and customer-scoring operations, Quorum acts as a "business" in its own right under CCPA/CPRA with respect to its first-party data and is independently responsible for compliance with CCPA/CPRA with respect to such first-party data. The Parties further acknowledge that the creation of Derived Data (including QuorumScore™ outputs and other predictive model outputs) may implicate both (a) service-provider or contractor obligations under CCPA/CPRA with respect to the Meridian Licensed Data inputs incorporated into or used in the generation of such Derived Data, and (b) independent business activities under CCPA/CPRA with respect to Quorum's own first-party data inputs. The allocation of CCPA/CPRA obligations with respect to Derived Data is addressed in Section 7 of this DPA.

2.4 No Joint Controller Relationship. Nothing in this DPA shall be construed to create a joint-controller, joint-business, or joint-venture relationship between Meridian and Quorum. Each Party independently determines the purposes and means of its own processing activities and is independently responsible for its own compliance with CCPA/CPRA and other applicable data-protection laws. Neither Party shall be deemed to be the agent, employee, partner, or legal representative of the other Party for any purpose whatsoever, except as expressly provided in this DPA or the MDLA.

SECTION 3: PURPOSE LIMITATIONS

3.1 Permitted Purposes. Quorum shall process Personal Information received from Meridian only for the Business Purposes enumerated in Schedule 1 to this DPA and as reasonably necessary to perform services under the MDLA. Quorum shall not process Personal Information received from Meridian for any purpose that is incompatible with the Business Purposes without the prior written authorization of Meridian. Any request for authorization to process Personal Information for a purpose not enumerated in Schedule 1 shall be submitted to Meridian in writing and shall include a description of the proposed processing activity, the categories of Personal Information involved, the business justification for the proposed processing, and an assessment of the privacy risks associated therewith. Meridian shall respond to any such request within thirty (30) calendar days of receipt. If Meridian grants authorization, the Parties shall amend Schedule 1 to reflect the additional Business Purpose.

3.2 Prohibition on Use Beyond MDLA Scope. Quorum shall not retain, use, or disclose Personal Information received from Meridian for any commercial purpose other than performing the services and fulfilling the Business Purposes specified in the MDLA and this DPA. Without limiting the foregoing, Quorum shall not retain, use, or disclose Personal Information received from Meridian outside of the direct business relationship between Quorum and Meridian, except as otherwise expressly permitted by CCPA/CPRA, Cal. Civ. Code § 1798.140(ag)(1)(A)–(C), which permits a service provider to retain, use, or disclose Personal Information to (A) retain and employ another service provider or contractor as a sub-processor, subject to the requirements of Section 8 of this DPA; (B) use the Personal Information for the specific purposes of detecting data-security incidents, protecting against fraudulent or illegal activity, or for the Business Purposes enumerated in Schedule 1, provided that such use is reasonably necessary and proportionate to achieve the intended purpose; or (C) use the Personal Information for internal uses that are reasonably aligned with the expectations of the consumer, taking into account the consumer's relationship with Meridian.

3.3 Combining Data. Quorum shall not combine Personal Information received from Meridian with Personal Information that Quorum receives from or on behalf of another person or persons, or that Quorum collects from its own interaction with a consumer, except as expressly permitted by CCPA/CPRA, Cal. Civ. Code § 1798.140(ag)(1)(B), and subject to the following conditions:

(a) Quorum may combine Personal Information received from Meridian with Quorum's own first-party data solely for the purposes of detecting data-security incidents, protecting against fraudulent or illegal activity, or for the specific Business Purposes enumerated in Schedule 1 to this DPA;

(b) Any such combination of data shall be conducted in a manner that maintains the service-provider or contractor obligations applicable to the Meridian-sourced Personal Information and does not result in a "sale" or "sharing" of such Personal Information within the meaning of CCPA/CPRA;

(c) The treatment of Derived Data created through the combination of Meridian Licensed Data and Quorum first-party data is addressed in Section 7 of this DPA, and any such Derived Data that constitutes or contains Personal Information remains subject to the restrictions of this DPA with respect to the Meridian-sourced Personal Information component.

Drafting Note: This restriction on combining data is in tension with Quorum's intended use case of blending Meridian consumer credit data with Quorum's first-party claims, policy, and telematics data for QuorumScore™ and other predictive models. Section 7 addresses the Derived Data exception and the applicable CCPA/CPRA framework for such combined processing. The Parties should discuss whether additional carve-outs are necessary to accommodate Quorum's data-blending requirements while maintaining CCPA/CPRA compliance.

3.4 Notification Obligation. Quorum shall notify Meridian promptly, and in any event within five (5) business days, if Quorum determines that it can no longer meet its obligations under CCPA/CPRA as a service provider or contractor with respect to Personal Information received from Meridian. Upon providing such notification, Quorum shall cooperate with Meridian to take reasonable and appropriate steps to stop and remediate any unauthorized processing or use of Personal Information. Meridian shall have the right, upon receipt of such notification, to take reasonable and appropriate steps to ensure that the Personal Information is processed in a manner consistent with Meridian's obligations under CCPA/CPRA, which may include directing Quorum to cease processing activities or to return or destroy the affected Personal Information.

SECTION 4: SALE AND SHARING RESTRICTIONS

4.1 No Sale of Personal Information. Quorum shall not sell (as defined in Section 1.11 of this DPA and Cal. Civ. Code § 1798.140(ad)) any Personal Information received from Meridian under the MDLA. Quorum hereby certifies that it understands the prohibition on selling Personal Information received from Meridian and that it will comply with such prohibition. Quorum further certifies that it will not sell any Personal Information received from Meridian to any third party for monetary or other valuable consideration, directly or indirectly, and that it will not make any such Personal Information available to third parties in a manner that would constitute a "sale" under CCPA/CPRA.

4.2 No Sharing for Cross-Context Behavioral Advertising. Quorum shall not share (as defined in Section 1.14 of this DPA and Cal. Civ. Code § 1798.140(ah)) any Personal Information received from Meridian for cross-context behavioral advertising purposes. Without limiting the foregoing, Quorum shall not disclose, transmit, or otherwise make available Personal Information received from Meridian to any advertising network, data broker, advertising technology provider, or other person or entity for the purpose of targeting advertising to consumers based on Personal Information obtained from a different business, context, or interaction.

4.3 Meridian's Certification. Meridian certifies that, to the extent it collects Personal Information that is included in the Licensed Data, it has provided consumers with appropriate notice regarding the disclosure of their Personal Information to service providers and contractors for business purposes, including the categories of Personal Information disclosed and the business purposes for which such Personal Information is disclosed, in accordance with the notice requirements of CCPA/CPRA, Cal. Civ. Code § 1798.100(a) and § 1798.100(b), and the corresponding provisions of the CPPA implementing regulations. Meridian further certifies that it maintains a privacy policy that discloses the categories of Personal Information that it collects, the purposes for which such categories of Personal Information are collected, and the categories of third parties to which it discloses Personal Information, as required by CCPA/CPRA.

4.4 Third-Party Commercialization of Derived Data. [Bracketed — Subject to resolution of Article VII of the MDLA.] To the extent Quorum seeks to commercialize Derived Data to third parties outside Quorum's corporate group (including affiliates and subsidiaries), such commercialization shall be subject to the following conditions:

(a) Any Derived Data that is commercialized to third parties must qualify as De-identified Information (as defined in Section 1.6 of this DPA) or as aggregate consumer information within the meaning of Cal. Civ. Code § 1798.140(b), and must satisfy the de-identification requirements of Section 6 of this DPA;

(b) The commercialization of Derived Data to third parties shall not constitute a "sale" or "sharing" of Personal Information under CCPA/CPRA;

(c) Prior to any third-party commercialization of Derived Data, Quorum shall provide Meridian with a written certification confirming that the Derived Data proposed for commercialization satisfies the de-identification and aggregation standards set forth in this DPA and does not constitute Personal Information within the meaning of CCPA/CPRA;

(d) Meridian shall have the right, upon reasonable notice, to audit or review the de-identification methodology applied by Quorum to any Derived Data proposed for third-party commercialization, in accordance with Section 11 of this DPA.

Drafting Note: This provision intersects with the unresolved Article VII Derived Data commercialization dispute. The Parties currently disagree on whether Quorum's external commercialization of Derived Data constitutes a "sale" under CCPA/CPRA if such Derived Data incorporates Meridian data inputs. Quorum's position is that sufficiently transformed Derived Data does not constitute Personal Information and is therefore outside the scope of CCPA/CPRA. Meridian's position is that Derived Data that incorporates or is derived from Meridian's Licensed Data remains subject to Meridian's contractual and proprietary rights regardless of the degree of transformation. Resolution of this provision is contingent upon the Parties' agreement on the Article VII "sufficient transformation" standard and the Derived Data commercialization framework.

SECTION 5: CONSUMER RIGHTS FACILITATION

5.1 Cooperation on Consumer Requests. Quorum shall cooperate with and assist Meridian in responding to verifiable consumer requests submitted under CCPA/CPRA, including, without limitation, the following categories of requests:

(a) Requests to know and access Personal Information, pursuant to Cal. Civ. Code § 1798.110;

(b) Requests to delete Personal Information, pursuant to Cal. Civ. Code § 1798.105;

(d) Requests to opt out of the sale or sharing of Personal Information, pursuant to Cal. Civ. Code § 1798.120; and

(e) Requests to limit the use and disclosure of Sensitive Personal Information, pursuant to Cal. Civ. Code § 1798.121.

Quorum shall designate a point of contact for the purpose of receiving and processing consumer-rights requests relayed by Meridian, and shall provide Meridian with the contact information for such designee within thirty (30) calendar days of the Effective Date. Quorum shall maintain internal procedures sufficient to facilitate the timely processing of consumer-rights requests in accordance with the timeframes established by CCPA/CPRA.

5.2 Notice and Response Process. Upon receipt from Meridian of a verified consumer request that relates to Personal Information processed by Quorum under this DPA, Quorum shall take commercially reasonable steps to comply with such request within the timeframes required by CCPA/CPRA. Under CCPA/CPRA, businesses are generally required to respond to verified consumer requests within forty-five (45) calendar days of receipt, with one forty-five (45)-calendar-day extension available upon notice to the consumer explaining the reasons for the delay. To facilitate Meridian's compliance with these timeframes, Quorum shall use commercially reasonable efforts to respond to consumer-rights requests relayed by Meridian within twenty (20) business days of receipt of such request from Meridian, or such shorter period as may be reasonably necessary for Meridian to meet its obligations under CCPA/CPRA. Quorum shall provide Meridian with written confirmation of the actions taken in response to each consumer-rights request, including any exceptions or limitations applied.

5.3 Deletion Obligations. Upon receiving a deletion request relayed by Meridian pursuant to Cal. Civ. Code § 1798.105, Quorum shall delete the requesting consumer's Personal Information from Quorum's systems, and shall instruct its sub-processors that have received such Personal Information to delete the consumer's Personal Information from their systems, unless retention is permitted under a recognized exception to the deletion right under CCPA/CPRA, including, without limitation, the following exceptions:

(a) Retention is necessary to complete the transaction for which the Personal Information was collected, to fulfill the terms of a written warranty or product recall conducted in accordance with federal law, or to otherwise perform a contract between Meridian and the consumer;

(b) Retention is necessary to detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, or prosecute those responsible for that activity;

(c) Retention is necessary to comply with a legal obligation, including, without limitation, record-retention requirements under the FCRA, the GLBA, or applicable state insurance regulations;

(d) Retention is necessary to exercise or defend legal claims; or

(e) Retention is otherwise permitted under Cal. Civ. Code § 1798.105(d).

If Quorum relies on an exception to the deletion right, Quorum shall promptly notify Meridian in writing of the specific exception(s) relied upon and the categories of Personal Information retained. Quorum shall notify Meridian upon completion of deletion.

5.4 Correction Obligations. Upon receiving a correction request relayed by Meridian pursuant to Cal. Civ. Code § 1798.106, Quorum shall use commercially reasonable efforts to correct the inaccurate Personal Information in Quorum's records, taking into account the nature of the Personal Information, the purposes of processing, and the instructions provided by Meridian. Quorum shall implement reasonable measures to ensure that corrected information is reflected in all active processing systems and analytical models in which the inaccurate Personal Information was previously used. Quorum shall notify Meridian upon completion of any correction, including a description of the corrective actions taken.

5.5 Right to Limit Use of Sensitive Personal Information. To the extent Quorum processes Sensitive Personal Information received from Meridian under this DPA, Quorum shall honor verified consumer requests to limit the use and disclosure of such Sensitive Personal Information to uses that are necessary to perform the services or provide the goods reasonably expected by an average consumer who requests such goods or services, as provided in Cal. Civ. Code § 1798.121. Quorum shall implement internal procedures to identify and flag Sensitive Personal Information within the Licensed Data and to restrict its processing in accordance with a consumer's exercise of this right. Without limiting the foregoing, upon receipt of a request to limit use of Sensitive Personal Information relayed by Meridian, Quorum shall restrict its processing of the affected consumer's Sensitive Personal Information to the minimum necessary to perform the Business Purposes for which such Sensitive Personal Information is strictly required.

5.6 Direct Consumer Requests to Quorum. If Quorum receives a consumer request directly (i.e., not through Meridian) that relates to Personal Information received from Meridian under the MDLA, Quorum shall promptly, and in any event within five (5) business days, notify Meridian of such request and coordinate with Meridian on the appropriate response. Quorum shall not respond directly to such consumer requests without Meridian's prior written consent, unless Quorum is independently required to do so in its capacity as a business under CCPA/CPRA with respect to its own first-party data. In such cases, Quorum shall respond to the consumer only with respect to the Quorum first-party data component of the request and shall refer the consumer to Meridian with respect to the Licensed Data component, unless otherwise directed by Meridian. Quorum shall provide Meridian with copies of all consumer requests received directly by Quorum that relate to Personal Information sourced from Meridian.

5.7 Record Keeping. Both Parties shall maintain complete and accurate records of all consumer requests received and responses provided with respect to Personal Information processed under this DPA, for a minimum period of twenty-four (24) months from the date of receipt of each consumer request, or such longer period as may be required by CCPA/CPRA implementing regulations or other applicable law. Such records shall include, at a minimum, the date of receipt of the request, the nature of the request, the identity of the requesting consumer (to the extent verified), the actions taken in response, the date of completion, and any exceptions or limitations applied. Each Party shall make such records available to the other Party upon reasonable request for purposes of regulatory compliance and audit.

SECTION 6: DE-IDENTIFICATION STANDARDS

6.1 De-identification Requirements. Any Personal Information that is de-identified by Quorum in connection with the creation of Derived Data, the preparation of analytical outputs, or otherwise, must satisfy the de-identification requirements of Cal. Civ. Code § 1798.140(m), including, without limitation, each of the following conditions:

(a) The information cannot reasonably be used to infer information about, or otherwise be linked to, a particular consumer or household, taking into account all reasonably available methods and technologies for re-identification, including those known to or accessible by Quorum or any person to whom the de-identified information is disclosed;

(b) Quorum implements and maintains reasonable technical safeguards and business processes that specifically prohibit re-identification of the consumer to whom the information may pertain, including, without limitation, access controls, data-masking techniques, and encryption of residual identifiers;

(c) Quorum implements and maintains business processes to prevent inadvertent release of de-identified information in a form that could be re-identified, including, without limitation, employee training, internal policies governing the handling of de-identified information, and quality-assurance procedures for de-identification outputs; and

(d) Quorum makes no attempt to re-identify the information and contractually prohibits any recipient of de-identified information from attempting re-identification.

Quorum shall document its de-identification methodology and the technical and organizational measures employed to satisfy the foregoing requirements, and shall make such documentation available to Meridian upon request in connection with audit and compliance verification under Section 11 of this DPA.

6.2 Aggregation Standards. Quorum may aggregate Personal Information received from Meridian, provided that the aggregated information relates to a group or category of consumers (and not to individual consumers) and that individual consumer identities have been removed from such aggregated information, consistent with the CCPA/CPRA definition of "aggregate consumer information" set forth in Cal. Civ. Code § 1798.140(b). Aggregate consumer information shall not be reasonably linkable to any individual consumer or household. Quorum shall apply minimum aggregation group sizes sufficient to prevent the identification or re-identification of individual consumers from aggregated data, as further specified in the technical appendix contemplated by Section 6.3 below.

6.3 Technical De-identification Measures. The Parties shall cooperate to develop a technical appendix to this DPA specifying the detailed technical de-identification standards and methodologies to be applied by Quorum in connection with the de-identification and aggregation of Personal Information received from Meridian. Such technical appendix shall be developed in coordination with Priya Nair, Director, Data Engineering, Quorum, and Lena Vasquez, Chief Privacy Officer, Meridian. The Parties anticipate that the technical appendix will address, at a minimum, the following measures:

(a) k-Anonymity Thresholds: Minimum k-anonymity thresholds for de-identified datasets, with a target minimum of k=10 for consumer-level outputs and k=25 for datasets intended for third-party disclosure;

(b) Differential Privacy Techniques: Application of differential privacy mechanisms (including, where appropriate, Laplacian noise injection or randomized response techniques) to analytical outputs derived from Personal Information;

(c) Suppression of Direct Identifiers: Removal or irreversible transformation of all direct identifiers (including name, Social Security number, date of birth, and street address) prior to any disclosure of de-identified or aggregated data;

(d) Minimum Aggregation Group Sizes: Establishment of minimum group sizes for aggregated data outputs, with suppression or generalization of cells containing fewer than the applicable minimum number of individuals; and

(e) Re-identification Risk Assessment: Periodic assessment of re-identification risk using accepted statistical methodologies, to be conducted no less frequently than annually.

Pending completion of the technical appendix, Quorum shall apply de-identification and aggregation measures that are consistent with industry best practices for consumer financial data and that satisfy the requirements of Cal. Civ. Code § 1798.140(m).

6.4 Relationship to "Sufficient Transformation" Standard. [Bracketed — Subject to resolution of Article VII of the MDLA.] The Parties acknowledge that the de-identification standards set forth in this Section 6 are distinct from, and supplementary to, any "sufficient transformation" standard that may be agreed upon in Article VII of the MDLA with respect to Derived Data commercialization. Compliance with the de-identification standards of this Section 6 is a necessary condition for the third-party commercialization of Derived Data under Section 4.4 of this DPA, but may not be a sufficient condition for such commercialization under the terms of the MDLA. The "sufficient transformation" standard in Article VII of the MDLA may impose additional requirements — including, without limitation, requirements relating to the degree of analytical transformation, the irreversibility of derivation processes, and the extent to which Meridian's Licensed Data can be reconstructed or reverse-engineered from the Derived Data — that go beyond the CCPA/CPRA de-identification requirements of this Section 6.

SECTION 7: DERIVED DATA UNDER CCPA/CPRA

7.1 CCPA/CPRA Treatment of Derived Data — General Principle. The Parties acknowledge that the treatment of Derived Data under CCPA/CPRA depends on whether such Derived Data constitutes, contains, or is linked to Personal Information within the meaning of Cal. Civ. Code § 1798.140(v). The following principles shall govern the CCPA/CPRA classification of Derived Data:

(a) To the extent Derived Data constitutes or contains Personal Information — that is, to the extent such Derived Data identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, to a particular consumer or household — such Derived Data remains subject to all of the service-provider/contractor restrictions, purpose limitations, consumer-rights obligations, and sale/sharing prohibitions of this DPA;

(b) To the extent Derived Data has been de-identified in compliance with Section 6 of this DPA and qualifies as De-identified Information or aggregate consumer information, such Derived Data is not Personal Information for purposes of CCPA/CPRA and is outside the scope of the CCPA/CPRA-specific obligations of this DPA (though it may remain subject to contractual restrictions under Article VII of the MDLA);

(c) The determination of whether Derived Data constitutes or contains Personal Information shall be made on a case-by-case basis, taking into account the totality of the circumstances, including the nature and granularity of the Derived Data, the availability of linking information, and the methods and technologies reasonably available for re-identification.

7.2 Machine-Learning Model Outputs. The Parties acknowledge that Quorum intends to use Personal Information received from Meridian as one of multiple training inputs for machine-learning models, including QuorumScore™ and other predictive underwriting, fraud-detection, and customer-segmentation models. The Parties agree to the following framework for the CCPA/CPRA treatment of machine-learning model components:

(a) Trained Model Weights and Parameters. Model weights, parameters, coefficients, and other mathematical representations learned during the training process, once abstracted from the underlying training data, do not themselves constitute Personal Information within the meaning of CCPA/CPRA, provided that such weights and parameters cannot reasonably be used to reconstruct, derive, or infer Personal Information about individual consumers. Accordingly, trained model weights and parameters, standing alone, are not subject to the CCPA/CPRA-specific obligations of this DPA;

(b) Live Inference Outputs — Consumer-Level. Live inference outputs that are generated by applying a trained model to consumer-level input data and that produce consumer-level scores, predictions, classifications, or recommendations attributable to identified or identifiable consumers constitute Personal Information under CCPA/CPRA and remain subject to the purpose limitations, consumer-rights provisions, sale/sharing prohibitions, and other restrictions of this DPA;

(c) Live Inference Outputs — Aggregate or De-identified. Aggregate or de-identified model outputs that relate to groups or categories of consumers and that do not identify, relate to, or link to individual consumers are not Personal Information under CCPA/CPRA, provided they satisfy the de-identification and aggregation standards of Section 6 of this DPA.

Drafting Note: This provision reflects a compromise position between the Parties' divergent views on the CCPA/CPRA treatment of machine-learning model outputs. Quorum's position is that trained model weights and parameters, once abstracted from the training data, do not constitute Personal Information and are not subject to CCPA/CPRA obligations or Meridian's contractual rights. Meridian's position is that model outputs traceable to Meridian data remain subject to Meridian's proprietary and contractual rights regardless of the degree of abstraction. This DPA adopts the position that model weights and parameters, standing alone, do not constitute Personal Information; however, live inference outputs that incorporate or reveal consumer-level Personal Information remain subject to this DPA. The Parties should evaluate whether this framework is consistent with the Parties' respective positions on Derived Data ownership and commercialization under Article VII of the MDLA.

7.3 QuorumScore™ Outputs. The following provisions apply specifically to outputs generated by QuorumScore™, Quorum's proprietary predictive underwriting model (USPTO application pending, Serial No. 97/482,116):

(a) QuorumScore™ predictive model outputs that produce consumer-level scores, risk assessments, or predictions attributable to identified or identifiable consumers — including, without limitation, individual consumer risk scores, propensity scores, and underwriting recommendations — constitute Personal Information under CCPA/CPRA and are subject to the purpose limitations, consumer-rights provisions, sale/sharing prohibitions, and other restrictions of this DPA;

(b) Aggregate or de-identified QuorumScore™ outputs — including, without limitation, aggregate risk profiles, portfolio-level risk distributions, market-segment analyses, and trend analyses — that cannot be linked to individual consumers are not Personal Information under CCPA/CPRA and are outside the scope of the CCPA/CPRA-specific obligations of this DPA, provided that such outputs satisfy the de-identification and aggregation standards of Section 6 of this DPA;

(c) Quorum shall maintain documentation of the data inputs, processing methodologies, and de-identification techniques applied in the generation of QuorumScore™ outputs, and shall make such documentation available to Meridian upon reasonable request in connection with audit and compliance verification under Section 11 of this DPA.

7.4 Internal Use vs. Third-Party Commercialization. Quorum's internal use of Derived Data for the Business Purposes specified in Schedule 1 to this DPA is permitted under this DPA, subject to the purpose limitations of Section 3, the sale/sharing restrictions of Section 4, and the consumer-rights obligations of Section 5. Third-party commercialization of Derived Data (i.e., the disclosure, licensing, or sale of Derived Data to persons or entities outside Quorum's corporate group) is subject to the following restrictions:

(a) Any Derived Data disclosed to third parties must qualify as De-identified Information (as defined in Section 1.6) or aggregate consumer information (as defined in Cal. Civ. Code § 1798.140(b)), and must satisfy the de-identification and aggregation standards of Section 6 of this DPA;

(b) The disclosure of Derived Data to third parties must not constitute a "sale" or "sharing" of Personal Information within the meaning of CCPA/CPRA;

(c) Prior to any third-party commercialization, Quorum shall provide Meridian with the written certification contemplated by Section 4.4(c) of this DPA; and

(d) Third-party commercialization of Derived Data is further subject to any restrictions, conditions, or approval requirements agreed upon in Article VII of the MDLA.

[Bracketed — Subject to resolution of Article VII of the MDLA.]

7.5 Revenue Share and CCPA/CPRA Interaction. [Bracketed — Negotiation Note.] Meridian has proposed a revenue-share arrangement pursuant to which Quorum would pay to Meridian fifteen percent (15%) of net revenues derived from third-party commercialization of Derived Data. The Parties note that if such revenue-share arrangement is structured as consideration paid by Quorum to Meridian in exchange for the disclosure of Personal Information by Meridian to Quorum (or as consideration flowing from Quorum's downstream disclosure of Personal Information to third parties), such arrangement could implicate the CCPA/CPRA definition of "sale" set forth in Cal. Civ. Code § 1798.140(ad). The Parties shall structure any revenue-share arrangement to avoid characterization as a "sale" of Personal Information under CCPA/CPRA, including by ensuring that: (a) any revenue share is structured as consideration for the licensing of intellectual-property rights or data-aggregation services, rather than for the disclosure of Personal Information; (b) any Derived Data subject to a revenue-share arrangement is De-identified Information or aggregate consumer information and does not constitute Personal Information; and (c) the contractual documentation for any revenue-share arrangement expressly states that the revenue share does not constitute consideration for the sale or sharing of Personal Information.

Drafting Note: This provision is included for completeness and reflects the current state of negotiations. Quorum has rejected the proposed 15% revenue share. This provision would be deleted from the DPA in the event that the revenue-share proposal is not agreed upon in Article VII of the MDLA. If a revenue share is agreed, the provision should be revised to reflect the agreed terms and should be reviewed by tax counsel for potential tax implications.

SECTION 8: SUB-PROCESSOR REQUIREMENTS

8.1 Sub-processor Engagement. Quorum shall not engage any sub-processor to process Personal Information received from Meridian under the MDLA without prior written notice to Meridian identifying the sub-processor by name and legal entity, the scope and purpose of the sub-processor's processing activities, the categories of Personal Information involved, and the location(s) at which the sub-processor will process such Personal Information. Quorum shall provide such notice to Meridian no fewer than thirty (30) calendar days prior to the sub-processor's commencement of processing activities. Upon the Effective Date, Quorum shall provide Meridian with a list of all sub-processors then currently engaged by Quorum that will or may process Personal Information received from Meridian under the MDLA.

8.2 Sub-processor Contractual Requirements. Quorum shall enter into a written agreement with each sub-processor that imposes data-protection obligations no less protective than those imposed on Quorum under this DPA, including, without limitation, the following:

(a) Purpose limitations restricting the sub-processor's processing of Personal Information to the specific purposes for which the Personal Information was disclosed by Quorum;

(b) Prohibitions on the sale or sharing of Personal Information;

(c) Obligations to cooperate with consumer-rights requests, including requests to know, access, delete, correct, and limit the use of Sensitive Personal Information;

(d) De-identification requirements consistent with Section 6 of this DPA;

(e) Data-security standards consistent with the DSA, including, at a minimum, SOC 2 Type II certification or an equivalent independent security assessment;

(f) Confidentiality obligations with respect to Personal Information;

(g) Provisions for the return or destruction of Personal Information upon termination of the sub-processor engagement;

(h) Notification obligations with respect to data breaches or unauthorized access to Personal Information; and

(i) Audit rights permitting Quorum (and, upon reasonable request, Meridian) to verify the sub-processor's compliance with its data-protection obligations.

Quorum shall make copies of its sub-processor agreements (or, at a minimum, the data-protection provisions thereof) available to Meridian upon reasonable request.

8.3 Sub-processor Liability. Quorum shall remain fully liable to Meridian for the acts and omissions of its sub-processors with respect to the processing of Personal Information received from Meridian. The engagement of a sub-processor shall not relieve Quorum of any obligation under this DPA. If a sub-processor fails to fulfill its data-protection obligations, Quorum shall remain fully responsible for the performance of the sub-processor's obligations with respect to the Personal Information.

8.4 Meridian's Right to Object. Meridian shall have the right to object to Quorum's engagement of a specific sub-processor on reasonable data-protection grounds, including, without limitation, concerns regarding the sub-processor's data-security posture, regulatory compliance history, or adequacy of contractual data-protection commitments. Meridian shall communicate any objection to Quorum in writing within fifteen (15) calendar days of receipt of Quorum's notice under Section 8.1. Upon receipt of an objection from Meridian, Quorum shall use commercially reasonable efforts to address Meridian's concerns, which may include providing additional information regarding the sub-processor's security controls, modifying the scope of the sub-processor's access to Personal Information, or proposing an alternative sub-processor. If Meridian objects and the Parties cannot resolve the objection within thirty (30) calendar days of Meridian's written objection, either Party may escalate the dispute under the dispute-resolution provisions of the MDLA.

Drafting Note: The dispute-resolution mechanism for the MDLA remains unresolved. Quorum proposes exclusive jurisdiction in the United States District Court for the Southern District of New York or the Commercial Division of the Supreme Court of the State of New York, New York County. Meridian proposes binding arbitration under the Commercial Arbitration Rules of the American Arbitration Association, with a three-arbitrator panel, seated in New York, New York. This provision should be updated to reflect the agreed dispute-resolution mechanism upon finalization of the MDLA.

SECTION 9: DATA SECURITY

9.1 Cross-Reference to Data Security Addendum. The comprehensive data-security obligations of the Parties with respect to Personal Information processed under this DPA are set forth in the Data Security Addendum (the "DSA") to the MDLA. This Section 9 supplements the DSA with requirements that are specific to the Parties' obligations under CCPA/CPRA and does not limit or supersede the security obligations established in the DSA. In the event of any conflict or inconsistency between this Section 9 and the DSA, the provision imposing the more protective data-security obligation shall control.

9.2 Reasonable Security Measures. Each Party shall implement and maintain reasonable security procedures and practices appropriate to the nature of the Personal Information processed under this DPA, in order to protect Personal Information from unauthorized or illegal access, destruction, use, modification, or disclosure, as required by Cal. Civ. Code § 1798.100(e). Such reasonable security procedures and practices shall be consistent with, and shall not be less protective than, the security standards specified in the DSA, including the following:

(a) SOC 2 Type II Certification. Each Party shall maintain current SOC 2 Type II certification covering trust service criteria relevant to the processing of Personal Information under this DPA. As of the date hereof: (i) Quorum's SOC 2 Type II report was issued by Felton Thorpe & Co. LLP, covering the period ending December 31, 2023; and (ii) Meridian's SOC 2 Type II report was issued by Galloway Nash LLP, covering the period ending March 31, 2023;

(b) ISO 27001 Certification. Meridian maintains ISO 27001 certification for its information-security management system. Quorum shall maintain security controls consistent with ISO 27001 standards, whether or not Quorum holds formal ISO 27001 certification;

(c) Industry-Standard Controls. Both Parties shall implement and maintain industry-standard technical and organizational security measures, as further detailed in Schedule 2 to this DPA and in the DSA.

9.3 Data Breach Notification Under CCPA/CPRA. In addition to the forty-eight (48)-hour breach-notification obligation established in the DSA, each Party shall comply with the security-breach notification requirements of Cal. Civ. Code § 1798.82 et seq. and the private right of action provisions of Cal. Civ. Code § 1798.150 (providing consumers with a private right of action for unauthorized access and exfiltration, theft, or disclosure of nonencrypted or nonredacted personal information resulting from a business's violation of the duty to implement and maintain reasonable security procedures and practices). Quorum shall notify Meridian within forty-eight (48) hours of discovery of any security breach involving Personal Information received from Meridian, regardless of whether such breach triggers statutory notification obligations under Cal. Civ. Code § 1798.82. Such notification shall include, to the extent known at the time of notification: (a) a description of the nature of the breach; (b) the categories and approximate number of consumers affected; (c) the categories of Personal Information involved; (d) a description of the measures taken or proposed to be taken to address the breach; and (e) a description of the measures taken or proposed to be taken to mitigate possible adverse effects. Quorum shall cooperate with Meridian in investigating and remediating any such breach and in complying with applicable breach-notification laws and regulations.

9.4 Encryption. Personal Information received from Meridian shall be encrypted both in transit and at rest using industry-standard encryption protocols, as follows:

(a) Encryption at Rest: Personal Information stored by Quorum shall be encrypted using the Advanced Encryption Standard (AES) with a minimum key length of 256 bits (AES-256), or an equivalent or stronger encryption standard;

(b) Encryption in Transit: Personal Information transmitted between the Parties, or between Quorum and its sub-processors, shall be encrypted using Transport Layer Security (TLS) version 1.2 or higher, or an equivalent or stronger encryption protocol.

These encryption requirements are consistent with the requirements of the DSA and the NY DFS Cybersecurity Regulation, 23 NYCRR Part 500. Quorum shall review and update its encryption standards no less frequently than annually to ensure consistency with then-current industry standards and regulatory requirements.

SECTION 10: DATA RETENTION AND RETURN/DESTRUCTION

10.1 Retention During Term. During the term of the MDLA, Quorum may retain Personal Information received from Meridian only for so long as necessary to fulfill the Business Purposes specified in Schedule 1 to this DPA and in compliance with applicable law. Quorum shall implement and maintain a data-retention policy that specifies the retention periods applicable to each category of Personal Information processed under this DPA, and shall make such policy availab

PRIVILEGED & CONFIDENTIAL ATTORNEY WORK PRODUCT
DATA PROCESSING AGREEMENT
CCPA/CPRA Compliance Addendum to the Master Data License Agreement
Prepared by: Lisa Johannsen, Associate Data Privacy & Cybersecurity Practice Group Calderwood & Harkness LLP
Reviewed by: David Cartwright, Partner Data Privacy & Cybersecurity Practice Group Calderwood & Harkness LLP
March 2023
C&H Matter No. 1025-00008
This DPA is intended to be attached as an addendum to the Master Data License Agreement ("MDLA") between Quorum Insurance Holdings Corp. and Meridian Credit intelligence, Inc. This document constitutes attorney work product and is protected by the attorney-client privilege. Distribution is limited to authorized representatives of the client. This draft is subject to further revision and client review and does not constitute a final agreement or binding commitment of any party.
Right-click to update Table of Contents
PREAMBLE AND RECITALS
This Data Processing Agreement (this "DPA") is entered into as of the date set forth on the signature page hereto (the "Effective Date"), by and between:
Quorum Insurance Holdings Corp., a corporation organized and existing under the laws of the State of Delaware, with its principal place of business at 1200 Atlantic Street, Suite 3400, Stamford, Connecticut 06901 (hereinafter referred to as "Licensee" or "Business" or "Quorum");
and
Meridian Credit intelligence, Inc., a corporation organized and existing under the laws of the State of Georgia, with its principal place of business at 3300 Peachtree Road NE, Suite 2100, Atlanta, Georgia 30326 (hereinafter referred to as "Licensor" or "Data Provider" or "Meridian").
Quorum and Meridian are each referred to herein individually as a "Party" and collectively as the "Parties."
RECITALS
WHEREAS:
A. The Parties are engaged in negotiations with respect to a Master Data License Agreement (the "MDLA") pursuant to which Meridian will license to Quorum certain consumer credit-file data, commercial credit data, and alternative-data feeds, including, without limitation, the following proprietary data products: (i) the MCI Consumer Credit File™, which encompasses approximately 310 million consumer credit records; (ii) MCI CommercialView™, which encompasses approximately 42 million business credit records; and (iii) MCI AltSignal™, which encompasses approximately 85 million consumer alternative-data records derived from utility payment, telecommunications payment, and rental payment histories (collectively, the "Licensed Data" as further defined below);
B. Quorum will process consumer personal information received from Meridian under the MDLA for purposes of automated underwriting models, claims-fraud detection algorithms, and customer propensity scoring across Quorum's property and casualty ("P&C"), life, and specialty insurance lines of business, and for such other operational and analytical purposes as are specified in the MDLA and in Schedule 1 to this DPA;
C. The Parties intend this DPA to establish their respective obligations with respect to the processing of consumer personal information under the California Consumer Privacy Act of 2018, Cal. Civ. Code §§ 1798.100 et seq., as amended by the California Privacy Rights Act of 2020 (collectively, the "CCPA/CPRA"), and the implementing regulations adopted by the California Privacy Protection Agency (the "CPPA"), as such regulations may be amended, supplemented, or superseded from time to time;
D. This DPA supplements and is incorporated into the MDLA and the Data Security Addendum to the MDLA (the "DSA"). In the event of any conflict or inconsistency between the terms of this DPA and the terms of the MDLA or the DSA, the provision imposing the more restrictive data-protection obligation on the applicable Party shall control with respect to the subject matter of such conflict or inconsistency;
E. The Parties acknowledge and agree that the Licensed Data processed under the MDLA is also subject to the requirements of the Fair Credit Reporting Act, 15 U.S.C. §§ 1681 et seq. (the "FCRA"), the Gramm-Leach-Bliley Act, 15 U.S.C. §§ 6801 et seq. (the "GLBA"), and applicable state insurance data-security regulations, including, without limitation, the New York Department of Financial Services Cybersecurity Regulation, 23 NYCRR Part 500 (the "NY DFS Cybersecurity Regulation"), and that compliance with this DPA does not diminish, supersede, or otherwise affect either Party's obligations under such statutes and regulations.
NOW, THEREFORE, in consideration of the mutual covenants, agreements, and obligations set forth herein, and for other good and valuable consideration, the receipt and sufficiency of which are hereby acknowledged, the Parties agree as follows:
SECTION 1: DEFINITIONS
For purposes of this DPA, the following terms shall have the meanings set forth below. Capitalized terms used but not defined in this DPA shall have the meanings ascribed to them in the MDLA.
1.1 "Business" means Quorum Insurance Holdings Corp. and its controlled affiliates that determine the purposes and means of processing Personal Information under this DPA. The term "Business" is used in this DPA consistent with the definition set forth in Cal. Civ. Code § 1798.140(d), as amended by the CPRA. For the avoidance of doubt, Meridian also constitutes a "business" within the meaning of CCPA/CPRA with respect to its own collection and processing of consumer Personal Information, as further described in Section 2.1 of this DPA.
1.2 "Business Purpose" means the specific operational purposes for which Personal Information is processed under the MDLA, as enumerated in Schedule 1 to this DPA, which include, without limitation: (a) insurance underwriting and risk assessment; (b) claims-fraud detection and investigation; (c) customer propensity scoring and segmentation; (d) development, training, testing, and validation of predictive models, including QuorumScore™, Quorum's proprietary predictive underwriting model (United States Patent and Trademark Office application pending, Serial No. 97/482,116); (e) regulatory compliance and reporting; (f) internal audit, quality assurance, and data-integrity verification; and (g) responding to verified consumer requests under applicable privacy laws. The term "Business Purpose" is used in this DPA consistent with the definition set forth in Cal. Civ. Code § 1798.140(e), as amended by the CPRA, and shall be construed to include such additional categories of business purposes as may be specified by the CPPA in implementing regulations.
1.3 "Consumer" means a California resident as defined under CCPA/CPRA, Cal. Civ. Code § 1798.140(i). For purposes of this DPA, the term "Consumer" refers specifically to natural persons who are California residents and whose Personal Information is included in the Licensed Data.
1.4 "Contractor" means a person to whom a business makes available a consumer's Personal Information and with whom the business enters into a written contract that includes the terms and conditions required by CCPA/CPRA, Cal. Civ. Code § 1798.140(j), as amended by the CPRA. To the extent Quorum's receipt and processing of Personal Information under this DPA satisfies the requirements for classification as a "contractor" under CCPA/CPRA, the contractual obligations set forth in this DPA are intended to satisfy the written-contract requirements applicable to contractors.
1.5 "Data Provider" means Meridian Credit intelligence, Inc., in its capacity as the licensor and provider of the Licensed Data under the MDLA.
1.6 "De-identified Information" means information that cannot reasonably be used to infer information about, or otherwise be linked to, a particular consumer or household, provided that the requirements of Cal. Civ. Code § 1798.140(m) are met, including, without limitation, the following conditions: (a) the business that possesses the information has implemented technical safeguards that prohibit re-identification of the consumer to whom the information may pertain; (b) the business has implemented business processes that specifically prohibit re-identification of the information; (c) the business has implemented business processes to prevent inadvertent release of de-identified information; and (d) the business makes no attempt to re-identify the information. De-identified Information is not Personal Information for purposes of this DPA.
1.7 "Derived Data" means, as defined in Article VII of the MDLA (which definition remains subject to ongoing negotiation between the Parties), data, models, scores, indices, analytics outputs, and other informational products or work product created by Quorum using Licensed Data from Meridian as an input, whether alone or in combination with Quorum's own first-party data or data from other sources. For the avoidance of doubt, Derived Data includes, without limitation, QuorumScore™ outputs, statistical models, risk scores, and analytical insights generated through Quorum's processing of Licensed Data. The treatment of Derived Data under CCPA/CPRA is addressed in Section 7 of this DPA.
1.8 "Licensed Data" means the MCI Consumer Credit File™, MCI CommercialView™, and MCI AltSignal™ data feeds, and any updates, supplements, corrections, or modifications thereto, made available to Quorum under the MDLA.
1.9 "Personal Information" means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household, as defined under CCPA/CPRA, Cal. Civ. Code § 1798.140(v). For purposes of this DPA, Personal Information includes, without limitation, consumer credit tradeline data, payment history, account balances, account status information, identifying information (including consumer name, address, Social Security number, and date of birth), public record information, alternative data (including utility payment history, telecommunications payment history, and rental payment history), and any other information within the Licensed Data that meets the foregoing definition. Personal Information does not include De-identified Information or aggregate consumer information, as those terms are defined in this DPA and under CCPA/CPRA.
1.10 "Processing" means any operation or set of operations performed on Personal Information, or on sets of Personal Information, whether or not by automated means. Processing includes, without limitation, the collection, recording, organization, structuring, storage, adaptation, alteration, retrieval, consultation, use, disclosure by transmission, dissemination, or otherwise making available, alignment, combination, restriction, erasure, destruction, analysis, modeling, scoring, or modification of Personal Information. This definition is consistent with the broad construction of "processing" under CCPA/CPRA and its implementing regulations.
1.11 "Sale" has the meaning set forth in Cal. Civ. Code § 1798.140(ad), as amended by the CPRA, and means selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer's Personal Information by the business to a third party for monetary or other valuable consideration. For the avoidance of doubt, the term "Sale" does not include the disclosure of Personal Information to a service provider or contractor for a business purpose pursuant to a written contract that includes the restrictions required by CCPA/CPRA, provided that the service provider or contractor does not further collect, sell, or use the Personal Information except as necessary to perform the business purpose.
1.12 "Sensitive Personal Information" has the meaning set forth in Cal. Civ. Code § 1798.140(ae), as amended by the CPRA. As applicable to the Licensed Data, Sensitive Personal Information includes, without limitation, Social Security numbers, driver's license numbers, state identification card numbers, financial account numbers (including account numbers, debit card numbers, or credit card numbers in combination with any required security code, access code, or password that would permit access to a consumer's financial account), and such other categories of information as may be specified in CCPA/CPRA or its implementing regulations.
1.13 "Service Provider" means a person that processes Personal Information on behalf of a business and to which the business discloses a consumer's Personal Information for a business purpose pursuant to a written contract, as defined under CCPA/CPRA, Cal. Civ. Code § 1798.140(ag), as amended by the CPRA. The written contract must prohibit the person receiving the Personal Information from (i) selling or sharing the Personal Information, (ii) retaining, using, or disclosing the Personal Information for any purpose other than for the business purposes specified in the contract, including retaining, using, or disclosing the Personal Information for a commercial purpose other than providing the services specified in the contract, and (iii) retaining, using, or disclosing the information outside of the direct business relationship between the person and the business.
1.14 "Sharing" has the meaning set forth in Cal. Civ. Code § 1798.140(ah), as amended by the CPRA, and means sharing, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer's Personal Information by the business to a third party for cross-context behavioral advertising, whether or not for monetary or other valuable consideration, including transactions between a business and a third party for cross-context behavioral advertising for the benefit of a business in which no money is exchanged.
1.15 "Sub-processor" means any third party engaged by either Party to process Personal Information in connection with the performance of obligations under the MDLA and this DPA. Sub-processors include, without limitation, Quorum's data-engineering contractors, cloud-infrastructure providers, and analytics service providers, as well as Meridian's data-delivery service providers, data-hosting providers, and technology vendors that have access to or process Personal Information on Meridian's behalf.
1.16 "Third Party" has the meaning set forth in Cal. Civ. Code § 1798.140(ai), as amended by the CPRA, and means a person who is not any of the following: (a) the business with whom the consumer intentionally interacts and that collects Personal Information from the consumer as part of the consumer's current interaction with the business; or (b) a service provider to the business; or (c) a contractor.
SECTION 2: ROLES AND RELATIONSHIP OF THE PARTIES
2.1 Meridian as Business / Data Provider. Meridian collects and maintains consumer Personal Information through its credit-bureau operations, consumer reporting activities, and alternative-data collection programs. For purposes of CCPA/CPRA, Meridian acts as a "business" within the meaning of Cal. Civ. Code § 1798.140(d) with respect to the Personal Information it has collected from and about consumers and that is included in the Licensed Data. Meridian independently determines the purposes and means of its collection and processing of such Personal Information. Meridian's disclosure of Personal Information to Quorum under the MDLA is made for a "business purpose" as defined in Section 1.2 of this DPA and Cal. Civ. Code § 1798.140(e), and such disclosure does not constitute a "sale" or "sharing" of Personal Information within the meaning of CCPA/CPRA, provided that the requirements of this DPA are satisfied and that Quorum complies with the restrictions and obligations set forth herein. Nothing in this DPA shall limit Meridian's independent obligations as a business under CCPA/CPRA with respect to the Personal Information it collects and maintains.
2.2 Quorum as Service Provider / Contractor. For purposes of CCPA/CPRA, Quorum receives Personal Information from Meridian and processes such Personal Information as a "service provider" within the meaning of Cal. Civ. Code § 1798.140(ag), or, to the extent applicable under the CPRA, as a "contractor" within the meaning of Cal. Civ. Code § 1798.140(j), with respect to the Licensed Data received from Meridian. Quorum shall process Personal Information received from Meridian solely for the Business Purposes specified in Schedule 1 to this DPA and as otherwise expressly permitted under this DPA and the MDLA. Quorum shall not retain, use, or disclose such Personal Information for any purpose other than the Business Purposes, except as otherwise expressly permitted by CCPA/CPRA. The Parties intend that this DPA satisfies the written-contract requirements applicable to service providers and contractors under Cal. Civ. Code § 1798.140(ag) and § 1798.140(j), respectively, as well as the corresponding provisions of the CPPA implementing regulations.
2.3 Independent Business Activities. The Parties acknowledge that Quorum collects and processes its own first-party data — including, without limitation, claims data, policy data, telematics data, and customer-relationship data — independently of and in addition to the Licensed Data received from Meridian. To the extent Quorum combines Licensed Data from Meridian with Quorum's own first-party data for purposes of its internal underwriting, fraud-detection, and customer-scoring operations, Quorum acts as a "business" in its own right under CCPA/CPRA with respect to its first-party data and is independently responsible for compliance with CCPA/CPRA with respect to such first-party data. The Parties further acknowledge that the creation of Derived Data (including QuorumScore™ outputs and other predictive model outputs) may implicate both (a) service-provider or contractor obligations under CCPA/CPRA with respect to the Meridian Licensed Data inputs incorporated into or used in the generation of such Derived Data, and (b) independent business activities under CCPA/CPRA with respect to Quorum's own first-party data inputs. The allocation of CCPA/CPRA obligations with respect to Derived Data is addressed in Section 7 of this DPA.
2.4 No Joint Controller Relationship. Nothing in this DPA shall be construed to create a joint-controller, joint-business, or joint-venture relationship between Meridian and Quorum. Each Party independently determines the purposes and means of its own processing activities and is independently responsible for its own compliance with CCPA/CPRA and other applicable data-protection laws. Neither Party shall be deemed to be the agent, employee, partner, or legal representative of the other Party for any purpose whatsoever, except as expressly provided in this DPA or the MDLA.
SECTION 3: PURPOSE LIMITATIONS
3.1 Permitted Purposes. Quorum shall process Personal Information received from Meridian only for the Business Purposes enumerated in Schedule 1 to this DPA and as reasonably necessary to perform services under the MDLA. Quorum shall not process Personal Information received from Meridian for any purpose that is incompatible with the Business Purposes without the prior written authorization of Meridian. Any request for authorization to process Personal Information for a purpose not enumerated in Schedule 1 shall be submitted to Meridian in writing and shall include a description of the proposed processing activity, the categories of Personal Information involved, the business justification for the proposed processing, and an assessment of the privacy risks associated therewith. Meridian shall respond to any such request within thirty (30) calendar days of receipt. If Meridian grants authorization, the Parties shall amend Schedule 1 to reflect the additional Business Purpose.
3.2 Prohibition on Use Beyond MDLA Scope. Quorum shall not retain, use, or disclose Personal Information received from Meridian for any commercial purpose other than performing the services and fulfilling the Business Purposes specified in the MDLA and this DPA. Without limiting the foregoing, Quorum shall not retain, use, or disclose Personal Information received from Meridian outside of the direct business relationship between Quorum and Meridian, except as otherwise expressly permitted by CCPA/CPRA, Cal. Civ. Code § 1798.140(ag)(1)(A)–(C), which permits a service provider to retain, use, or disclose Personal Information to (A) retain and employ another service provider or contractor as a sub-processor, subject to the requirements of Section 8 of this DPA; (B) use the Personal Information for the specific purposes of detecting data-security incidents, protecting against fraudulent or illegal activity, or for the Business Purposes enumerated in Schedule 1, provided that such use is reasonably necessary and proportionate to achieve the intended purpose; or (C) use the Personal Information for internal uses that are reasonably aligned with the expectations of the consumer, taking into account the consumer's relationship with Meridian.
3.3 Combining Data. Quorum shall not combine Personal Information received from Meridian with Personal Information that Quorum receives from or on behalf of another person or persons, or that Quorum collects from its own interaction with a consumer, except as expressly permitted by CCPA/CPRA, Cal. Civ. Code § 1798.140(ag)(1)(B), and subject to the following conditions:
(a) Quorum may combine Personal Information received from Meridian with Quorum's own first-party data solely for the purposes of detecting data-security incidents, protecting against fraudulent or illegal activity, or for the specific Business Purposes enumerated in Schedule 1 to this DPA;
(b) Any such combination of data shall be conducted in a manner that maintains the service-provider or contractor obligations applicable to the Meridian-sourced Personal Information and does not result in a "sale" or "sharing" of such Personal Information within the meaning of CCPA/CPRA;
(c) The treatment of Derived Data created through the combination of Meridian Licensed Data and Quorum first-party data is addressed in Section 7 of this DPA, and any such Derived Data that constitutes or contains Personal Information remains subject to the restrictions of this DPA with respect to the Meridian-sourced Personal Information component.
Drafting Note: This restriction on combining data is in tension with Quorum's intended use case of blending Meridian consumer credit data with Quorum's first-party claims, policy, and telematics data for QuorumScore™ and other predictive models. Section 7 addresses the Derived Data exception and the applicable CCPA/CPRA framework for such combined processing. The Parties should discuss whether additional carve-outs are necessary to accommodate Quorum's data-blending requirements while maintaining CCPA/CPRA compliance.
3.4 Notification Obligation. Quorum shall notify Meridian promptly, and in any event within five (5) business days, if Quorum determines that it can no longer meet its obligations under CCPA/CPRA as a service provider or contractor with respect to Personal Information received from Meridian. Upon providing such notification, Quorum shall cooperate with Meridian to take reasonable and appropriate steps to stop and remediate any unauthorized processing or use of Personal Information. Meridian shall have the right, upon receipt of such notification, to take reasonable and appropriate steps to ensure that the Personal Information is processed in a manner consistent with Meridian's obligations under CCPA/CPRA, which may include directing Quorum to cease processing activities or to return or destroy the affected Personal Information.
SECTION 4: SALE AND SHARING RESTRICTIONS
4.1 No Sale of Personal Information. Quorum shall not sell (as defined in Section 1.11 of this DPA and Cal. Civ. Code § 1798.140(ad)) any Personal Information received from Meridian under the MDLA. Quorum hereby certifies that it understands the prohibition on selling Personal Information received from Meridian and that it will comply with such prohibition. Quorum further certifies that it will not sell any Personal Information received from Meridian to any third party for monetary or other valuable consideration, directly or indirectly, and that it will not make any such Personal Information available to third parties in a manner that would constitute a "sale" under CCPA/CPRA.
4.2 No Sharing for Cross-Context Behavioral Advertising. Quorum shall not share (as defined in Section 1.14 of this DPA and Cal. Civ. Code § 1798.140(ah)) any Personal Information received from Meridian for cross-context behavioral advertising purposes. Without limiting the foregoing, Quorum shall not disclose, transmit, or otherwise make available Personal Information received from Meridian to any advertising network, data broker, advertising technology provider, or other person or entity for the purpose of targeting advertising to consumers based on Personal Information obtained from a different business, context, or interaction.
4.3 Meridian's Certification. Meridian certifies that, to the extent it collects Personal Information that is included in the Licensed Data, it has provided consumers with appropriate notice regarding the disclosure of their Personal Information to service providers and contractors for business purposes, including the categories of Personal Information disclosed and the business purposes for which such Personal Information is disclosed, in accordance with the notice requirements of CCPA/CPRA, Cal. Civ. Code § 1798.100(a) and § 1798.100(b), and the corresponding provisions of the CPPA implementing regulations. Meridian further certifies that it maintains a privacy policy that discloses the categories of Personal Information that it collects, the purposes for which such categories of Personal Information are collected, and the categories of third parties to which it discloses Personal Information, as required by CCPA/CPRA.
4.4 Third-Party Commercialization of Derived Data. [Bracketed — Subject to resolution of Article VII of the MDLA.] To the extent Quorum seeks to commercialize Derived Data to third parties outside Quorum's corporate group (including affiliates and subsidiaries), such commercialization shall be subject to the following conditions:
(a) Any Derived Data that is commercialized to third parties must qualify as De-identified Information (as defined in Section 1.6 of this DPA) or as aggregate consumer information within the meaning of Cal. Civ. Code § 1798.140(b), and must satisfy the de-identification requirements of Section 6 of this DPA;
(b) The commercialization of Derived Data to third parties shall not constitute a "sale" or "sharing" of Personal Information under CCPA/CPRA;
(c) Prior to any third-party commercialization of Derived Data, Quorum shall provide Meridian with a written certification confirming that the Derived Data proposed for commercialization satisfies the de-identification and aggregation standards set forth in this DPA and does not constitute Personal Information within the meaning of CCPA/CPRA;
(d) Meridian shall have the right, upon reasonable notice, to audit or review the de-identification methodology applied by Quorum to any Derived Data proposed for third-party commercialization, in accordance with Section 11 of this DPA.
Drafting Note: This provision intersects with the unresolved Article VII Derived Data commercialization dispute. The Parties currently disagree on whether Quorum's external commercialization of Derived Data constitutes a "sale" under CCPA/CPRA if such Derived Data incorporates Meridian data inputs. Quorum's position is that sufficiently transformed Derived Data does not constitute Personal Information and is therefore outside the scope of CCPA/CPRA. Meridian's position is that Derived Data that incorporates or is derived from Meridian's Licensed Data remains subject to Meridian's contractual and proprietary rights regardless of the degree of transformation. Resolution of this provision is contingent upon the Parties' agreement on the Article VII "sufficient transformation" standard and the Derived Data commercialization framework.
SECTION 5: CONSUMER RIGHTS FACILITATION
5.1 Cooperation on Consumer Requests. Quorum shall cooperate with and assist Meridian in responding to verifiable consumer requests submitted under CCPA/CPRA, including, without limitation, the following categories of requests:
(a) Requests to know and access Personal Information, pursuant to Cal. Civ. Code § 1798.110;
(b) Requests to delete Personal Information, pursuant to Cal. Civ. Code § 1798.105;
(c) Requests to correct inaccurate Personal Information, pursuant to Cal. Civ. Code § 1798.106;
(d) Requests to opt out of the sale or sharing of Personal Information, pursuant to Cal. Civ. Code § 1798.120; and
(e) Requests to limit the use and disclosure of Sensitive Personal Information, pursuant to Cal. Civ. Code § 1798.121.
Quorum shall designate a point of contact for the purpose of receiving and processing consumer-rights requests relayed by Meridian, and shall provide Meridian with the contact information for such designee within thirty (30) calendar days of the Effective Date. Quorum shall maintain internal procedures sufficient to facilitate the timely processing of consumer-rights requests in accordance with the timeframes established by CCPA/CPRA.
5.2 Notice and Response Process. Upon receipt from Meridian of a verified consumer request that relates to Personal Information processed by Quorum under this DPA, Quorum shall take commercially reasonable steps to comply with such request within the timeframes required by CCPA/CPRA. Under CCPA/CPRA, businesses are generally required to respond to verified consumer requests within forty-five (45) calendar days of receipt, with one forty-five (45)-calendar-day extension available upon notice to the consumer explaining the reasons for the delay. To facilitate Meridian's compliance with these timeframes, Quorum shall use commercially reasonable efforts to respond to consumer-rights requests relayed by Meridian within twenty (20) business days of receipt of such request from Meridian, or such shorter period as may be reasonably necessary for Meridian to meet its obligations under CCPA/CPRA. Quorum shall provide Meridian with written confirmation of the actions taken in response to each consumer-rights request, including any exceptions or limitations applied.
5.3 Deletion Obligations. Upon receiving a deletion request relayed by Meridian pursuant to Cal. Civ. Code § 1798.105, Quorum shall delete the requesting consumer's Personal Information from Quorum's systems, and shall instruct its sub-processors that have received such Personal Information to delete the consumer's Personal Information from their systems, unless retention is permitted under a recognized exception to the deletion right under CCPA/CPRA, including, without limitation, the following exceptions:
(a) Retention is necessary to complete the transaction for which the Personal Information was collected, to fulfill the terms of a written warranty or product recall conducted in accordance with federal law, or to otherwise perform a contract between Meridian and the consumer;
(b) Retention is necessary to detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, or prosecute those responsible for that activity;
(c) Retention is necessary to comply with a legal obligation, including, without limitation, record-retention requirements under the FCRA, the GLBA, or applicable state insurance regulations;
(d) Retention is necessary to exercise or defend legal claims; or
(e) Retention is otherwise permitted under Cal. Civ. Code § 1798.105(d).
If Quorum relies on an exception to the deletion right, Quorum shall promptly notify Meridian in writing of the specific exception(s) relied upon and the categories of Personal Information retained. Quorum shall notify Meridian upon completion of deletion.
5.4 Correction Obligations. Upon receiving a correction request relayed by Meridian pursuant to Cal. Civ. Code § 1798.106, Quorum shall use commercially reasonable efforts to correct the inaccurate Personal Information in Quorum's records, taking into account the nature of the Personal Information, the purposes of processing, and the instructions provided by Meridian. Quorum shall implement reasonable measures to ensure that corrected information is reflected in all active processing systems and analytical models in which the inaccurate Personal Information was previously used. Quorum shall notify Meridian upon completion of any correction, including a description of the corrective actions taken.
5.5 Right to Limit Use of Sensitive Personal Information. To the extent Quorum processes Sensitive Personal Information received from Meridian under this DPA, Quorum shall honor verified consumer requests to limit the use and disclosure of such Sensitive Personal Information to uses that are necessary to perform the services or provide the goods reasonably expected by an average consumer who requests such goods or services, as provided in Cal. Civ. Code § 1798.121. Quorum shall implement internal procedures to identify and flag Sensitive Personal Information within the Licensed Data and to restrict its processing in accordance with a consumer's exercise of this right. Without limiting the foregoing, upon receipt of a request to limit use of Sensitive Personal Information relayed by Meridian, Quorum shall restrict its processing of the affected consumer's Sensitive Personal Information to the minimum necessary to perform the Business Purposes for which such Sensitive Personal Information is strictly required.
5.6 Direct Consumer Requests to Quorum. If Quorum receives a consumer request directly (i.e., not through Meridian) that relates to Personal Information received from Meridian under the MDLA, Quorum shall promptly, and in any event within five (5) business days, notify Meridian of such request and coordinate with Meridian on the appropriate response. Quorum shall not respond directly to such consumer requests without Meridian's prior written consent, unless Quorum is independently required to do so in its capacity as a business under CCPA/CPRA with respect to its own first-party data. In such cases, Quorum shall respond to the consumer only with respect to the Quorum first-party data component of the request and shall refer the consumer to Meridian with respect to the Licensed Data component, unless otherwise directed by Meridian. Quorum shall provide Meridian with copies of all consumer requests received directly by Quorum that relate to Personal Information sourced from Meridian.
5.7 Record Keeping. Both Parties shall maintain complete and accurate records of all consumer requests received and responses provided with respect to Personal Information processed under this DPA, for a minimum period of twenty-four (24) months from the date of receipt of each consumer request, or such longer period as may be required by CCPA/CPRA implementing regulations or other applicable law. Such records shall include, at a minimum, the date of receipt of the request, the nature of the request, the identity of the requesting consumer (to the extent verified), the actions taken in response, the date of completion, and any exceptions or limitations applied. Each Party shall make such records available to the other Party upon reasonable request for purposes of regulatory compliance and audit.
SECTION 6: DE-IDENTIFICATION STANDARDS
6.1 De-identification Requirements. Any Personal Information that is de-identified by Quorum in connection with the creation of Derived Data, the preparation of analytical outputs, or otherwise, must satisfy the de-identification requirements of Cal. Civ. Code § 1798.140(m), including, without limitation, each of the following conditions:
(a) The information cannot reasonably be used to infer information about, or otherwise be linked to, a particular consumer or household, taking into account all reasonably available methods and technologies for re-identification, including those known to or accessible by Quorum or any person to whom the de-identified information is disclosed;
(b) Quorum implements and maintains reasonable technical safeguards and business processes that specifically prohibit re-identification of the consumer to whom the information may pertain, including, without limitation, access controls, data-masking techniques, and encryption of residual identifiers;
(c) Quorum implements and maintains business processes to prevent inadvertent release of de-identified information in a form that could be re-identified, including, without limitation, employee training, internal policies governing the handling of de-identified information, and quality-assurance procedures for de-identification outputs; and
(d) Quorum makes no attempt to re-identify the information and contractually prohibits any recipient of de-identified information from attempting re-identification.
Quorum shall document its de-identification methodology and the technical and organizational measures employed to satisfy the foregoing requirements, and shall make such documentation available to Meridian upon request in connection with audit and compliance verification under Section 11 of this DPA.
6.2 Aggregation Standards. Quorum may aggregate Personal Information received from Meridian, provided that the aggregated information relates to a group or category of consumers (and not to individual consumers) and that individual consumer identities have been removed from such aggregated information, consistent with the CCPA/CPRA definition of "aggregate consumer information" set forth in Cal. Civ. Code § 1798.140(b). Aggregate consumer information shall not be reasonably linkable to any individual consumer or household. Quorum shall apply minimum aggregation group sizes sufficient to prevent the identification or re-identification of individual consumers from aggregated data, as further specified in the technical appendix contemplated by Section 6.3 below.
6.3 Technical De-identification Measures. The Parties shall cooperate to develop a technical appendix to this DPA specifying the detailed technical de-identification standards and methodologies to be applied by Quorum in connection with the de-identification and aggregation of Personal Information received from Meridian. Such technical appendix shall be developed in coordination with Priya Nair, Director, Data Engineering, Quorum, and Lena Vasquez, Chief Privacy Officer, Meridian. The Parties anticipate that the technical appendix will address, at a minimum, the following measures:
(a) k-Anonymity Thresholds: Minimum k-anonymity thresholds for de-identified datasets, with a target minimum of k=10 for consumer-level outputs and k=25 for datasets intended for third-party disclosure;
(b) Differential Privacy Techniques: Application of differential privacy mechanisms (including, where appropriate, Laplacian noise injection or randomized response techniques) to analytical outputs derived from Personal Information;
(c) Suppression of Direct Identifiers: Removal or irreversible transformation of all direct identifiers (including name, Social Security number, date of birth, and street address) prior to any disclosure of de-identified or aggregated data;
(d) Minimum Aggregation Group Sizes: Establishment of minimum group sizes for aggregated data outputs, with suppression or generalization of cells containing fewer than the applicable minimum number of individuals; and
(e) Re-identification Risk Assessment: Periodic assessment of re-identification risk using accepted statistical methodologies, to be conducted no less frequently than annually.
Pending completion of the technical appendix, Quorum shall apply de-identification and aggregation measures that are consistent with industry best practices for consumer financial data and that satisfy the requirements of Cal. Civ. Code § 1798.140(m).
6.4 Relationship to "Sufficient Transformation" Standard. [Bracketed — Subject to resolution of Article VII of the MDLA.] The Parties acknowledge that the de-identification standards set forth in this Section 6 are distinct from, and supplementary to, any "sufficient transformation" standard that may be agreed upon in Article VII of the MDLA with respect to Derived Data commercialization. Compliance with the de-identification standards of this Section 6 is a necessary condition for the third-party commercialization of Derived Data under Section 4.4 of this DPA, but may not be a sufficient condition for such commercialization under the terms of the MDLA. The "sufficient transformation" standard in Article VII of the MDLA may impose additional requirements — including, without limitation, requirements relating to the degree of analytical transformation, the irreversibility of derivation processes, and the extent to which Meridian's Licensed Data can be reconstructed or reverse-engineered from the Derived Data — that go beyond the CCPA/CPRA de-identification requirements of this Section 6.
SECTION 7: DERIVED DATA UNDER CCPA/CPRA
7.1 CCPA/CPRA Treatment of Derived Data — General Principle. The Parties acknowledge that the treatment of Derived Data under CCPA/CPRA depends on whether such Derived Data constitutes, contains, or is linked to Personal Information within the meaning of Cal. Civ. Code § 1798.140(v). The following principles shall govern the CCPA/CPRA classification of Derived Data:
(a) To the extent Derived Data constitutes or contains Personal Information — that is, to the extent such Derived Data identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, to a particular consumer or household — such Derived Data remains subject to all of the service-provider/contractor restrictions, purpose limitations, consumer-rights obligations, and sale/sharing prohibitions of this DPA;
(b) To the extent Derived Data has been de-identified in compliance with Section 6 of this DPA and qualifies as De-identified Information or aggregate consumer information, such Derived Data is not Personal Information for purposes of CCPA/CPRA and is outside the scope of the CCPA/CPRA-specific obligations of this DPA (though it may remain subject to contractual restrictions under Article VII of the MDLA);
(c) The determination of whether Derived Data constitutes or contains Personal Information shall be made on a case-by-case basis, taking into account the totality of the circumstances, including the nature and granularity of the Derived Data, the availability of linking information, and the methods and technologies reasonably available for re-identification.
7.2 Machine-Learning Model Outputs. The Parties acknowledge that Quorum intends to use Personal Information received from Meridian as one of multiple training inputs for machine-learning models, including QuorumScore™ and other predictive underwriting, fraud-detection, and customer-segmentation models. The Parties agree to the following framework for the CCPA/CPRA treatment of machine-learning model components:
(a) Trained Model Weights and Parameters. Model weights, parameters, coefficients, and other mathematical representations learned during the training process, once abstracted from the underlying training data, do not themselves constitute Personal Information within the meaning of CCPA/CPRA, provided that such weights and parameters cannot reasonably be used to reconstruct, derive, or infer Personal Information about individual consumers. Accordingly, trained model weights and parameters, standing alone, are not subject to the CCPA/CPRA-specific obligations of this DPA;
(b) Live Inference Outputs — Consumer-Level. Live inference outputs that are generated by applying a trained model to consumer-level input data and that produce consumer-level scores, predictions, classifications, or recommendations attributable to identified or identifiable consumers constitute Personal Information under CCPA/CPRA and remain subject to the purpose limitations, consumer-rights provisions, sale/sharing prohibitions, and other restrictions of this DPA;
(c) Live Inference Outputs — Aggregate or De-identified. Aggregate or de-identified model outputs that relate to groups or categories of consumers and that do not identify, relate to, or link to individual consumers are not Personal Information under CCPA/CPRA, provided they satisfy the de-identification and aggregation standards of Section 6 of this DPA.
Drafting Note: This provision reflects a compromise position between the Parties' divergent views on the CCPA/CPRA treatment of machine-learning model outputs. Quorum's position is that trained model weights and parameters, once abstracted from the training data, do not constitute Personal Information and are not subject to CCPA/CPRA obligations or Meridian's contractual rights. Meridian's position is that model outputs traceable to Meridian data remain subject to Meridian's proprietary and contractual rights regardless of the degree of abstraction. This DPA adopts the position that model weights and parameters, standing alone, do not constitute Personal Information; however, live inference outputs that incorporate or reveal consumer-level Personal Information remain subject to this DPA. The Parties should evaluate whether this framework is consistent with the Parties' respective positions on Derived Data ownership and commercialization under Article VII of the MDLA.
7.3 QuorumScore™ Outputs. The following provisions apply specifically to outputs generated by QuorumScore™, Quorum's proprietary predictive underwriting model (USPTO application pending, Serial No. 97/482,116):
(a) QuorumScore™ predictive model outputs that produce consumer-level scores, risk assessments, or predictions attributable to identified or identifiable consumers — including, without limitation, individual consumer risk scores, propensity scores, and underwriting recommendations — constitute Personal Information under CCPA/CPRA and are subject to the purpose limitations, consumer-rights provisions, sale/sharing prohibitions, and other restrictions of this DPA;
(b) Aggregate or de-identified QuorumScore™ outputs — including, without limitation, aggregate risk profiles, portfolio-level risk distributions, market-segment analyses, and trend analyses — that cannot be linked to individual consumers are not Personal Information under CCPA/CPRA and are outside the scope of the CCPA/CPRA-specific obligations of this DPA, provided that such outputs satisfy the de-identification and aggregation standards of Section 6 of this DPA;
(c) Quorum shall maintain documentation of the data inputs, processing methodologies, and de-identification techniques applied in the generation of QuorumScore™ outputs, and shall make such documentation available to Meridian upon reasonable request in connection with audit and compliance verification under Section 11 of this DPA.
7.4 Internal Use vs. Third-Party Commercialization. Quorum's internal use of Derived Data for the Business Purposes specified in Schedule 1 to this DPA is permitted under this DPA, subject to the purpose limitations of Section 3, the sale/sharing restrictions of Section 4, and the consumer-rights obligations of Section 5. Third-party commercialization of Derived Data (i.e., the disclosure, licensing, or sale of Derived Data to persons or entities outside Quorum's corporate group) is subject to the following restrictions:
(a) Any Derived Data disclosed to third parties must qualify as De-identified Information (as defined in Section 1.6) or aggregate consumer information (as defined in Cal. Civ. Code § 1798.140(b)), and must satisfy the de-identification and aggregation standards of Section 6 of this DPA;
(b) The disclosure of Derived Data to third parties must not constitute a "sale" or "sharing" of Personal Information within the meaning of CCPA/CPRA;
(c) Prior to any third-party commercialization, Quorum shall provide Meridian with the written certification contemplated by Section 4.4(c) of this DPA; and
(d) Third-party commercialization of Derived Data is further subject to any restrictions, conditions, or approval requirements agreed upon in Article VII of the MDLA.
[Bracketed — Subject to resolution of Article VII of the MDLA.]
7.5 Revenue Share and CCPA/CPRA Interaction. [Bracketed — Negotiation Note.] Meridian has proposed a revenue-share arrangement pursuant to which Quorum would pay to Meridian fifteen percent (15%) of net revenues derived from third-party commercialization of Derived Data. The Parties note that if such revenue-share arrangement is structured as consideration paid by Quorum to Meridian in exchange for the disclosure of Personal Information by Meridian to Quorum (or as consideration flowing from Quorum's downstream disclosure of Personal Information to third parties), such arrangement could implicate the CCPA/CPRA definition of "sale" set forth in Cal. Civ. Code § 1798.140(ad). The Parties shall structure any revenue-share arrangement to avoid characterization as a "sale" of Personal Information under CCPA/CPRA, including by ensuring that: (a) any revenue share is structured as consideration for the licensing of intellectual-property rights or data-aggregation services, rather than for the disclosure of Personal Information; (b) any Derived Data subject to a revenue-share arrangement is De-identified Information or aggregate consumer information and does not constitute Personal Information; and (c) the contractual documentation for any revenue-share arrangement expressly states that the revenue share does not constitute consideration for the sale or sharing of Personal Information.
Drafting Note: This provision is included for completeness and reflects the current state of negotiations. Quorum has rejected the proposed 15% revenue share. This provision would be deleted from the DPA in the event that the revenue-share proposal is not agreed upon in Article VII of the MDLA. If a revenue share is agreed, the provision should be revised to reflect the agreed terms and should be reviewed by tax counsel for potential tax implications.
SECTION 8: SUB-PROCESSOR REQUIREMENTS
8.1 Sub-processor Engagement. Quorum shall not engage any sub-processor to process Personal Information received from Meridian under the MDLA without prior written notice to Meridian identifying the sub-processor by name and legal entity, the scope and purpose of the sub-processor's processing activities, the categories of Personal Information involved, and the location(s) at which the sub-processor will process such Personal Information. Quorum shall provide such notice to Meridian no fewer than thirty (30) calendar days prior to the sub-processor's commencement of processing activities. Upon the Effective Date, Quorum shall provide Meridian with a list of all sub-processors then currently engaged by Quorum that will or may process Personal Information received from Meridian under the MDLA.
8.2 Sub-processor Contractual Requirements. Quorum shall enter into a written agreement with each sub-processor that imposes data-protection obligations no less protective than those imposed on Quorum under this DPA, including, without limitation, the following:
(a) Purpose limitations restricting the sub-processor's processing of Personal Information to the specific purposes for which the Personal Information was disclosed by Quorum;
(b) Prohibitions on the sale or sharing of Personal Information;
(c) Obligations to cooperate with consumer-rights requests, including requests to know, access, delete, correct, and limit the use of Sensitive Personal Information;
(d) De-identification requirements consistent with Section 6 of this DPA;
(e) Data-security standards consistent with the DSA, including, at a minimum, SOC 2 Type II certification or an equivalent independent security assessment;
(f) Confidentiality obligations with respect to Personal Information;
(g) Provisions for the return or destruction of Personal Information upon termination of the sub-processor engagement;
(h) Notification obligations with respect to data breaches or unauthorized access to Personal Information; and
(i) Audit rights permitting Quorum (and, upon reasonable request, Meridian) to verify the sub-processor's compliance with its data-protection obligations.
Quorum shall make copies of its sub-processor agreements (or, at a minimum, the data-protection provisions thereof) available to Meridian upon reasonable request.
8.3 Sub-processor Liability. Quorum shall remain fully liable to Meridian for the acts and omissions of its sub-processors with respect to the processing of Personal Information received from Meridian. The engagement of a sub-processor shall not relieve Quorum of any obligation under this DPA. If a sub-processor fails to fulfill its data-protection obligations, Quorum shall remain fully responsible for the performance of the sub-processor's obligations with respect to the Personal Information.
8.4 Meridian's Right to Object. Meridian shall have the right to object to Quorum's engagement of a specific sub-processor on reasonable data-protection grounds, including, without limitation, concerns regarding the sub-processor's data-security posture, regulatory compliance history, or adequacy of contractual data-protection commitments. Meridian shall communicate any objection to Quorum in writing within fifteen (15) calendar days of receipt of Quorum's notice under Section 8.1. Upon receipt of an objection from Meridian, Quorum shall use commercially reasonable efforts to address Meridian's concerns, which may include providing additional information regarding the sub-processor's security controls, modifying the scope of the sub-processor's access to Personal Information, or proposing an alternative sub-processor. If Meridian objects and the Parties cannot resolve the objection within thirty (30) calendar days of Meridian's written objection, either Party may escalate the dispute under the dispute-resolution provisions of the MDLA.
Drafting Note: The dispute-resolution mechanism for the MDLA remains unresolved. Quorum proposes exclusive jurisdiction in the United States District Court for the Southern District of New York or the Commercial Division of the Supreme Court of the State of New York, New York County. Meridian proposes binding arbitration under the Commercial Arbitration Rules of the American Arbitration Association, with a three-arbitrator panel, seated in New York, New York. This provision should be updated to reflect the agreed dispute-resolution mechanism upon finalization of the MDLA.
SECTION 9: DATA SECURITY
9.1 Cross-Reference to Data Security Addendum. The comprehensive data-security obligations of the Parties with respect to Personal Information processed under this DPA are set forth in the Data Security Addendum (the "DSA") to the MDLA. This Section 9 supplements the DSA with requirements that are specific to the Parties' obligations under CCPA/CPRA and does not limit or supersede the security obligations established in the DSA. In the event of any conflict or inconsistency between this Section 9 and the DSA, the provision imposing the more protective data-security obligation shall control.
9.2 Reasonable Security Measures. Each Party shall implement and maintain reasonable security procedures and practices appropriate to the nature of the Personal Information processed under this DPA, in order to protect Personal Information from unauthorized or illegal access, destruction, use, modification, or disclosure, as required by Cal. Civ. Code § 1798.100(e). Such reasonable security procedures and practices shall be consistent with, and shall not be less protective than, the security standards specified in the DSA, including the following:
(a) SOC 2 Type II Certification. Each Party shall maintain current SOC 2 Type II certification covering trust service criteria relevant to the processing of Personal Information under this DPA. As of the date hereof: (i) Quorum's SOC 2 Type II report was issued by Felton Thorpe & Co. LLP, covering the period ending December 31, 2023; and (ii) Meridian's SOC 2 Type II report was issued by Galloway Nash LLP, covering the period ending March 31, 2023;
(b) ISO 27001 Certification. Meridian maintains ISO 27001 certification for its information-security management system. Quorum shall maintain security controls consistent with ISO 27001 standards, whether or not Quorum holds formal ISO 27001 certification;
(c) Industry-Standard Controls. Both Parties shall implement and maintain industry-standard technical and organizational security measures, as further detailed in Schedule 2 to this DPA and in the DSA.
9.3 Data Breach Notification Under CCPA/CPRA. In addition to the forty-eight (48)-hour breach-notification obligation established in the DSA, each Party shall comply with the security-breach notification requirements of Cal. Civ. Code § 1798.82 et seq. and the private right of action provisions of Cal. Civ. Code § 1798.150 (providing consumers with a private right of action for unauthorized access and exfiltration, theft, or disclosure of nonencrypted or nonredacted personal information resulting from a business's violation of the duty to implement and maintain reasonable security procedures and practices). Quorum shall notify Meridian within forty-eight (48) hours of discovery of any security breach involving Personal Information received from Meridian, regardless of whether such breach triggers statutory notification obligations under Cal. Civ. Code § 1798.82. Such notification shall include, to the extent known at the time of notification: (a) a description of the nature of the breach; (b) the categories and approximate number of consumers affected; (c) the categories of Personal Information involved; (d) a description of the measures taken or proposed to be taken to address the breach; and (e) a description of the measures taken or proposed to be taken to mitigate possible adverse effects. Quorum shall cooperate with Meridian in investigating and remediating any such breach and in complying with applicable breach-notification laws and regulations.
9.4 Encryption. Personal Information received from Meridian shall be encrypted both in transit and at rest using industry-standard encryption protocols, as follows:
(a) Encryption at Rest: Personal Information stored by Quorum shall be encrypted using the Advanced Encryption Standard (AES) with a minimum key length of 256 bits (AES-256), or an equivalent or stronger encryption standard;
(b) Encryption in Transit: Personal Information transmitted between the Parties, or between Quorum and its sub-processors, shall be encrypted using Transport Layer Security (TLS) version 1.2 or higher, or an equivalent or stronger encryption protocol.
These encryption requirements are consistent with the requirements of the DSA and the NY DFS Cybersecurity Regulation, 23 NYCRR Part 500. Quorum shall review and update its encryption standards no less frequently than annually to ensure consistency with then-current industry standards and regulatory requirements.
SECTION 10: DATA RETENTION AND RETURN/DESTRUCTION
10.1 Retention During Term. During the term of the MDLA, Quorum may retain Personal Information received from Meridian only for so long as necessary to fulfill the Business Purposes specified in Schedule 1 to this DPA and in compliance with applicable law. Quorum shall implement and maintain a data-retention policy that specifies the retention periods applicable to each category of Personal Information processed under this DPA, and shall make such policy availab