Minnesota Legislature
HF 1648
as introduced - 91st Legislature (2019 - 2020) Posted on 02/25/2019 02:52pm
Bill Text Versions
| Engrossments | ||
|---|---|---|
| Introduction | Posted on 02/25/2019 |
Current Version - as introduced
1.8 1.9 1.10 1.11 1.12 1.13 1.14 1.15 1.16 1.17 1.18
1.19 1.20 1.21 1.22 1.23 2.1 2.2 2.3 2.4 2.5 2.6 2.7 2.8 2.9 2.10 2.11
2.12 2.13 2.14 2.15 2.16 2.17 2.18 2.19 2.20 2.21 2.22 2.23 2.24 2.25 2.26 2.27 2.28 2.29 2.30 3.1 3.2 3.3 3.4 3.5 3.6 3.7 3.8
3.9 3.10 3.11 3.12 3.13 3.14 3.15 3.16 3.17 3.18 3.19 3.20 3.21 3.22 3.23 3.24 3.25 3.26 3.27 3.28 3.29 3.30 3.31 3.32
3.33
A bill for an act
relating to motor vehicles; amending bulk vehicle record requirements and
procedures; requiring annual reports by commissioner of public safety and
legislative auditor; requiring notice of disclosure of private data; amending
Minnesota Statutes 2018, sections 168.327, subdivisions 5, 6, by adding a
subdivision; 168.346, subdivision 3.
BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF MINNESOTA:
Section 1.
Minnesota Statutes 2018, section 168.327, subdivision 5, is amended to read:
Subd. 5.
Bulk vehicle records requests.
(a) "Bulk vehicle records" in this section is a
total of 1,000 or more vehicle title records and vehicle registration records.
(b) The commissioner shall establish a fee that does not exceed $0.01 per record for a
request of bulk vehicle records.
(c) Of the fees collected, 40 percent deleted text begin must be credited to the vehicle services operating
account in the special revenue fund under section 299A.705 anddeleted text end is appropriated to the
deleted text begin commissioner for the purposes in this subdivision, and 60 percent must be credited to the
data security account in the special revenue fund under section 3.9741, subdivision 5deleted text end new text begin
legislative auditor for the report required by subdivision 7, and 60 percent is deposited in
the general fundnew text end .
Sec. 2.
Minnesota Statutes 2018, section 168.327, subdivision 6, is amended to read:
Subd. 6.
Review and audit of purchases of bulk driver and motor vehicle records.
new text begin (a)
new text end Each subscriber and each requester of bulk vehicle records shall new text begin annually new text end engage an
independent professional organization to auditnew text begin , for the previous calendar year,new text end its uses of
bulk data and its information technology security procedures, including the methods and
practices employed in the processing and use of driver and vehicle services data. deleted text begin Within 30
days of the date of the audit reportdeleted text end new text begin The organization that conducts the audit must conclude
whether the subscriber or requester has effectively implemented security controls over
processing and use of driver and vehicle services data consistent with controls recommended
by the National Institute of Standards and Technology or substantially similar best practice
controls. By February 1 of each yearnew text end , each subscriber and requester must submit deleted text begin eachdeleted text end new text begin the
annual audit new text end report to the legislative auditor and the commissioner.
new text begin
(b) If a subscriber or requester of bulk vehicle records fails to submit an annual audit
report as required in this subdivision, the commissioner must not provide any additional
bulk vehicle records to the subscriber or requester until the subscriber or requester submits
an annual audit report.
new text end
Sec. 3.
Minnesota Statutes 2018, section 168.327, is amended by adding a subdivision to
read:
new text begin Subd. 7. new text end
new text begin Annual reports. new text end
new text begin
(a) By March 1 of each year, the commissioner must report
to the chairs and ranking minority members of the legislative committees with jurisdiction
over transportation on the following:
new text end
new text begin
(1) the name of each entity that purchased bulk vehicle records, as provided in subdivision
5, from the commissioner for the past fiscal year;
new text end
new text begin
(2) whether each entity submitted the annual report required by subdivision 6 and the
date the report was submitted;
new text end
new text begin
(3) a summary of the annual audit report required by subdivision 6, including, at a
minimum, all conclusions or recommendations relating to the vendor's use of the data and
the vendor's information technology security procedures; and
new text end
new text begin
(4) any recommendations to the legislature on how to improve the security or handling
of bulk data vehicle records transfers.
new text end
new text begin
(b) By March 1 of each year, the legislative auditor must report to the chairs and ranking
minority members of the legislative committees with jurisdiction over transportation on the
following:
new text end
new text begin
(1) the name of each entity that submitted the annual report required by subdivision 6,
including the date the report was submitted;
new text end
new text begin
(2) a summary of each annual audit report submitted pursuant to subdivision 6, including,
at a minimum, all conclusions or recommendations relating to the vendor's use of the data
and the vendor's information technology security procedures;
new text end
new text begin
(3) an evaluation of the annual audit report submitted pursuant to subdivision 6, including
whether the audit was conducted by a qualified organization and whether the audit addressed
all necessary aspects of the vendor's acceptance and use of the data; and
new text end
new text begin
(4) any recommendations to the commissioner or legislature on how to improve the
security or handling of bulk data vehicle records transfers.
new text end
Sec. 4.
Minnesota Statutes 2018, section 168.346, subdivision 3, is amended to read:
Subd. 3.
Privacy classification for personal safety.
new text begin (a) new text end The registered owner of a vehicle
who is an individual may request, in writing, that the registered owner's residence address
or name and residence address be classified as "private data on individuals," as defined in
section 13.02, subdivision 12. The commissioner shall grant the classification on receipt of
a signed statement by the registered owner that the classification is required for the safety
of the registered owner or the registered owner's family, if the statement also provides a
valid, existing address where the registered owner consents to receive service of process.
The commissioner shall use the service of process mailing address in place of the registered
owner's residence address in all documents and notices pertaining to the vehicle. The
residence address or name and residence address and any information provided in the
classification request, other than the individual's service for process mailing address, are
private data on individuals but may be provided to requesting law enforcement agencies,
probation and parole agencies, and public authorities, as defined in section 518A.26,
subdivision 18.
new text begin
(b) If the commissioner discloses the name or residence address that is classified as
private data pursuant to paragraph (a), the commissioner must, upon discovery of the
disclosure, immediately notify the individual that is the subject of the data of the disclosure.
Within seven days of the discovery of the disclosure, the commissioner must notify the
recipient of the data of the disclosure and request that the recipient delete or remove the
private data from the recipient's system. Within seven days of the discovery of the disclosure,
the commissioner must notify the chairs and ranking minority members of the legislative
committees with jurisdiction over transportation that private data was disclosed and the
name of the recipient of the data. All notices required by this paragraph must be in writing.
new text end
new text begin EFFECTIVE DATE. new text end
new text begin
This section is effective the day following final enactment.
new text end