1.1 	A bill for an act
1.2 	relating to data practices; modifying definition of data security breach;amending 
1.3 	Minnesota Statutes 2018, section 13.055, subdivision 1.
1.4 	BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF MINNESOTA:

1.5 	Section 1. Minnesota Statutes 2018, section 13.055, subdivision 1, is amended to read:
1.6 		Subdivision 1.Definitions. For purposes of this section, the following terms have the 
1.7 	meanings given to them.
1.8 	(a) "Breach of the security of the data" means unauthorized acquisition of data personal 
1.9 	information as defined in section 325E.61 or an individual's health record as defined in 
1.10 	section 144.291 that is maintained by a government entity that compromises the security 
1.11 	and classification of the data. Good faith acquisition of or access to government data by an 
1.12 	employee, contractor, or agent of a government entity for the governmental purposes of the 
1.13 	entity is not a breach of the security of the data, if the government data is not further provided 
1.14 	to or viewable by an unauthorized person, outside the government entity or further accessed 
1.15 	for a purpose not described in the procedures required by section 13.05, subdivision 5. For 
1.16 	purposes of this paragraph, data maintained by a government entity includes data maintained 
1.17 	by a person under a contract with the government entity that provides for the acquisition of 
1.18 	or access to the data by an employee, contractor, or agent of the government entity.
1.19 	(b) "Contact information" means either name and mailing address or name and e-mail 
1.20 	address for each individual who is the subject of data maintained by the government entity.
1.21 	(c) "Unauthorized acquisition" means that a person has obtained, accessed, or viewed 
1.22 	government data without the informed consent of the individuals who are the subjects of 
2.1 	the data or statutory authority and with the intent to use the data for nongovernmental 
2.2 	purposes.
2.3 	(d) "Unauthorized person" means any person who accesses government data without a 
2.4 	work assignment that reasonably requires access, or regardless of the person's work 
2.5 	assignment, for a purpose not described in the procedures required by section 13.05, 
2.6 	subdivision 5.