Minnesota Legislature
HF 183
1st Unofficial Engrossment - 88th Legislature (2013 - 2014) Posted on 04/02/2014 01:55pm
KEY: stricken = removed, old language.
underscored = added, new language.
1.2relating to data practices; enhancing certain penalties and procedures related to
1.3unauthorized access to data by a public employee; amending Minnesota Statutes
1.42012, sections 13.04, subdivision 3; 13.05, subdivision 5; 13.055; 13.09.
1.5BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF MINNESOTA:
1.6 Section 1. Minnesota Statutes 2012, section 13.04, subdivision 3, is amended to read:
1.7 Subd. 3. Access to data by individual. (a) Upon request to a responsible authority
1.8or designee, an individual shall be informed whether the individual is the subject of
1.9stored data on individuals, and whether it is classified as public, private or confidential.
1.10Upon further request, an individual who is the subject of stored private or public data
1.11on individuals shall be shown the data without any charge and, if desired, shall be
1.12informed of the content and meaning of that data. After an individual has been shown
1.13the private data and informed of its meaning, the data need not be disclosed to that
1.14individual for six months thereafter unless a dispute or action pursuant to this section is
1.15pending or additional data on the individual has been collected or created. The responsible
1.16authority or designee shall provide copies of the private or public data upon request by
1.17the individual subject of the data. The responsible authority or designee may require the
1.18requesting person to pay the actual costs of making and certifying the copies.
1.19(b) Notwithstanding section 13.15 or 13.43, or other law to the contrary, upon request,
1.20to the extent the data are maintained by the government entity, an individual has access to
1.21the name of persons who have obtained access to private data on the individual, unless the
1.22data would identify an undercover law enforcement officer or are active investigative data.
2.1 (c) The responsible authority or designee shall comply immediately, if possible, with
2.2any request made pursuant to this subdivision, or within ten days of the date of the request,
2.3excluding Saturdays, Sundays and legal holidays, if immediate compliance is not possible.
2.4 Sec. 2. Minnesota Statutes 2012, section 13.05, subdivision 5, is amended to read:
2.5 Subd. 5. Data protection. (a) The responsible authority shall:
2.6 (1) establish procedures to assure that all data on individuals is accurate, complete,
2.7and current for the purposes for which it was collected;and
2.8 (2) establish appropriate security safeguards for all records containing data on
2.9individuals, including procedures for ensuring that data that are not public are only
2.10accessible to persons whose work assignment reasonably requires access to the data, and
2.11is only being accessed by those persons for purposes described in the procedure; and
2.12(3) develop a policy incorporating these procedures, which may include a model
2.13policy governing access to the data if sharing of the data with other government entities is
2.14authorized by law.
2.15(b) When not public data is being disposed of, the data must be destroyed in a way
2.16that prevents its contents from being determined.
2.17 Sec. 3. Minnesota Statutes 2012, section 13.055, is amended to read:
2.1813.055STATE AGENCIES; DISCLOSURE OF BREACH IN SECURITY;
2.19NOTIFICATION AND INVESTIGATION REPORT REQUIRED.
2.20 Subdivision 1. Definitions. For purposes of this section, the following terms have
2.21the meanings given to them.
2.22(a) "Breach of the security of the data" means unauthorized acquisition of or access
2.23to data maintained by astate agency government entity that compromises the security and
2.24classification of the data. Good faith acquisition of or access to government data by an
2.25employee, contractor, or agent of astate agency government entity for the purposes of
2.26thestate agency entity is not a breach of the security of the data, if the government data
2.27is not provided to or viewable by an unauthorized person, or accessed for a purpose not
2.28described in the procedures required by section 13.05, subdivision 5. For purposes of this
2.29paragraph, data maintained by a government entity includes data maintained by a person
2.30under a contract with the government entity that provides for the acquisition of or access
2.31to the data by an employee, contractor, or agent of the government entity.
2.32(b) "Contact information" means either name and mailing address or name and
2.33e-mail address for each individual who is the subject of data maintained by thestate
2.34agency government entity.
3.1(c) "Unauthorized acquisition" means that a person has obtained or viewed
3.2 government data without the informed consent of the individuals who are the subjects of the
3.3data or statutory authority and with the intent to use the data for nongovernmental purposes.
3.4(d) "Unauthorized person" means any person who accesses government datawithout
3.5permission or without a work assignment that reasonably requires the person to have
3.6 accessto the data, or regardless of the person's work assignment, for a purpose not
3.7described in the procedures required by section 13.05, subdivision 5.
3.8 Subd. 2. Notice to individuals; investigation report. (a) Astate agency
3.9 government entity that collects, creates, receives, maintains, or disseminates private or
3.10confidential data on individuals must disclose any breach of the security of the data
3.11following discovery or notification of the breach. Written notification must be made to
3.12any individual who is the subject of the data and whose private or confidential data was, or
3.13is reasonably believed to have been, acquired by an unauthorized person and must inform
3.14the individual that a report will be prepared under paragraph (b), how the individual may
3.15obtain access to the report, and that the individual may request delivery of the report by
3.16mail or e-mail. The disclosure must be made in the most expedient time possible and
3.17without unreasonable delay, consistent with (1) the legitimate needs of a law enforcement
3.18agency as provided in subdivision 3; or (2) any measures necessary to determine the scope
3.19of the breach and restore the reasonable security of the data.
3.20(b) Upon completion of an investigation into any breach in the security of data, the
3.21responsible authority shall prepare a report on the facts and results of the investigation.
3.22If the breach involves unauthorized access to or acquisition of data by an employee,
3.23contractor, or agent of the government entity, the report must at a minimum include:
3.24(1) a description of the data that were accessed or acquired;
3.25(2) the number of individuals whose data was improperly accessed or acquired;
3.26(3) if there has been final disposition of disciplinary action for purposes of section
3.2713.43, the name of each employee determined to be responsible for the unauthorized
3.28access or acquisition;
3.29(4) the final disposition of any disciplinary action taken against each employee in
3.30response; and
3.31(5) if disciplinary action was determined to be unnecessary, the specific findings and
3.32reasons for that determination.
3.33The report must not include data that are not public under other law. The report is
3.34public and must be posted on the government entity's Web site, if the government entity
3.35maintains a Web site, and provided to an individual who received the notification under
3.36paragraph (a) and requested delivery of the report. If the government entity does not
4.1maintain a Web site, the report must be posted on the principal bulletin board of the
4.2government entity, or if the government entity does not have a principal bulletin board, on
4.3the door of its usual meeting room.
4.4 Subd. 3. Delayed notice. The notification required by this section may be delayed if
4.5a law enforcement agency determines that the notification will impede an active criminal
4.6investigation. The notification required by this section must be made after the law
4.7enforcement agency determines that it will not compromise the investigation.
4.8 Subd. 4. Method of notice. Notice under this section may be provided by one of
4.9the following methods:
4.10(a) written notice by first class mail to each affected individual;
4.11(b) electronic notice to each affected individual, if the notice provided is consistent
4.12with the provisions regarding electronic records and signatures as set forth in United
4.13States Code, title 15, section 7001; or
4.14(c) substitute notice, if thestate agency government entity demonstrates that the cost
4.15of providing the written notice required by paragraph (a) would exceed $250,000, or
4.16that the affected class of individuals to be notified exceeds 500,000, or thestate agency
4.17 government entity does not have sufficient contact information. Substitute notice consists
4.18of all of the following:
4.19(i) e-mail notice if thestate agency government entity has an e-mail address for
4.20the affected individuals;
4.21(ii) conspicuous posting of the notice on the Web site page of thestate agency
4.22 government entity, if thestate agency government entity maintains a Web site; and
4.23(iii) notification to major media outlets that reach the general public within the
4.24government entity's jurisdiction.
4.25 Subd. 5. Coordination with consumer reporting agencies. If thestate agency
4.26 government entity discovers circumstances requiring notification under this section of
4.27more than 1,000 individuals at one time, thestate agency government entity must also
4.28notify, without unreasonable delay, all consumer reporting agencies that compile and
4.29maintain files on consumers on a nationwide basis, as defined in United States Code, title
4.3015, section 1681a, of the timing, distribution, and content of the notices.
4.31 Subd. 6. Security assessments. At least annually, each government entity shall
4.32conduct a comprehensive security assessment of any personal information maintained
4.33by the government entity. For the purposes of this subdivision, personal information is
4.34defined under section 325E.61, subdivision 1, paragraphs (e) and (f).
4.35EFFECTIVE DATE.This section is effective August 1, 2014, and applies to
4.36security breaches occurring on or after that date.
5.1 Sec. 4. Minnesota Statutes 2012, section 13.09, is amended to read:
5.213.09 PENALTIES.
5.3(a) Any person who willfully violates the provisions of this chapter or any rules
5.4adopted under this chapter or whose conduct constitutes the knowing unauthorized
5.5acquisition of not public data, as defined in section 13.055, subdivision 1, is guilty of a
5.6misdemeanor.
5.7(b) Willful violation of this chapterby, including any action subject to a criminal
5.8penalty under paragraph (a), by any public employee constitutes just cause for suspension
5.9without pay or dismissal of the public employee.
5.10EFFECTIVE DATE.This section is effective August 1, 2014, and applies to crimes
5.11committed on or after that date.
1.3unauthorized access to data by a public employee; amending Minnesota Statutes
1.42012, sections 13.04, subdivision 3; 13.05, subdivision 5; 13.055; 13.09.
1.5BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF MINNESOTA:
1.6 Section 1. Minnesota Statutes 2012, section 13.04, subdivision 3, is amended to read:
1.7 Subd. 3. Access to data by individual. (a) Upon request to a responsible authority
1.8or designee, an individual shall be informed whether the individual is the subject of
1.9stored data on individuals, and whether it is classified as public, private or confidential.
1.10Upon further request, an individual who is the subject of stored private or public data
1.11on individuals shall be shown the data without any charge and, if desired, shall be
1.12informed of the content and meaning of that data. After an individual has been shown
1.13the private data and informed of its meaning, the data need not be disclosed to that
1.14individual for six months thereafter unless a dispute or action pursuant to this section is
1.15pending or additional data on the individual has been collected or created. The responsible
1.16authority or designee shall provide copies of the private or public data upon request by
1.17the individual subject of the data. The responsible authority or designee may require the
1.18requesting person to pay the actual costs of making and certifying the copies.
1.19(b) Notwithstanding section 13.15 or 13.43, or other law to the contrary, upon request,
1.20to the extent the data are maintained by the government entity, an individual has access to
1.21the name of persons who have obtained access to private data on the individual, unless the
1.22data would identify an undercover law enforcement officer or are active investigative data.
2.1 (c) The responsible authority or designee shall comply immediately, if possible, with
2.2any request made pursuant to this subdivision, or within ten days of the date of the request,
2.3excluding Saturdays, Sundays and legal holidays, if immediate compliance is not possible.
2.4 Sec. 2. Minnesota Statutes 2012, section 13.05, subdivision 5, is amended to read:
2.5 Subd. 5. Data protection. (a) The responsible authority shall:
2.6 (1) establish procedures to assure that all data on individuals is accurate, complete,
2.7and current for the purposes for which it was collected;
2.8 (2) establish appropriate security safeguards for all records containing data on
2.9individuals, including procedures for ensuring that data that are not public are only
2.10accessible to persons whose work assignment reasonably requires access to the data, and
2.11is only being accessed by those persons for purposes described in the procedure; and
2.12(3) develop a policy incorporating these procedures, which may include a model
2.13policy governing access to the data if sharing of the data with other government entities is
2.14authorized by law.
2.15(b) When not public data is being disposed of, the data must be destroyed in a way
2.16that prevents its contents from being determined.
2.17 Sec. 3. Minnesota Statutes 2012, section 13.055, is amended to read:
2.1813.055
2.19NOTIFICATION AND INVESTIGATION REPORT REQUIRED.
2.20 Subdivision 1. Definitions. For purposes of this section, the following terms have
2.21the meanings given to them.
2.22(a) "Breach of the security of the data" means unauthorized acquisition of or access
2.23to data maintained by a
2.24classification of the data. Good faith acquisition of or access to government data by an
2.25employee, contractor, or agent of a
2.26the
2.27is not provided to or viewable by an unauthorized person, or accessed for a purpose not
2.28described in the procedures required by section 13.05, subdivision 5. For purposes of this
2.29paragraph, data maintained by a government entity includes data maintained by a person
2.30under a contract with the government entity that provides for the acquisition of or access
2.31to the data by an employee, contractor, or agent of the government entity.
2.32(b) "Contact information" means either name and mailing address or name and
2.33e-mail address for each individual who is the subject of data maintained by the
2.34
3.1(c) "Unauthorized acquisition" means that a person has obtained or viewed
3.2 government data without the informed consent of the individuals who are the subjects of the
3.3data or statutory authority and with the intent to use the data for nongovernmental purposes.
3.4(d) "Unauthorized person" means any person who accesses government data
3.5
3.6 access
3.7described in the procedures required by section 13.05, subdivision 5.
3.8 Subd. 2. Notice to individuals; investigation report. (a) A
3.9 government entity that collects, creates, receives, maintains, or disseminates private or
3.10confidential data on individuals must disclose any breach of the security of the data
3.11following discovery or notification of the breach. Written notification must be made to
3.12any individual who is the subject of the data and whose private or confidential data was, or
3.13is reasonably believed to have been, acquired by an unauthorized person and must inform
3.14the individual that a report will be prepared under paragraph (b), how the individual may
3.15obtain access to the report, and that the individual may request delivery of the report by
3.16mail or e-mail. The disclosure must be made in the most expedient time possible and
3.17without unreasonable delay, consistent with (1) the legitimate needs of a law enforcement
3.18agency as provided in subdivision 3; or (2) any measures necessary to determine the scope
3.19of the breach and restore the reasonable security of the data.
3.20(b) Upon completion of an investigation into any breach in the security of data, the
3.21responsible authority shall prepare a report on the facts and results of the investigation.
3.22If the breach involves unauthorized access to or acquisition of data by an employee,
3.23contractor, or agent of the government entity, the report must at a minimum include:
3.24(1) a description of the data that were accessed or acquired;
3.25(2) the number of individuals whose data was improperly accessed or acquired;
3.26(3) if there has been final disposition of disciplinary action for purposes of section
3.2713.43, the name of each employee determined to be responsible for the unauthorized
3.28access or acquisition;
3.29(4) the final disposition of any disciplinary action taken against each employee in
3.30response; and
3.31(5) if disciplinary action was determined to be unnecessary, the specific findings and
3.32reasons for that determination.
3.33The report must not include data that are not public under other law. The report is
3.34public and must be posted on the government entity's Web site, if the government entity
3.35maintains a Web site, and provided to an individual who received the notification under
3.36paragraph (a) and requested delivery of the report. If the government entity does not
4.1maintain a Web site, the report must be posted on the principal bulletin board of the
4.2government entity, or if the government entity does not have a principal bulletin board, on
4.3the door of its usual meeting room.
4.4 Subd. 3. Delayed notice. The notification required by this section may be delayed if
4.5a law enforcement agency determines that the notification will impede an active criminal
4.6investigation. The notification required by this section must be made after the law
4.7enforcement agency determines that it will not compromise the investigation.
4.8 Subd. 4. Method of notice. Notice under this section may be provided by one of
4.9the following methods:
4.10(a) written notice by first class mail to each affected individual;
4.11(b) electronic notice to each affected individual, if the notice provided is consistent
4.12with the provisions regarding electronic records and signatures as set forth in United
4.13States Code, title 15, section 7001; or
4.14(c) substitute notice, if the
4.15of providing the written notice required by paragraph (a) would exceed $250,000, or
4.16that the affected class of individuals to be notified exceeds 500,000, or the
4.17 government entity does not have sufficient contact information. Substitute notice consists
4.18of all of the following:
4.19(i) e-mail notice if the
4.20the affected individuals;
4.21(ii) conspicuous posting of the notice on the Web site page of the
4.22 government entity, if the
4.23(iii) notification to major media outlets that reach the general public within the
4.24government entity's jurisdiction.
4.25 Subd. 5. Coordination with consumer reporting agencies. If the
4.26 government entity discovers circumstances requiring notification under this section of
4.27more than 1,000 individuals at one time, the
4.28notify, without unreasonable delay, all consumer reporting agencies that compile and
4.29maintain files on consumers on a nationwide basis, as defined in United States Code, title
4.3015, section 1681a, of the timing, distribution, and content of the notices.
4.31 Subd. 6. Security assessments. At least annually, each government entity shall
4.32conduct a comprehensive security assessment of any personal information maintained
4.33by the government entity. For the purposes of this subdivision, personal information is
4.34defined under section 325E.61, subdivision 1, paragraphs (e) and (f).
4.35EFFECTIVE DATE.This section is effective August 1, 2014, and applies to
4.36security breaches occurring on or after that date.
5.1 Sec. 4. Minnesota Statutes 2012, section 13.09, is amended to read:
5.213.09 PENALTIES.
5.3(a) Any person who willfully violates the provisions of this chapter or any rules
5.4adopted under this chapter or whose conduct constitutes the knowing unauthorized
5.5acquisition of not public data, as defined in section 13.055, subdivision 1, is guilty of a
5.6misdemeanor.
5.7(b) Willful violation of this chapter
5.8penalty under paragraph (a), by any public employee constitutes just cause for suspension
5.9without pay or dismissal of the public employee.
5.10EFFECTIVE DATE.This section is effective August 1, 2014, and applies to crimes
5.11committed on or after that date.