The rights of individuals on whom the data is stored or to be stored shall be as set forth in this section.
An individual asked to supply private or confidential data concerning the individual shall be informed of: (a) the purpose and intended use of the requested data within the collecting government entity; (b) whether the individual may refuse or is legally required to supply the requested data; (c) any known consequence arising from supplying or refusing to supply private or confidential data; and (d) the identity of other persons or entities authorized by state or federal law to receive the data. This requirement shall not apply when an individual is asked to supply investigative data, pursuant to section 13.82, subdivision 7, to a law enforcement officer.
Upon request to a responsible authority or designee, an individual shall be informed whether the individual is the subject of stored data on individuals, and whether it is classified as public, private or confidential. Upon further request, an individual who is the subject of stored private or public data on individuals shall be shown the data without any charge and, if desired, shall be informed of the content and meaning of that data. After an individual has been shown the private data and informed of its meaning, the data need not be disclosed to that individual for six months thereafter unless a dispute or action pursuant to this section is pending or additional data on the individual has been collected or created. The responsible authority or designee shall provide copies of the private or public data upon request by the individual subject of the data. The responsible authority or designee may require the requesting person to pay the actual costs of making and certifying the copies.
The responsible authority or designee shall comply immediately, if possible, with any request made pursuant to this subdivision, or within ten days of the date of the request, excluding Saturdays, Sundays and legal holidays, if immediate compliance is not possible.
(a) An individual subject of the data may contest the accuracy or completeness of public or private data. To exercise this right, an individual shall notify in writing the responsible authority describing the nature of the disagreement. The responsible authority shall within 30 days either: (1) correct the data found to be inaccurate or incomplete and attempt to notify past recipients of inaccurate or incomplete data, including recipients named by the individual; or (2) notify the individual that the authority believes the data to be correct. Data in dispute shall be disclosed only if the individual's statement of disagreement is included with the disclosed data.
The determination of the responsible authority may be appealed pursuant to the provisions of the Administrative Procedure Act relating to contested cases. Upon receipt of an appeal by an individual, the commissioner shall, before issuing the order and notice of a contested case hearing required by chapter 14, try to resolve the dispute through education, conference, conciliation, or persuasion. If the parties consent, the commissioner may refer the matter to mediation. Following these efforts, the commissioner shall dismiss the appeal or issue the order and notice of hearing.
(b) Data on individuals that have been successfully challenged by an individual must be completed, corrected, or destroyed by a government entity without regard to the requirements of section 138.17.
After completing, correcting, or destroying successfully challenged data, a government entity may retain a copy of the commissioner of administration's order issued under chapter 14 or, if no order were issued, a summary of the dispute between the parties that does not contain any particulars of the successfully challenged data.