Bill Text: MN HF474 | 2013-2014 | 88th Legislature | Engrossed
Bill Title: Automated license plate reader data classified, log of use required, and data required to be destroyed.
Spectrum: Slight Partisan Bill (Republican 5-2)
Status: (Engrossed - Dead) 2014-04-29 - Senate conferees Champion, Hayden, Hall [HF474 Detail]
Download: Minnesota-2013-HF474-Engrossed.html
1.2relating to data practices; classifying data related to automated license plate
1.3readers; requiring a log of use; requiring data to be destroyed in certain
1.4circumstances; providing criminal penalties;amending Minnesota Statutes 2012,
1.5sections 13.05, subdivision 5; 13.055; 13.09; 13.82, by adding a subdivision;
1.6299C.40, subdivision 4.
1.7BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF MINNESOTA:
1.8 Section 1. Minnesota Statutes 2012, section 13.05, subdivision 5, is amended to read:
1.9 Subd. 5. Data protection. (a) The responsible authority shall:
1.10 (1) establish procedures to assure that all data on individuals is accurate, complete,
1.11and current for the purposes for which it was collected;and
1.12 (2) establish appropriate security safeguards for all records containing data on
1.13individuals, including procedures for ensuring that data that are not public are only
1.14accessible to persons whose work assignment reasonably requires access to the data, and
1.15is only being accessed by those persons for purposes described in the procedure; and
1.16(3) develop a policy incorporating these procedures, which may include a model
1.17policy governing access to the data if sharing of the data with other government entities is
1.18authorized by law.
1.19(b) When not public data is being disposed of, the data must be destroyed in a way
1.20that prevents its contents from being determined.
1.21 Sec. 2. Minnesota Statutes 2012, section 13.055, is amended to read:
1.2213.055STATE AGENCIES; DISCLOSURE OF BREACH IN SECURITY;
1.23NOTIFICATION AND INVESTIGATION REPORT REQUIRED.
2.1 Subdivision 1. Definitions. For purposes of this section, the following terms have
2.2the meanings given to them.
2.3(a) "Breach of the security of the data" means unauthorized acquisition of or access
2.4to data maintained by astate agency government entity that compromises the security and
2.5classification of the data. Good faith acquisition of or access to government data by an
2.6employee, contractor, or agent of astate agency government entity for the purposes of
2.7thestate agency entity is not a breach of the security of the data, if the government data
2.8is not provided to or viewable by an unauthorized person, or accessed for a purpose not
2.9described in the procedures required by section 13.05, subdivision 5. For purposes of this
2.10paragraph, data maintained by a government entity includes data maintained by a person
2.11under a contract with the government entity that provides for the acquisition of or access
2.12to the data by an employee, contractor, or agent of the government entity.
2.13(b) "Contact information" means either name and mailing address or name and
2.14e-mail address for each individual who is the subject of data maintained by thestate
2.15agency government entity.
2.16(c) "Unauthorized acquisition" means that a person has obtained or viewed
2.17 government data without the informed consent of the individuals who are the subjects of the
2.18data or statutory authority and with the intent to use the data for nongovernmental purposes.
2.19(d) "Unauthorized person" means any person who accesses government datawithout
2.20permission or without a work assignment that reasonably requires the person to have
2.21 accessto the data, or regardless of the person's work assignment, for a purpose not
2.22described in the procedures required by section 13.05, subdivision 5.
2.23 Subd. 2. Notice to individuals; investigation report. (a) Astate agency
2.24 government entity that collects, creates, receives, maintains, or disseminates private or
2.25confidential data on individuals must disclose any breach of the security of the data
2.26following discovery or notification of the breach. Notification must be made to any
2.27individual who is the subject of the data and whose private or confidential data was, or is
2.28reasonably believed to have been, acquired by an unauthorized person and must inform
2.29the individual that a report will be prepared under paragraph (b), how the individual may
2.30obtain access to the report, and that the individual may request delivery of the report by
2.31mail or e-mail. The disclosure must be made in the most expedient time possible and
2.32without unreasonable delay, consistent with (1) the legitimate needs of a law enforcement
2.33agency as provided in subdivision 3; or (2) any measures necessary to determine the scope
2.34of the breach and restore the reasonable security of the data.
2.35(b) Upon completion of an investigation into any breach in the security of data,
2.36including exhaustion of all rights of appeal under any applicable collective bargaining
3.1agreement or other law, the responsible authority shall prepare a report on the facts and
3.2results of the investigation. If the breach involves unauthorized access to or acquisition of
3.3data by an employee, contractor, or agent of the government entity, the report must at a
3.4minimum include:
3.5(1) a description of the data that were accessed or acquired; and
3.6(2) if disciplinary action was taken against an employee:
3.7(i) the number of individuals whose data was improperly accessed or acquired;
3.8(ii) the name of each employee determined responsible for the unauthorized access
3.9or acquisition; and
3.10(iii) the final disposition of the disciplinary action taken against the employee in
3.11response.
3.12(c) The report must not include data that are not public under other law.
3.13 Subd. 3. Delayed notice. The notification required by this section may be delayed if
3.14a law enforcement agency determines that the notification will impede an active criminal
3.15investigation. The notification required by this section must be made after the law
3.16enforcement agency determines that it will not compromise the investigation.
3.17 Subd. 4. Method of notice. Notice under this section may be provided by one of
3.18the following methods:
3.19(a) written notice by first class mail to each affected individual;
3.20(b) electronic notice to each affected individual, if the notice provided is consistent
3.21with the provisions regarding electronic records and signatures as set forth in United
3.22States Code, title 15, section 7001; or
3.23(c) substitute notice, if thestate agency government entity demonstrates that the cost
3.24of providing the written notice required by paragraph (a) would exceed $250,000, or
3.25that the affected class of individuals to be notified exceeds 500,000, or thestate agency
3.26 government entity does not have sufficient contact information. Substitute notice consists
3.27of all of the following:
3.28(i) e-mail notice if thestate agency government entity has an e-mail address for
3.29the affected individuals;
3.30(ii) conspicuous posting of the notice on the Web site page of thestate agency
3.31 government entity, if thestate agency government entity maintains a Web site; and
3.32(iii) notification to major media outlets that reach the general public within the
3.33government entity's jurisdiction.
3.34 Subd. 5. Coordination with consumer reporting agencies. If thestate agency
3.35 government entity discovers circumstances requiring notification under this section of
3.36more than 1,000 individuals at one time, thestate agency government entity must also
4.1notify, without unreasonable delay, all consumer reporting agencies that compile and
4.2maintain files on consumers on a nationwide basis, as defined in United States Code, title
4.315, section 1681a, of the timing, distribution, and content of the notices.
4.4 Subd. 6. Security assessments. At least annually, each government entity shall
4.5conduct a comprehensive security assessment of any personal information maintained
4.6by the government entity. For the purposes of this subdivision, personal information is
4.7defined under section 325E.61, subdivision 1, paragraphs (e) and (f).
4.8EFFECTIVE DATE.This section is effective August 1, 2013, and applies to
4.9security breaches occurring on or after that date.
4.10 Sec. 3. Minnesota Statutes 2012, section 13.09, is amended to read:
4.1113.09 PENALTIES.
4.12(a) Any person who willfully violates the provisions of this chapter or any rules
4.13adopted under this chapter or whose conduct constitutes the knowing unauthorized
4.14acquisition of not public data, as defined in section 13.055, subdivision 1, is guilty of a
4.15misdemeanor.
4.16(b) Willful violation of this chapterby, including any action subject to a criminal
4.17penalty under paragraph (a), by any public employee constitutes just cause for suspension
4.18without pay or dismissal of the public employee.
4.19EFFECTIVE DATE.This section is effective August 1, 2013, and applies to crimes
4.20committed on or after that date.
4.21 Sec. 4. Minnesota Statutes 2012, section 13.82, is amended by adding a subdivision to
4.22read:
4.23 Subd. 31. License plate reader data. (a) For purposes of this subdivision,
4.24"automated license plate reader data" means government data derived from an automated
4.25reader that captures motor vehicle license plate numbers.
4.26(b) Automated license plate reader data are private data on individuals or nonpublic
4.27data. Notwithstanding section 138.17, automated license plate reader data must not be
4.28retained, in any format, unless, based on a search of the Minnesota license plate data file,
4.29the data identify a vehicle or license plate that has been stolen, there is a warrant for the
4.30arrest of the owner of the vehicle or the owner has a suspended or revoked driver's license,
4.31or the data are active investigative data.
4.32(c) A law enforcement agency that installs or uses an automated license plate reader
4.33must maintain a log of its use, including:
5.1(1) locations at which the reader is installed or used;
5.2(2) specific times of day that the reader actively collected data; and
5.3(3) the aggregate number of vehicles or license plates on which data are collected for
5.4each period of active use.
5.5Notwithstanding any other law to the contrary, data contained in a log required under
5.6this paragraph are public.
5.7(d) The responsible law enforcement agency shall conduct a biennial audit of data
5.8collected from automated license plate readers to determine whether the data has been
5.9classified or destroyed as required under this subdivision. Specific data used in the audit
5.10under this paragraph are classified as provided in paragraph (b). Summary data related to
5.11the results of the audit are public.
5.12(e) A law enforcement agency may not use an automated license plate reader unless
5.13the agency has implemented policies and procedures necessary to ensure compliance
5.14with this subdivision.
5.15 Sec. 5. Minnesota Statutes 2012, section 299C.40, subdivision 4, is amended to read:
5.16 Subd. 4. Data classification; general rule; changes in classification; audit trail.
5.17(a) The classification of data in the law enforcement agency does not change after the data
5.18is submitted to CIBRS. If CIBRS is the only source of data made public by section13.82,
5.19subdivisions 2, 3, 6, and 7 , data described in those subdivisions must be downloaded and
5.20made available to the public as required by section13.03 .
5.21(b) Data on individuals created, collected, received, maintained, or disseminated
5.22by CIBRS is classified as confidential data on individuals as defined in section13.02,
5.23subdivision 3 , and becomes private data on individuals as defined in section
13.02,
5.24subdivision 12 , as provided by this section.
5.25(c) Data not on individuals created, collected, received, maintained, or disseminated
5.26by CIBRS is classified as protected nonpublic data as defined in section13.02, subdivision
5.2713 , and becomes nonpublic data as defined in section
13.02, subdivision 9 , as provided
5.28by this section.
5.29(d) Confidential or protected nonpublic data created, collected, received, maintained,
5.30or disseminated by CIBRS must automatically change classification from confidential
5.31data to private data or from protected nonpublic data to nonpublic data on the earlier of
5.32the following dates:
5.33(1) upon receipt by CIBRS of notice from a law enforcement agency that an
5.34investigation has become inactive; or
6.1(2) when the data has not been updated by the law enforcement agency that
6.2submitted it for a period of 120 days.
6.3(e) For the purposes of this section, an investigation becomes inactive upon the
6.4occurrence of any of the events listed in section13.82, subdivision 7 , clauses (a) to (c).
6.5(f) Ten days before making a data classification change because data has not been
6.6updated, CIBRS must notify the law enforcement agency that submitted the data that a
6.7classification change will be made on the 120th day. The notification must inform the law
6.8enforcement agency that the data will retain its classification as confidential or protected
6.9nonpublic data if the law enforcement agency updates the data or notifies CIBRS that the
6.10investigation is still active before the 120th day. A new 120-day period begins if the data
6.11is updated or if a law enforcement agency notifies CIBRS that an active investigation
6.12is continuing.
6.13(g) A law enforcement agency that submits data to CIBRS must notify CIBRS if an
6.14investigation has become inactive so that the data is classified as private data or nonpublic
6.15data. The law enforcement agency must provide this notice to CIBRS within ten days
6.16after an investigation becomes inactive.
6.17(h) All queries and responses and all actions in which data is submitted to CIBRS,
6.18changes classification, or is disseminated by CIBRS to any law enforcement agency
6.19must be recorded in the CIBRS audit trail.
6.20(i) Notwithstanding paragraphs (b) and (c), the name of each law enforcement
6.21agency that submits data to CIBRS, and a general description of the types of data
6.22submitted by the agency, are public.
1.3readers; requiring a log of use; requiring data to be destroyed in certain
1.4circumstances; providing criminal penalties;amending Minnesota Statutes 2012,
1.5sections 13.05, subdivision 5; 13.055; 13.09; 13.82, by adding a subdivision;
1.6299C.40, subdivision 4.
1.7BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF MINNESOTA:
1.8 Section 1. Minnesota Statutes 2012, section 13.05, subdivision 5, is amended to read:
1.9 Subd. 5. Data protection. (a) The responsible authority shall:
1.10 (1) establish procedures to assure that all data on individuals is accurate, complete,
1.11and current for the purposes for which it was collected;
1.12 (2) establish appropriate security safeguards for all records containing data on
1.13individuals, including procedures for ensuring that data that are not public are only
1.14accessible to persons whose work assignment reasonably requires access to the data, and
1.15is only being accessed by those persons for purposes described in the procedure; and
1.16(3) develop a policy incorporating these procedures, which may include a model
1.17policy governing access to the data if sharing of the data with other government entities is
1.18authorized by law.
1.19(b) When not public data is being disposed of, the data must be destroyed in a way
1.20that prevents its contents from being determined.
1.21 Sec. 2. Minnesota Statutes 2012, section 13.055, is amended to read:
1.2213.055
1.23NOTIFICATION AND INVESTIGATION REPORT REQUIRED.
2.1 Subdivision 1. Definitions. For purposes of this section, the following terms have
2.2the meanings given to them.
2.3(a) "Breach of the security of the data" means unauthorized acquisition of or access
2.4to data maintained by a
2.5classification of the data. Good faith acquisition of or access to government data by an
2.6employee, contractor, or agent of a
2.7the
2.8is not provided to or viewable by an unauthorized person, or accessed for a purpose not
2.9described in the procedures required by section 13.05, subdivision 5. For purposes of this
2.10paragraph, data maintained by a government entity includes data maintained by a person
2.11under a contract with the government entity that provides for the acquisition of or access
2.12to the data by an employee, contractor, or agent of the government entity.
2.13(b) "Contact information" means either name and mailing address or name and
2.14e-mail address for each individual who is the subject of data maintained by the
2.15
2.16(c) "Unauthorized acquisition" means that a person has obtained or viewed
2.17 government data without the informed consent of the individuals who are the subjects of the
2.18data or statutory authority and with the intent to use the data for nongovernmental purposes.
2.19(d) "Unauthorized person" means any person who accesses government data
2.20
2.21 access
2.22described in the procedures required by section 13.05, subdivision 5.
2.23 Subd. 2. Notice to individuals; investigation report. (a) A
2.24 government entity that collects, creates, receives, maintains, or disseminates private or
2.25confidential data on individuals must disclose any breach of the security of the data
2.26following discovery or notification of the breach. Notification must be made to any
2.27individual who is the subject of the data and whose private or confidential data was, or is
2.28reasonably believed to have been, acquired by an unauthorized person and must inform
2.29the individual that a report will be prepared under paragraph (b), how the individual may
2.30obtain access to the report, and that the individual may request delivery of the report by
2.31mail or e-mail. The disclosure must be made in the most expedient time possible and
2.32without unreasonable delay, consistent with (1) the legitimate needs of a law enforcement
2.33agency as provided in subdivision 3; or (2) any measures necessary to determine the scope
2.34of the breach and restore the reasonable security of the data.
2.35(b) Upon completion of an investigation into any breach in the security of data,
2.36including exhaustion of all rights of appeal under any applicable collective bargaining
3.1agreement or other law, the responsible authority shall prepare a report on the facts and
3.2results of the investigation. If the breach involves unauthorized access to or acquisition of
3.3data by an employee, contractor, or agent of the government entity, the report must at a
3.4minimum include:
3.5(1) a description of the data that were accessed or acquired; and
3.6(2) if disciplinary action was taken against an employee:
3.7(i) the number of individuals whose data was improperly accessed or acquired;
3.8(ii) the name of each employee determined responsible for the unauthorized access
3.9or acquisition; and
3.10(iii) the final disposition of the disciplinary action taken against the employee in
3.11response.
3.12(c) The report must not include data that are not public under other law.
3.13 Subd. 3. Delayed notice. The notification required by this section may be delayed if
3.14a law enforcement agency determines that the notification will impede an active criminal
3.15investigation. The notification required by this section must be made after the law
3.16enforcement agency determines that it will not compromise the investigation.
3.17 Subd. 4. Method of notice. Notice under this section may be provided by one of
3.18the following methods:
3.19(a) written notice by first class mail to each affected individual;
3.20(b) electronic notice to each affected individual, if the notice provided is consistent
3.21with the provisions regarding electronic records and signatures as set forth in United
3.22States Code, title 15, section 7001; or
3.23(c) substitute notice, if the
3.24of providing the written notice required by paragraph (a) would exceed $250,000, or
3.25that the affected class of individuals to be notified exceeds 500,000, or the
3.26 government entity does not have sufficient contact information. Substitute notice consists
3.27of all of the following:
3.28(i) e-mail notice if the
3.29the affected individuals;
3.30(ii) conspicuous posting of the notice on the Web site page of the
3.31 government entity, if the
3.32(iii) notification to major media outlets that reach the general public within the
3.33government entity's jurisdiction.
3.34 Subd. 5. Coordination with consumer reporting agencies. If the
3.35 government entity discovers circumstances requiring notification under this section of
3.36more than 1,000 individuals at one time, the
4.1notify, without unreasonable delay, all consumer reporting agencies that compile and
4.2maintain files on consumers on a nationwide basis, as defined in United States Code, title
4.315, section 1681a, of the timing, distribution, and content of the notices.
4.4 Subd. 6. Security assessments. At least annually, each government entity shall
4.5conduct a comprehensive security assessment of any personal information maintained
4.6by the government entity. For the purposes of this subdivision, personal information is
4.7defined under section 325E.61, subdivision 1, paragraphs (e) and (f).
4.8EFFECTIVE DATE.This section is effective August 1, 2013, and applies to
4.9security breaches occurring on or after that date.
4.10 Sec. 3. Minnesota Statutes 2012, section 13.09, is amended to read:
4.1113.09 PENALTIES.
4.12(a) Any person who willfully violates the provisions of this chapter or any rules
4.13adopted under this chapter or whose conduct constitutes the knowing unauthorized
4.14acquisition of not public data, as defined in section 13.055, subdivision 1, is guilty of a
4.15misdemeanor.
4.16(b) Willful violation of this chapter
4.17penalty under paragraph (a), by any public employee constitutes just cause for suspension
4.18without pay or dismissal of the public employee.
4.19EFFECTIVE DATE.This section is effective August 1, 2013, and applies to crimes
4.20committed on or after that date.
4.21 Sec. 4. Minnesota Statutes 2012, section 13.82, is amended by adding a subdivision to
4.22read:
4.23 Subd. 31. License plate reader data. (a) For purposes of this subdivision,
4.24"automated license plate reader data" means government data derived from an automated
4.25reader that captures motor vehicle license plate numbers.
4.26(b) Automated license plate reader data are private data on individuals or nonpublic
4.27data. Notwithstanding section 138.17, automated license plate reader data must not be
4.28retained, in any format, unless, based on a search of the Minnesota license plate data file,
4.29the data identify a vehicle or license plate that has been stolen, there is a warrant for the
4.30arrest of the owner of the vehicle or the owner has a suspended or revoked driver's license,
4.31or the data are active investigative data.
4.32(c) A law enforcement agency that installs or uses an automated license plate reader
4.33must maintain a log of its use, including:
5.1(1) locations at which the reader is installed or used;
5.2(2) specific times of day that the reader actively collected data; and
5.3(3) the aggregate number of vehicles or license plates on which data are collected for
5.4each period of active use.
5.5Notwithstanding any other law to the contrary, data contained in a log required under
5.6this paragraph are public.
5.7(d) The responsible law enforcement agency shall conduct a biennial audit of data
5.8collected from automated license plate readers to determine whether the data has been
5.9classified or destroyed as required under this subdivision. Specific data used in the audit
5.10under this paragraph are classified as provided in paragraph (b). Summary data related to
5.11the results of the audit are public.
5.12(e) A law enforcement agency may not use an automated license plate reader unless
5.13the agency has implemented policies and procedures necessary to ensure compliance
5.14with this subdivision.
5.15 Sec. 5. Minnesota Statutes 2012, section 299C.40, subdivision 4, is amended to read:
5.16 Subd. 4. Data classification; general rule; changes in classification; audit trail.
5.17(a) The classification of data in the law enforcement agency does not change after the data
5.18is submitted to CIBRS. If CIBRS is the only source of data made public by section
5.19subdivisions 2, 3, 6, and 7
5.20made available to the public as required by section
5.21(b) Data on individuals created, collected, received, maintained, or disseminated
5.22by CIBRS is classified as confidential data on individuals as defined in section
5.23subdivision 3
5.24subdivision 12
5.25(c) Data not on individuals created, collected, received, maintained, or disseminated
5.26by CIBRS is classified as protected nonpublic data as defined in section
5.2713
5.28by this section.
5.29(d) Confidential or protected nonpublic data created, collected, received, maintained,
5.30or disseminated by CIBRS must automatically change classification from confidential
5.31data to private data or from protected nonpublic data to nonpublic data on the earlier of
5.32the following dates:
5.33(1) upon receipt by CIBRS of notice from a law enforcement agency that an
5.34investigation has become inactive; or
6.1(2) when the data has not been updated by the law enforcement agency that
6.2submitted it for a period of 120 days.
6.3(e) For the purposes of this section, an investigation becomes inactive upon the
6.4occurrence of any of the events listed in section
6.5(f) Ten days before making a data classification change because data has not been
6.6updated, CIBRS must notify the law enforcement agency that submitted the data that a
6.7classification change will be made on the 120th day. The notification must inform the law
6.8enforcement agency that the data will retain its classification as confidential or protected
6.9nonpublic data if the law enforcement agency updates the data or notifies CIBRS that the
6.10investigation is still active before the 120th day. A new 120-day period begins if the data
6.11is updated or if a law enforcement agency notifies CIBRS that an active investigation
6.12is continuing.
6.13(g) A law enforcement agency that submits data to CIBRS must notify CIBRS if an
6.14investigation has become inactive so that the data is classified as private data or nonpublic
6.15data. The law enforcement agency must provide this notice to CIBRS within ten days
6.16after an investigation becomes inactive.
6.17(h) All queries and responses and all actions in which data is submitted to CIBRS,
6.18changes classification, or is disseminated by CIBRS to any law enforcement agency
6.19must be recorded in the CIBRS audit trail.
6.20(i) Notwithstanding paragraphs (b) and (c), the name of each law enforcement
6.21agency that submits data to CIBRS, and a general description of the types of data
6.22submitted by the agency, are public.
