1.1 	A bill for an act
1.2 	relating to data practices; establishing operating principles for criminal 
1.3 	intelligence databases; classifying data;proposing coding for new law in 
1.4 	Minnesota Statutes, chapter 13.
1.5 	BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF MINNESOTA:

1.6 	Section 1. [13.823] CRIMINAL INTELLIGENCE DATABASES.
1.7 		Subdivision 1.Definitions. (a) The definitions in this subdivision apply to this 
1.8 	section.
1.9 	(b) "Criminal intelligence data" means data that have been evaluated to determine 
1.10 	that the data:
1.11 	(1) are relevant to the identification of, and the criminal activity engaged in by, an 
1.12 	individual who or organization that is reasonably suspected of involvement in criminal 
1.13 	activity; and
1.14 	(2) meet criminal intelligence system submission criteria.
1.15 	(c) "Criminal intelligence system" or "intelligence system" means the arrangements, 
1.16 	equipment, facilities, and procedures used for the receipt, storage, interagency exchange 
1.17 	or dissemination, and analysis of criminal intelligence data.
1.18 	(d) "Intelligence project" or "project" means the organizational unit that operates an 
1.19 	intelligence system on behalf of and for the benefit of a single agency or the organization 
1.20 	that operates an interjurisdictional intelligence system on behalf of a group of participating 
1.21 	agencies.
1.22 	(e) "Interjurisdictional intelligence system" means an intelligence system that 
1.23 	involves two or more participating agencies representing different governmental units 
1.24 	or jurisdictions.
2.1 	(f) "Participating agency" means an agency of local, county, state, federal, or other 
2.2 	governmental unit that exercises law enforcement or criminal investigation authority and 
2.3 	is authorized to submit and receive criminal intelligence data through an interjurisdictional 
2.4 	intelligence system. A participating agency may be a member or a nonmember of an 
2.5 	interjurisdictional intelligence system.
2.6 	(g) "Validation of information" means the procedures governing the periodic review 
2.7 	of criminal intelligence data to ensure its continuing compliance with system submission 
2.8 	criteria.
2.9 		Subd. 2.Operating principles. (a) A project may collect and maintain criminal 
2.10 	intelligence data on an individual only if there is reasonable suspicion that the individual 
2.11 	is involved in criminal conduct or activity and the data are relevant to that criminal 
2.12 	conduct or activity.
2.13 	(b) A project must not collect or maintain criminal intelligence data about the 
2.14 	political, religious or social views, associations, or activities of an individual or a group, 
2.15 	association, corporation, business, partnership, or other organization unless the data 
2.16 	directly relate to criminal conduct or activity and there is reasonable suspicion that the 
2.17 	subject of the information is or may be involved in criminal conduct or activity.
2.18 	(c) Reasonable suspicion is established when information exists that establishes 
2.19 	sufficient facts to give a trained law enforcement or criminal investigative agency officer, 
2.20 	investigator, or employee a basis to believe that there is a reasonable possibility that an 
2.21 	individual or organization is involved in a definable criminal activity or enterprise. In 
2.22 	an interjurisdictional intelligence system, the project is responsible for establishing the 
2.23 	existence of reasonable suspicion of criminal activity through examination of supporting 
2.24 	data submitted by a participating agency or by delegation of this responsibility to a 
2.25 	properly trained participating agency.
2.26 	(d) A project must not include any criminal intelligence system data that have been 
2.27 	obtained in violation of law. In an interjurisdictional intelligence system, the project is 
2.28 	responsible for establishing that no data are entered in violation of law, either through 
2.29 	examination of supporting data submitted by a participating agency or by delegation of 
2.30 	this responsibility to a properly trained participating agency.
2.31 		Subd. 3.Dissemination of data. (a) A project may disseminate criminal 
2.32 	intelligence data only if there is a need to know and a right to know the data in the 
2.33 	performance of a law enforcement activity.
2.34 	(b) A project may disseminate criminal intelligence data only to law enforcement 
2.35 	authorities who agree to follow procedures regarding receipt, maintenance, security, and 
2.36 	dissemination of the data that are consistent with this section. This paragraph does not 
3.1 	limit the dissemination of an assessment of criminal intelligence data to any person, when 
3.2 	necessary to avoid imminent danger to life or property.
3.3 		Subd. 4.Safeguards; security requirements. A project maintaining criminal 
3.4 	intelligence data shall ensure that administrative, technical, and physical safeguards, 
3.5 	including audit trails, are adopted to ensure against unauthorized access and intentional or 
3.6 	unintentional damage. A record indicating who has been given data, the reason for release 
3.7 	of the data, and the date of each dissemination outside the project must be kept. Data 
3.8 	must be labeled to indicate levels of sensitivity, levels of confidence, and the identity of 
3.9 	submitting agencies and control officials. A project shall establish written definitions for 
3.10 	the need-to-know and right-to-know standards for dissemination to other agencies under 
3.11 	subdivision 3. The project is responsible for establishing the existence of an inquirer's 
3.12 	need to know and right to know the requested data through inquiry or by delegation of 
3.13 	this responsibility to a properly trained participating agency that is subject to routine 
3.14 	inspection and audit procedures established by the project. An intelligence project shall 
3.15 	ensure that the following security requirements are implemented:
3.16 	(1) where appropriate, projects must adopt effective and technologically advanced 
3.17 	computer software and hardware designs to prevent unauthorized access to data in the 
3.18 	system;
3.19 	(2) the project must restrict access to its facilities, operating environment, and 
3.20 	documentation to organizations and personnel authorized by the project;
3.21 	(3) the project must store data in the system so that the data cannot be modified, 
3.22 	destroyed, accessed, or purged without authorization;
3.23 	(4) the project must institute procedures to protect criminal intelligence data from 
3.24 	unauthorized access, theft, sabotage, fire, flood, or other natural or man-made disaster;
3.25 	(5) the project must establish standards based on good cause for implementing 
3.26 	its authority to screen, reject for employment, transfer, or remove personnel authorized 
3.27 	to have direct access to the system; and
3.28 	(6) a project may authorize and use remote, off-premises, system databases to the 
3.29 	extent that these databases comply with these security requirements.
3.30 		Subd. 5.Relevance. A project shall adopt procedures to ensure that data that are 
3.31 	retained by a project are relevant, as provided under subdivision 1, paragraph (b). These 
3.32 	procedures must provide for the periodic review of data and the destruction of data that 
3.33 	are misleading, obsolete, or otherwise unreliable and must require that recipient agencies 
3.34 	be advised of changes that involve errors or corrections. Data retained after a review must 
3.35 	reflect the name of the reviewer, the date of review, and an explanation of the decision 
3.36 	to retain. Data retained in the system must be reviewed and validated for continuing 
4.1 	compliance with system submission criteria before the expiration of the data's retention 
4.2 	period, which must not be longer than five years.
4.3 		Subd. 6.Project assurances. (a) A project shall ensure that there will be no 
4.4 	purchase or use in the course of the project of any electronic, mechanical, or other device 
4.5 	for surveillance purposes that is in violation of sections 626A.01 to 626A.381, and the 
4.6 	Electronic Communications Privacy Act of 1986, United States Code, title 18, sections 
4.7 	2510 to 2520, 2701 to 2709, and 3121 to 3125.
4.8 	(b) A project shall establish procedures to ensure that there will be no harassment or 
4.9 	interference with lawful political activities as part of an intelligence operation.
4.10 		Subd. 7.Data. (a) Criminal intelligence data are confidential data on individuals.
4.11 	(b) A participating agency of an interjurisdictional intelligence system must maintain 
4.12 	data that document each submission to the system and support compliance with project 
4.13 	entry criteria.
4.14 		Subd. 8.Supervision. (a) The head of an agency, or an individual expressly 
4.15 	delegated this control and supervision by the head of the agency, maintaining an 
4.16 	interjurisdictional criminal intelligence system shall:
4.17 	(1) assume official responsibility and accountability for actions taken in the name of 
4.18 	the joint entity; and 
4.19 	(2) certify in writing that the official takes full responsibility and will be accountable 
4.20 	for ensuring that data transmitted to the interjurisdictional intelligence system or to 
4.21 	participating agencies will be in compliance with this section.
4.22 	(b) This section must be made part of the bylaws or operating procedures for an 
4.23 	intelligence system. Each participating agency, as a condition of participation, must accept 
4.24 	in writing the principles that govern the submission, maintenance, and dissemination of 
4.25 	data included as part of an interjurisdictional system.