1. June 20101 Data Practices in Minnesota

2. June 20102 Outline for this presentation Minnesota data practices laws Classification of government data Government entity responsibilities Rights of access to government data Government data requests & responses Data subject rights Civil remedies and penalties in the Data Practices Act

3. Three key laws of data practices Three laws give general guidance and form the basic legal framework governing data practices for all Minnesota government These laws impose specific duties on government entities relative to: Access to government data requested by members of the public Access to government data requested by data subjects and their additional rights as data subjects The classification of government data Collecting, creating, maintaining, using, disseminating, and properly disposing of government data June 20103

4. 4 Three key laws of data practices The Official Records Act (Minnesota Statutes, section 15.17) The Records Management Statute (Minnesota Statutes, section 138.17) The Data Practices Act (Minnesota Statutes, Chapter 13 and Minnesota Rules, Chapter 1205)

5. June 20105 The Official Records Act Minnesota Statutes, section 15.17 Requires government entities to make and preserve records to document official activities Records must be passed on to successors in office

6. June 20106 Records Management Statute Minnesota Statutes, section 138.17 Requires government entities to follow a process when disposing of official records Must maintain official records for time period specified in retention schedule Resource: State Archives group at Minnesota State Historical Society www.mnhs.org/preserve/records/gov_services.htm

7. The Data Practices Act, generally Minnesota Statutes, Chapter 13, and Minnesota Rules, Chapter 1205 Defines government data Presumes government data are public Classifies certain data as not public Provides rights for the public and data subjects Requires that data on individuals are accurate, complete, current, and secure June 20107

8. 8 Definition of government data Government data means all data collected, created, received, maintained, or disseminated by any government entity regardless of its physical form, storage media, or conditions of use. (Minnesota Statutes, section 13.02, subd. 7) Includes data in any media: paper, email, CD, videotape, photographs, etc. Does not include mental impressions that are not recorded, see Keezer v. Spickard, 493 N.W.2d 614 (Minn. App. 1992)

9. Classification of government data There are two types of government data Data on individuals: an individual can be identified as the subject of the data (Minnesota Statutes, section 13.02, subd. 5) Data not on individuals: data that are not about individuals, e.g., data on businesses, organizations, or intangible objects (Minnesota Statutes, section 13.02, subd. 4) June 20109

10. Data CategoryClassificationMeaning of Classification Data on IndividualsPublic Available to anyone for any reason Data Not on IndividualsPublic Data on IndividualsPrivate Available to: Data subject Those whose work requires access Entities authorized by law Those authorized by data subject Data Not on IndividualsNonpublic Data on IndividualsConfidential Available to: Those whose work requires access Entities authorized by law Not available to data subject Data Not on IndividualsProtected Nonpublic Classification of government data June 201010

11. June 201011 Classification of government data Data on decedents (Minnesota Statutes, section 13.10) Data on individuals after they die A subset of data on individuals Not public data on individuals remain not public until a specified number of years have passed

12. June 201012 Government entity responsibilities Some examples Identify/appoint key individuals with data practices responsibilities Establish an inventory for data on individuals (Minnesota Statutes, section 13.05, subd. 1) Establish required policies on data access and data subject rights (Minnesota Statutes, sections 13.03, subd. 2, and 13.05, subd. 8) Respond to data requests

13. Government entity responsibilities Key individuals Responsible Authority (RA) (Minnesota Statutes, section 13.05, and Minnesota Rules1205.0200, subparts 12-15) Ultimately responsible for entitys data practices decisions and policies May appoint one or more designees to assist in meeting obligations Data practices compliance official (DPCO) (Minnesota Statutes, section 13.05, subd. 13) Appointed by the RA Receives and responds to questions about data practices RA may also act as DPCO June 201013

14. Rights of access to government data Members of the public (not data subjects) (Minnesota Statutes, section 13.03) Right to inspect and/or get copies of public government data within a reasonable amount of time June 201014

15. June 201015 Rights of access to government data Data subject (person that the data are about) (Minnesota Statutes, section 13.04) Right to find out what data a government entity has about him/her Right to inspect and/or get copies of data (public and private) about him/her within 10 business days

16. June 201016 Responding to data requests from members of the public Data are public Provide data to requestor as soon as reasonably possible Data are classified as not public Data cannot be released – must provide statutory citation denying access (Minnesota Statutes, section 13.03, subd. 3(f) Requested data do not exist at the entity Entity must inform requestor Entity not required to create data

17. June 201017 Responding to data requests from data subjects Data are classified as public or private Provide public data and private data about the subject within 10 days Data are classified as confidential or are not about the data subject Data cannot be released – must provide statutory citation denying access (Minnesota Statutes, section 13.03, subd. 3(f) Requested data do not exist at the entity Entity must inform requestor Entity not required to create data

18. June 201018 Responding to data requests - copy charges Inspection – no cost Even if entity must make a copy so the requestor may view it Requestor may take notes, pictures, scan the data Copies – cost depends on request Member of the public (Minnesota Statutes, section 13.03) 25¢ per page – 100 or fewer copies of black & white, letter/legal size paper Actual cost – all other copies Data subject (Minnesota Statutes, section 13.04) Actual cost

19. June 201019 Additional rights of data subjects – Tennessen warning notice ( Minnesota Statutes, section 13.04, subd. 2) When an entity collects private or confidential data from an individual, the entity must give a notice that includes: Purpose and intended use of data Whether the individual may refuse or is legally required to provide the data Known consequences from supplying or refusing to supply the data Identity of other persons or entities with statutorily authorized access to the data

20. June 201020 Additional rights of data subjects – informed consent (Minnesota Statutes, section 13.05, subd. 3(d) Given when an entity has private or confidential data on an individual Informed consent is necessary for: Individual asks the entity to release data A new release of data by the entity Different use of data than described in Tennessen notice Different release than described in Tennessen notice

21. June 201021 Additional rights of data subjects Limits on the governments collection and storage of data on individuals Entities may only use and disseminate private or confidential data that are necessary for the administration of programs authorized by law (Minnesota Statutes, section 13.05, subd. 3) Expectation in the security of data Entities must establish appropriate safeguards for all data Entities must have written procedures regarding access to private data Entities must notify individuals if there is a breach in security of not public data

22. June 201022 Additional rights of data subjects Minors may request that data be withheld from a parent or guardian Educational data exception – a minor cannot deny a parent access to a students education record. Right to challenge the accuracy and/or completeness of data

23. Civil remedies and penalties Minnesota Statutes, sections 13.08, 13.085 and 13.09 Court processes A person may bring a civil action against government entity or responsible authority Request for injunction from collecting/disclosing data Action to compel compliance with Chapter 13 Government employees may be prosecuted for willful violations Administrative remedy A person may request a hearing at the Office of Administrative Hearings Action to compel compliance with Chapter 13 Must be filed within 2 years of the occurrence $1000 filing fee June 201023

24. June 201024 How to contact the Information Policy Analysis Division (IPAD) www.ipad.state.mn.us 651.296.6733 info.ipad@state.mn.us 201 Administration Building 50 Sherburne Ave. St. Paul, MN 55155