Subdivision 1. Data inventory. The responsible authority shall prepare an inventory containing the authority's name, title, address, and a description of each category of record, file, or process relating to private or confidential data on individuals maintained by the authority's government entity. Forms used to collect private and confidential data may be included in the inventory. The responsible authority shall update the inventory annually and make any changes necessary to maintain the accuracy of the inventory. The inventory must be available from the responsible authority to the public according to the provisions of sections 13.03 and 15.17. The commissioner may require responsible authorities to submit copies of the inventory and may request additional information relevant to data collection practices, policies, and procedures.

Subd. 2. Public data access policy. The responsible authority shall prepare a written data access policy and update it no later than August 1 of each year, and at any other time as necessary to reflect changes in personnel, procedures, or other circumstances that impact the public's ability to access data.

Subd. 3. Data subject rights and access policy. The responsible authority shall prepare a written policy of the rights of data subjects under section 13.04 and the specific procedures used by the government entity for access by the data subject to public or private data on individuals. The written policy must be updated no later than August 1 of each year, and at any other time as necessary to reflect changes in personnel, procedures, or other circumstances that impact the public's ability to access data.

Subd. 4. Availability. The responsible authority shall make copies of the policies required under subdivisions 2 and 3 easily available to the public by distributing free copies to the public or by posting the policies in a conspicuous place within the government entity that is easily accessible to the public or by posting it on the government entity's website.

History: 2012 c 290 s 10