1.1 	A bill for an act
1.2 	relating to data practices; modifying provisions governing automatic license plate 
1.3 	readers and portable recording systems;amending Minnesota Statutes 2016, sections 
1.4 	13.824, subdivisions 5, 6, 7, 8; 13.825, subdivisions 7, 9.
1.5 	BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF MINNESOTA:

1.6 	Section 1. Minnesota Statutes 2016, section 13.824, subdivision 5, is amended to read:
1.7 		Subd. 5.Log of use required. (a) A law enforcement agency that installs or uses an 
1.8 	automated license plate reader must maintain a public log of its use, including but not limited 
1.9 	to:
1.10 	(1) specific times of day that the reader actively collected data;
1.11 	(2) the aggregate number of vehicles or license plates on which data are collected for 
1.12 	each period of active use and a list of all state and federal databases with which the data 
1.13 	were compared, unless the existence of the database itself is not public;
1.14 	(3) for each period of active use, the number of vehicles or license plates in each of the 
1.15 	following categories where the data identify a vehicle or license plate that has been stolen, 
1.16 	a warrant for the arrest of the owner of the vehicle or an owner with a suspended or revoked 
1.17 	driver's license or similar category, or are active investigative data on which data are 
1.18 	collected:
1.19 	(i) that identify a vehicle or license plate that has been stolen;
1.20 	(ii) that identify a vehicle whose owner has an outstanding arrest warrant; and
1.21 	(iii) that identify a vehicle whose owner has a suspended, revoked, or canceled driver's 
1.22 	license; and
2.1 	(4) for a reader at a stationary or fixed location, the location at which the reader actively 
2.2 	collected data and is installed and used.
2.3 	(b) The law enforcement agency must maintain a list of the current and previous locations, 
2.4 	including dates at those locations, of any fixed stationary automated license plate readers 
2.5 	or other surveillance devices with automated license plate reader capability used by the 
2.6 	agency. The agency's list must be accessible to the public, unless the agency determines 
2.7 	that the data are security information as provided in section 13.37, subdivision 2. A 
2.8 	determination that these data are security information is subject to in-camera judicial review 
2.9 	as provided in section 13.08, subdivision 4.

2.10 	Sec. 2. Minnesota Statutes 2016, section 13.824, subdivision 6, is amended to read:
2.11 		Subd. 6.Biennial audit. (a) In addition to the log required under subdivision 5, the law 
2.12 	enforcement agency must maintain records showing the date and time automated license 
2.13 	plate reader data were collected and the applicable classification of the data. The law 
2.14 	enforcement agency shall arrange for an independent, biennial audit of the records to 
2.15 	determine whether data currently in the records are classified, how the data are used, whether 
2.16 	they are destroyed as required under this section, and to verify compliance with subdivision 
2.17 	7. If the commissioner of administration believes that a law enforcement agency is not 
2.18 	complying with this section or other applicable law, the commissioner may order a law 
2.19 	enforcement agency to arrange for additional independent audits. Data in the records required 
2.20 	under this paragraph are classified as provided in subdivision 2. A law enforcement agency 
2.21 	that installs or uses an automatic license plate reader must contract with the state auditor or 
2.22 	a private auditing firm to perform an independent, biennial audit of the agency's automated 
2.23 	license plate reader data to verify compliance with this section. For purposes of this 
2.24 	subdivision, the time period for conducting a biennial audit commences when an agency 
2.25 	begins using automated license plate reader technology. By July 1 of each odd-numbered 
2.26 	year, the agency must provide a report on the results of each audit to the commissioner of 
2.27 	administration, to the chair and ranking minority members of the legislative committees 
2.28 	with jurisdiction over data practices and public safety issues, and to the Legislative 
2.29 	Commission on Data Practices and Personal Data Privacy.
2.30 	(b) The results of the audit are report required under paragraph (a) is public.and must 
2.31 	include the following and assess compliance with this section:
2.32 	(1) the number of automated license plate readers used by the agency, including the 
2.33 	brand and model of each reader, whether the reader is mobile or stationary, and contact 
2.34 	information for the agency's automated license plate reader vendor;
3.1 	(2) all information in the log of use required by subdivision 5 for the biennial period; 
3.2 	and
3.3 	(3) all agency policies and procedures regarding automated license plate readers and 
3.4 	automated license plate reader data, including policies and procedures regarding classification 
3.5 	of the data, role-based access and data security, data retention and destruction, and data 
3.6 	sharing.
3.7 	(c) The commissioner of administration shall review the results of the audit report. If, 
3.8 	based on the audit report, the commissioner of administration believes that a law enforcement 
3.9 	agency is not complying with this section or other applicable law, the commissioner may 
3.10 	order a law enforcement agency to arrange for additional independent audits. If the 
3.11 	commissioner determines that there is a pattern of substantial noncompliance with this 
3.12 	section by the law enforcement agency, the agency must immediately suspend operation of 
3.13 	all automated license plate reader devices until the commissioner has authorized the agency 
3.14 	to reinstate their use. An order of suspension under this paragraph may be issued by the 
3.15 	commissioner, upon review of the results of the audit report, review of the applicable 
3.16 	provisions of this chapter, and after providing the agency a reasonable opportunity to respond 
3.17 	to the audit's findings.
3.18 	(c) A report summarizing the results of each audit must be provided to the commissioner 
3.19 	of administration, to the chair and ranking minority members of the committees of the house 
3.20 	of representatives and the senate with jurisdiction over data practices and public safety 
3.21 	issues, and to the Legislative Commission on Data Practices and Personal Data Privacy no 
3.22 	later than 30 days following completion of the audit.

3.23 	Sec. 3. Minnesota Statutes 2016, section 13.824, subdivision 7, is amended to read:
3.24 		Subd. 7.Authorization to access data. (a) A law enforcement agency must comply 
3.25 	with sections 13.05, subdivision 5, and 13.055 in the operation of automated license plate 
3.26 	readers, and in maintaining automated license plate reader data.
3.27 	(b) The responsible authority for a law enforcement agency must establish written 
3.28 	procedures to ensure that law enforcement personnel have access to the data only if authorized 
3.29 	in writing by the chief of police, sheriff, or head of the law enforcement agency, or their 
3.30 	designee, to obtain access to data collected by an automated license plate reader for a 
3.31 	legitimate, specified, and documented law enforcement purpose. The ability of authorized 
3.32 	individuals to enter, update, or access automated license plate reader data must be limited 
3.33 	through the use of role-based access that corresponds to the official duties or training level 
3.34 	of the individual and the statutory authorization that grants access for that purpose. Consistent 
4.1 	with the requirements of paragraph (c), each access must be based on a reasonable suspicion 
4.2 	that the data are pertinent to an active criminal investigation and must include a record of 
4.3 	the factual basis for the access and any associated case number, complaint, or incident that 
4.4 	is the basis for the access.
4.5 	(c) The ability of authorized individuals to enter, update, or access automated license 
4.6 	plate reader data must be limited through the use of role-based access that corresponds to 
4.7 	the official duties or training level of the individual and the statutory authorization that 
4.8 	grants access for that purpose. All queries and responses, and all actions in which data are 
4.9 	entered, updated, accessed, shared, or disseminated, must be recorded in a data audit trail. 
4.10 	Data contained in the audit trail are public, to the extent that the data are not otherwise 
4.11 	classified by law.

4.12 	Sec. 4. Minnesota Statutes 2016, section 13.824, subdivision 8, is amended to read:
4.13 		Subd. 8.Notification to Bureau of Criminal Apprehension. (a) Within ten days of 
4.14 	the installation or current use of acquiring an automated license plate reader or the integration 
4.15 	of automated license plate reader technology into another surveillance device, a law 
4.16 	enforcement agency must notify the Bureau of Criminal Apprehension of that installation 
4.17 	or use that it has acquired automated license plate reader technology. Within ten days of 
4.18 	beginning the use of an automated license plate reader, a law enforcement agency must 
4.19 	notify the Bureau of Criminal Apprehension that it has begun using automated license plate 
4.20 	reader technology and of any fixed location of a stationary automated license plate reader.
4.21 	(b) The Bureau of Criminal Apprehension must maintain a list of law enforcement 
4.22 	agencies using automated license plate readers or other surveillance devices with automated 
4.23 	license plate reader capability, including the dates that the agency acquired and first began 
4.24 	using the technology and the locations of any fixed stationary automated license plate readers 
4.25 	or other devices. Except to the extent that the law enforcement agency determines that the 
4.26 	location of a specific reader or other device is security information, as defined in section 
4.27 	13.37, this list is accessible to the public and must be available on the bureau's Web site. A 
4.28 	determination that the location of a reader or other device is security information is subject 
4.29 	to in-camera judicial review, as provided in section 13.08, subdivision 4.

4.30 	Sec. 5. Minnesota Statutes 2016, section 13.825, subdivision 7, is amended to read:
4.31 		Subd. 7.Authorization to access data. (a) A law enforcement agency must comply 
4.32 	with sections 13.05, subdivision 5, and 13.055 in the operation of portable recording systems 
4.33 	and in maintaining portable recording system data.
5.1 	(b) The responsible authority for a law enforcement agency must establish written 
5.2 	procedures to ensure that law enforcement personnel have access to the portable recording 
5.3 	system data that are not public only if authorized in writing by the chief of police, sheriff, 
5.4 	or head of the law enforcement agency, or their designee, to obtain access to the data for a 
5.5 	legitimate, specified law enforcement purpose. The ability of authorized individuals to enter, 
5.6 	redact, or access portable recording system data must be limited through the use of role-based 
5.7 	access that corresponds to the official duties or training level of the individual and the 
5.8 	statutory authorization that grants access for that purpose. Consistent with the requirements 
5.9 	of paragraph (c), each access must include a record of the factual basis for the access and 
5.10 	any associated case number, complaint, or incident that is the basis for the access.
5.11 	(c) All actions in which data are entered, updated, accessed, shared, or disseminated, 
5.12 	must be recorded in a data audit trail. Data contained in the audit trail are public to the extent 
5.13 	that the data are not otherwise classified by law.

5.14 	Sec. 6. Minnesota Statutes 2016, section 13.825, subdivision 9, is amended to read:
5.15 		Subd. 9.Biennial audit. (a) A law enforcement agency must maintain records showing 
5.16 	the date and time portable recording system data were collected and the applicable 
5.17 	classification of the data. The law enforcement agency shall arrange for an independent, 
5.18 	biennial audit of the data to determine whether data are appropriately classified according 
5.19 	to this section, how the data are used, and whether the data are destroyed as required under 
5.20 	this section, and to verify compliance with subdivisions 7 and 8. If the governing body with 
5.21 	jurisdiction over the budget of the agency determines that the agency is not complying with 
5.22 	this section or other applicable law, the governing body may order additional independent 
5.23 	audits. Data in the records required under this paragraph are classified as provided in 
5.24 	subdivision 2. A law enforcement agency that uses a portable recording system must contract 
5.25 	with the state auditor or a private auditing firm to perform an independent, biennial audit 
5.26 	of the agency's portable recording system data to verify compliance with this section. By 
5.27 	July 1 of each odd-numbered year, the agency must provide a report on the results of each 
5.28 	audit to the commissioner of administration, to the chair and ranking minority members of 
5.29 	the legislative committees with jurisdiction over data practices and public safety issues, and 
5.30 	to the Legislative Commission on Data Practices and Personal Data Privacy.
5.31 	(b) The results of the audit are report required under paragraph (a) is public, except for 
5.32 	data that are otherwise classified under law. and must include the following and assess 
5.33 	compliance with this section:
5.34 	(1) all information required by subdivision 5 for the biennial period; and
6.1 	(2) all agency policies and procedures regarding portable recording systems and portable 
6.2 	recording system data including policies and procedures regarding classification of the data, 
6.3 	role-based access and data security, data retention and destruction, and data sharing.
6.4 	(c) The governing body with jurisdiction over the budget of the law enforcement agency 
6.5 	shall review the results of the audit report. If the governing body determines that there is a 
6.6 	pattern of substantial noncompliance with this section, the governing body must order that 
6.7 	operation of all portable recording systems be suspended until the governing body has 
6.8 	authorized the agency to reinstate their use. An order of suspension under this paragraph 
6.9 	may only be made following review of the results of the audit report and review of the 
6.10 	applicable provisions of this chapter, and after providing the agency and members of the 
6.11 	public a reasonable opportunity to respond to the audit's findings in a public meeting.
6.12 	(c) A report summarizing the results of each audit must be provided to the governing 
6.13 	body with jurisdiction over the budget of the law enforcement agency and to the Legislative 
6.14 	Commission on Data Practices and Personal Data Privacy no later than 60 days following 
6.15 	completion of the audit.