USCC'S ELECTION: (A) RETURN TO USCC ALL OF THE PERSONALLY
IDENTIFIABLE INFORMATION TRANSFERRED BY USCC TO CONSULTANT AND THE COPIES
THEREOF; OR (B) CERTIFY TO USCC THAT CONSULTANT HAS TAKEN ALL REASONABLE STEPS
TO DESTROY, OR ARRANGE FOR THE PERMANENT DESTRUCTION OF, ALL THE PERSONALLY
IDENTIFIABLE INFORMATION PROVIDED PURSUANT TO THIS AGREEMENT BY (I) SHREDDING,
(II) ERASING, OR (III) OTHERWISE MODIFYING THE PERSONALLY IDENTIFIABLE
INFORMATION IN THOSE RECORDS TO MAKE IT UNREASONABLE OR UNDECIPHERABLE THROUGH
ANY MEANS. IF ANY APPLICABLE LAW PREVENTS OR PRECLUDES THE RETURN OR DESTRUCTION
OF ANY PERSONALLY IDENTIFIABLE INFORMATION UPON THE TERMINATION OF THE
PROCESSING OF PERSONALLY IDENTIFIABLE INFORMATION, CONSULTANT SHALL NOTIFY USCC
OF SUCH REASON AND SHALL NOT PROCESS SUCH PERSONALLY IDENTIFIABLE INFORMATION
THEREAFTER WITHOUT THE EXPRESS PRIOR WRITTEN CONSENT OF USCC.
10.10
Indemnification and Recoverable Damages
(a)
Subject to Sections 8.3 and 10.10(c), Consultant will indemnify,
defend and hold harmless USCC against third-party claims and/or amounts payable
under any judgment, verdict, court order, administrative fine, civil penalty or
settlement for any Data Security Breach involving Personally Identifiable
Information, provided to Consultant in the manner required in Section 10.1 above
by USCC, while such Personally Identifiable Information is in the possession,
custody or control of Consultant or if such Personally Identifiable Information
ceased to be in the possession, custody or control of Consultant as a result of
a Data Security Breach.
Page 25 of 66
***Information omitted and filed separately with the Securities and Exchange
Commission pursuant to a request for Confidential Treatment under Rule 24b-2
under the Securities Exchange Act of 1934, as amended.
(B)
ADDITIONALLY, SUBJECT TO SECTION 9.1 AND SECTION 10.10(C), IN
THE EVENT OF A DATA SECURITY BREACH INVOLVING PERSONALLY IDENTIFIABLE
INFORMATION, USCC WILL BE ENTITLED TO CLAIM FROM CONSULTANT DAMAGES IN THE
AMOUNT OF THE REASONABLE COSTS TO CONDUCT THE INVESTIGATION OF ANY DATA SECURITY
BREACH BY OUTSIDE PROFESSIONALS OF USCC'S CHOICE IN ITS SOLE DISCRETION,
NOTIFYING INDIVIDUALS AND OTHERS AS REQUIRED BY LAW OR THE PAYMENT CARD INDUSTRY
DATA SECURITY STANDARD, AND PROVIDING ANY AFFECTED INDIVIDUALS WITH UP TO TWO
YEARS OF CREDIT MONITORING.
(C)
NOTWITHSTANDING THE FOREGOING, CONSULTANT'S LIABILITY UNDER
SECTIONS 10.10(A) AND 10.10(B) ABOVE SHALL BE PROPORTIONATE TO THE RELATIVE
FAULT OF CONSULTANT FOR THE BREACHES, CLAIMS, DAMAGES AND/OR COSTS REFERENCED IN
THOSE SECTIONS (E.G., IF IT IS DETERMINED THAT A DATA SECURITY PROBLEM WAS
CAUSED EQUALLY BY CONSULTANT AND BY OTHER FACTORS NOT UNDER CONSULTANT'S
RESPONSIBILITY AND CONTROL, CONSULTANT WILL BE LIABLE FOR FIFTY PERCENT OF THE
DAMAGES AND COSTS ARISING FROM OR RELATED TO SUCH PROBLEM).
11.
GENERAL.
11.1
ASSIGNMENT.
NEITHER PARTY SHALL HAVE THE RIGHT TO ASSIGN OR
TRANSFER ITS RIGHTS OR OBLIGATIONS PURSUANT TO THIS AGREEMENT WITHOUT THE PRIOR
WRITTEN CONSENT OF THE OTHER PARTY, EXCEPT THAT EITHER PARTY MAY ASSIGN OR
TRANSFER THIS AGREEMENT: (A) TO A SUCCESSOR AS A RESULT OF A MERGER,
CONSOLIDATION, ACQUISITION, REORGANIZATION OR SALE OF ALL OR SUBSTANTIALLY ALL
OF SUCH PARTY'S ASSETS; OR (B) TO AN AFFILIATE.
NO SUCH ASSIGNMENT OR TRANSFER
SHALL HAVE THE