SF 3680

1st Engrossment - 92nd Legislature (2021 - 2022) Posted on 03/16/2022 04:04pm

A bill for an act
relating to motor vehicles; modifying provisions regarding access to driver and
vehicle services information system; amending Minnesota Statutes 2020, section
171.12, subdivision 1a.

BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF MINNESOTA:

Section 1.

Minnesota Statutes 2020, section 171.12, subdivision 1a, is amended to read:

Subd. 1a.

Driver and vehicle services information system; security and auditing.

(a)
The commissioner must establish written procedures to ensure that only individuals
authorized by law may enter, update, or access not public data collected, created, or
maintained by the driver and vehicle services information system. An authorized individual's
ability to enter, update, or access data in the system must correspond to the official duties
or training level of the individual and to the statutory authorization granting access for that
purpose. All queries and responses, and all actions in which data are entered, updated,
accessed, shared, or disseminated, must be recorded in a data audit trail. new text begin If an individual
accesses data to resolve an issue and the access does not result in a completed transaction,
the individual must include a notation on the record for the transaction explaining the
business need for accessing the data. new text end Data contained in the audit trail are public to the extent
the data are not otherwise classified by law.

(b) The commissioner must immediately deleted text begin and permanently revoke deleted text end new text begin suspend new text end the
authorization of any individual who willfully entered, updated, accessed, shared, or
disseminated data in violation of state or federal law. If an individual willfully gained access
to data without authorization by law, the commissioner must forward the matter to the
appropriate prosecuting authority for prosecution. new text begin The commissioner must not suspend or
revoke the authorization of any individual for properly accessing data to complete an
authorized transaction or to resolve an issue that does not result in a completed authorized
transaction.
new text end

new text begin (c) If the commissioner suspends an individual's access to the driver and vehicle services
information system, the commissioner must notify the individual, in writing, of the
suspension, provide an explanation for the suspension, explain how to appeal the decision,
and inform the individual that the individual's access will be permanently revoked unless
an appeal pursuant to this subdivision determines otherwise. The commissioner must issue
the notification within five calendar days of the suspension.
new text end

new text begin (d) Within 20 calendar days of revocation or receiving a notice of suspension, the
individual may submit a request for reconsideration in writing to the commissioner. The
commissioner shall review the request for reconsideration and issue a decision within 30
days of receipt of the request. If the commissioner determines the suspension was
unwarranted, the individual's access must be immediately reinstated. If the commissioner
determines the suspension was warranted, the individual may request a contested case
hearing under chapter 14. If the appeal results in a determination that the suspension was
unwarranted, the commissioner must immediately reinstate the individual's access. If the
appeal results in a determination that the suspension was warranted, the commissioner must
immediately and permanently revoke the individual's access.
new text end

new text begin (e) As an alternative to the process described in paragraph (d), the individual may proceed
to a contested case hearing without first making a request to the commissioner for
reconsideration. In this instance, the individual may initiate a contested case proceeding
within 20 calendar days of receiving a notice of suspension. If the appeal results in a
determination that the suspension was unwarranted, the commissioner must immediately
reinstate the individual's access. If the appeal results in a determination that the suspension
was warranted, the commissioner must immediately and permanently revoke the individual's
access.
new text end

new text begin (f) If the individual does not make a request for reconsideration or an appeal as provided
in paragraph (d) or (e) within 20 calendar days of receiving the notice of suspension, the
commissioner must immediately and permanently revoke the individual's access. This
revocation is not subject to the appeal processes described in paragraph (d) or (e).
new text end

deleted text begin (c) deleted text end new text begin (g) new text end The commissioner must arrange for an independent biennial audit of the driver
and vehicle services information system to determine whether data currently in the system
are classified correctly, how the data are used, and to verify compliance with this subdivision.
The results of the audit are public. No later than 30 days following completion of the audit,
the commissioner must provide a report summarizing the audit results to the commissioner
of administration; the chairs and ranking minority members of the committees of the house
of representatives and the senate with jurisdiction over transportation policy and finance,
public safety, and data practices; and the Legislative Commission on Data Practices and
Personal Data Privacy. The report must be submitted as required under section 3.195, except
that printed copies are not required.

new text begin EFFECTIVE DATE. new text end

new text begin This section is effective August 1, 2022, and applies to access
to data on or after that date.
new text end