1.1 	A bill for an act
1.2 	relating to government data practices; modifying requirements for mandatory 
1.3 	biennial audits of automatic license plate reader data and police body camera data;
1.4 	amending Minnesota Statutes 2016, sections 13.824, subdivisions 5, 6, 8; 13.825, 
1.5 	subdivisions 7, 9.
1.6 	BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF MINNESOTA:

1.7 	Section 1. Minnesota Statutes 2016, section 13.824, subdivision 5, is amended to read:
1.8 		Subd. 5.Log of use required. (a) A law enforcement agency that installs or uses an 
1.9 	automated license plate reader must maintain a public log of its use, including but not limited 
1.10 	to:
1.11 	(1) specific times of day that the reader actively collected data;
1.12 	(2) the aggregate number of vehicles or license plates on which data are collected for 
1.13 	each period of active use and a list of all state and federal databases with which the data 
1.14 	were compared, unless the existence of the database itself is not public;
1.15 	(3) for each period of active use, the number of vehicles or license plates ~~in each of the~~ 
1.16 	~~following categories where the data identify a vehicle or license plate that has been stolen,~~ 
1.17 	~~a warrant for the arrest of the owner of the vehicle or an owner with a suspended or revoked~~ 
1.18 	~~driver's license or similar category, or are active investigative data; and~~ on which data are 
1.19 	collected:
1.20 	(i) that identify a vehicle or license plate that has been stolen;
1.21 	(ii) that identify a vehicle whose owner has an outstanding arrest warrant;
2.1 	(iii) that identify a vehicle whose owner has a suspended, revoked, or canceled driver's 
2.2 	license;
2.3 	(iv) that identify a vehicle whose owner is associated with other information providing 
2.4 	reasonable suspicion to conduct a traffic stop;
2.5 	(v) where the collected data results in an arrest; and
2.6 	(vi) where the collected data are classified as active investigative data; and
2.7 	(4) for a reader at a stationary or fixed location, the location at which the reader actively 
2.8 	collected data and is installed and used.
2.9 	(b) The law enforcement agency must maintain a list of the current and previous locations, 
2.10 	including dates at those locations, of any fixed stationary automated license plate readers 
2.11 	or other surveillance devices with automated license plate reader capability used by the 
2.12 	agency. The agency's list must be accessible to the public, unless the agency determines 
2.13 	that the data are security information as provided in section 13.37, subdivision 2. A 
2.14 	determination that these data are security information is subject to in-camera judicial review 
2.15 	as provided in section 13.08, subdivision 4.

2.16 	Sec. 2. Minnesota Statutes 2016, section 13.824, subdivision 6, is amended to read:
2.17 		Subd. 6.Biennial audit. (a) ~~In addition to the log required under subdivision 5, the law~~ 
2.18 	~~enforcement agency must maintain records showing the date and time automated license~~ 
2.19 	~~plate reader data were collected and the applicable classification of the data. The law~~ 
2.20 	~~enforcement agency shall arrange for an independent, biennial audit of the records to~~ 
2.21 	~~determine whether data currently in the records are classified, how the data are used, whether~~ 
2.22 	~~they are destroyed as required under this section, and to verify compliance with subdivision~~ 
2.23 	~~7. If the commissioner of administration believes that a law enforcement agency is not~~ 
2.24 	~~complying with this section or other applicable law, the commissioner may order a law~~ 
2.25 	~~enforcement agency to arrange for additional independent audits. Data in the records required~~ 
2.26 	~~under this paragraph are classified as provided in subdivision 2.~~ A law enforcement agency 
2.27 	that installs or uses an automatic license plate reader must contract with a private auditing 
2.28 	firm to perform an independent, biennial audit of the agency's automated license plate reader 
2.29 	data to verify compliance with this section. By July 1 of each odd-numbered year, the agency 
2.30 	must provide a report on the results of each audit to the commissioner of administration, to 
2.31 	the chair and ranking minority members of the legislative committees with jurisdiction over 
2.32 	data practices and public safety issues, and to the Legislative Commission on Data Practices 
2.33 	and Personal Data Privacy.
3.1 	(b) The ~~results of the~~ audit ~~are~~ report is public. The audit report must include and assess 
3.2 	the compliance of the following information:
3.3 	(1) the number of automated license plate readers used by the agency, including the 
3.4 	brand and model of each reader, whether the reader is mobile or stationary, and contact 
3.5 	information for the agency's automated license plate reader vendor;
3.6 	(2) all information in the log of use required by subdivision 5, aggregated and summarized 
3.7 	for the biennial period; and
3.8 	(3) all agency policies and procedures regarding automated license plate readers and 
3.9 	automated license plate reader data including, but not limited to, policies and procedures 
3.10 	regarding classification of the data, role-based access and data security, data retention and 
3.11 	destruction, and data sharing.
3.12 	(c) The commissioner of administration shall review the ~~results of the~~ audit report. If, 
3.13 	based on the audit report, the commissioner of administration believes that a law enforcement 
3.14 	agency is not complying with this section or other applicable law, the commissioner may 
3.15 	order a law enforcement agency to arrange for additional independent audits. If the 
3.16 	commissioner determines that there is a pattern of substantial noncompliance with this 
3.17 	section by the law enforcement agency, the agency must immediately suspend operation of 
3.18 	all automated license plate reader devices until the commissioner has authorized the agency 
3.19 	to reinstate their use. An order of suspension under this paragraph may be issued by the 
3.20 	commissioner, upon review of the ~~results of the~~ audit report, review of the applicable 
3.21 	provisions of this chapter, and after providing the agency a reasonable opportunity to respond 
3.22 	to the audit's findings.
3.23 	~~(c) A report summarizing the results of each audit must be provided to the commissioner~~ 
3.24 	~~of administration, to the chair and ranking minority members of the committees of the house~~ 
3.25 	~~of representatives and the senate with jurisdiction over data practices and public safety~~ 
3.26 	~~issues, and to the Legislative Commission on Data Practices and Personal Data Privacy no~~ 
3.27 	~~later than 30 days following completion of the audit.~~

3.28 	Sec. 3. Minnesota Statutes 2016, section 13.824, subdivision 8, is amended to read:
3.29 		Subd. 8.Notification to Bureau of Criminal Apprehension. (a) Within ten days of 
3.30 	~~the installation or current use of~~ acquiring an automated license plate reader or the integration 
3.31 	of automated license plate reader technology into another surveillance device, a law 
3.32 	enforcement agency must notify the Bureau of Criminal Apprehension ~~of that installation~~ 
4.1 	~~or use~~ that it has begun using automated license plate reader technology and of any fixed 
4.2 	location of a stationary automated license plate reader.
4.3 	(b) The Bureau of Criminal Apprehension must maintain a list of law enforcement 
4.4 	agencies using automated license plate readers or other surveillance devices with automated 
4.5 	license plate reader capability, including the date that the agency first began using the 
4.6 	technology and the locations of any fixed stationary automated license plate readers or other 
4.7 	devices. Except to the extent that the law enforcement agency determines that the location 
4.8 	of a specific reader or other device is security information, as defined in section 13.37, this 
4.9 	list is accessible to the public and must be available on the bureau's Web site. A determination 
4.10 	that the location of a reader or other device is security information is subject to in-camera 
4.11 	judicial review, as provided in section 13.08, subdivision 4.

4.12 	Sec. 4. Minnesota Statutes 2016, section 13.825, subdivision 7, is amended to read:
4.13 		Subd. 7.Authorization to access data. (a) A law enforcement agency must comply 
4.14 	with sections 13.05, subdivision 5, and 13.055 in the operation of portable recording systems 
4.15 	and in maintaining portable recording system data.
4.16 	(b) The responsible authority for a law enforcement agency must establish written 
4.17 	procedures to ensure that law enforcement personnel have access to the portable recording 
4.18 	system data that are not public only if authorized in writing by the chief of police, sheriff, 
4.19 	or head of the law enforcement agency, or their designee, to obtain access to the data ~~for a~~ 
4.20 	~~legitimate, specified law enforcement purpose~~ based on a reasonable suspicion that the data 
4.21 	are pertinent to an active criminal investigation. Consistent with the requirements of 
4.22 	paragraph (c), each access must include a record of the factual basis for the access and any 
4.23 	associated case number, complaint, or incident that is the basis for the access.
4.24 	(c) The ability of authorized individuals to enter, update, or access portable recording 
4.25 	system data must be limited through the use of role-based access that corresponds to the 
4.26 	official duties or training level of the individual and the statutory authorization that grants 
4.27 	access for that purpose. All queries and responses, and all actions in which data are entered, 
4.28 	updated, accessed, shared, or disseminated, must be recorded in a data audit trail. Data 
4.29 	contained in the audit trail are public to the extent that the data are not otherwise classified 
4.30 	by law.

4.31 	Sec. 5. Minnesota Statutes 2016, section 13.825, subdivision 9, is amended to read:
4.32 		Subd. 9.Biennial audit. (a) ~~A law enforcement agency must maintain records showing~~ 
4.33 	~~the date and time portable recording system data were collected and the applicable~~ 
5.1 	~~classification of the data. The law enforcement agency shall arrange for an independent,~~ 
5.2 	~~biennial audit of the data to determine whether data are appropriately classified according~~ 
5.3 	~~to this section, how the data are used, and whether the data are destroyed as required under~~ 
5.4 	~~this section, and to verify compliance with subdivisions 7 and 8. If the governing body with~~ 
5.5 	~~jurisdiction over the budget of the agency determines that the agency is not complying with~~ 
5.6 	~~this section or other applicable law, the governing body may order additional independent~~ 
5.7 	~~audits. Data in the records required under this paragraph are classified as provided in~~ 
5.8 	~~subdivision 2.~~ A law enforcement agency that uses a portable recording system must contract 
5.9 	with a private auditing firm to perform an independent, biennial audit of the agency's portable 
5.10 	recording system data to verify compliance with this section. By July 1 of each odd-numbered 
5.11 	year, the agency must provide a report on the results of each audit to the commissioner of 
5.12 	administration, to the chair and ranking minority members of the legislative committees 
5.13 	with jurisdiction over data practices and public safety issues, and to the Legislative 
5.14 	Commission on Data Practices and Personal Data Privacy.
5.15 	(b) The ~~results of the~~ audit ~~are~~ report required under paragraph (a) is public~~, except for~~ 
5.16 	~~data that are otherwise classified under law.~~ and must include and assess the compliance 
5.17 	of:
5.18 	(1) all information required by subdivision 5, aggregated and summarized for the biennial 
5.19 	period where helpful for comprehension; and
5.20 	(2) all agency policies and procedures regarding portable recording systems and portable 
5.21 	recording system data including, but not limited to, policies and procedures regarding 
5.22 	classification of the data, role-based access and data security, data retention and destruction, 
5.23 	and data sharing.
5.24 	(c) The ~~governing body with jurisdiction over the budget of the law enforcement agency~~
5.25 	commissioner of administration shall review the ~~results of the~~ audit report. If, based on the 
5.26 	audit report, the commissioner of administration believes that a law enforcement agency is 
5.27 	not complying with this section or other applicable law, the commissioner may order a law 
5.28 	enforcement agency to arrange for additional independent audits. If the ~~governing body~~
5.29 	commissioner determines that there is a pattern of substantial noncompliance with this 
5.30 	section by the law enforcement agency, the ~~governing body~~ agency must ~~order that~~
5.31 	immediately suspend operation of all portable recording systems ~~be suspended~~ until the 
5.32 	~~governing body~~ commissioner has authorized the agency to reinstate their use. An order of 
5.33 	suspension under this paragraph may ~~only be made~~ be issued by the commissioner following 
5.34 	review of the ~~results of the~~ audit report and review of the applicable provisions of this 
6.1 	chapter, and after providing the agency ~~and members of the public~~ a reasonable opportunity 
6.2 	to respond to the audit's findings ~~in a public meeting~~.
6.3 	~~(c) A report summarizing the results of each audit must be provided to the governing~~ 
6.4 	~~body with jurisdiction over the budget of the law enforcement agency and to the Legislative~~ 
6.5 	~~Commission on Data Practices and Personal Data Privacy no later than 60 days following~~ 
6.6 	~~completion of the audit.~~