HF 4647

as introduced - 93rd Legislature (2023 - 2024) Posted on 03/07/2024 02:44pm

A bill for an act
relating to data practices; modifying certain data practices provisions to modernize
and update data storage practices; amending Minnesota Statutes 2022, sections
13.05, subdivision 5; 13.055, subdivision 2; 13.08, subdivision 1; 13.40, subdivision
2; 15.17, subdivisions 1, 2; 138.17, subdivision 1.

BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF MINNESOTA:

Section 1.

Minnesota Statutes 2022, section 13.05, subdivision 5, is amended to read:

Subd. 5.

Data protection.

(a) The responsible authority shall:

(1) establish procedures to assure that all data on individuals is accurate, complete, and
current for the purposes for which it was collected;

(2) establish appropriate security safeguards for all records containing data on individuals,
including procedures for ensuring that data that are not public are only accessible to persons
whose work assignment reasonably requires access to the data, and is only being accessed
by those persons for purposes described in the procedure; deleted text begin and
deleted text end

new text begin (3) establish procedures for monitoring access to private or confidential data on
individuals; and
new text end

deleted text begin (3) deleted text end new text begin (4) new text end develop a policy incorporating these procedures, which may include a model
policy governing access to the data if sharing of the data with other government entities is
authorized by law.

(b) When not public data is being disposed of, the data must be destroyed in a way that
prevents its contents from being determined.

Sec. 2.

Minnesota Statutes 2022, section 13.055, subdivision 2, is amended to read:

Subd. 2.

Notice to individuals; investigation report.

(a) A government entity that
collects, creates, receives, maintains, or disseminates private or confidential data on
individuals must disclose deleted text begin any deleted text end new text begin a new text end breach of the security of the data deleted text begin following discovery or
notification of the breach. deleted text end new text begin if:
new text end

new text begin (1) the data is personal information as defined under section 325E.61, subdivision 1,
paragraphs (e) and (f);
new text end

new text begin (2) the data is data on a minor child; or
new text end

new text begin (3) the unauthorized access to or acquisition of data is by an employee, contractor, or
agent of the government entity with the intent to use the data for nongovernmental purposes.
new text end

new text begin (b) new text end Written notification must be made to deleted text begin any deleted text end new text begin the new text end individual who is the subject of the
data deleted text begin and whose private or confidential data was, or is reasonably believed to have been,
acquired by an unauthorized person deleted text end new text begin identified in paragraph (a) new text end and must inform the individual
that a report will be prepared under paragraph deleted text begin (b) deleted text end new text begin (c) new text end , how the individual may obtain access
to the report, and that the individual may request delivery of the report by mail or email.
The disclosure must be made in the most expedient time possible and without unreasonable
delay, consistent with (1) the legitimate needs of a law enforcement agency as provided in
subdivision 3; or (2) any measures necessary to determine the scope of the breach and restore
the reasonable security of the data.

deleted text begin (b) deleted text end new text begin (c) new text end Notwithstanding section 13.15 or 13.37, upon completion of an investigation into
any breach in the security of data and final disposition of any disciplinary action for purposes
of section 13.43, including exhaustion of all rights of appeal under any applicable collective
bargaining agreement, the responsible authority shall prepare a report on the facts and results
of the investigation. If the breach involves unauthorized access to or acquisition of data by
an employee, contractor, or agent of the government entity, the report must at a minimum
include:

(1) a description of the type of data that were accessed or acquired;

(2) the number of individuals whose data was improperly accessed or acquired;

(3) if there has been final disposition of disciplinary action for purposes of section 13.43,
the name of each employee determined to be responsible for the unauthorized access or
acquisition, unless the employee was performing duties under chapter 5B; and

(4) the final disposition of any disciplinary action taken against each employee in
response.

Sec. 3.

Minnesota Statutes 2022, section 13.08, subdivision 1, is amended to read:

Subdivision 1.

Action for damages.

Notwithstanding section 466.03, a responsible
authority or government entity which violates any provision of this chapter is liable to deleted text begin a
person deleted text end new text begin the subject of the data, a parent or guardian of a minor subject of the data, new text end or
representative of a decedent who suffers any damage as a result of the violation, and the
deleted text begin person damaged deleted text end new text begin the subject of the data, a parent or guardian of a minor subject of the data, new text end
or a representative in the case of private data on decedents or confidential data on decedents
may bring an action against the responsible authority or government entity to cover any
damages sustained, plus costs and reasonable attorney fees. In the case of a willful violation,
the government entity shall, in addition, be liable to exemplary damages of not less than
$1,000, nor more than $15,000 for each violation. The state is deemed to have waived any
immunity to a cause of action brought under this chapter.

Sec. 4.

Minnesota Statutes 2022, section 13.40, subdivision 2, is amended to read:

Subd. 2.

Private data; library deleted text begin borrowers deleted text end new text begin patrons new text end .

(a) Except as provided in paragraph
(b) new text begin or pursuant to a court order new text end , the following data maintained by a library are private data
on individuals and may not be disclosed for other than library purposes deleted text begin except pursuant to
a court order deleted text end :

(1) data that link a library patron's name with materials requested or borrowed by the
patron or that link a patron's name with a specific subject about which the patron has
requested information or materials; deleted text begin or
deleted text end

(2) data in applications for new text begin patron new text end borrower cards, other than the name of the borrower deleted text begin . deleted text end new text begin ;
and
new text end

new text begin (3) the names of minor children library patrons maintained in library records.
new text end

(b) A library may release reserved materials to a family member or other person who
resides with a library patron and who is picking up the material on behalf of the patron. A
patron may request that reserved materials be released only to the patron.

new text begin (c) Section 13.04, subdivision 2, does not apply to data classified under paragraph (a),
clause (3).
new text end

Sec. 5.

Minnesota Statutes 2022, section 15.17, subdivision 1, is amended to read:

Subdivision 1.

Must be kept.

All officers and agencies of the state, counties, cities,
towns, school districts, municipal subdivisions or corporations, or other public authorities
or political entities within the state, hereinafter "public officer," shall make and preserve
all records deleted text begin necessary to deleted text end new text begin pursuant to state law or in connection with the transaction of public
business for new text end a full and accurate knowledge of their official activities new text begin regardless of the record's
physical form or storage media new text end . deleted text begin Government records may be produced in the form of
computerized records. deleted text end All government records shall be made deleted text begin on a physical medium of a deleted text end new text begin in
a manner and new text end quality to insure permanent records. Every public officer is empowered to
reproduce records deleted text begin if the records are not deemed to be of permanent or archival value by the
commissioner of administration and the records disposition panel under section 138.17. The
public officer is empowered to reproduce these records by any photographic, photostatic,
microphotographic, optical disk imaging system, microfilming, or other reproduction deleted text end new text begin in a new text end
method that clearly and accurately reproduces the records. Each public officer may order
deleted text begin that those photographs, photostats, microphotographs, microfilms, optical images, or other
reproductions, deleted text end new text begin reproductions new text end be substituted for the originals of them. new text begin Records that are
reproduced when so ordered by any public officer are admissible as evidence in all courts
and proceedings of every kind. A certified or exemplified copy of the reproduction has the
same effect and weight as evidence as would a certified or exemplified copy of the original.
new text end The public officer may direct the destruction or sale for salvage or other disposition of the
originals from which they were made, in accordance with the disposition requirements of
section 138.17. deleted text begin Photographs, photostats, microphotographs, microfilms, optical images, or
other reproductions are for all purposes deemed the original recording of the papers, books,
documents, and records reproduced when so ordered by any public officer and are admissible
as evidence in all courts and proceedings of every kind. A facsimile or exemplified or
certified copy of a photograph, photostat, microphotograph, microfilm, optical image, or
other reproduction, or an enlargement or reduction of it, has the same effect and weight as
evidence as would a certified or exemplified copy of the original.
deleted text end

Sec. 6.

Minnesota Statutes 2022, section 15.17, subdivision 2, is amended to read:

Subd. 2.

Responsibility for records.

The chief administrative officer of each public
agency shall be responsible for the preservation and care of the deleted text begin agency's government records,
which shall include written or printed books, papers, letters, contracts, documents, maps,
plans, computer-based data, and other records made or received pursuant to law or in
connection with the transaction of public business deleted text end new text begin records described in subdivision 1 new text end . It
shall be the duty of each agency, and of its chief administrative officer, to carefully protect
and preserve government records from deterioration, mutilation, loss, or destruction. Records
or record books may be repaired, renovated, or rebound when necessary to preserve them
properly.

Sec. 7.

Minnesota Statutes 2022, section 138.17, subdivision 1, is amended to read:

Subdivision 1.

Destruction, preservation, reproduction of records; prima facie
evidence.

(a) The attorney general, legislative auditor in the case of state records, state
auditor in the case of local records, and director of the Minnesota Historical Society,
hereinafter director, shall constitute the Records Disposition Panel. The members of the
panel shall have power by majority vote to direct the destruction or sale for salvage of
government records determined to be no longer of any value, or to direct the disposition by
gift to the Minnesota Historical Society or otherwise of government records determined to
be valuable for preservation. The Records Disposition Panel may by majority vote order
any of those records to be reproduced deleted text begin by photographic or other means, and order that
photographic or other deleted text end new text begin and that the new text end reproductions be substituted for the originals of them.
new text begin Records that are reproduced when so ordered by the Records Disposition Panel are admissible
as evidence in all courts and proceedings of every kind. A certified or exemplified copy of
the reproduction has the same effect and weight as evidence as would a certified or
exemplified copy of the original. new text end It may direct the destruction or sale for salvage or other
disposition of the originals from which they were made. deleted text begin Photographic or other reproductions
shall for all purposes be deemed the originals of the records reproduced when so ordered
by the records disposition panel, and shall be admissible as evidence in all courts and in
proceedings of every kind. A facsimile, exemplified or certified copy of a photographic,
optical disk imaging, or other reproduction, or an enlargement or reduction of it, shall have
the same effect and weight as evidence as would a certified or exemplified copy of the
original. deleted text end The Records Disposition Panel, by majority vote, may direct the storage of
government records, except as herein provided deleted text begin , and direct the storage of photographic or
other reproductions deleted text end . deleted text begin Photographic or other deleted text end Reproductions substituted for original records
shall be disposed of in accordance with the procedures provided for the original records.

(b) For the purposes of this chapter:

(1) the term "government records" means deleted text begin state and local records, including all cards,
correspondence, discs, maps, memoranda, microfilms, papers, photographs, recordings,
reports, tapes, writings, optical disks, and other data, information, or documentary material,
regardless of physical form or characteristics, storage media or conditions of use, made or
received by an officer or agency of the state and an officer or agency of a county, city, town,
school district, municipal subdivision or corporation or other public authority or political
entity within the state pursuant to state law or in connection with the transaction of public
business by an officer or agency deleted text end new text begin those state or local records which must be preserved under
section 15.17, subdivision 1 new text end ;

(2) the term "state record" means a record of a department, office, officer, commission,
commissioner, board or any other agency, however styled or designated, of the executive
branch of state government; a record of the state legislature; a record of any court, whether
of statewide or local jurisdiction; and any other record designated or treated as a state record
under state law;

(3) the term "local record" means a record of an agency of a county, city, town, school
district, municipal subdivision or corporation or other public authority or political entity;

(4) the term "records" excludes data and information that does not become part of an
official transaction, library and museum material made or acquired and kept solely for
reference or exhibit purposes, extra copies of documents kept only for convenience of
reference and stock of publications and processed documents, and bonds, coupons, or other
obligations or evidences of indebtedness, the destruction or other disposition of which is
governed by other laws;

(5) the term "state archives" means those records preserved or appropriate for preservation
as evidence of the organization, functions, policies, decisions, procedures, operations or
other activities of government or because of the value of the information contained in them,
when determined to have sufficient historical or other value to warrant continued preservation
by the state of Minnesota and accepted for inclusion in the collections of the Minnesota
Historical Society.

(c) If the decision is made to dispose of records by majority vote, the Minnesota Historical
Society may acquire and retain whatever they determine to be of potential historical value.