1.1 	A bill for an act
1.2 	relating to government data practices; providing for
1.3 	treatment of data held by the comprehensive
1.4 	incident-based reporting system; proposing coding for
1.5 	new law in Minnesota Statutes, chapter 299C.
1.6 	BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF MINNESOTA:

1.7 	Section 1. [299C.40] COMPREHENSIVE INCIDENT-BASED
1.8 	REPORTING SYSTEM.
1.9 		Subdivision 1.Definitions. (a) The definitions in this
1.10 	subdivision apply to this section.
1.11 	(b) "CIBRS" means the Comprehensive Incident-Based
1.12 	Reporting System, located in the Department of Public Safety and
1.13 	managed by the Bureau of Criminal Apprehension, Criminal Justice
1.14 	Information Systems Section.  A reference in this section to
1.15 	"CIBRS" includes the Bureau of Criminal Apprehension.
1.16 	(c) "Law enforcement agency" means a Minnesota municipal
1.17 	police department, a Minnesota county sheriff's department, the
1.18 	Bureau of Criminal Apprehension, or the Minnesota State Patrol.
1.19 		Subd. 2.Purpose. CIBRS is a statewide system containing
1.20 	data from law enforcement agencies.  Data in CIBRS must be made
1.21 	available to law enforcement agencies only for purposes of
1.22 	criminal investigations being conducted in order to prepare a
1.23 	case against a person, whether known or unknown, for the
1.24 	commission of a crime or other offense, or for purposes of
1.25 	background investigations required by state statute.
2.1 		Subd. 3.Data classification; general rule; changes in
2.2 	classification; audit trail. (a) The classification of data in
2.3 	the law enforcement agency does not change after the data is
2.4 	submitted to CIBRS.
2.5 	(b) Data on individuals created, collected, received,
2.6 	maintained, or disseminated by CIBRS is classified as
2.7 	confidential data on individuals as defined in section 13.02,
2.8 	subdivision 3, and becomes private data on individuals as
2.9 	defined in section 13.02, subdivision 12, as provided by this
2.10 	section.
2.11 	(c) Data not on individuals created, collected, received,
2.12 	maintained, or disseminated by CIBRS is classified as protected
2.13 	nonpublic data as defined in section 13.02, subdivision 13, and
2.14 	becomes nonpublic data as defined in section 13.02, subdivision
2.15 	9, as provided by this section.
2.16 	(d) Confidential or protected nonpublic data created,
2.17 	collected, received, maintained, or disseminated by CIBRS must
2.18 	automatically change classification from confidential data to
2.19 	private data or from protected nonpublic data to nonpublic data
2.20 	on the earlier of the following dates:
2.21 	(1) upon receipt by CIBRS of notice from a law enforcement
2.22 	agency that an investigation has become inactive; or 
2.23 	(2) when the data has not been updated by the law
2.24 	enforcement agency that submitted it for a period of 120 days.
2.25 	(e) For the purposes of this section, an investigation
2.26 	becomes inactive upon the occurrence of any of the events listed
2.27 	in section 13.82, subdivision 7, clauses (a) to (c).
2.28 	(f) Ten days before making a data classification change
2.29 	because data has not been updated, CIBRS must notify the law
2.30 	enforcement agency that submitted the data that a classification
2.31 	change will be made on the 120th day.  The notification must
2.32 	inform the law enforcement agency that the data will retain its
2.33 	classification as confidential or protected nonpublic data if
2.34 	the law enforcement agency updates the data or notifies CIBRS
2.35 	that the investigation is still active before the 120th day.  A
2.36 	new 120-day period begins if the data is updated or if a law
3.1 	enforcement agency notifies CIBRS that an active investigation
3.2 	is continuing.
3.3 	(g) A law enforcement agency that submits data to CIBRS
3.4 	must notify CIBRS if an investigation has become inactive so
3.5 	that the data is classified as private data or nonpublic data.
3.6 	The law enforcement agency must provide this notice to CIBRS
3.7 	within ten days after an investigation becomes inactive.
3.8 	(h) All queries and responses and all actions in which data
3.9 	is submitted to CIBRS, changes classification, or is
3.10 	disseminated by CIBRS to any law enforcement agency must be
3.11 	recorded in the CIBRS audit trail.
3.12 		Subd. 4.Access to cibrs data by law enforcement agency
3.13 	personnel. Only law enforcement agency personnel with
3.14 	certification from the Bureau of Criminal Apprehension may
3.15 	access CIBRS data.  Access to CIBRS data by particular law
3.16 	enforcement agency personnel may be limited through the use of
3.17 	purpose codes that correspond to the official duties and
3.18 	training level of the personnel.
3.19 		Subd. 5.Access to cibrs data by data subject. Upon
3.20 	request to the Bureau of Criminal Apprehension or to a law
3.21 	enforcement agency participating in CIBRS an individual shall be
3.22 	informed whether the individual is the subject of private or
3.23 	confidential data held by CIBRS.  An individual who is the
3.24 	subject of private data held by CIBRS may obtain access to the
3.25 	data by making a request to the Bureau of Criminal Apprehension
3.26 	or to a participating law enforcement agency.  Private data
3.27 	provided to the subject under this subdivision must also include
3.28 	the name of the law enforcement agency that submitted the data
3.29 	to CIBRS and the name, telephone number, and address of the
3.30 	responsible authority of that law enforcement agency.
3.31 		Subd. 6.Challenge to completeness and accuracy of data.
 3.32 	An individual who is the subject of public or private data held
3.33 	by CIBRS and who wants to challenge the completeness or accuracy
3.34 	of the data under section 13.04, subdivision 4, must notify in
3.35 	writing the responsible authority of the participating law
3.36 	enforcement agency.  A law enforcement agency must notify the
4.1 	Bureau of Criminal Apprehension when data held by CIBRS is
4.2 	challenged.  The notification must identify the data that was
4.3 	challenged and the subject of the data.  CIBRS must include any
4.4 	notification received under this paragraph whenever
4.5 	disseminating data about which no determination has been made.
4.6 	When the responsible authority of a law enforcement agency
4.7 	completes, corrects, or destroys successfully challenged data,
4.8 	the corrected data must be submitted to CIBRS and any future
4.9 	dissemination must be of the corrected data.