1.1 	A bill for an act
1.2 	relating to motor vehicles; amending bulk vehicle record requirements and 
1.3 	procedures; requiring annual reports by commissioner of public safety and 
1.4 	legislative auditor; requiring notice of disclosure of private data;amending 
1.5 	Minnesota Statutes 2018, sections 168.327, subdivisions 5, 6, by adding a 
1.6 	subdivision; 168.346, subdivision 3.
1.7 	BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF MINNESOTA:

1.8 	Section 1. Minnesota Statutes 2018, section 168.327, subdivision 5, is amended to read:
1.9 		Subd. 5.Bulk vehicle records requests. (a) "Bulk vehicle records" in this section is a 
1.10 	total of 1,000 or more vehicle title records and vehicle registration records.
1.11 	(b) The commissioner shall establish a fee that does not exceed $0.01 per record for a 
1.12 	request of bulk vehicle records.
1.13 	(c) Of the fees collected, 40 percent must be credited to the vehicle services operating 
1.14 	account in the special revenue fund under section 299A.705 and is appropriated to the 
1.15 	commissioner for the purposes in this subdivision, and 60 percent must be credited to the 
1.16 	data security account in the special revenue fund under section 3.9741, subdivision 5
1.17 	legislative auditor for the report required by subdivision 7, and 60 percent is deposited in 
1.18 	the general fund.

1.19 	Sec. 2. Minnesota Statutes 2018, section 168.327, subdivision 6, is amended to read:
1.20 		Subd. 6.Review and audit of purchases of bulk driver and motor vehicle records. (a) 
1.21 	Each subscriber and each requester of bulk vehicle records shall annually engage an 
1.22 	independent professional organization to audit, for the previous calendar year, its uses of 
1.23 	bulk data and its information technology security procedures, including the methods and 
2.1 	practices employed in the processing and use of driver and vehicle services data. Within 30 
2.2 	days of the date of the audit report The organization that conducts the audit must conclude 
2.3 	whether the subscriber or requester has effectively implemented security controls over 
2.4 	processing and use of driver and vehicle services data consistent with controls recommended 
2.5 	by the National Institute of Standards and Technology or substantially similar best practice 
2.6 	controls. By February 1 of each year, each subscriber and requester must submit eachthe 
2.7 	annual audit report to the legislative auditor and the commissioner.
2.8 	(b) If a subscriber or requester of bulk vehicle records fails to submit an annual audit 
2.9 	report as required in this subdivision, the commissioner must not provide any additional 
2.10 	bulk vehicle records to the subscriber or requester until the subscriber or requester submits 
2.11 	an annual audit report.

2.12 	Sec. 3. Minnesota Statutes 2018, section 168.327, is amended by adding a subdivision to 
2.13 	read:
2.14 		Subd. 7.Annual reports. (a) By March 1 of each year, the commissioner must report 
2.15 	to the chairs and ranking minority members of the legislative committees with jurisdiction 
2.16 	over transportation on the following:
2.17 	(1) the name of each entity that purchased bulk vehicle records, as provided in subdivision 
2.18 	5, from the commissioner for the past fiscal year;
2.19 	(2) whether each entity submitted the annual report required by subdivision 6 and the 
2.20 	date the report was submitted;
2.21 	(3) a summary of each annual audit report required by subdivision 6, including, at a 
2.22 	minimum, all conclusions or recommendations relating to the vendor's use of the data and 
2.23 	the vendor's information technology security procedures; and
2.24 	(4) any recommendations to the legislature on how to improve the security or handling 
2.25 	of bulk data vehicle records.
2.26 	(b) By March 1 of each year, the legislative auditor must report to the chairs and ranking 
2.27 	minority members of the legislative committees with jurisdiction over transportation on the 
2.28 	following:
2.29 	(1) the name of each entity that submitted the annual report required by subdivision 6, 
2.30 	including the date the report was submitted;
3.1 	(2) a summary of each annual audit report submitted pursuant to subdivision 6, including, 
3.2 	at a minimum, all conclusions or recommendations relating to the vendor's use of the data 
3.3 	and the vendor's information technology security procedures;
3.4 	(3) an evaluation of each annual audit report submitted pursuant to subdivision 6, 
3.5 	including whether the audit was conducted by a qualified organization and whether the audit 
3.6 	addressed all necessary aspects of the vendor's acceptance and use of the data; and
3.7 	(4) any recommendations to the commissioner or legislature on how to improve the 
3.8 	security or handling of bulk data vehicle records.

3.9 	Sec. 4. Minnesota Statutes 2018, section 168.346, subdivision 3, is amended to read:
3.10 		Subd. 3.Privacy classification for personal safety. (a) The registered owner of a vehicle 
3.11 	who is an individual may request, in writing, that the registered owner's residence address 
3.12 	or name and residence address be classified as "private data on individuals," as defined in 
3.13 	section 13.02, subdivision 12. The commissioner shall grant the classification on receipt of 
3.14 	a signed statement by the registered owner that the classification is required for the safety 
3.15 	of the registered owner or the registered owner's family, if the statement also provides a 
3.16 	valid, existing address where the registered owner consents to receive service of process. 
3.17 	The commissioner shall use the service of process mailing address in place of the registered 
3.18 	owner's residence address in all documents and notices pertaining to the vehicle. The 
3.19 	residence address or name and residence address and any information provided in the 
3.20 	classification request, other than the individual's service for process mailing address, are 
3.21 	private data on individuals but may be provided to requesting law enforcement agencies, 
3.22 	probation and parole agencies, and public authorities, as defined in section 518A.26, 
3.23 	subdivision 18.
3.24 	(b) If the commissioner discloses the name or residence address that is classified as 
3.25 	private data pursuant to paragraph (a), the commissioner must, upon discovery of the 
3.26 	disclosure, immediately notify the individual that is the subject of the data of the disclosure. 
3.27 	Within seven days of the discovery of the disclosure, the commissioner must notify the 
3.28 	recipient of the data of the disclosure and request that the recipient delete or remove the 
3.29 	private data from the recipient's system. Within seven days of the discovery of the disclosure, 
3.30 	the commissioner must notify the chairs and ranking minority members of the legislative 
3.31 	committees with jurisdiction over transportation that private data was disclosed and the 
3.32 	name of the recipient of the data. All notices required by this paragraph must be in writing.

3.33 	EFFECTIVE DATE. This section is effective the day following final enactment.