HF 4340

as introduced - 91st Legislature (2019 - 2020) Posted on 03/11/2020 11:37am

A bill for an act
relating to transportation; providing for an investigation prior to revoking access
to the driver and vehicle services information system; allowing an appeal after
revocation; amending Minnesota Statutes 2018, section 171.12, subdivision 1a.

BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF MINNESOTA:

Section 1.

Minnesota Statutes 2018, section 171.12, subdivision 1a, is amended to read:

Subd. 1a.

Driver and vehicle services information system; security and auditing.

(a)
The commissioner must establish written procedures to ensure that only individuals
authorized by law may enter, update, or access not public data collected, created, or
maintained by the driver and vehicle services information system. An authorized individual's
ability to enter, update, or access data in the system must correspond to the official duties
or training level of the individual and to the statutory authorization granting access for that
purpose. All queries and responses, and all actions in which data are entered, updated,
accessed, shared, or disseminated, must be recorded in a data audit trail. Data contained in
the audit trail are public to the extent the data are not otherwise classified by law.

(b) new text begin If the commissioner has reason to believe that an individual willfully entered, updated,
accessed, shared, or disseminated data in violation of state or federal law, the commissioner
must conduct an investigation to determine if state or federal law has been violated. The
commissioner must give the individual who is the subject of the investigation notice of the
investigation and provide an opportunity for the individual to participate in the investigation.
If the commissioner determines that the investigation shows that the individual willfully
entered, updated, accessed, shared, or disseminated data in violation of state or federal law,
new text end the commissioner must immediately and permanently revoke the authorization of deleted text begin any deleted text end new text begin that
new text end individual deleted text begin who willfully entered, updated, accessed, shared, or disseminated data in violation
of state or federal law deleted text end . new text begin An individual who has had authorization revoked may initiate a
contested case proceeding under chapter 14 within 60 days of the revocation. An individual
aggrieved by a final decision in the contested case regarding revocation is entitled to judicial
review of the decision as provided in sections 14.63 to 14.68. new text end If deleted text begin an deleted text end new text begin the commissioner
determines that the investigation shows that the new text end individual willfully gained access to data
without authorization by law, the commissioner must forward the matter to the appropriate
prosecuting authority for prosecution.

(c) The commissioner must arrange for an independent biennial audit of the driver and
vehicle services information system to determine whether data currently in the system are
classified correctly, how the data are used, and to verify compliance with this subdivision.
The results of the audit are public. No later than 30 days following completion of the audit,
the commissioner must provide a report summarizing the audit results to the commissioner
of administration; the chairs and ranking minority members of the committees of the house
of representatives and the senate with jurisdiction over transportation policy and finance,
public safety, and data practices; and the Legislative Commission on Data Practices and
Personal Data Privacy. The report must be submitted as required under section 3.195, except
that printed copies are not required.