1.1 	A bill for an act
1.2 	relating to motor vehicles; modifying provisions regarding access to driver and 
1.3 	vehicle services information system;amending Minnesota Statutes 2020, section 
1.4 	171.12, subdivision 1a.
1.5 	BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF MINNESOTA:

1.6 	Section 1. Minnesota Statutes 2020, section 171.12, subdivision 1a, is amended to read:
1.7 		Subd. 1a.Driver and vehicle services information system; security and auditing. (a) 
1.8 	The commissioner must establish written procedures to ensure that only individuals 
1.9 	authorized by law may enter, update, or access not public data collected, created, or 
1.10 	maintained by the driver and vehicle services information system. An authorized individual's 
1.11 	ability to enter, update, or access data in the system must correspond to the official duties 
1.12 	or training level of the individual and to the statutory authorization granting access for that 
1.13 	purpose. All queries and responses, and all actions in which data are entered, updated, 
1.14 	accessed, shared, or disseminated, must be recorded in a data audit trail. If an authorized 
1.15 	individual accesses data to resolve an issue and the access does not result in a completed 
1.16 	transaction, the individual must include a notation on the record for the transaction explaining 
1.17 	the business need for accessing the data. Data contained in the audit trail are public to the 
1.18 	extent the data are not otherwise classified by law.
1.19 	(b) If the commissioner must immediately and permanently revoke the authorization of 
1.20 	any determines that an individual who willfully entered, updated, accessed, shared, or 
1.21 	disseminated data in violation of state or federal law, the commissioner must impose 
1.22 	disciplinary action. If an individual willfully gained access to data without authorization by 
1.23 	law, the commissioner must forward the matter to the appropriate prosecuting authority for 
2.1 	prosecution. The commissioner must not impose disciplinary action with regards to an 
2.2 	individual who properly accessed data to complete an authorized transaction or to resolve 
2.3 	an issue that did not result in a completed authorized transaction.
2.4 	(c) If the commissioner imposes disciplinary action, the commissioner must notify the 
2.5 	individual, in writing, of the action, explain the reason for the action, and explain how to 
2.6 	appeal the action. The commissioner must mail the notification within five calendar days 
2.7 	of the action.
2.8 	(d) Within 20 calendar days of the mailing date of the notice required by paragraph (c), 
2.9 	the individual may submit a written request, by mail, for reconsideration to the commissioner. 
2.10 	The commissioner must review the request for reconsideration and issue a decision within 
2.11 	30 days of the mailing date of the request. The commissioner must make a determination 
2.12 	in writing and mail the decision to the individual. If the commissioner determines that the 
2.13 	disciplinary action was inappropriate, the commissioner must rescind the action. If the 
2.14 	commissioner determines the disciplinary action was appropriate, the individual may request 
2.15 	a contested case hearing under chapter 14 within 20 calendar days of the mailing date of 
2.16 	the commissioner's written decision.
2.17 	(e) As an alternative to the process described in paragraph (d), the individual may proceed 
2.18 	to a contested case hearing without first making a request to the commissioner for 
2.19 	reconsideration. In this instance, the individual may initiate a contested case proceeding 
2.20 	within 20 calendar days of the mailing date of the notice required by paragraph (c).
2.21 	(f) The commissioner must arrange for an independent biennial audit of the driver and 
2.22 	vehicle services information system to determine whether data currently in the system are 
2.23 	classified correctly, how the data are used, and to verify compliance with this subdivision. 
2.24 	The results of the audit are public. No later than 30 days following completion of the audit, 
2.25 	the commissioner must provide a report summarizing the audit results to the commissioner 
2.26 	of administration; the chairs and ranking minority members of the committees of the house 
2.27 	of representatives and the senate with jurisdiction over transportation policy and finance, 
2.28 	public safety, and data practices; and the Legislative Commission on Data Practices and 
2.29 	Personal Data Privacy. The report must be submitted as required under section 3.195, except 
2.30 	that printed copies are not required.
2.31 	(g) For purposes of this subdivision, "disciplinary action" means a formal or informal 
2.32 	disciplinary measure, including but not limited to requiring corrective action or suspending 
2.33 	or revoking the individual's access to the driver and vehicle information system.

3.1 	EFFECTIVE DATE. This section is effective August 1, 2022, and applies to access 
3.2 	to data on or after that date.