1.1 	A bill for an act
1.2 	relating to data practices; modifying notification procedure related to an 
1.3 	unauthorized acquisition of government data;amending Minnesota Statutes 2018, 
1.4 	section 13.055, subdivision 2.
1.5 	BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF MINNESOTA:

1.6 	Section 1. Minnesota Statutes 2018, section 13.055, subdivision 2, is amended to read:
1.7 		Subd. 2.Notice to individuals; investigation report. (a) A government entity that 
1.8 	collects, creates, receives, maintains, or disseminates private or confidential data on 
1.9 	individuals must disclose any breach of the security of the data following discovery or 
1.10 	notification of the breach. Written Notification must be made to any individual who is the 
1.11 	subject of the data and whose private or confidential data was, or is reasonably believed to 
1.12 	have been, acquired by an unauthorized person and if the unauthorized acquisition creates 
1.13 	a significant risk of financial, reputational, or other harm to the subject of the data. In 
1.14 	evaluating whether an unauthorized acquisition creates a significant risk to the subject of 
1.15 	the data, the government entity must consider the following factors:
1.16 	(1) the nature of the unauthorized acquisition;
1.17 	(2) the nature and type of the data breached;
1.18 	(3) the likelihood that the breach caused the data to become accessible and usable outside 
1.19 	of the government entity;
1.20 	(4) the likelihood that the breach will result in harm to the subject of the data; and
1.21 	(5) the ability of the government entity to mitigate the risk of harm to the subject of the 
1.22 	data.
2.1 	The notification must inform the individual that a report will be prepared under paragraph 
2.2 	(b), how the individual may obtain access to the report, and that the individual may request 
2.3 	delivery of the report by mail or e-mail. The disclosure must be made in the most expedient 
2.4 	time possible and without unreasonable delay, consistent with (1) (i) the legitimate needs 
2.5 	of a law enforcement agency as provided in subdivision 3; or (2) (ii) any measures necessary 
2.6 	to determine the scope of the breach and restore the reasonable security of the data.
2.7 	(b) Notwithstanding section 13.15 or 13.37, upon completion of an investigation into 
2.8 	any breach in the security of data and final disposition of any disciplinary action for purposes 
2.9 	of section 13.43, including exhaustion of all rights of appeal under any applicable collective 
2.10 	bargaining agreement, the responsible authority shall prepare a report on the facts and results 
2.11 	of the investigation. If the breach involves unauthorized access to or acquisition of data by 
2.12 	an employee, contractor, or agent of the government entity, the report must at a minimum 
2.13 	include:
2.14 	(1) a description of the type of data that were accessed or acquired;
2.15 	(2) the number of individuals whose data was improperly accessed or acquired;
2.16 	(3) if there has been final disposition of disciplinary action for purposes of section 13.43, 
2.17 	the name of each employee determined to be responsible for the unauthorized access or 
2.18 	acquisition, unless the employee was performing duties under chapter 5B; and
2.19 	(4) the final disposition of any disciplinary action taken against each employee in 
2.20 	response.