The following information is excerpted from e-mails sent on March 20 & 21, 2013 from Mark Ranum, 2013 MLA Legislative Chair. Additional linked information added.
Date Privacy Bill
The short update is that with the assistance of legislators on the committee and other experts, we have determined that the data privacy protection we are seeking is already in the current law. What follows is the longer update.
We drafted the following language to be included in MS 13.40 Subd. 2 (a) is as follows (bold portion):
(a) Except as provided in paragraph (b), the following data maintained by a library or a vendor providing any electronic data services under contract with a library are private data on individuals and may not be disclosed for other than library purposes except pursuant to a court order
We had a comment from Rep. Mary Liz Holberg in the first committee hearing, followed by comments from Don Gemberling, a data practices expert in MN, who both believed that this addition might be covered in MS 13.05 Subd. 6 as follows.
Except as provided in section 13.46, subdivision 5, in any contract between a government entity subject to this chapter and any person, when the contract requires that data on individuals be made available to the contracting parties by the government entity, that data shall be administered consistent with this chapter. A contracting party shall maintain the data on individuals which it received according to the statutory provisions applicable to the data.
Our point on this issue is that this data on individuals is not “made available to the contracting parties ,” but rather is sometimes directly input into the vendor’s system by the patron. This addition seemed to be necessary for this reason, and more broadly protects patron privacy when using these systems.
Further discussions with data privacy experts, however, led to the belief that rather than MS 13.05 Subd. 6. covering this issue, MS 13.05 Subd. 11. Privatization covers our needs. Here is that section.
(a) If a government entity enters into a contract with a private person to perform any of its functions, the government entity shall include in the contract terms that make it clear that all of the data created, collected, received, stored, used, maintained, or disseminated by the private person in performing those functions is subject to the requirements of this chapter and that the private person must comply with those requirements as if it were a government entity. The remedies in section 13.08 apply to the private person under this subdivision.
This section places the burden on libraries to make sure our contracts include references to the Minnesota Data Practices Act. Libraries need to require the vendor understands they are “subject to the requirements of this chapter and that the private person must comply with those requirements as if it were a government entity.”
Given the results of the legislative conversations and advice from experts, we are withdrawing the library language platform item from this bill. Since the Library bill was the vehicle for the House Omnibus Data Practices act, our bill is still technically alive by number. However, the library provision will not be included.
Minitex and MnLINK
Our hearing on SF 995 (Eken) Minitex and MnLINK Gateway programs appropriation, was held in the Higher Education and Workforce Development Division of the Senate Finance Committee on Tuesday, March 19, 2013. You can listen to the testimony here, which runs less than 10 minutes, starting around the 2 hour mark.
Bruce Willms from Metropolitan State University did a terrific job testifying! Thank you to Bruce for pinch hitting for me on that day! And if you ever wondered if our lobbyist is an enthusiastic library supporter, PLEASE listen to her few minutes of remarks and her expert handling of the committee. Elaine Keefe is a terrific advocate for us every day at the Capitol.
Senator Eken, the lead author, is from Norman County in the Lake Agassiz region, and thank you emails to him for supporting libraries with this bill would be greatly appreciated from anywhere in the state: firstname.lastname@example.org