1.1 	A bill for an act
1.2 	relating to data practices; restricting use of private and nonpublic data to only 
1.3 	those purposes authorized by law; amending Minnesota Statutes 2014, section 
1.4 	13.03, by adding a subdivision.
1.5 	BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF MINNESOTA:

1.6 	Section 1. Minnesota Statutes 2014, section 13.03, is amended by adding a subdivision 
1.7 	to read:
1.8 		Subd. 13.Access to private data. (a) Unless the data subject has otherwise 
1.9 	provided consent, a person who is not the subject of private or nonpublic data but is 
1.10 	authorized to access that data for a purpose expressed by state or federal law:
1.11 	(1) may only request and use the data for that purpose; and
1.12 	(2) may not further disseminate the data to another person except for purposes 
1.13 	expressly authorized by law.
1.14 	(b) Prior to dissemination of private or nonpublic data to a person who is not a 
1.15 	subject of the data, a government entity must require the requesting person to certify, in 
1.16 	writing, that the data will only be used for an authorized purpose, if authorized purposes 
1.17 	are expressly provided by law. This paragraph does not apply to requests for access to 
1.18 	data made on behalf of a government entity.
1.19 	(c) The remedies provided in sections 13.08 and 13.09 apply to any person who uses 
1.20 	or disseminates data in violation of this subdivision. A government entity is not subject 
1.21 	to civil or criminal liability for a violation of paragraph (a), if it has complied with the 
1.22 	requirements of paragraph (b).