HF 1404

1st Engrossment - 92nd Legislature (2021 - 2022) Posted on 03/24/2022 06:43pm

A bill for an act
relating to data practices; modifying certain government data practices provisions;
classifying certain data; reestablishing the Legislative Commission on Data
Practices; requiring certifying entities to timely process visa certification documents;
amending Minnesota Statutes 2020, sections 13.32, subdivision 3; 13.7931, by
adding a subdivision; 13.824, subdivision 6; 13.825, subdivision 9; 13.856,
subdivision 3; 144.225, subdivision 7; proposing coding for new law in Minnesota
Statutes, chapters 3; 84; 611A.

BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF MINNESOTA:

Section 1.

new text begin [3.8844] LEGISLATIVE COMMISSION ON DATA PRACTICES.
new text end

new text begin Subdivision 1. new text end

new text begin Established. new text end

new text begin The Legislative Commission on Data Practices and Personal
Data Privacy is created to study issues relating to government data practices and individuals'
personal data privacy rights and to review legislation impacting data practices, data security,
and personal data privacy. The commission is a continuation of the commission that was
established by Laws 2014, chapter 193, as amended, and which expired June 30, 2019.
new text end

new text begin Subd. 2. new text end

new text begin Membership. new text end

new text begin The commission consists of four senators appointed by the senate
Subcommittee on Committees of the Committee on Rules and Administration, and four
members of the house of representatives appointed by the speaker. Two members from each
chamber must be from the majority party in that chamber and two members from each
chamber must be from the minority party in that chamber. Each appointing authority must
make appointments as soon as possible after the beginning of the regular legislative session
in the odd-numbered year. The ranking senator from the majority party appointed to the
commission must convene the first meeting of a biennium by February 15 in the
odd-numbered year. The commission may elect up to four former legislators who have
demonstrated an interest in, or have a history of working in, the areas of government data
practices and personal data privacy to serve as nonvoting members of the commission. The
former legislators must not be registered lobbyists and shall be compensated as provided
under section 15.0575, subdivision 3.
new text end

new text begin Subd. 3. new text end

new text begin Terms; vacancies. new text end

new text begin Members of the commission serve for terms beginning upon
appointment and ending at the beginning of the regular legislative session in the next
odd-numbered year. The appropriate appointing authority must fill a vacancy for a seat of
a current legislator for the remainder of the unexpired term.
new text end

new text begin Subd. 4. new text end

new text begin Officers. new text end

new text begin The commission must elect a chair and may elect other officers as it
determines are necessary. The chair alternates between a member of the senate and a member
of the house of representatives in January of each odd-numbered year.
new text end

new text begin Subd. 5. new text end

new text begin Staff. new text end

new text begin Legislative staff must provide administrative and research assistance to
the commission. The Legislative Coordinating Commission may, if funding is available,
appoint staff to provide research assistance.
new text end

new text begin Subd. 6. new text end

new text begin Duties. new text end

new text begin The commission shall:
new text end

new text begin (1) review and provide the legislature with research and analysis of emerging issues
relating to government data practices and security and privacy of personal data;
new text end

new text begin (2) review and make recommendations on legislative proposals relating to the Minnesota
Government Data Practices Act; and
new text end

new text begin (3) review and make recommendations on legislative proposals impacting personal data
privacy rights, data security, and other related issues.
new text end

new text begin EFFECTIVE DATE. new text end

new text begin This section is effective the day following final enactment. Initial
members of the commission serve for a term ending in January 2023. A member of the
house of representatives shall serve as the first chair of the commission. A member of the
senate shall serve as chair of the commission beginning in January 2023.
new text end

Sec. 2.

Minnesota Statutes 2020, section 13.32, subdivision 3, is amended to read:

Subd. 3.

Private data; when disclosure is permitted.

Except as provided in subdivision
5, educational data is private data on individuals and shall not be disclosed except as follows:

(a) pursuant to section 13.05;

(b) pursuant to a valid court order;

(c) pursuant to a statute specifically authorizing access to the private data;

(d) to disclose information in health, including mental health, and safety emergencies
pursuant to the provisions of United States Code, title 20, section 1232g(b)(1)(I) and Code
of Federal Regulations, title 34, section 99.36;

(e) pursuant to the provisions of United States Code, title 20, sections 1232g(b)(1),
(b)(4)(A), (b)(4)(B), (b)(1)(B), (b)(3), (b)(6), (b)(7), and (i), and Code of Federal Regulations,
title 34, sections 99.31, 99.32, 99.33, 99.34, 99.35, and 99.39;

(f) to appropriate health authorities to the extent necessary to administer immunization
programs and for bona fide epidemiologic investigations which the commissioner of health
determines are necessary to prevent disease or disability to individuals in the public
educational agency or institution in which the investigation is being conducted;

(g) when disclosure is required for institutions that participate in a program under title
IV of the Higher Education Act, United States Code, title 20, section 1092;

(h) to the appropriate school district officials to the extent necessary under subdivision
6, annually to indicate the extent and content of remedial instruction, including the results
of assessment testing and academic performance at a postsecondary institution during the
previous academic year by a student who graduated from a Minnesota school district within
two years before receiving the remedial instruction;

(i) to appropriate authorities as provided in United States Code, title 20, section
1232g(b)(1)(E)(ii), if the data concern the juvenile justice system and the ability of the
system to effectively serve, prior to adjudication, the student whose records are released;
provided that the authorities to whom the data are released submit a written request for the
data that certifies that the data will not be disclosed to any other person except as authorized
by law without the written consent of the parent of the student and the request and a record
of the release are maintained in the student's file;

(j) to volunteers who are determined to have a legitimate educational interest in the data
and who are conducting activities and events sponsored by or endorsed by the educational
agency or institution for students or former students;

(k) to provide student recruiting information, from educational data held by colleges
and universities, as required by and subject to Code of Federal Regulations, title 32, section
216;

(l) to the juvenile justice system if information about the behavior of a student who poses
a risk of harm is reasonably necessary to protect the health or safety of the student or other
individuals;

(m) with respect to Social Security numbers of students in the adult basic education
system, to Minnesota State Colleges and Universities and the Department of Employment
and Economic Development for the purpose and in the manner described in section 124D.52,
subdivision 7;

(n) to the commissioner of education for purposes of an assessment or investigation of
a report of alleged maltreatment of a student as mandated by chapter 260E. Upon request
by the commissioner of education, data that are relevant to a report of maltreatment and are
from charter school and school district investigations of alleged maltreatment of a student
must be disclosed to the commissioner, including, but not limited to, the following:

(1) information regarding the student alleged to have been maltreated;

(2) information regarding student and employee witnesses;

(3) information regarding the alleged perpetrator; and

(4) what corrective or protective action was taken, if any, by the school facility in response
to a report of maltreatment by an employee or agent of the school or school district;

(o) when the disclosure is of the final results of a disciplinary proceeding on a charge
of a crime of violence or nonforcible sex offense to the extent authorized under United
States Code, title 20, section 1232g(b)(6)(A) and (B) and Code of Federal Regulations, title
34, sections 99.31 (a)(13) and (14);

(p) when the disclosure is information provided to the institution under United States
Code, title 42, section 14071, concerning registered sex offenders to the extent authorized
under United States Code, title 20, section 1232g(b)(7); deleted text begin or
deleted text end

(q) when the disclosure is to a parent of a student at an institution of postsecondary
education regarding the student's violation of any federal, state, or local law or of any rule
or policy of the institution, governing the use or possession of alcohol or of a controlled
substance, to the extent authorized under United States Code, title 20, section 1232g(i), and
Code of Federal Regulations, title 34, section 99.31 (a)(15), and provided the institution
has an information release form signed by the student authorizing disclosure to a parent.
The institution must notify parents and students about the purpose and availability of the
information release forms. At a minimum, the institution must distribute the information
release forms at parent and student orientation meetings deleted text begin . deleted text end new text begin ; or
new text end

new text begin (r) with tribal nations about tribally enrolled or descendant students to the extent necessary
for the tribal nation and school district or charter school to support the educational attainment
of the student.
new text end

Sec. 3.

Minnesota Statutes 2020, section 13.7931, is amended by adding a subdivision to
read:

new text begin Subd. 1b. new text end

new text begin Data on individuals who are minors. new text end

new text begin Data on individuals who are minors
that are collected, created, received, maintained, or disseminated by the Department of
Natural Resources are classified under section 84.0873.
new text end

Sec. 4.

Minnesota Statutes 2020, section 13.824, subdivision 6, is amended to read:

Subd. 6.

Biennial audit.

(a) In addition to the log required under subdivision 5, the law
enforcement agency must maintain records showing the date and time automated license
plate reader data were collected and the applicable classification of the data. The law
enforcement agency shall arrange for an independent, biennial audit of the records to
determine whether data currently in the records are classified, how the data are used, whether
they are destroyed as required under this section, and to verify compliance with subdivision
7. If the commissioner of administration believes that a law enforcement agency is not
complying with this section or other applicable law, the commissioner may order a law
enforcement agency to arrange for additional independent audits. Data in the records required
under this paragraph are classified as provided in subdivision 2.

(b) The results of the audit are public. The commissioner of administration shall review
the results of the audit. If the commissioner determines that there is a pattern of substantial
noncompliance with this section by the law enforcement agency, the agency must
immediately suspend operation of all automated license plate reader devices until the
commissioner has authorized the agency to reinstate their use. An order of suspension under
this paragraph may be issued by the commissioner, upon review of the results of the audit,
review of the applicable provisions of this chapter, and after providing the agency a
reasonable opportunity to respond to the audit's findings.

(c) A report summarizing the results of each audit must be provided to the commissioner
of administration, to the deleted text begin chair deleted text end new text begin chairs new text end and ranking minority members of the committees of
the house of representatives and the senate with jurisdiction over data practices and public
safety issues, and to the Legislative Commission on Data Practices and Personal Data Privacy
no later than 30 days following completion of the audit.

new text begin EFFECTIVE DATE. new text end

new text begin This section is effective the day following final enactment.
new text end

Sec. 5.

Minnesota Statutes 2020, section 13.825, subdivision 9, is amended to read:

Subd. 9.

Biennial audit.

(a) A law enforcement agency must maintain records showing
the date and time portable recording system data were collected and the applicable
classification of the data. The law enforcement agency shall arrange for an independent,
biennial audit of the data to determine whether data are appropriately classified according
to this section, how the data are used, and whether the data are destroyed as required under
this section, and to verify compliance with subdivisions 7 and 8. If the governing body with
jurisdiction over the budget of the agency determines that the agency is not complying with
this section or other applicable law, the governing body may order additional independent
audits. Data in the records required under this paragraph are classified as provided in
subdivision 2.

(b) The results of the audit are public, except for data that are otherwise classified under
law. The governing body with jurisdiction over the budget of the law enforcement agency
shall review the results of the audit. If the governing body determines that there is a pattern
of substantial noncompliance with this section, the governing body must order that operation
of all portable recording systems be suspended until the governing body has authorized the
agency to reinstate their use. An order of suspension under this paragraph may only be made
following review of the results of the audit and review of the applicable provisions of this
chapter, and after providing the agency and members of the public a reasonable opportunity
to respond to the audit's findings in a public meeting.

(c) A report summarizing the results of each audit must be provided to the governing
body with jurisdiction over the budget of the law enforcement agency deleted text begin and deleted text end new text begin , new text end to the Legislative
Commission on Data Practices and Personal Data Privacy new text begin , and to the chairs and ranking
minority members of the committees of the house of representatives and the senate with
jurisdiction over data practices and public safety issues new text end no later than 60 days following
completion of the audit.

new text begin EFFECTIVE DATE. new text end

new text begin This section is effective the day following final enactment.
new text end

Sec. 6.

Minnesota Statutes 2020, section 13.856, subdivision 3, is amended to read:

Subd. 3.

Public data.

The following new text begin closed case new text end data maintained by the ombudsperson
are classified as public data pursuant to section 13.02, subdivision 15:

(1) client name;

(2) client location; and

(3) the inmate identification number assigned by the Department of Corrections.

Sec. 7.

new text begin [84.0873] DATA ON INDIVIDUALS WHO ARE MINORS.
new text end

new text begin (a) When the Department of Natural Resources collects, creates, receives, maintains, or
disseminates the following data on individuals who the department knows are minors, the
data are considered private data on individuals, as defined in section 13.02, subdivision 12,
except for data classified as public data according to section 13.43:
new text end

new text begin (1) name;
new text end

new text begin (2) date of birth;
new text end

new text begin (3) Social Security number;
new text end

new text begin (4) telephone number;
new text end

new text begin (5) e-mail address;
new text end

new text begin (6) physical or mailing address;
new text end

new text begin (7) location data;
new text end

new text begin (8) online account access information;
new text end

new text begin (9) data associated with the location of electronic devices; and
new text end

new text begin (10) other data that would identify participants who have registered for events, programs,
or classes sponsored by the Department of Natural Resources.
new text end

new text begin (b) Data about minors classified under this section maintain their classification as private
data on individuals after the individual is no longer a minor.
new text end

Sec. 8.

Minnesota Statutes 2020, section 144.225, subdivision 7, is amended to read:

Subd. 7.

Certified birth or death record.

(a) The state registrar or local issuance office
shall issue a certified birth or death record or a statement of no vital record found to an
individual upon the individual's proper completion of an attestation provided by the
commissioner and payment of the required fee:

(1) to a person who deleted text begin has a tangible interest in the requested vital record. A person who
has a tangible interest deleted text end is:

(i) the subject of the vital record;

(ii) a child of the subject;

(iii) the spouse of the subject;

(iv) a parent of the subject;

(v) the grandparent or grandchild of the subject;

(vi) if the requested record is a death record, a sibling of the subject;

deleted text begin (vii) the party responsible for filing the vital record;
deleted text end

deleted text begin (viii) deleted text end new text begin (vii) new text end the legal custodian, guardian or conservator, or health care agent of the subject;

deleted text begin (ix) deleted text end new text begin (viii) new text end a personal representative, by sworn affidavit of the fact that the certified copy
is required for administration of the estate;

deleted text begin (x) deleted text end new text begin (ix) new text end a successor of the subject, as defined in section 524.1-201, if the subject is
deceased, by sworn affidavit of the fact that the certified copy is required for administration
of the estate;

deleted text begin (xi) deleted text end new text begin (x) new text end if the requested record is a death record, a trustee of a trust by sworn affidavit
of the fact that the certified copy is needed for the proper administration of the trust;

deleted text begin (xii) deleted text end new text begin (xi) new text end a person or entity who demonstrates that a certified vital record is necessary
for the determination or protection of a personal or property right, pursuant to rules adopted
by the commissioner; or

deleted text begin (xiii) deleted text end new text begin (xii) new text end an adoption agency in order to complete confidential postadoption searches
as required by section 259.83;

(2) to any local, state, tribal, or federal governmental agency upon request if the certified
vital record is necessary for the governmental agency to perform its authorized duties;

(3) to an attorney new text begin representing the subject of the vital record or another person listed in
clause (1), new text end upon evidence of the attorney's license;

(4) pursuant to a court order issued by a court of competent jurisdiction. For purposes
of this section, a subpoena does not constitute a court order; or

(5) to a representative authorized by a person under clauses (1) to (4).

(b) The state registrar or local issuance office shall also issue a certified death record to
an individual described in paragraph (a), clause (1), items (ii) to deleted text begin (viii) deleted text end new text begin (xi) new text end , if, on behalf of
the individual, a licensed mortician furnishes the registrar with a properly completed
attestation in the form provided by the commissioner within 180 days of the time of death
of the subject of the death record. This paragraph is not subject to the requirements specified
in Minnesota Rules, part 4601.2600, subpart 5, item B.

Sec. 9.

new text begin [611A.95] CERTIFICATIONS FOR VICTIMS OF CRIMES.
new text end

new text begin Subdivision 1. new text end

new text begin Definitions. new text end

new text begin For purposes of this section, the following terms have the
meanings given:
new text end

new text begin (1) "certifying entity" means a state or local law enforcement agency;
new text end

new text begin (2) "criminal activity" means qualifying criminal activity pursuant to section
101(a)(15)(U)(iii) of the Immigration and Nationality Act, and includes the attempt,
conspiracy, or solicitation to commit such crimes; and
new text end

new text begin (3) "certification" means any certification or statement required by federal immigration
law including but not limited to the information required by United States Code, title 8,
section 1184(p), and United States Code, title 8, section 1184(o), including current United
States Citizenship and Immigration Services Form I-918, Supplement B, and United States
Citizenship and Immigration Services Form I-914, Supplement B, and any successor forms.
new text end

new text begin Subd. 2. new text end

new text begin Certification process. new text end

new text begin (a) A certifying entity shall process a certification
requested by a victim of criminal activity or a representative of the victim, including but
not limited to the victim's attorney, family member, or domestic violence or sexual assault
violence advocate, within the time period prescribed in paragraph (b).
new text end

new text begin (b) A certifying entity shall process the certification within 90 days of request, unless
the victim is in removal proceedings, in which case the certification shall be processed
within 14 days of the request. Requests for expedited certification must be affirmatively
raised at the time of the request.
new text end

new text begin (c) An active investigation, the filing of charges, or a prosecution or conviction are not
required for the victim of criminal activity to request and obtain the certification.
new text end

new text begin Subd. 3. new text end

new text begin Certifying entity; designate agent. new text end

new text begin (a) The head of a certifying entity shall
designate an agent to perform the following responsibilities:
new text end

new text begin (1) timely process requests for certification;
new text end

new text begin (2) provide outreach to victims of criminal activity to inform them of the entity's
certification process; and
new text end

new text begin (3) keep a written or electronic record of all certification requests and responses.
new text end

new text begin (b) All certifying entities shall implement a language access protocol for
non-English-speaking victims of criminal activity.
new text end

new text begin Subd. 4. new text end

new text begin Disclosure prohibited; data classification. new text end

new text begin (a) A certifying entity is prohibited
from disclosing the immigration status of a victim of criminal activity or a representative
requesting the certification, except to comply with federal law or legal process, or if
authorized by the victim of criminal activity or the representative requesting the certification.
new text end

new text begin (b) Data provided to a certifying entity under this section is classified as private data
pursuant to section 13.02, subdivision 12.
new text end

new text begin EFFECTIVE DATE. new text end

new text begin Subdivisions 1, 2, and 4 are effective the day following final
enactment. Subdivision 3 is effective July 1, 2021.
new text end

Sec. 10. new text begin INITIAL APPOINTMENTS AND MEETINGS.
new text end

new text begin Appointing authorities for the Legislative Commission on Data Practices under Minnesota
Statutes, section 3.8844, must make initial appointments by June 1, 2021. The speaker of
the house must designate one member of the commission to convene the first meeting of
the commission by June 15, 2021.
new text end