1.1 	A bill for an act
1.2 	relating to government data practices; providing for
1.3 	treatment of data held by the comprehensive
1.4 	incident-based reporting system; proposing coding for
1.5 	new law in Minnesota Statutes, chapter 299C.
1.6 	BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF MINNESOTA:

1.7 	Section 1. [299C.40] COMPREHENSIVE INCIDENT-BASED
1.8 	REPORTING SYSTEM.
1.9 		Subdivision 1.Definition. For purposes of this section,
1.10 	"law enforcement agency" means a Minnesota municipal police
1.11 	department, a Minnesota county sheriff's department, the Bureau
1.12 	of Criminal Apprehension, or the Minnesota State Patrol.
1.13 		Subd. 2.Purpose. The Comprehensive Incident-Based
1.14 	Reporting System (CIBRS) is a statewide system in the Department
1.15 	of Public Safety containing data from law enforcement agencies
1.16 	managed by the Bureau of Criminal Apprehension, criminal justice
1.17 	information systems section.  Data in CIBRS must be made
1.18 	available to law enforcement agencies only for purposes of
1.19 	criminal investigations being conducted in order to prepare a
1.20 	case against a person, whether known or unknown, for the
1.21 	commission of a crime or other offense, or for purposes of
1.22 	background investigations required by state statute.
1.23 		Subd. 3.Data classification; general rule; changes in
1.24 	classification; audit trail. (a) Submitting data to CIBRS does
1.25 	not change the classification of the data in the law enforcement
2.1 	agency that submitted the data.
2.2 	(b) Data on individuals created, collected, received,
2.3 	maintained, or disseminated by CIBRS is classified as
2.4 	confidential data on individuals as defined in section 13.02,
2.5 	subdivision 3, and becomes private data on individuals as
2.6 	defined in section 13.02, subdivision 12, as provided by this
2.7 	subdivision.
2.8 	(c) Data not on individuals created, collected, received,
2.9 	maintained, or disseminated by CIBRS is classified as protected
2.10 	nonpublic data as defined in section 13.02, subdivision 13, and
2.11 	becomes nonpublic data as defined in section 13.02, subdivision
2.12 	9, as provided by this subdivision.
2.13 	(d) Confidential or protected nonpublic data created,
2.14 	collected, received, maintained, or disseminated by CIBRS must
2.15 	automatically change classification from confidential data on
2.16 	individuals to private data on individuals or from protected
2.17 	nonpublic data to nonpublic data on the earlier of the following
2.18 	dates:
2.19 	(1) upon receipt by CIBRS of notice from a law enforcement
2.20 	agency that an investigation has become inactive; or 
2.21 	(2) when the data has not been updated by the law
2.22 	enforcement agency that submitted it for a period of 120 days.
2.23 	(e) For purposes of this section, an investigation becomes
2.24 	inactive upon the occurrence of any of the events listed in
2.25 	section 13.82, subdivision 7, clauses (a) to (c).
2.26 	(f) Ten days before making a data classification change
2.27 	under this subdivision, CIBRS must notify the law enforcement
2.28 	agency that submitted the data that a classification change will
2.29 	be made on the 120th day.  The notification must inform the
2.30 	agency that the data will retain its classification as
2.31 	confidential or protected nonpublic data if the agency modifies
2.32 	the data or notifies CIBRS that the investigation is still
2.33 	active before the 120th day.  A new 120-day period begins
2.34 	running upon modification of data or notice by a law enforcement
2.35 	agency to CIBRS that an active investigation is continuing.
2.36 	(g) A law enforcement agency that submits data to the
3.1 	Bureau of Criminal Apprehension through CIBRS must notify the
3.2 	Bureau of Criminal Apprehension through CIBRS if an
3.3 	investigation has become inactive, so that the data is
3.4 	classified as private data on individuals or nonpublic data.
3.5 	The law enforcement agency must provide this notice to the
3.6 	Bureau of Criminal Apprehension through CIBRS within ten days
3.7 	after an investigation becomes inactive.
3.8 	(h) All queries and responses, and all actions in which
3.9 	data is submitted to CIBRS, changes classification, or is
3.10 	disseminated by CIBRS to any law enforcement agency must be
3.11 	recorded in the CIBRS audit trail.
3.12 		Subd. 4.Access to cibrs data by law enforcement agency
3.13 	personnel. Only law enforcement agency personnel with
3.14 	certification from the Bureau of Criminal Apprehension may
3.15 	access CIBRS data.  Access to CIBRS data by particular law
3.16 	enforcement agency personnel may be limited through the use of
3.17 	purpose codes that correspond to the official duties and
3.18 	training level of the personnel.
3.19 		Subd. 5.Access to cibrs data by data subject. Upon
3.20 	request to the Bureau of Criminal Apprehension, an individual
3.21 	shall be informed whether the individual is the subject of
3.22 	private or confidential data held by CIBRS.  An individual who
3.23 	is the subject of private data held by CIBRS may obtain access
3.24 	to the data by making a request to CIBRS or to the law
3.25 	enforcement agency that submitted the data to CIBRS.  When
3.26 	providing private data to the subject, CIBRS must also include
3.27 	the name of the law enforcement agency that submitted the data
3.28 	to CIBRS and the name, telephone number, and address of the
3.29 	responsible authority of that law enforcement agency.
3.30 		Subd. 6.Challenge to completeness and accuracy of data.
 3.31 	An individual who is the subject of public or private data held
3.32 	by CIBRS and who wants to challenge the completeness or accuracy
3.33 	of the data under section 13.04, subdivision 4, must notify in
3.34 	writing the responsible authority of the law enforcement agency
3.35 	that submitted the data to CIBRS.  A law enforcement agency must
3.36 	notify CIBRS when data is challenged.  The notification must
4.1 	identify the data that was challenged and the subject of the
4.2 	data.  CIBRS must include any notification received under this
4.3 	subdivision whenever disseminating data about which no
4.4 	determination has been made.  When the responsible authority of
4.5 	a law enforcement agency completes, corrects, or destroys
4.6 	successfully challenged data, the corrected data must be
4.7 	submitted to CIBRS and disseminated from that time on.