SF 3680

2nd Engrossment - 92nd Legislature (2021 - 2022) Posted on 03/24/2022 11:49am

A bill for an act
relating to motor vehicles; modifying provisions regarding access to driver and
vehicle services information system; amending Minnesota Statutes 2020, section
171.12, subdivision 1a.

BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF MINNESOTA:

Section 1.

Minnesota Statutes 2020, section 171.12, subdivision 1a, is amended to read:

Subd. 1a.

Driver and vehicle services information system; security and auditing.

(a)
The commissioner must establish written procedures to ensure that only individuals
authorized by law may enter, update, or access not public data collected, created, or
maintained by the driver and vehicle services information system. An authorized individual's
ability to enter, update, or access data in the system must correspond to the official duties
or training level of the individual and to the statutory authorization granting access for that
purpose. All queries and responses, and all actions in which data are entered, updated,
accessed, shared, or disseminated, must be recorded in a data audit trail. new text begin If an authorized
individual accesses data to resolve an issue and the access does not result in a completed
transaction, the individual must include a notation on the record for the transaction explaining
the business need for accessing the data. new text end Data contained in the audit trail are public to the
extent the data are not otherwise classified by law.

(b) new text begin If new text end the commissioner deleted text begin must immediately and permanently revoke the authorization of
any deleted text end new text begin determines that an new text end individual deleted text begin who deleted text end willfully entered, updated, accessed, shared, or
disseminated data in violation of state or federal law new text begin , the commissioner must impose
disciplinary action new text end . If an individual willfully gained access to data without authorization by
law, the commissioner must forward the matter to the appropriate prosecuting authority for
prosecution. new text begin The commissioner must not impose disciplinary action with regards to an
individual who properly accessed data to complete an authorized transaction or to resolve
an issue that did not result in a completed authorized transaction.
new text end

(c) new text begin If the commissioner imposes disciplinary action, the commissioner must notify the
individual, in writing, of the action, explain the reason for the action, and explain how to
appeal the action. The commissioner must mail the notification within five calendar days
of the action.
new text end

new text begin (d) Within 20 calendar days of the mailing date of the notice required by paragraph (c),
the individual may submit a written request, by mail, for reconsideration to the commissioner.
The commissioner must review the request for reconsideration and issue a decision within
30 days of the mailing date of the request. The commissioner must make a determination
in writing and mail the decision to the individual. If the commissioner determines that the
disciplinary action was inappropriate, the commissioner must rescind the action. If the
commissioner determines the disciplinary action was appropriate, the individual may request
a contested case hearing under chapter 14 within 20 calendar days of the mailing date of
the commissioner's written decision.
new text end

new text begin (e) As an alternative to the process described in paragraph (d), the individual may proceed
to a contested case hearing without first making a request to the commissioner for
reconsideration. In this instance, the individual may initiate a contested case proceeding
within 20 calendar days of the mailing date of the notice required by paragraph (c).
new text end

new text begin (f) new text end The commissioner must arrange for an independent biennial audit of the driver and
vehicle services information system to determine whether data currently in the system are
classified correctly, how the data are used, and to verify compliance with this subdivision.
The results of the audit are public. No later than 30 days following completion of the audit,
the commissioner must provide a report summarizing the audit results to the commissioner
of administration; the chairs and ranking minority members of the committees of the house
of representatives and the senate with jurisdiction over transportation policy and finance,
public safety, and data practices; and the Legislative Commission on Data Practices and
Personal Data Privacy. The report must be submitted as required under section 3.195, except
that printed copies are not required.

new text begin (g) For purposes of this subdivision, "disciplinary action" means a formal or informal
disciplinary measure, including but not limited to requiring corrective action or suspending
or revoking the individual's access to the driver and vehicle information system.
new text end

new text begin EFFECTIVE DATE. new text end

new text begin This section is effective August 1, 2022, and applies to access
to data on or after that date.
new text end