Bill Text: MN HF183 | 2013-2014 | 88th Legislature | Introduced
NOTE: There are more recent revisions of this legislation. Read Latest Draft
Bill Title: Data practices; penalties and procedures related to unauthorized access to data by a public employee enhanced, and data submission by law enforcement agencies to Comprehensive Incident Based Reporting System (CIBRS) provided to be public.
Sponsorship: Slight Partisan Bill (Republican 15-8)
Status: (Passed) 2014-05-21 - Secretary of State Chapter 284 [HF183 Detail]
Download: Minnesota-2013-HF183-Introduced.html
Bill Title: Data practices; penalties and procedures related to unauthorized access to data by a public employee enhanced, and data submission by law enforcement agencies to Comprehensive Incident Based Reporting System (CIBRS) provided to be public.
Sponsorship: Slight Partisan Bill (Republican 15-8)
Status: (Passed) 2014-05-21 - Secretary of State Chapter 284 [HF183 Detail]
Download: Minnesota-2013-HF183-Introduced.html
1.2relating to data practices; enhancing certain penalties and procedures related to
1.3unauthorized access to data by a public employee; amending Minnesota Statutes
1.42012, sections 13.05, subdivision 5; 13.055; 13.08, subdivision 1; 13.09.
1.5BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF MINNESOTA:
1.6 Section 1. Minnesota Statutes 2012, section 13.05, subdivision 5, is amended to read:
1.7 Subd. 5. Data protection. (a) The responsible authority shall (1) establish
1.8procedures to assure that all data on individuals is accurate, complete, and current for the
1.9purposes for which it was collected; and (2) establish appropriate security safeguards for
1.10all records containing data on individuals, including procedures for ensuring that data that
1.11is not public is only accessible to persons explicitly authorized by law, and is only being
1.12accessed by those persons for reasons explicitly authorized by law.
1.13(b) When not public data is being disposed of, the data must be destroyed in a way
1.14that prevents its contents from being determined.
1.15 Sec. 2. Minnesota Statutes 2012, section 13.055, is amended to read:
1.1613.055STATE AGENCIES; DISCLOSURE OF BREACH IN SECURITY;
1.17NOTIFICATION AND INVESTIGATION REPORT REQUIRED.
1.18 Subdivision 1. Definitions. For purposes of this section, the following terms have
1.19the meanings given to them.
1.20(a) "Breach of the security of the data" means unauthorized acquisition of or access
1.21to data maintained by astate agency government entity that compromises the security and
1.22classification of the data. Good faith acquisition of or access to government data by an
1.23employee, contractor, or agent of astate agency government entity for the purposes of
2.1thestate agency entity is not a breach of the security of the data, if the government data
2.2is not provided to or viewable by an unauthorized person, or accessed for a reason not
2.3explicitly authorized by law.
2.4(b) "Contact information" means either name and mailing address or name and
2.5e-mail address for each individual who is the subject of data maintained by thestate
2.6agency government entity.
2.7(c) "Unauthorized acquisition" means that a person has obtained or viewed
2.8 government data without the informed consent of the individuals who are the subjects
2.9of the data or statutory authority and with the intent to use the data for nongovernmental
2.10purposes. Intent to cause harm to a data subject is not a factor in determining whether an
2.11acquisition of data is unauthorized.
2.12(d) "Unauthorized person" means any person who accesses government data
2.13without permission or without a work assignment that reasonably requires the person to
2.14have access to the data, or regardless of the person's work assignment, for a reason not
2.15explicitly permitted by law.
2.16 Subd. 2. Notice to individuals; investigation report. (a) Astate agency government
2.17entity that collects, creates, receives, maintains, or disseminates private or confidential data
2.18on individuals must disclose any breach of the security of the data following discovery or
2.19notification of the breach. Notification must be made to any individual who is the subject of
2.20the data and whose private or confidential data was, or is reasonably believed to have been,
2.21acquired by an unauthorized person. The disclosure must be made in the most expedient
2.22time possible and without unreasonable delay, consistent with (1) the legitimate needs of a
2.23law enforcement agency as provided in subdivision 3; or (2) any measures necessary to
2.24determine the scope of the breach and restore the reasonable security of the data.
2.25(b) Upon completion of an investigation into any breach in the security of data, the
2.26responsible authority shall prepare a report on the facts and results of the investigation.
2.27If the breach involved unauthorized acquisition to data by a public employee, the report
2.28must at a minimum include:
2.29(1) a description of the data that were accessed or acquired;
2.30(2) the number of individuals whose data was improperly accessed or acquired;
2.31(3) the name of each employee determined responsible for the unauthorized access
2.32or acquisition; and
2.33(4) the final disposition of any disciplinary action taken against each employee in
2.34response, or if disciplinary action was determined to be unnecessary, the specific findings
2.35and reasons for that determination.
3.1Notwithstanding any other provision of law, the full contents of this report shall be public
3.2at all times, provided to any individual required to receive a notice under paragraph (a),
3.3and posted on the affected government entity's Web site.
3.4 Subd. 3. Delayed notice. The notification required by this section may be delayed if
3.5a law enforcement agency determines that the notification will impede an active criminal
3.6investigation. The notification required by this section must be made after the law
3.7enforcement agency determines that it will not compromise the investigation.
3.8 Subd. 4. Method of notice. Notice under this section may be provided by one of
3.9the following methods:
3.10(a) written notice by first class mail to each affected individual;
3.11(b) electronic notice to each affected individual, if the notice provided is consistent
3.12with the provisions regarding electronic records and signatures as set forth in United
3.13States Code, title 15, section 7001; or
3.14(c) substitute notice, if thestate agency government entity demonstrates that the cost
3.15of providing the written notice required by paragraph (a) would exceed $250,000, or
3.16that the affected class of individuals to be notified exceeds 500,000, or thestate agency
3.17 government entity does not have sufficient contact information. Substitute notice consists
3.18of all of the following:
3.19(i) e-mail notice if thestate agency government entity has an e-mail address for
3.20the affected individuals;
3.21(ii) conspicuous posting of the notice on the Web site page of thestate agency
3.22 government entity, if thestate agency government entity maintains a Web site; and
3.23(iii) notification to major media outlets that reach the general public within the
3.24government entity's jurisdiction.
3.25 Subd. 5. Coordination with consumer reporting agencies. If thestate agency
3.26 government entity discovers circumstances requiring notification under this section of
3.27more than 1,000 individuals at one time, thestate agency government entity must also
3.28notify, without unreasonable delay, all consumer reporting agencies that compile and
3.29maintain files on consumers on a nationwide basis, as defined in United States Code, title
3.3015, section 1681a, of the timing, distribution, and content of the notices.
3.31 Subd. 6. Security assessments. At least annually, each government entity shall
3.32conduct a comprehensive security assessment of any personal information maintained
3.33by the government entity. For the purposes of this subdivision, personal information is
3.34defined under section 325E.61, subdivision 1, paragraphs (e) and (f).
3.35EFFECTIVE DATE.This section is effective the day following final enactment
3.36and applies to security breaches occurring on or after that date.
4.1 Sec. 3. Minnesota Statutes 2012, section 13.08, subdivision 1, is amended to read:
4.2 Subdivision 1. Action for damages. Notwithstanding section466.03 , a responsible
4.3authority or government entity which violates any provision of this chapter is liable to a
4.4person or representative of a decedent who suffers any damage as a result of the violation,
4.5and the person damaged or a representative in the case of private data on decedents or
4.6confidential data on decedents may bring an action against the responsible authority or
4.7government entity to cover any damages sustained, plus costs and reasonable attorney
4.8fees. In the case of a willful violation, or in the case of any violation resulting from a
4.9public employee's unauthorized access to not public data, the government entity shall, in
4.10addition, be liable to exemplary damages of not less than $1,000, nor more than $15,000
4.11for each violation. The state is deemed to have waived any immunity to a cause of action
4.12brought under this chapter.
4.13EFFECTIVE DATE.This section is effective the day following final enactment
4.14and applies to violations occurring on or after that date.
4.15 Sec. 4. Minnesota Statutes 2012, section 13.09, is amended to read:
4.1613.09 PENALTIES.
4.17(a)(1) Any person who willfully violates the provisions of this chapter or any rules
4.18adopted under this chapter is guilty of a misdemeanor.
4.19(2) A public employee who acquires or accesses not public data in a manner not
4.20explicitly authorized by law is guilty of a gross misdemeanor if the employee:
4.21(i) acquired or accessed data on a single data subject on more than one occasion; or
4.22(ii) acquired or accessed data on multiple data subjects, regardless of the number
4.23of occasions on which the acquisition or access occurred.
4.24Willful violation of this chapter by (b) Any action subject to a criminal penalty under
4.25paragraph (a) by any public employee constitutes just cause for suspension without pay or
4.26immediate dismissal of the public employee.
4.27EFFECTIVE DATE.This section is effective the day following final enactment
4.28and applies to violations occurring on or after that date.
1.3unauthorized access to data by a public employee; amending Minnesota Statutes
1.42012, sections 13.05, subdivision 5; 13.055; 13.08, subdivision 1; 13.09.
1.5BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF MINNESOTA:
1.6 Section 1. Minnesota Statutes 2012, section 13.05, subdivision 5, is amended to read:
1.7 Subd. 5. Data protection. (a) The responsible authority shall (1) establish
1.8procedures to assure that all data on individuals is accurate, complete, and current for the
1.9purposes for which it was collected; and (2) establish appropriate security safeguards for
1.10all records containing data on individuals, including procedures for ensuring that data that
1.11is not public is only accessible to persons explicitly authorized by law, and is only being
1.12accessed by those persons for reasons explicitly authorized by law.
1.13(b) When not public data is being disposed of, the data must be destroyed in a way
1.14that prevents its contents from being determined.
1.15 Sec. 2. Minnesota Statutes 2012, section 13.055, is amended to read:
1.1613.055
1.17NOTIFICATION AND INVESTIGATION REPORT REQUIRED.
1.18 Subdivision 1. Definitions. For purposes of this section, the following terms have
1.19the meanings given to them.
1.20(a) "Breach of the security of the data" means unauthorized acquisition of or access
1.21to data maintained by a
1.22classification of the data. Good faith acquisition of or access to government data by an
1.23employee, contractor, or agent of a
2.1the
2.2is not provided to or viewable by an unauthorized person, or accessed for a reason not
2.3explicitly authorized by law.
2.4(b) "Contact information" means either name and mailing address or name and
2.5e-mail address for each individual who is the subject of data maintained by the
2.6
2.7(c) "Unauthorized acquisition" means that a person has obtained or viewed
2.8 government data without the informed consent of the individuals who are the subjects
2.9of the data or statutory authority and with the intent to use the data for nongovernmental
2.10purposes. Intent to cause harm to a data subject is not a factor in determining whether an
2.11acquisition of data is unauthorized.
2.12(d) "Unauthorized person" means any person who accesses government data
2.13
2.14
2.15explicitly permitted by law.
2.16 Subd. 2. Notice to individuals; investigation report. (a) A
2.17entity that collects, creates, receives, maintains, or disseminates private or confidential data
2.18on individuals must disclose any breach of the security of the data following discovery or
2.19notification of the breach. Notification must be made to any individual who is the subject of
2.20the data and whose private or confidential data was, or is reasonably believed to have been,
2.21acquired by an unauthorized person. The disclosure must be made in the most expedient
2.22time possible and without unreasonable delay, consistent with (1) the legitimate needs of a
2.23law enforcement agency as provided in subdivision 3; or (2) any measures necessary to
2.24determine the scope of the breach and restore the reasonable security of the data.
2.25(b) Upon completion of an investigation into any breach in the security of data, the
2.26responsible authority shall prepare a report on the facts and results of the investigation.
2.27If the breach involved unauthorized acquisition to data by a public employee, the report
2.28must at a minimum include:
2.29(1) a description of the data that were accessed or acquired;
2.30(2) the number of individuals whose data was improperly accessed or acquired;
2.31(3) the name of each employee determined responsible for the unauthorized access
2.32or acquisition; and
2.33(4) the final disposition of any disciplinary action taken against each employee in
2.34response, or if disciplinary action was determined to be unnecessary, the specific findings
2.35and reasons for that determination.
3.1Notwithstanding any other provision of law, the full contents of this report shall be public
3.2at all times, provided to any individual required to receive a notice under paragraph (a),
3.3and posted on the affected government entity's Web site.
3.4 Subd. 3. Delayed notice. The notification required by this section may be delayed if
3.5a law enforcement agency determines that the notification will impede an active criminal
3.6investigation. The notification required by this section must be made after the law
3.7enforcement agency determines that it will not compromise the investigation.
3.8 Subd. 4. Method of notice. Notice under this section may be provided by one of
3.9the following methods:
3.10(a) written notice by first class mail to each affected individual;
3.11(b) electronic notice to each affected individual, if the notice provided is consistent
3.12with the provisions regarding electronic records and signatures as set forth in United
3.13States Code, title 15, section 7001; or
3.14(c) substitute notice, if the
3.15of providing the written notice required by paragraph (a) would exceed $250,000, or
3.16that the affected class of individuals to be notified exceeds 500,000, or the
3.17 government entity does not have sufficient contact information. Substitute notice consists
3.18of all of the following:
3.19(i) e-mail notice if the
3.20the affected individuals;
3.21(ii) conspicuous posting of the notice on the Web site page of the
3.22 government entity, if the
3.23(iii) notification to major media outlets that reach the general public within the
3.24government entity's jurisdiction.
3.25 Subd. 5. Coordination with consumer reporting agencies. If the
3.26 government entity discovers circumstances requiring notification under this section of
3.27more than 1,000 individuals at one time, the
3.28notify, without unreasonable delay, all consumer reporting agencies that compile and
3.29maintain files on consumers on a nationwide basis, as defined in United States Code, title
3.3015, section 1681a, of the timing, distribution, and content of the notices.
3.31 Subd. 6. Security assessments. At least annually, each government entity shall
3.32conduct a comprehensive security assessment of any personal information maintained
3.33by the government entity. For the purposes of this subdivision, personal information is
3.34defined under section 325E.61, subdivision 1, paragraphs (e) and (f).
3.35EFFECTIVE DATE.This section is effective the day following final enactment
3.36and applies to security breaches occurring on or after that date.
4.1 Sec. 3. Minnesota Statutes 2012, section 13.08, subdivision 1, is amended to read:
4.2 Subdivision 1. Action for damages. Notwithstanding section
4.3authority or government entity which violates any provision of this chapter is liable to a
4.4person or representative of a decedent who suffers any damage as a result of the violation,
4.5and the person damaged or a representative in the case of private data on decedents or
4.6confidential data on decedents may bring an action against the responsible authority or
4.7government entity to cover any damages sustained, plus costs and reasonable attorney
4.8fees. In the case of a willful violation, or in the case of any violation resulting from a
4.9public employee's unauthorized access to not public data, the government entity shall, in
4.10addition, be liable to exemplary damages of not less than $1,000, nor more than $15,000
4.11for each violation. The state is deemed to have waived any immunity to a cause of action
4.12brought under this chapter.
4.13EFFECTIVE DATE.This section is effective the day following final enactment
4.14and applies to violations occurring on or after that date.
4.15 Sec. 4. Minnesota Statutes 2012, section 13.09, is amended to read:
4.1613.09 PENALTIES.
4.17(a)(1) Any person who willfully violates the provisions of this chapter or any rules
4.18adopted under this chapter is guilty of a misdemeanor.
4.19(2) A public employee who acquires or accesses not public data in a manner not
4.20explicitly authorized by law is guilty of a gross misdemeanor if the employee:
4.21(i) acquired or accessed data on a single data subject on more than one occasion; or
4.22(ii) acquired or accessed data on multiple data subjects, regardless of the number
4.23of occasions on which the acquisition or access occurred.
4.24
4.25paragraph (a) by any public employee constitutes just cause for suspension without pay or
4.26immediate dismissal of the public employee.
4.27EFFECTIVE DATE.This section is effective the day following final enactment
4.28and applies to violations occurring on or after that date.
