<a id="pl.1.3"></a><var>1.3</var>unauthorized access to data by a public employee; amending Minnesota Statutes <br/>
<a id="pl.1.4"></a><var>1.4</var>2012, sections 13.04, subdivision 3; 13.05, subdivision 5; 13.055; 13.09.<br/>
<a id="pl.1.5"></a><var>1.5</var>BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF MINNESOTA:<br/>
<br/>
<a id="bill.0.1.0"></a><a id="pl.1.6"></a><var>1.6</var>    Section 1. Minnesota Statutes 2012, section 13.04, subdivision 3, is amended to read:<br/>
<a id="pl.1.7"></a><var>1.7</var>    Subd. 3. <b>Access to data by individual.</b> (a) Upon request to a responsible authority <br/>
<a id="pl.1.8"></a><var>1.8</var>or designee, an individual shall be informed whether the individual is the subject of <br/>
<a id="pl.1.9"></a><var>1.9</var>stored data on individuals, and whether it is classified as public, private or confidential. <br/>
<a id="pl.1.10"></a><var>1.10</var>Upon further request, an individual who is the subject of stored private or public data <br/>
<a id="pl.1.11"></a><var>1.11</var>on individuals shall be shown the data without any charge and, if desired, shall be <br/>
<a id="pl.1.12"></a><var>1.12</var>informed of the content and meaning of that data. After an individual has been shown <br/>
<a id="pl.1.13"></a><var>1.13</var>the private data and informed of its meaning, the data need not be disclosed to that <br/>
<a id="pl.1.14"></a><var>1.14</var>individual for six months thereafter unless a dispute or action pursuant to this section is <br/>
<a id="pl.1.15"></a><var>1.15</var>pending or additional data on the individual has been collected or created. The responsible <br/>
<a id="pl.1.16"></a><var>1.16</var>authority or designee shall provide copies of the private or public data upon request by <br/>
<a id="pl.1.17"></a><var>1.17</var>the individual subject of the data. The responsible authority or designee may require the <br/>
<a id="pl.1.18"></a><var>1.18</var>requesting person to pay the actual costs of making and certifying the copies.<br/>
<a id="pl.1.19"></a><var>1.19</var>(b) Notwithstanding section 13.15 or 13.43, or other law to the contrary, upon request, <br/>
<a id="pl.1.20"></a><var>1.20</var>to the extent the data are maintained by the government entity, an individual has access to <br/>
<a id="pl.1.21"></a><var>1.21</var>the name of persons who have obtained access to private data on the individual, unless the <br/>
<a id="pl.1.22"></a><var>1.22</var>data would identify an undercover law enforcement officer or are active investigative data.<br/>
<a id="pl.2.1"></a><var>2.1</var>    (c) The responsible authority or designee shall comply immediately, if possible, with <br/>
<a id="pl.2.2"></a><var>2.2</var>any request made pursuant to this subdivision, or within ten days of the date of the request, <br/>
<a id="pl.2.3"></a><var>2.3</var>excluding Saturdays, Sundays and legal holidays, if immediate compliance is not possible.<br/>
<br/>
<a id="bill.0.2.0"></a><a id="pl.2.4"></a><var>2.4</var>    Sec. 2. Minnesota Statutes 2012, section 13.05, subdivision 5, is amended to read:<br/>
<a id="pl.2.5"></a><var>2.5</var>    Subd. 5. <b>Data protection.</b> (a) The responsible authority shall:<br/>
<a id="pl.2.6"></a><var>2.6</var> (1) establish procedures to assure that all data on individuals is accurate, complete, <br/>
<a id="pl.2.7"></a><var>2.7</var>and current for the purposes for which it was collected; and<br/>
<a id="pl.2.8"></a><var>2.8</var> (2) establish appropriate security safeguards for all records containing data on <br/>
<a id="pl.2.9"></a><var>2.9</var>individuals, including procedures for ensuring that data that are not public are only <br/>
<a id="pl.2.10"></a><var>2.10</var>accessible to persons whose work assignment reasonably requires access to the data, and <br/>
<a id="pl.2.11"></a><var>2.11</var>is only being accessed by those persons for purposes described in the procedure; and<br/>
<a id="pl.2.12"></a><var>2.12</var>(3) develop a policy incorporating these procedures, which may include a model <br/>
<a id="pl.2.13"></a><var>2.13</var>policy governing access to the data if sharing of the data with other government entities is <br/>
<a id="pl.2.14"></a><var>2.14</var>authorized by law.<br/>
<a id="pl.2.15"></a><var>2.15</var>(b) When not public data is being disposed of, the data must be destroyed in a way <br/>
<a id="pl.2.16"></a><var>2.16</var>that prevents its contents from being determined.<br/>
<br/>
<a id="bill.0.3.0"></a><a id="pl.2.17"></a><var>2.17</var>    Sec. 3. Minnesota Statutes 2012, section 13.055, is amended to read:<br/>
<a id="pl.2.18"></a><var>2.18</var><b>13.055 </b><b>STATE AGENCIES;</b><b> DISCLOSURE OF BREACH IN SECURITY</b><b>; </b><br/>
<a id="pl.2.19"></a><var>2.19</var><b>NOTIFICATION AND INVESTIGATION REPORT REQUIRED</b><b>.</b><br/>
<a id="pl.2.20"></a><var>2.20</var>    Subdivision 1. <b>Definitions.</b> For purposes of this section, the following terms have <br/>
<a id="pl.2.21"></a><var>2.21</var>the meanings given to them.<br/>
<a id="pl.2.22"></a><var>2.22</var>(a) "Breach of the security of the data" means unauthorized acquisition of or access <br/>
<a id="pl.2.23"></a><var>2.23</var>to data maintained by a state agency government entity that compromises the security and <br/>
<a id="pl.2.24"></a><var>2.24</var>classification of the data. Good faith acquisition of or access to government data by an <br/>
<a id="pl.2.25"></a><var>2.25</var>employee, contractor, or agent of a state agency government entity for the purposes of <br/>
<a id="pl.2.26"></a><var>2.26</var>the state agency entity is not a breach of the security of the data, if the government data <br/>
<a id="pl.2.27"></a><var>2.27</var>is not provided to or viewable by an unauthorized person, or accessed for a purpose not <br/>
<a id="pl.2.28"></a><var>2.28</var>described in the procedures required by section 13.05, subdivision 5. For purposes of this <br/>
<a id="pl.2.29"></a><var>2.29</var>paragraph, data maintained by a government entity includes data maintained by a person <br/>
<a id="pl.2.30"></a><var>2.30</var>under a contract with the government entity that provides for the acquisition of or access <br/>
<a id="pl.2.31"></a><var>2.31</var>to the data by an employee, contractor, or agent of the government entity.<br/>
<a id="pl.2.32"></a><var>2.32</var>(b) "Contact information" means either name and mailing address or name and <br/>
<a id="pl.2.33"></a><var>2.33</var>e-mail address for each individual who is the subject of data maintained by the state <br/>
<a id="pl.2.34"></a><var>2.34</var>agency government entity.<br/>
<a id="pl.3.1"></a><var>3.1</var>(c) "Unauthorized acquisition" means that a person has obtained or viewed<br/>
<a id="pl.3.2"></a><var>3.2</var> government data without the informed consent of the individuals who are the subjects of the <br/>
<a id="pl.3.3"></a><var>3.3</var>data or statutory authority and with the intent to use the data for nongovernmental purposes.<br/>
<a id="pl.3.4"></a><var>3.4</var>(d) "Unauthorized person" means any person who accesses government data without <br/>
<a id="pl.3.5"></a><var>3.5</var>permission or without a work assignment that reasonably requires the person to have<br/>
<a id="pl.3.6"></a><var>3.6</var> access to the data, or regardless of the person's work assignment, for a purpose not <br/>
<a id="pl.3.7"></a><var>3.7</var>described in the procedures required by section 13.05, subdivision 5.<br/>
<a id="pl.3.8"></a><var>3.8</var>    Subd. 2. <b>Notice to individuals</b><b>; investigation report</b><b>.</b> (a) A state agency<br/>
<a id="pl.3.9"></a><var>3.9</var> government entity that collects, creates, receives, maintains, or disseminates private or <br/>
<a id="pl.3.10"></a><var>3.10</var>confidential data on individuals must disclose any breach of the security of the data <br/>
<a id="pl.3.11"></a><var>3.11</var>following discovery or notification of the breach. Written notification must be made to <br/>
<a id="pl.3.12"></a><var>3.12</var>any individual who is the subject of the data and whose private or confidential data was, or <br/>
<a id="pl.3.13"></a><var>3.13</var>is reasonably believed to have been, acquired by an unauthorized person and must inform <br/>
<a id="pl.3.14"></a><var>3.14</var>the individual that a report will be prepared under paragraph (b), how the individual may <br/>
<a id="pl.3.15"></a><var>3.15</var>obtain access to the report, and that the individual may request delivery of the report by <br/>
<a id="pl.3.16"></a><var>3.16</var>mail or e-mail. The disclosure must be made in the most expedient time possible and <br/>
<a id="pl.3.17"></a><var>3.17</var>without unreasonable delay, consistent with (1) the legitimate needs of a law enforcement <br/>
<a id="pl.3.18"></a><var>3.18</var>agency as provided in subdivision 3; or (2) any measures necessary to determine the scope <br/>
<a id="pl.3.19"></a><var>3.19</var>of the breach and restore the reasonable security of the data.<br/>
<a id="pl.3.20"></a><var>3.20</var>(b) Upon completion of an investigation into any breach in the security of data, the <br/>
<a id="pl.3.21"></a><var>3.21</var>responsible authority shall prepare a report on the facts and results of the investigation. <br/>
<a id="pl.3.22"></a><var>3.22</var>If the breach involves unauthorized access to or acquisition of data by an employee, <br/>
<a id="pl.3.23"></a><var>3.23</var>contractor, or agent of the government entity, the report must at a minimum include:<br/>
<a id="pl.3.24"></a><var>3.24</var>(1) a description of the data that were accessed or acquired;<br/>
<a id="pl.3.25"></a><var>3.25</var>(2) the number of individuals whose data was improperly accessed or acquired; <br/>
<a id="pl.3.26"></a><var>3.26</var>(3) if there has been final disposition of disciplinary action for purposes of section <br/>
<a id="pl.3.27"></a><var>3.27</var>13.43, the name of each employee determined to be responsible for the unauthorized <br/>
<a id="pl.3.28"></a><var>3.28</var>access or acquisition;<br/>
<a id="pl.3.29"></a><var>3.29</var>(4) the final disposition of any disciplinary action taken against each employee in <br/>
<a id="pl.3.30"></a><var>3.30</var>response; and<br/>
<a id="pl.3.31"></a><var>3.31</var>(5) if disciplinary action was determined to be unnecessary, the specific findings and <br/>
<a id="pl.3.32"></a><var>3.32</var>reasons for that determination.<br/>
<a id="pl.3.33"></a><var>3.33</var>The report must not include data that are not public under other law. The report is <br/>
<a id="pl.3.34"></a><var>3.34</var>public and must be posted on the government entity's Web site, if the government entity <br/>
<a id="pl.3.35"></a><var>3.35</var>maintains a Web site, and provided to an individual who received the notification under <br/>
<a id="pl.3.36"></a><var>3.36</var>paragraph (a) and requested delivery of the report. If the government entity does not <br/>
<a id="pl.4.1"></a><var>4.1</var>maintain a Web site, the report must be posted on the principal bulletin board of the <br/>
<a id="pl.4.2"></a><var>4.2</var>government entity, or if the government entity does not have a principal bulletin board, on <br/>
<a id="pl.4.3"></a><var>4.3</var>the door of its usual meeting room. <br/>
<a id="pl.4.4"></a><var>4.4</var>    Subd. 3. <b>Delayed notice.</b> The notification required by this section may be delayed if <br/>
<a id="pl.4.5"></a><var>4.5</var>a law enforcement agency determines that the notification will impede an active criminal <br/>
<a id="pl.4.6"></a><var>4.6</var>investigation. The notification required by this section must be made after the law <br/>
<a id="pl.4.7"></a><var>4.7</var>enforcement agency determines that it will not compromise the investigation.<br/>
<a id="pl.4.8"></a><var>4.8</var>    Subd. 4. <b>Method of notice.</b> Notice under this section may be provided by one of <br/>
<a id="pl.4.9"></a><var>4.9</var>the following methods:<br/>
<a id="pl.4.10"></a><var>4.10</var>(a) written notice by first class mail to each affected individual;<br/>
<a id="pl.4.11"></a><var>4.11</var>(b) electronic notice to each affected individual, if the notice provided is consistent <br/>
<a id="pl.4.12"></a><var>4.12</var>with the provisions regarding electronic records and signatures as set forth in United <br/>
<a id="pl.4.13"></a><var>4.13</var>States Code, title 15, section 7001; or<br/>
<a id="pl.4.14"></a><var>4.14</var>(c) substitute notice, if the state agency government entity demonstrates that the cost <br/>
<a id="pl.4.15"></a><var>4.15</var>of providing the written notice required by paragraph (a) would exceed $250,000, or <br/>
<a id="pl.4.16"></a><var>4.16</var>that the affected class of individuals to be notified exceeds 500,000, or the state agency<br/>
<a id="pl.4.17"></a><var>4.17</var> government entity does not have sufficient contact information. Substitute notice consists <br/>
<a id="pl.4.18"></a><var>4.18</var>of all of the following:<br/>
<a id="pl.4.19"></a><var>4.19</var>(i) e-mail notice if the state agency government entity has an e-mail address for <br/>
<a id="pl.4.20"></a><var>4.20</var>the affected individuals;<br/>
<a id="pl.4.21"></a><var>4.21</var>(ii) conspicuous posting of the notice on the Web site page of the state agency<br/>
<a id="pl.4.22"></a><var>4.22</var> government entity, if the state agency government entity maintains a Web site; and<br/>
<a id="pl.4.23"></a><var>4.23</var>(iii) notification to major media outlets that reach the general public within the <br/>
<a id="pl.4.24"></a><var>4.24</var>government entity's jurisdiction.<br/>
<a id="pl.4.25"></a><var>4.25</var>    Subd. 5. <b>Coordination with consumer reporting agencies.</b> If the state agency<br/>
<a id="pl.4.26"></a><var>4.26</var> government entity discovers circumstances requiring notification under this section of <br/>
<a id="pl.4.27"></a><var>4.27</var>more than 1,000 individuals at one time, the state agency government entity must also <br/>
<a id="pl.4.28"></a><var>4.28</var>notify, without unreasonable delay, all consumer reporting agencies that compile and <br/>
<a id="pl.4.29"></a><var>4.29</var>maintain files on consumers on a nationwide basis, as defined in United States Code, title <br/>
<a id="pl.4.30"></a><var>4.30</var>15, section 1681a, of the timing, distribution, and content of the notices.<br/>
<a id="pl.4.31"></a><var>4.31</var>    Subd. 6. <b>Security assessments.</b> At least annually, each government entity shall <br/>
<a id="pl.4.32"></a><var>4.32</var>conduct a comprehensive security assessment of any personal information maintained <br/>
<a id="pl.4.33"></a><var>4.33</var>by the government entity. For the purposes of this subdivision, personal information is <br/>
<a id="pl.4.34"></a><var>4.34</var>defined under section 325E.61, subdivision 1, paragraphs (e) and (f).<br/>
<a id="pl.4.35"></a><var>4.35</var><b>EFFECTIVE DATE.</b>This section is effective August 1, 2014, and applies to <br/>
<a id="pl.4.36"></a><var>4.36</var>security breaches occurring on or after that date.<br/>
<br/>
<a id="bill.0.4.0"></a><a id="pl.5.1"></a><var>5.1</var>    Sec. 4. Minnesota Statutes 2012, section 13.09, is amended to read:<br/>
<a id="pl.5.2"></a><var>5.2</var><b>13.09 PENALTIES.</b><br/>
<a id="pl.5.3"></a><var>5.3</var>(a) Any person who willfully violates the provisions of this chapter or any rules <br/>
<a id="pl.5.4"></a><var>5.4</var>adopted under this chapter or whose conduct constitutes the knowing unauthorized <br/>
<a id="pl.5.5"></a><var>5.5</var>acquisition of not public data, as defined in section 13.055, subdivision 1, is guilty of a <br/>
<a id="pl.5.6"></a><var>5.6</var>misdemeanor. <br/>
<a id="pl.5.7"></a><var>5.7</var>(b) Willful violation of this chapter by, including any action subject to a criminal <br/>
<a id="pl.5.8"></a><var>5.8</var>penalty under paragraph (a), by any public employee constitutes just cause for suspension <br/>
<a id="pl.5.9"></a><var>5.9</var>without pay or dismissal of the public employee.<br/>
<a id="pl.5.10"></a><var>5.10</var><b>EFFECTIVE DATE.</b>This section is effective August 1, 2014, and applies to crimes <br/>
<a id="pl.5.11"></a><var>5.11</var>committed on or after that date.<br/>