SF 2193

as introduced - 92nd Legislature (2021 - 2022) Posted on 11/09/2021 01:57pm

A bill for an act
relating to government data practices; regulating data collected by the state's
COVID-19 vaccine connector tool; classifying data; requiring a legislative report.

BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF MINNESOTA:

Section 1. new text begin COVID-19 VACCINE CONNECTOR DATA.
new text end

new text begin Subdivision 1. new text end

new text begin Definitions. new text end

new text begin (a) The definitions provided by Minnesota Statutes, section
13.02, apply to this section, except that, for purposes of this section, the following terms
have the meanings given.
new text end

new text begin (b) "Commissioner" means the commissioner of health.
new text end

new text begin (c) "Vaccine connector" means an online tool operated by the state of Minnesota that
allows Minnesota residents to register in order to be notified when they are eligible to receive
a COVID-19 vaccine under the terms of the state's COVID-19 vaccine allocation and
prioritization plan and to provide information on access to COVID-19 vaccines and vaccine
scheduling.
new text end

new text begin (d) "Vaccine connector data" means data on individuals collected, created, received,
maintained, or disseminated by the vaccine connector.
new text end

new text begin Subd. 2. new text end

new text begin Data collection. new text end

new text begin (a) To fully register with the vaccine connector, an individual
must not be required to provide any information except for the following:
new text end

new text begin (1) name;
new text end

new text begin (2) address;
new text end

new text begin (3) phone number or e-mail address;
new text end

new text begin (4) date of birth;
new text end

new text begin (5) occupation;
new text end

new text begin (6) health information necessary to determine vaccine priority; and
new text end

new text begin (7) need for a language interpreter.
new text end

new text begin (b) The vaccine connector may collect information from individuals in addition to any
required information under paragraph (a), but the vaccine connector must clearly and
explicitly inform individuals that they may decline to provide the additional information
and that doing so will not affect any services provided as a result of registration.
new text end

new text begin Subd. 3. new text end

new text begin Data classification. new text end

new text begin Vaccine connector data are classified as private data on
individuals.
new text end

new text begin Subd. 4. new text end

new text begin Data sharing and controls. new text end

new text begin (a) The commissioner and any government entity
that receives vaccine connector data may only use vaccine connector data to:
new text end

new text begin (1) alert individuals when they are eligible to receive a COVID-19 vaccine;
new text end

new text begin (2) connect individuals to resources to schedule a COVID-19 vaccine appointment;
new text end

new text begin (3) notify individuals if there are COVID-19 vaccine opportunities in their area; and
new text end

new text begin (4) prepare summary data as authorized by Minnesota Statutes, section 13.05, subdivision
7.
new text end

new text begin Any other use of vaccine connector data is prohibited.
new text end

new text begin (b) Notwithstanding any law to the contrary, the commissioner must not share vaccine
connector data with any government entity or person unless:
new text end

new text begin (1) the data subject has been informed that the specific government entity or person may
receive vaccine connector data about the subject; and
new text end

new text begin (2) the data subject has affirmatively consented to data sharing with that government
entity or person.
new text end

new text begin (c) The commissioner must establish written procedures to ensure that only individuals
authorized by the commissioner may enter, update, or access vaccine connector data. An
authorized individual's ability to enter, update, or access vaccine connector data must
correspond to the official duties or training level of the individual and to the statutory
authorization granting access for that purpose. All queries and responses, and all actions in
which data are entered, updated, accessed, shared, or disseminated, must be recorded in a
data audit trail. When vaccine connector data is disseminated outside of the Department of
Health, the data audit trail must record the government entity or person who received the
data. Data contained in the audit trail that identify individuals are classified as private data
on individuals. The audit trail must also be available in a public format that does not identify
individuals or include other information that could uniquely identify an individual.
new text end

new text begin Subd. 5. new text end

new text begin Data destruction mandate. new text end

new text begin (a) Notwithstanding Minnesota Statutes, section
138.163, the commissioner must destroy vaccine connector data by one year after the date
the data was initially collected or by June 1, 2022, whichever is earlier.
new text end

new text begin (b) Notwithstanding Minnesota Statutes, section 138.163, the commissioner must destroy
vaccine connector data about an individual upon written request from that individual. On
the vaccine connector website, the commissioner must provide a link allowing individuals
to submit a request for data destruction under this paragraph.
new text end

new text begin (c) Vaccine connector data must be destroyed in a way that prevents its contents from
being determined.
new text end

new text begin Subd. 6. new text end

new text begin Audit required. new text end

new text begin By April 1, 2022, the commissioner must have arranged for
and completed an independent audit of the vaccine connector system to verify compliance
with this section. The results of the audit are public. No later than 30 days following
completion of the audit, the commissioner must provide a report summarizing the audit
results to the chairs and ranking minority members of the committees of the house of
representatives and the senate with jurisdiction over health policy and finance and data
practices and the Legislative Commission on Data Practices and Personal Data Privacy.
The report must be submitted as required under Minnesota Statutes, section 3.195, except
that printed copies are not required.
new text end

new text begin Subd. 7. new text end

new text begin Remedies for violation. new text end

new text begin The remedies and penalties available in Minnesota
Statutes, sections 13.08, 13.085, and 13.09, apply to this section. In a civil action under
Minnesota Statutes, section 13.08, exemplary damages are available for a violation of this
section even if the violation was not willful.
new text end

new text begin EFFECTIVE DATE. new text end

new text begin This section is effective the day following final enactment.
new text end