June 2010 1

Data Practices in Minnesota

June 2010 2

Outline for this presentation

Minnesota data practices lawsClassification of government dataGovernment entity responsibilitiesRights of access to government dataGovernment data requests &

responses Data subject rightsCivil remedies and penalties in the

Data Practices Act

Three key laws of data practices

Three laws give general guidance and form the basic legal framework governing data practices for all Minnesota government

These laws impose specific duties on government entities relative to:

Access to government data requested by members of the public

Access to government data requested by data subjects and their additional rights as data subjects

The classification of government dataCollecting, creating, maintaining, using,

disseminating, and properly disposing of government data

June 2010 3

June 2010 4

Three key laws of data practices

The Official Records Act (Minnesota Statutes, section 15.17)

The Records Management Statute (Minnesota Statutes, section 138.17)

The Data Practices Act (Minnesota Statutes, Chapter 13 and Minnesota Rules, Chapter 1205)

The Data Practices Act, generallyMinnesota Statutes, Chapter 13, and Minnesota Rules, Chapter 1205

Defines government data Presumes government data are publicClassifies certain data as not publicProvides rights for the public and

data subjectsRequires that data on individuals are

accurate, complete, current, and secure

June 2010 5

June 2010 6

Definition of government data

“Government data” means all data collected, created, received, maintained, or disseminated by any government entity regardless of its physical form, storage media, or conditions of use. (Minnesota Statutes, section 13.02, subd. 7)Includes data in any media: paper, email,

CD, videotape, photographs, etc.Does not include mental impressions that

are not recorded, see Keezer v. Spickard, 493 N.W.2d 614 (Minn. App. 1992)

Classification of government data

There are two types of government data Data on individuals: an individual can

be identified as the subject of the data (Minnesota Statutes, section 13.02, subd. 5)

Data not on individuals: data that are not about individuals, e.g., data on businesses, organizations, or intangible objects (Minnesota Statutes, section 13.02, subd. 4)

June 2010 7

Data Category Classification Meaning of Classification

Data on Individuals Public Available to anyone for any reason

Data Not on Individuals Public

Data on Individuals Private Available to: Data subject Those whose work requires access Entities authorized by law Those authorized by data subjectData Not on Individuals Nonpublic

Data on Individuals Confidential Available to:Those whose work requires accessEntities authorized by law Not available to data subject Data Not on Individuals Protected Nonpublic

Classification of government data

June 2010 8

Rights of access to government data

Members of the public (not data subjects) (Minnesota Statutes, section 13.03)Right to inspect and/or get copies of

public government data within a reasonable amount of time

June 2010 9

June 2010 10

Rights of access to government data

Data subject (person that the data are about) (Minnesota Statutes, section 13.04) Right to find out what data a government entity has about him/her

Right to inspect and/or get copies of data (public and private) about him/her within 10 business days

June 2010 11

Responding to data requests from members of the public

Data are public Provide data to requestor as soon as

reasonably possible Data are classified as not public

Data cannot be released – must provide statutory citation denying access (Minnesota Statutes, section 13.03, subd. 3(f)

Requested data do not exist at the entity

Entity must inform requestor Entity not required to create data

June 2010 12

Responding to data requests from data subjects

Data are classified as public or private Provide public data and private data

about the subject within 10 days Data are classified as confidential or

are not about the data subject Data cannot be released – must provide

statutory citation denying access (Minnesota Statutes, section 13.03, subd. 3(f)

Requested data do not exist at the entity

Entity must inform requestor Entity not required to create data

June 2010 13

Responding to data requests - copy charges

Inspection – no cost Even if entity must make a copy so the

requestor may view it Requestor may take notes, pictures, scan the

dataCopies – cost depends on request

Member of the public (Minnesota Statutes, section 13.03)

25¢ per page – 100 or fewer copies of black & white, letter/legal size paper

Actual cost – all other copies Data subject (Minnesota Statutes, section 13.04)

Actual cost

June 2010 14

Additional rights of data subjects – Tennessen warning notice (Minnesota Statutes, section 13.04, subd. 2)

When an entity collects private or confidential data from an individual, the entity must give a notice that includes:Purpose and intended use of dataWhether the individual may refuse or is

legally required to provide the dataKnown consequences from supplying or

refusing to supply the dataIdentity of other persons or entities with

statutorily authorized access to the data

June 2010 15

Additional rights of data subjects – informed consent (Minnesota Statutes, section 13.05, subd. 3(d)

Given when an entity has private or confidential data on an individual

Informed consent is necessary for:Individual asks the entity to release

dataA new release of data by the entityDifferent use of data than described in

Tennessen noticeDifferent release than described in

Tennessen notice

June 2010 16

Additional rights of data subjects

Limits on the government’s collection and storage of data on individuals Entities may only use and disseminate private or

confidential data that are necessary for the administration of programs authorized by law (Minnesota Statutes, section 13.05, subd. 3)

Expectation in the security of data Entities must establish appropriate safeguards

for all data Entities must have written procedures regarding

access to private data Entities must notify individuals if there is a

breach in security of not public data

June 2010 17

Additional rights of data subjects

Minors may request that data be withheld from a parent or guardianEducational data exception – a minor

cannot deny a parent access to a student’s education record.

Right to challenge the accuracy and/or completeness of data

June 2010 18

How to contact the Information Policy Analysis Division (IPAD)

www.ipad.state.mn.us651.296.6733info.ipad@state.mn.us 201 Administration Building

50 Sherburne Ave.St. Paul, MN 55155