Subdivision 1. Definitions. As used in this section, the following terms have the meanings given.

(a) "Electronic access data" means data created, collected, or maintained about a person's access to a government entity's computer for the purpose of:

(1) gaining access to data or information;

(2) transferring data or information; or

(3) using government services.

(b) "Cookie" means any data that a government-operated computer electronically places on the computer of a person who has gained access to a government computer.

Subd. 2. Classification of data. Electronic access data are private data on individuals or nonpublic data.

Subd. 3. Notice; refusal to accept cookie. (a) A government entity that creates, collects, or maintains electronic access data or uses its computer to install a cookie on a person's computer must inform persons gaining access to the entity's computer of the creation, collection, or maintenance of electronic access data or the entity's use of cookies before requiring the person to provide any data about the person to the government entity. As part of that notice, the government entity must inform the person how the data will be used and disseminated, including the uses and disseminations in subdivision 4.

(b) Notwithstanding a person's refusal to accept a cookie on the person's computer, a government entity must allow the person to gain access to data or information, transfer data or information, or use government services by the government entity's computer.

Subd. 4. Use of electronic access data. Electronic access data may be disseminated:

(1) to the commissioner for the purpose of evaluating electronic government services;

(2) to another government entity or a federal law enforcement agency to prevent or report unlawful intrusions into government electronic systems; or

(3) as otherwise provided by law.

Subd. 5. Exception. This section does not apply to a cookie temporarily installed by a government entity on a person's computer during a single session on or visit to a government entity's website if the cookie is installed only in a computer's memory and is deleted from the memory when the website browser or website application is closed.

History: 1Sp2003 c 8 art 2 s 4; 2010 c 222 s 1; 2017 c 92 art 1 s 4