1.1 	A bill for an act
1.2 	relating to government data practices; regulating data collected by the state's 
1.3 	COVID-19 vaccine connector tool; classifying data; requiring a legislative report.
1.4 	BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF MINNESOTA:

1.5 	Section 1. COVID-19 VACCINE CONNECTOR DATA.
 1.6 		Subdivision 1.Definitions. (a) The definitions provided by Minnesota Statutes, section 
1.7 	13.02, apply to this section, except that, for purposes of this section, the following terms 
1.8 	have the meanings given.
1.9 	(b) "Commissioner" means the commissioner of health.
1.10 	(c) "Vaccine connector" means an online tool operated by the state of Minnesota that 
1.11 	allows Minnesota residents to register in order to be notified when they are eligible to receive 
1.12 	a COVID-19 vaccine under the terms of the state's COVID-19 vaccine allocation and 
1.13 	prioritization plan and to provide information on access to COVID-19 vaccines and vaccine 
1.14 	scheduling.
1.15 	(d) "Vaccine connector data" means data on individuals collected, created, received, 
1.16 	maintained, or disseminated by the vaccine connector.
1.17 		Subd. 2.Data collection. (a) To fully register with the vaccine connector, an individual 
1.18 	must not be required to provide any information except for the following:
1.19 	(1) name;
1.20 	(2) address;
1.21 	(3) phone number or e-mail address;
2.1 	(4) date of birth;
2.2 	(5) occupation;
2.3 	(6) health information necessary to determine vaccine priority; and
2.4 	(7) need for a language interpreter.
2.5 	(b) The vaccine connector may collect information from individuals in addition to any 
2.6 	required information under paragraph (a), but the vaccine connector must clearly and 
2.7 	explicitly inform individuals that they may decline to provide the additional information 
2.8 	and that doing so will not affect any services provided as a result of registration.
2.9 		Subd. 3.Data classification. Vaccine connector data are classified as private data on 
2.10 	individuals.
2.11 		Subd. 4.Data sharing and controls. (a) The commissioner and any government entity 
2.12 	that receives vaccine connector data may only use vaccine connector data to:
2.13 	(1) alert individuals when they are eligible to receive a COVID-19 vaccine;
2.14 	(2) connect individuals to resources to schedule a COVID-19 vaccine appointment;
2.15 	(3) notify individuals if there are COVID-19 vaccine opportunities in their area; and
2.16 	(4) prepare summary data as authorized by Minnesota Statutes, section 13.05, subdivision 
2.17 	7.
2.18 	Any other use of vaccine connector data is prohibited.
2.19 	(b) Notwithstanding any law to the contrary, the commissioner must not share vaccine 
2.20 	connector data with any government entity or person unless:
2.21 	(1) the data subject has been informed that the specific government entity or person may 
2.22 	receive vaccine connector data about the subject; and
2.23 	(2) the data subject has affirmatively consented to data sharing with that government 
2.24 	entity or person.
2.25 	(c) The commissioner must establish written procedures to ensure that only individuals 
2.26 	authorized by the commissioner may enter, update, or access vaccine connector data. An 
2.27 	authorized individual's ability to enter, update, or access vaccine connector data must 
2.28 	correspond to the official duties or training level of the individual and to the statutory 
2.29 	authorization granting access for that purpose. All queries and responses, and all actions in 
2.30 	which data are entered, updated, accessed, shared, or disseminated, must be recorded in a 
2.31 	data audit trail. When vaccine connector data is disseminated outside of the Department of 
3.1 	Health, the data audit trail must record the government entity or person who received the 
3.2 	data. Data contained in the audit trail that identify individuals are classified as private data 
3.3 	on individuals. The audit trail must also be available in a public format that does not identify 
3.4 	individuals or include other information that could uniquely identify an individual.
3.5 		Subd. 5.Data destruction mandate. (a) Notwithstanding Minnesota Statutes, section 
3.6 	138.163, the commissioner must destroy vaccine connector data by one year after the date 
3.7 	the data was initially collected or by June 1, 2022, whichever is earlier.
3.8 	(b) Notwithstanding Minnesota Statutes, section 138.163, the commissioner must destroy 
3.9 	vaccine connector data about an individual upon written request from that individual. On 
3.10 	the vaccine connector website, the commissioner must provide a link allowing individuals 
3.11 	to submit a request for data destruction under this paragraph.
3.12 	(c) Vaccine connector data must be destroyed in a way that prevents its contents from 
3.13 	being determined.
3.14 		Subd. 6.Audit required. By April 1, 2022, the commissioner must have arranged for 
3.15 	and completed an independent audit of the vaccine connector system to verify compliance 
3.16 	with this section. The results of the audit are public. No later than 30 days following 
3.17 	completion of the audit, the commissioner must provide a report summarizing the audit 
3.18 	results to the chairs and ranking minority members of the committees of the house of 
3.19 	representatives and the senate with jurisdiction over health policy and finance and data 
3.20 	practices and the Legislative Commission on Data Practices and Personal Data Privacy. 
3.21 	The report must be submitted as required under Minnesota Statutes, section 3.195, except 
3.22 	that printed copies are not required.
3.23 		Subd. 7.Remedies for violation. The remedies and penalties available in Minnesota 
3.24 	Statutes, sections 13.08, 13.085, and 13.09, apply to this section. In a civil action under 
3.25 	Minnesota Statutes, section 13.08, exemplary damages are available for a violation of this 
3.26 	section even if the violation was not willful.

3.27 	EFFECTIVE DATE. This section is effective the day following final enactment.