Section 19-11-107 - Data company - Definitions(a) As used in this section:(1) "Contractor" means a person having a public contract with a public entity for storage services or software services;(2) "Data" means recorded information, regardless of form or characteristic;(3) "Data company" means a contractor that provides software and stores data for a public entity or provides storage services for a public entity;(4) "Entity of the state" means any department, institution of higher education, board, commission, agency, quasi-public organization, official, office, or employee, or any agency, instrumentality, or function thereof;(5) "Political subdivision of the state" means any county, municipality, quasi-public organization, district, official, office, or employee, or any agency, instrumentality, or function thereof;(6)(A) "Public contract" means an agreement for the purchase of commodities and services by a public entity.(B) "Public contract" includes supplemental agreements;(7) "Public entity" means an entity of the state or a political subdivision of the state or a school;(8) "School" means any public school district, charter school, or education service cooperative, or any publicly supported entity having supervision over public educational entities; and(9) "Storage services" means the storage of data of a public entity.(b)(1) Data that is stored by a data company for a public entity is the property of the public entity.(2) A data company shall not sell, disclose, or otherwise use the data that is stored for any other purpose without express authorization from the public entity unless the data is:(B) Released in the public domain by the public entity.(3) A data company shall comply with the Arkansas Information Systems Act of 1997, § 25-4-101 et seq.(c)(1) Upon the expiration or termination of a public contract, a data company shall return all data to the public entity in the format specified in the public contract and in a secure manner.(2)(A) If the public contract does not specify a format for return of the data, as an express term of the public contract, the data company shall return all data to the public entity in a secure common data format specified by the public entity in writing and delivered to the data company within thirty (30) days after the expiration or termination of the public contract.(B) Notwithstanding the requirement of a public entity to specify in writing the secure common data format for return of the data and to deliver the data in that format to a data company under subdivision (c)(2)(A) of this section, a data company shall return all data to a public entity in a usable format within sixty (60) days after the expiration or termination of a public contract unless there is a contractual agreement that specifies what data can be kept, how long the data can be kept, and the purposes for which the data can be used by the data company.(d)(1) A data company shall provide for the destruction of data still in its possession in a secure manner such that data cannot be reconstructed with backups or duplicate copies of data.(2) The data company shall provide a certificate of destruction and describe the methods used for destruction.(3) Destruction of the data shall be effected:(A) Upon written approval by the public entity that acknowledges destruction of the data; and(B) No later than six (6) months after the expiration or termination of the public contract.(e) This section does not prevent a public entity and a data company from negotiating a public contract to determine the type of data format that is acceptable for transferring data from a data company or from negotiating a public contract that expressly contemplates alternate terms with regard to data return or data destruction, which alternate terms shall prevail over this section.Added by Act 2021, No. 763,§ 1, eff. 7/28/2021.