HF 3259

as introduced - 90th Legislature (2017 - 2018) Posted on 03/14/2018 12:30pm

A bill for an act
relating to government data practices; modifying requirements for mandatory
biennial audits of automatic license plate reader data and police body camera data;
amending Minnesota Statutes 2016, sections 13.824, subdivisions 5, 6, 8; 13.825,
subdivisions 7, 9.

BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF MINNESOTA:

Section 1.

Minnesota Statutes 2016, section 13.824, subdivision 5, is amended to read:

Subd. 5.

Log of use required.

(a) A law enforcement agency that installs or uses an
automated license plate reader must maintain a public log of its use, including but not limited
to:

(1) specific times of day that the reader actively collected data;

(2) the aggregate number of vehicles or license plates on which data are collected for
each period of active use and a list of all state and federal databases with which the data
were compared, unless the existence of the database itself is not public;

(3) for each period of active use, the number of vehicles or license plates deleted text begin in each of the
following categories where the data identify a vehicle or license plate that has been stolen,
a warrant for the arrest of the owner of the vehicle or an owner with a suspended or revoked
driver's license or similar category, or are active investigative data; and deleted text end new text begin on which data are
collected:
new text end

new text begin (i) that identify a vehicle or license plate that has been stolen;
new text end

new text begin (ii) that identify a vehicle whose owner has an outstanding arrest warrant;
new text end

new text begin (iii) that identify a vehicle whose owner has a suspended, revoked, or canceled driver's
license;
new text end

new text begin (iv) that identify a vehicle whose owner is associated with other information providing
reasonable suspicion to conduct a traffic stop;
new text end

new text begin (v) where the collected data results in an arrest; and
new text end

new text begin (vi) where the collected data are classified as active investigative data; and
new text end

(4) for a reader at a stationary or fixed location, the location at which the reader actively
collected data and is installed and used.

(b) The law enforcement agency must maintain a list of the current and previous locations,
including dates at those locations, of any fixed stationary automated license plate readers
or other surveillance devices with automated license plate reader capability used by the
agency. The agency's list must be accessible to the public, unless the agency determines
that the data are security information as provided in section 13.37, subdivision 2. A
determination that these data are security information is subject to in-camera judicial review
as provided in section 13.08, subdivision 4.

Sec. 2.

Minnesota Statutes 2016, section 13.824, subdivision 6, is amended to read:

Subd. 6.

Biennial audit.

(a) deleted text begin In addition to the log required under subdivision 5, the law
enforcement agency must maintain records showing the date and time automated license
plate reader data were collected and the applicable classification of the data. The law
enforcement agency shall arrange for an independent, biennial audit of the records to
determine whether data currently in the records are classified, how the data are used, whether
they are destroyed as required under this section, and to verify compliance with subdivision
7. If the commissioner of administration believes that a law enforcement agency is not
complying with this section or other applicable law, the commissioner may order a law
enforcement agency to arrange for additional independent audits. Data in the records required
under this paragraph are classified as provided in subdivision 2. deleted text end new text begin A law enforcement agency
that installs or uses an automatic license plate reader must contract with a private auditing
firm to perform an independent, biennial audit of the agency's automated license plate reader
data to verify compliance with this section. By July 1 of each odd-numbered year, the agency
must provide a report on the results of each audit to the commissioner of administration, to
the chair and ranking minority members of the legislative committees with jurisdiction over
data practices and public safety issues, and to the Legislative Commission on Data Practices
and Personal Data Privacy.
new text end

(b) The deleted text begin results of the deleted text end audit deleted text begin are deleted text end new text begin report is new text end public. new text begin The audit report must include and assess
the compliance of the following information:
new text end

new text begin (1) the number of automated license plate readers used by the agency, including the
brand and model of each reader, whether the reader is mobile or stationary, and contact
information for the agency's automated license plate reader vendor;
new text end

new text begin (2) all information in the log of use required by subdivision 5, aggregated and summarized
for the biennial period; and
new text end

new text begin (3) all agency policies and procedures regarding automated license plate readers and
automated license plate reader data including, but not limited to, policies and procedures
regarding classification of the data, role-based access and data security, data retention and
destruction, and data sharing.
new text end

new text begin (c) new text end The commissioner of administration shall review the deleted text begin results of the deleted text end audit new text begin report new text end . new text begin If,
based on the audit report, the commissioner of administration believes that a law enforcement
agency is not complying with this section or other applicable law, the commissioner may
order a law enforcement agency to arrange for additional independent audits. new text end If the
commissioner determines that there is a pattern of substantial noncompliance with this
section by the law enforcement agency, the agency must immediately suspend operation of
all automated license plate reader devices until the commissioner has authorized the agency
to reinstate their use. An order of suspension under this paragraph may be issued by the
commissioner, upon review of the deleted text begin results of the deleted text end audit new text begin report new text end , review of the applicable
provisions of this chapter, and after providing the agency a reasonable opportunity to respond
to the audit's findings.

deleted text begin (c) A report summarizing the results of each audit must be provided to the commissioner
of administration, to the chair and ranking minority members of the committees of the house
of representatives and the senate with jurisdiction over data practices and public safety
issues, and to the Legislative Commission on Data Practices and Personal Data Privacy no
later than 30 days following completion of the audit.
deleted text end

Sec. 3.

Minnesota Statutes 2016, section 13.824, subdivision 8, is amended to read:

Subd. 8.

Notification to Bureau of Criminal Apprehension.

(a) Within ten days of
deleted text begin the installation or current use of deleted text end new text begin acquiring new text end an automated license plate reader or the integration
of automated license plate reader technology into another surveillance device, a law
enforcement agency must notify the Bureau of Criminal Apprehension deleted text begin of that installation
or use deleted text end new text begin that it has begun using automated license plate reader technology new text end and of any fixed
location of a stationary automated license plate reader.

(b) The Bureau of Criminal Apprehension must maintain a list of law enforcement
agencies using automated license plate readers or other surveillance devices with automated
license plate reader capability, including new text begin the date that the agency first began using the
technology and the new text end locations of any fixed stationary automated license plate readers or other
devices. Except to the extent that the law enforcement agency determines that the location
of a specific reader or other device is security information, as defined in section 13.37, this
list is accessible to the public and must be available on the bureau's Web site. A determination
that the location of a reader or other device is security information is subject to in-camera
judicial review, as provided in section 13.08, subdivision 4.

Sec. 4.

Minnesota Statutes 2016, section 13.825, subdivision 7, is amended to read:

Subd. 7.

Authorization to access data.

(a) A law enforcement agency must comply
with sections 13.05, subdivision 5, and 13.055 in the operation of portable recording systems
and in maintaining portable recording system data.

(b) The responsible authority for a law enforcement agency must establish written
procedures to ensure that law enforcement personnel have access to the portable recording
system data that are not public only if authorized in writing by the chief of police, sheriff,
or head of the law enforcement agency, or their designee, to obtain access to the data deleted text begin for a
legitimate, specified law enforcement purpose deleted text end new text begin based on a reasonable suspicion that the data
are pertinent to an active criminal investigation new text end . new text begin Consistent with the requirements of
paragraph (c), each access must include a record of the factual basis for the access and any
associated case number, complaint, or incident that is the basis for the access.
new text end

new text begin (c) The ability of authorized individuals to enter, update, or access portable recording
system data must be limited through the use of role-based access that corresponds to the
official duties or training level of the individual and the statutory authorization that grants
access for that purpose. All queries and responses, and all actions in which data are entered,
updated, accessed, shared, or disseminated, must be recorded in a data audit trail. Data
contained in the audit trail are public to the extent that the data are not otherwise classified
by law.
new text end

Sec. 5.

Minnesota Statutes 2016, section 13.825, subdivision 9, is amended to read:

Subd. 9.

Biennial audit.

(a) deleted text begin A law enforcement agency must maintain records showing
the date and time portable recording system data were collected and the applicable
classification of the data. The law enforcement agency shall arrange for an independent,
biennial audit of the data to determine whether data are appropriately classified according
to this section, how the data are used, and whether the data are destroyed as required under
this section, and to verify compliance with subdivisions 7 and 8. If the governing body with
jurisdiction over the budget of the agency determines that the agency is not complying with
this section or other applicable law, the governing body may order additional independent
audits. Data in the records required under this paragraph are classified as provided in
subdivision 2. deleted text end new text begin A law enforcement agency that uses a portable recording system must contract
with a private auditing firm to perform an independent, biennial audit of the agency's portable
recording system data to verify compliance with this section. By July 1 of each odd-numbered
year, the agency must provide a report on the results of each audit to the commissioner of
administration, to the chair and ranking minority members of the legislative committees
with jurisdiction over data practices and public safety issues, and to the Legislative
Commission on Data Practices and Personal Data Privacy.
new text end

(b) The deleted text begin results of the deleted text end audit deleted text begin are deleted text end new text begin report required under paragraph (a) is new text end public deleted text begin , except for
data that are otherwise classified under law. deleted text end new text begin and must include and assess the compliance
of:
new text end

new text begin (1) all information required by subdivision 5, aggregated and summarized for the biennial
period where helpful for comprehension; and
new text end

new text begin (2) all agency policies and procedures regarding portable recording systems and portable
recording system data including, but not limited to, policies and procedures regarding
classification of the data, role-based access and data security, data retention and destruction,
and data sharing.
new text end

new text begin (c) new text end The deleted text begin governing body with jurisdiction over the budget of the law enforcement agency deleted text end
new text begin commissioner of administration new text end shall review the deleted text begin results of the deleted text end audit new text begin report new text end . new text begin If, based on the
audit report, the commissioner of administration believes that a law enforcement agency is
not complying with this section or other applicable law, the commissioner may order a law
enforcement agency to arrange for additional independent audits. new text end If the deleted text begin governing body deleted text end
new text begin commissioner new text end determines that there is a pattern of substantial noncompliance with this
section new text begin by the law enforcement agency new text end , the deleted text begin governing body deleted text end new text begin agency new text end must deleted text begin order that deleted text end
new text begin immediately suspend new text end operation of all portable recording systems deleted text begin be suspended deleted text end until the
deleted text begin governing body deleted text end new text begin commissioner new text end has authorized the agency to reinstate their use. An order of
suspension under this paragraph may deleted text begin only be made deleted text end new text begin be issued by the commissioner new text end following
review of the deleted text begin results of the deleted text end audit new text begin report new text end and review of the applicable provisions of this
chapter, and after providing the agency deleted text begin and members of the public deleted text end a reasonable opportunity
to respond to the audit's findings deleted text begin in a public meeting deleted text end .

deleted text begin (c) A report summarizing the results of each audit must be provided to the governing
body with jurisdiction over the budget of the law enforcement agency and to the Legislative
Commission on Data Practices and Personal Data Privacy no later than 60 days following
completion of the audit.
deleted text end