Access to private data shall be available only to the following: the subject of such data, as limited by any applicable statute or federal law; individuals within the entity whose work assignments reasonably require access; entities and agencies as determined by the responsible authority who are authorized by statute, including Minnesota Statutes, section 13.05, subdivision 4, or federal law to gain access to that specific data; and entities or individuals given access by the express written direction of the data subject.
The responsible authority shall establish written procedures to assure that access is gained only by those parties identified in subpart 2.
In those procedures, the responsible authority shall provide for reasonable measures to assure, in those instances where an individual who seeks to gain access to private data asserts that he or she is the subject of that data or the authorized representative of the data subject, that the individual making the assertion is in fact the subject of the data or the authorized representative of the data subject. Examples of such reasonable measures include, but are not limited to, the following:
requiring the person seeking to gain access to appear at the offices of the entity to gain such access or, in lieu of a personal appearance, requiring the signature of any data subject who is unable to appear at the offices of the entity; and
requiring the person to provide reasonable identification.
The responsible authority may limit the time that access is available to the data subject to the normal working hours of the agency.
The responsible authority shall not charge the data subject any fee in those instances where the data subject only desires to view private data. The responsible authority may charge the data subject a reasonable fee for providing copies of private data.
In determining the amount of the reasonable fee, the responsible authority shall be guided by the criteria set out in part 1205.0300 concerning access to public data.
MS s 13.07
July 13, 2007