1.1 	A bill for an act
1.2 	relating to public safety; classifying criminal intelligence data under the Data 
1.3 	Practices Act; establishing standards;proposing coding for new law in Minnesota Statutes, chapter 13.1.5 	BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF MINNESOTA:

1.6 	Section 1. [13.824] CRIMINAL INTELLIGENCE DATA.
1.7 		Subdivision 1.Definitions. (a) The terms defined in this section have the meanings 
1.8 	given them.
1.9 	(b) "Association data" means data that document the associations or activities of a 
1.10 	person and that are about that person's political, religious, or social views.
1.11 	(c) "Criminal intelligence data" means data a law enforcement agency uses to 
1.12 	anticipate, prevent, or monitor possible criminal or terrorist activity by a person. Criminal 
1.13 	intelligence data does not include association data unless the association data have a direct 
1.14 	relationship to criminal or terrorist activities by a person.
1.15 	(d) "Criminal intelligence data assessment" means an analysis based on criminal 
1.16 	intelligence data.
1.17 	(e) "Criminal predicate" means sufficient, articulable facts, along with rational 
1.18 	inferences from those facts, to give employees working under the supervision of a law 
1.19 	enforcement agency a basis to believe that there is a reasonable possibility that a person is 
1.20 	involved in criminal or terrorist activity.
1.21 	(f) "Critical infrastructure" means physical or virtual assets that, when incapacitated 
1.22 	or destroyed, would have a debilitating impact on the physical or economic security, 
1.23 	public health, or public safety of the citizens of the state.
2.1 	(g) "Law enforcement agency" means a government agency at the federal, state, or 
2.2 	local level, including agencies in other states, that are charged with detecting criminal 
2.3 	activity, enforcing criminal laws, or protecting critical infrastructure.
2.4 	(h) "Terrorist activity" means acts dangerous to human life that violate the criminal 
2.5 	laws of this state or the United States and appear to be intended to:
2.6 	(1) intimidate or coerce the civilian population;
2.7 	(2) influence the policy of the state by intimidation or coercion; or
2.8 	(3) affect the state by mass destruction, assassination, or kidnapping.
2.9 	(i) "Threat of imminent serious harm" means a credible impending threat to the 
2.10 	safety of a person, government entity, or property.
2.11 		Subd. 2.Data classification and retention. (a) Criminal intelligence data are 
2.12 	classified as confidential data on individuals or protected nonpublic data for a period of 
2.13 	one year. After one year, the data classification changes to private data on individuals or 
2.14 	nonpublic data unless the following criteria are met:
2.15 	(1) the source of the data is reliable and verifiable;
2.16 	(2) the person alleged to be involved in criminal activity can be identified;
2.17 	(3) the allegations of criminal activity are supported by a criminal predicate;
2.18 	(4) the data were collected in a lawful manner; and
2.19 	(5) the data are accurate and current.
2.20 	If the criteria are met, the data remain classified as confidential data on individuals 
2.21 	or protected nonpublic data.
2.22 	(b) The informed consent of the subject of the data is not effective if the data are 
2.23 	classified as private data on individuals or nonpublic data.
2.24 	(c) Notwithstanding any other law to the contrary, data that have changed 
2.25 	classification as required by paragraph (a) shall not be maintained by a government entity 
2.26 	for more than three years from the last date the classification changed.
2.27 	(d) If, prior to the destruction required by paragraph (c), the criteria in paragraph (a) 
2.28 	can be met, the data classification reverts to confidential data on individuals or protected 
2.29 	nonpublic data.
2.30 	(e) Criminal intelligence data assessments and dissemination records are classified 
2.31 	as confidential data on individuals or protected nonpublic data.
2.32 		Subd. 3.Sharing authorized. (a) Criminal intelligence data may be shared with:
2.33 	(1) a law enforcement agency, if the recipient demonstrates a criminal predicate 
2.34 	related to the data requested;
2.35 	(2) a law enforcement agency to charge a person with a crime or allege that a 
2.36 	juvenile is delinquent;
3.1 	(3) a person or government entity when the dissemination is needed to protect the 
3.2 	person, government entity, or property from the threat of imminent serious harm;
3.3 	(4) a person or government entity to protect critical infrastructure;
3.4 	(5) a law enforcement agency conducting the background check required by section 
3.5 	626.87; or
3.6 	(6) the public to promote public health or safety or to dispel widespread rumor 
3.7 	or unrest.
3.8 	(b) Criminal intelligence data assessments may be shared with:
3.9 	(1) a law enforcement agency;
3.10 	(2) a person or government entity when the dissemination is needed to protect the 
3.11 	person, government entity, or property from the threat of imminent serious harm;
3.12 	(3) a person or government entity to protect critical infrastructure; or
3.13 	(4) the public to promote public health or safety or to dispel widespread rumor 
3.14 	or unrest.
3.15 		Subd. 4.Data prohibitions. (a) Unless there is a criminal predicate, a law 
3.16 	enforcement agency may not maintain or use criminal intelligence data.
3.17 	(b) Association data may not be maintained by a Minnesota law enforcement agency 
3.18 	or shared with any law enforcement agency.
3.19 		Subd. 5.Dissemination record. A law enforcement agency shall keep a 
3.20 	dissemination record of each sharing made under subdivision 3, paragraph (a).

3.21 	Sec. 2. [13.8735] CRIMINAL INTELLIGENCE SYSTEMS.
3.22 		Subdivision 1.Definitions. (a) For purposes of this section, the terms in this 
3.23 	subdivision have the meanings given them.
3.24 	(b) "Criminal intelligence data" means data that has been evaluated to determine 
3.25 	that it:
3.26 	(1) is relevant to the identification of and the criminal activity engaged in by an 
3.27 	individual or organization reasonably suspected of involvement in criminal activity; and
3.28 	(2) meets criminal intelligence system submission criteria.
3.29 	(c) "Criminal intelligence system" or "intelligence system" means the arrangements, 
3.30 	equipment, facilities, and procedures used for the receipt, storage, interagency exchange 
3.31 	or dissemination, and analysis of criminal intelligence data.
3.32 	(d) "Intelligence project" or "project" means the organizational unit that operates an 
3.33 	intelligence system on behalf of and for the benefit of a single agency or the organization 
3.34 	that operates an interjurisdictional intelligence system on behalf of a group of participating 
3.35 	agencies.
4.1 	(e) "Interjurisdictional intelligence system" means an intelligence system that 
4.2 	involves two or more participating agencies representing different government entities 
4.3 	or jurisdictions.
4.4 	(f) "Participating agency" means an agency of local, county, state, federal, or other 
4.5 	governmental unit that exercises law enforcement or criminal investigation authority 
4.6 	and which is authorized to submit and receive criminal intelligence data through an 
4.7 	interjurisdictional intelligence system. A participating agency may be a member or a 
4.8 	nonmember of an interjurisdictional intelligence system.
4.9 	(g) "Validation of data" means the procedures governing the periodic review of 
4.10 	criminal intelligence data to assure its continuing compliance with system submission 
4.11 	criteria established by regulation or program policy.
4.12 		Subd. 2.Operating principles. (a) A project shall collect and maintain criminal 
4.13 	intelligence data concerning an individual only if there is reasonable suspicion that the 
4.14 	individual is involved in criminal conduct or activity and the information is relevant to 
4.15 	that criminal conduct or activity.
4.16 	(b) A project shall not collect or maintain criminal intelligence data about the 
4.17 	political, religious, or social views, associations, or activities of any individual or any 
4.18 	group, association, corporation, business, partnership, or other organization unless the data 
4.19 	directly relates to criminal conduct or activity and there is reasonable suspicion that the 
4.20 	data subject is or may be involved in criminal conduct or activity.
4.21 	(c) Reasonable suspicion or criminal predicate is established when data exists that 
4.22 	establishes sufficient facts to give a trained law enforcement or criminal investigative 
4.23 	agency officer, investigator, or employee a basis to believe that there is a reasonable 
4.24 	possibility that an individual or organization is involved in a definable criminal activity 
4.25 	or enterprise. In an interjurisdictional intelligence system, the project is responsible for 
4.26 	establishing the existence of reasonable suspicion of criminal activity either through 
4.27 	examination of supporting data submitted by a participating agency or by delegation 
4.28 	of this responsibility to a properly trained participating agency that is subject to audit 
4.29 	procedures established by subdivision 4.
4.30 	(d) A project shall not include in any criminal intelligence system data that has 
4.31 	been obtained in violation of any applicable federal, state, or local law or ordinance. 
4.32 	In an interjurisdictional intelligence system, the project is responsible for establishing 
4.33 	that no information is entered in violation of federal, state, or local laws, either through 
4.34 	examination of supporting information submitted by a participating agency or by 
4.35 	delegation of this responsibility to a properly trained participating agency which is subject 
4.36 	to routine inspection and audit procedures established by subdivision 4.
5.1 	(e) A project shall disseminate criminal intelligence data only where there is a need 
5.2 	to know and a right to know the data in the performance of a law enforcement activity.
5.3 	(f) A project shall disseminate criminal intelligence data only to law enforcement 
5.4 	authorities who shall agree to follow procedures regarding data receipt, maintenance, 
5.5 	security, and dissemination which are consistent with this section. This paragraph shall 
5.6 	not limit the dissemination of an assessment of criminal intelligence data to a government 
5.7 	official or to any other individual, when necessary, to avoid imminent danger to life or 
5.8 	property.
5.9 	(g) A project maintaining criminal intelligence data shall adopt administrative, 
5.10 	technical, and physical safeguards, including audit trails, to prevent unauthorized access 
5.11 	and against intentional or unintentional damage. A record indicating who has been 
5.12 	given data, the reason for release of the data, and the date of each dissemination outside 
5.13 	the project shall be kept. Data shall be labeled to indicate levels of sensitivity, levels of 
5.14 	confidence, and the identity of submitting agencies and control officials. Each project 
5.15 	must establish written definitions for the "need to know" and "right to know" standards for 
5.16 	dissemination to other agencies as provided in paragraph (e). The project is responsible 
5.17 	for establishing the existence of an inquirer's need to know and right to know the data 
5.18 	being requested either through inquiry or by delegation of this responsibility to a properly 
5.19 	trained participating agency that is subject to routine inspection and audit procedures 
5.20 	established by the project.
5.21 	(h) A project:
5.22 	(1) where appropriate, must adopt effective and technologically advanced computer 
5.23 	software and hardware designs to prevent unauthorized access to the information 
5.24 	contained in the system;
5.25 	(2) must restrict access to its facilities, operating environment, and documentation 
5.26 	to organizations and personnel authorized by the project;
5.27 	(3) must store data in the system in a manner that prevents the data from being 
5.28 	modified, destroyed, accessed, or purged without authorization;
5.29 	(4) must institute procedures to protect criminal intelligence data from unauthorized 
5.30 	access, theft, sabotage, fire, flood, or other natural or man-made disaster;
5.31 	(5) must adopt rules based on good cause to implement its authority to screen, 
5.32 	reject for employment, transfer, or remove personnel authorized to have direct access 
5.33 	to the system; and
5.34 	(6) may authorize and utilize off-site system databases to the extent that they comply 
5.35 	with these security requirements.
6.1 	(i) All projects shall adopt procedures to ensure that all data retained by a project 
6.2 	has relevancy and importance. The procedures shall provide for the periodic review of 
6.3 	data and the destruction of any data that is misleading, obsolete, or otherwise unreliable, 
6.4 	and shall require that any recipient agencies be advised of any errors or corrections. All 
6.5 	data retained as a result of this review must identify the name of the reviewer, date of 
6.6 	review, and explanation of the decision to retain. Data retained in the system must be 
6.7 	reviewed and validated for continuing compliance with system submission criteria before 
6.8 	the expiration of its retention period, which in no event shall be longer than five years.
6.9 	(j) A project must not purchase or use in the course of the project any electronic, 
6.10 	mechanical, or other device for surveillance purposes that is in violation of sections 
6.11 	626A.01 to 626A.381 and the Electronic Communications Privacy Act of 1986, Public 
6.12 	Law 99-508, United States Code, title 18, sections 2510-2520, 2701-2709, and 3121-3125.
6.13 	(k) A project must not harass or interfere with any lawful political activities as 
6.14 	part of the intelligence operation.
6.15 	(l) A project shall adopt sanctions for unauthorized access, utilization, or disclosure 
6.16 	of data contained in the system.
6.17 	(m) A participating agency of an interjurisdictional intelligence system must 
6.18 	maintain in its agency files data that documents each submission to the system and 
6.19 	supports compliance with project entry criteria. Participating agency files supporting 
6.20 	system submissions must be made available for reasonable audit and inspection as 
6.21 	provided in subdivision 4. 
6.22 		Subd. 3.Supervision. The head of an agency, or an individual expressly delegated 
6.23 	control and supervision by the head of the agency, maintaining an interjurisdictional 
6.24 	criminal intelligence system shall:
6.25 	(1) assume official responsibility and accountability for actions taken in the name of 
6.26 	the joint entity; and
6.27 	(2) certify in writing that the official takes full responsibility and will be accountable 
6.28 	for insuring that the data transmitted to the interjurisdictional system or to participating 
6.29 	agencies will be in compliance with the principles in this chapter.
6.30 	The principles in this section shall be included in bylaws or operating procedures for 
6.31 	each system. Each participating agency, as a condition of participation, must accept in 
6.32 	writing those principles which govern the submission, maintenance, and dissemination 
6.33 	of data included as part of an interjurisdictional system.
6.34 		Subd. 4.Audit of data submitted to system; reports. At least once every three 
6.35 	years, the Bureau of Criminal Apprehension shall conduct periodic audits of criminal 
6.36 	intelligence systems and interjurisdictional criminal intelligence systems for compliance 
7.1 	with this section. The bureau shall have access to the documenting data for purposes 
7.2 	of conducting an audit. The bureau shall conduct the audit in a manner that protects 
7.3 	the confidentiality and sensitivity of participating agency intelligence records.  By 
7.4 	October 1 of each year, the bureau shall submit a report on the results of the audits to the 
7.5 	commissioner of public safety.
7.6 		Subd. 5.Classification of intelligence data. Criminal intelligence data is classified 
7.7 	as confidential data on individuals, or protected nonpublic data.

7.8 	EFFECTIVE DATE. This section is effective August 1, 2012.