Loading...
HomeMy WebLinkAboutItem 06.eDecember 31, 2014 Item No. DATA PRACTICES POLICIES Proposed Action Staff recommends adoption of the following motion: Move to adopt the City of Lakeville Data Practices Policies. Passage of this motion meets the requirements of Minnesota Statutes, Chapter 13. Overview Minnesota Statutes, Chapter 13, requires that each government entity establish a number of policies that govern the treatment of government data. Each government entity is required to have two polices about access to government data. One policy is to explain the rights of the public. The other policy must explain the rights of data subjects. A government entity is also required to create a document that identifies and describes any private or confidential data maintained by the entity. Effective August 1, 2014, Chapter 13 includes a requirement that government entities create procedures "ensuring that data that are not public are only accessible to persons whose work assignment reasonably requires access to the data". The attached Data Practices Policies meet the requirements of Minnesota Statutes, Chapter 13. All City of Lakeville employees who have access to data that are not public must attend a data practices training. Two sessions are scheduled in January. Primary Issues to Consider What are the penalties for unlawfully accessing not public data? The policy states that Lakeville will utilize the penalties for unlawful access to not public data as provided for in Minnesota Statutes, section 13.09, if necessary. Penalties include suspension, dismissal, or referring the matter to the appropriate prosecutorial authority, which may pursue a criminal misdemeanor charge. Charlene Friedges, City Cler Financial Impact: $ Budgeted: Y/N Source: Related Documents (CIP, ERP, etc.): Notes: CITY OF LAKEVILLE Data Practices Policy for Members of the Public Right to Access Public Data City of Lakeville www.lakevillemn.gov January 2015 The Government Data Practices Act (Minnesota Statutes, Chapter 13) presumes that all government data are public unless a state or federal law says the data are not public. Government data is a term that means all recorded information a government entity has, including paper, email, DVDs, photographs, etc. The Government Data Practices Act also provides that this government entity must keep all government data in a way that makes it easy for you, as a member of the public, to access public data. You have the right to look at (inspect), free of charge, all public data that we keep. You also have the right to get copies of public data. The Government Data Practices Act allows us to charge for copies. You have the right to look at data, free of charge, before deciding to request copies. How to Make a Data Request You may request to look at data or obtain copies of data that this government entity keeps. You may be asked to make a written request. Make your request for data to the appropriate individual listed in the Data Practices Contacts on Page 4. You may make your request for data by mail, fax, or email, using the Data Request Form on Page 6. If you choose not to use the data request form, your request should include: • that you, as a member of the public, are making a request for data under the Government Data Practices Act, Minnesota Statutes, Chapter 13; • whether you would like to look at the data, get copies of the data, or both; and • a clear description of the data you would like to inspect or have copied. This government entity cannot require you, as a member of the public, to identify yourself or explain the reason for your data request. However, depending on how you want us to process your request (if, for example, you want us to mail you copies of data), we may need some information about you. If you choose not to give us any identifying information, we will provide you with contact information so you may check on the status of your request. In addition, please keep in mind that if we do not understand your request and have no way to contact you, we will not be able to begin processing your request. How We Respond to a Data Request Upon receiving your request, we will work to process it. If we do not have the data, we will notify you in writing as soon as reasonably possible. If we have the data, but the data are not public, we will notify you as soon as reasonably possible and state which specific law says the data are not public. If we have the data, and the data are public, we will respond to your request appropriately and promptly, within a reasonable amount of time by doing one of the following: o arrange a date, time, and place to inspect data, for free, if your request is to look at the data, or o provide you with copies of the data as soon as reasonably possible. You may choose to pick up your copies, or we will mail or fax them to you. If you want us to send you the copies, you will need to provide us with an address or fax number. We will provide electronic copies (such as email or CD-ROM) upon request if we keep the data in electronic format. Policy required by Minnesota Statutes, section 13.025, subdivision 2. Page 2 Information about copy charges is on Page 5. We may require you to pre -pay for the copies. If you do not understand some of the data (technical terminology, abbreviations, or acronyms), please let us know. We will give you an explanation if you ask. The Government Data Practices Act does not require us to create or collect new data in response to a data request if we do not already have the data, or to provide data in a specific form or arrangement if we do not keep the data in that form or arrangement. (For example, if the data you request are on paper only, we are not required to create electronic documents to respond to your request.) If we agree to create data in response to your request, we will work with you on the details of your request, including cost and response time. In addition, the Government Data Practices Act does not require us to answer questions that are not requests for data. Requests for Summary Data Summary data are statistical records or reports that are prepared by removing all identifiers from private or confidential data on individuals. The preparation of summary data is not a means to gain access to private or confidential data. We will prepare summary data if you make your request in writing. We may require you to pre -pay for copies and for the cost of creating the data. Upon receiving your written request — you may use the data request form on Page 6 — we will respond within ten business days with the data or details of when the data will be ready and how much we will charge. Policy required by Minnesota Statutes, section 13.025, subdivision 2. Page 3 Data Practices Contacts Responsible Authority Charlene Friedges 20195 Holyoke Avenue, Lakeville, MN 55044 952-985-4404 cfriedges@lakevillemn.gov Data Practices Compliance Official Charlene Friedges 20195 Holyoke Avenue, Lakeville, MN 55044 952-985-4404 cfriedees@lakevillemn.p,ov Data Practices Designee — Human Resources Cindi Joosten 20195 Holyoke Avenue, Lakeville, MN 55044 952-985-4490 cioosten@lakevillemn.gov Data Practices Designees — Police Department Administrative Services 9237-183 rd Street, Lakeville, MN 55044 952-985-2800 policerecords@lakevillemn.gov Policy required by Minnesota Statutes, section 13.025, subdivision 2. Page 4 Copy Costs — Members of the Public This government entity charges members of the public for copies of government data. These charges are authorized under Minnesota Statutes, section 13.03, subdivision 3(c). You may be required to pay for the copies before we will give them to you. We do not charge for copies if the cost is less than $10. For 100 or Fewer Paper Copies — 25 cents per page 100 or fewer pages of black and white, letter or legal size paper copies cost 25C for a one-sided copy, or 50C for a two-sided copy. Most Other Types of Copies — Actual cost The charge for most other types of copies, when a charge is not set by statute or rule, is the actual cost of searching for and retrieving the data, and making the copies or electronically transmitting the data (e.g. sending the data by email). In determining the actual cost of making copies, we factor in employee time, the cost of the materials onto which we are copying the data (paper, CD, DVD, etc.), and mailing costs (if any). If your request is for copies of data that we cannot reproduce ourselves, such as photographs, we will charge you the actual cost we must pay an outside vendor for the copies. Policy required by Minnesota Statutes, section 13.025, subdivision 2. Page 5 Data Request Form - Members of the Public Date of request: I am requesting access to data in the following way: ❑ Inspection ❑ Copies ❑ Both inspection and copies Note: inspection is free but we charge for copies when the cost is over $10.00. You may be required to pay for copies before we will give them to you. These are the data I am requesting: Describe the data you are requesting as specifically as possible. If you need more space, please use the back of this form. Contact Information Name: Address: Phone number: Email address: You do not have to provide any of the above contact information. However, if you want us to mail/email you copies of data, we will need some type of contact information. In addition, if we do not understand your request and need to get clarification from you, without contact information we will not be able to begin processing your request until you contact us. We will respond to your request as soon as reasonably possible. Policy required by Minnesota Statutes, section 13.025, subdivision 2. Page 6 CITY OF LAKEVILLE Data Practices Policy for Data Subjects Data about You City of Lakeville www.lakevillemn.aov January 2015 The Government Data Practices Act (Minnesota Statutes, Chapter 13) says that data subjects have certain rights related to a government entity collecting, creating, and keeping government data about them. You are the subject of data when you can be identified from the data. Government data is a term that means all recorded information a government entity has, including paper, email, DVDs, photographs, etc. Classification of Data about You The Government Data Practices Act presumes that all government data are public unless a state or federal law says that the data are not public. Data about you are classified by state law as public, private, or confidential. See below for some examples. 1. Public data: We must give public data to anyone who asks; it does not matter who is asking for the data or why. The following is an example of public data about you: The names of City of Lakeville employees 2. Private data: We cannot give private data to the general public, but you have access when the data are about you. We can share your private data with you, with someone who has your permission, with our government entity staff who need the data to do their work, and as permitted by law or court order. The following is an example of private data about you: Social Security numbers Confidential data: Confidential data have the most protection. Neither the public nor you can get access even when the confidential data are about you. We can share confidential data about you with our government entity staff who need the data to do their work and to others as permitted by law or court order. We cannot give you access to confidential data. The following is an example of confidential data about you: The identity of the subject of an active criminal investigation Your Rights under the Government Data Practices Act This government entity must keep all government data in a way that makes it easy for you to access data about you. Also, we can collect and keep only those data about you that we need for administering and managing programs that are permitted by law. As a data subject, you have the following rights. • Access to Your Data You have the right to look at (inspect), free of charge, public and private data that we keep about you. You also have the right to get copies of public and private data about you. The Policy required by Minnesota Statutes, section 13.025, subdivision 3. Page 2 Government Data Practices Act allows us to charge for copies. You have the right to look at data, free of charge, before deciding to request copies. Also, if you ask, we will tell you whether we keep data about you and whether the data are public, private, or confidential. As a parent, you have the right to look at and get copies of public and private data about your minor children (under the age of 18). As a legally appointed guardian, you have the right to look at and get copies of public and private data about an individual for whom you are appointed guardian. Minors have the right to ask this government entity not to give data about them to their parent or guardian. If you are a minor, we will tell you that you have this right. We may ask you to put your request in writing and to include the reasons that we should deny your parents access to the data. We will make the final decision about your request based on your best interests. Note: Minors do not have this right if the data in question are educational data maintained by an educational agency or institution. • When We Collect Data from You When we ask you to provide data about yourself that are not public, we must give you a notice. The notice is sometimes called a Tennessen warning. The notice controls what we do with the data that we collect from you. Usually, we can use and release the data only in the ways described in the notice. We will ask for your written permission if we need to use or release private data about you in a different way, or if you ask us to release the data to another person. This permission is called informed consent. If you want us to release data to another person, you may use the consent form we provide. • Protecting your Data The Government Data Practices Act requires us to protect your data. We have established appropriate safeguards to ensure that your data are safe. • When your Data are Inaccurate and/or Incomplete You have the right to challenge the accuracy and/or completeness of public and private data about you. You also have the right to appeal our decision. If you are a minor, your parent or guardian has the right to challenge data about you. How to Make a Request for Your Data You may request to look at data, or obtain copies of data that this government entity keeps about you, your minor children, or an individual for whom you have been appointed legal guardian. You may be asked to make a written request. Make your request for data to the appropriate individual listed in the Data Practices Contacts on Page 5. You may make your request by mail, fax, or email, using the Data Request Form on Page 7. Policy required by Minnesota Statutes, section 13.025, subdivision 3. Page 3 If you choose not to use the data request form, your request should include: • that you are making a request, under the Government Data Practices Act (Minnesota Statutes, Chapter 13), as a data subject, for data about you; • whether you would like to inspect the data, have copies of the data, or both; • a clear description of the data you would like to inspect or have copied; and • identifying information that proves you are the data subject, or data subject's parent/guardian. This government entity may require proof of your identity before we can respond to your request for data. If you are requesting data about your minor child, you must show proof that you are the minor's parent. If you area guardian, you must show legal documentation of your guardianship. Please see the Standards for Verifying Identity located on Page 8. How We Respond to a Data Request Once you make your request, we will work to process your request. If it is not clear what data you are requesting, we will ask you for clarification. • If we do not have the data, we will notify you in writing within 10 business days. • If we have the data, but the data are confidential or private data that are not about you, we will notify you within 10 business days and state which specific law says you cannot access the data. • If we have the data, and the data are public or private data about you, we will respond to your request within 10 business days, by doing one of the following: o arrange a date, time, and place to inspect data, for free, if your request is to look at the data, or o provide you with copies of the data within 10 business days. You may choose to pick up your copies, or we will mail or fax them to you. We will provide electronic copies (such as email or CD-ROM) upon request if we keep the data in electronic format. Information about copy charges is on Page 6. We may require you to prepay for the copies. After we have provided you with access to data about you, we do not have to show you the data again for 6 months unless there is a dispute or we collect or create new data about you. If you do not understand some of the data (technical terminology, abbreviations, or acronyms), please let us know. We will give you an explanation if you ask. The Government Data Practices Act does not require us to create or collect new data in response to a data request if we do not already have the data, or to provide data in a specific form or arrangement if we do not keep the data in that form or arrangement. (For example, if the data you request are on paper only, we are not required to create electronic documents to respond to your request.) If we agree to create data in response to your request, we will work with you on the details of your request, including cost and response time. In addition, we are not required under the Government Data Practices Act to respond to questions that are not specific requests for data. Policy required by Minnesota Statutes, section 13.025, subdivision 3. Page 4 Data Practices Contacts Responsible Authority Charlene Friedges 20195 Holyoke Avenue, Lakeville, MN 55044 952-985-4404 cfriedges@lakevillemn.eov Data Practices Compliance Official Charlene Friedges 20195 Holyoke Avenue, Lakeville, MN 55044 952-985-4404 cfriedees@lakevillemn.gov Data Practices Designee — Human Resources Cindi Joosten 20195 Holyoke Avenue, Lakeville, MN 55044 952-985-4490 cioosten@lakevillemn.gov Data Practices Designees — Police Department Administrative Services 9237-183 rd Street, Lakeville, MN 55044 952-985-2800 policerecords@lakevillemn.gov Policy required by Minnesota Statutes, section 13.025, subdivision 3. Page 5 Copy Costs - Data Subjects This government entity may charge data subjects for copies of government data. These charges are authorized under Minnesota Statutes, section 13.04, subdivision 3. You may be required to pay for the copies before we will give them to you. We do not charge for copies if the cost is less than $10. Actual Cost of Making the Copies In determining the actual cost of making copies, we factor in employee time, the cost of the materials onto which we are copying the data (paper, CD, DVD, etc.), and mailing costs (if any). If your request is for copies of data that we cannot reproduce ourselves, such as photographs, we will charge you the actual cost we must pay an outside vendor for the copies. Policy required by Minnesota Statutes, section 13.025, subdivision 3. Page 6 Data Request Form - Data Subjects Date of request: To request data as a data subject, you may be required to show a valid state ID, such as a driver's license, military ID, or passport as proof of identity. I am requesting access to data in the following way: ❑ Inspection ❑ Copies ❑ Both inspection and copies Note: inspection is free but we charge for copies when the cost is over $10.00. You may be required to pay for copies before we will give them to you. These are the data I am requesting: Describe the data you are requesting as specifically as possible. If you need more space, please use the back of this form. Contact Information Data subject name Parent/Guardian name (if applica Address Phone number Staff Verification Identification provided Email address We will respond to your request within 10 business days. Policy required by Minnesota Statutes, section 13.025, subdivision 3. Page 7 Standards for Verifying Identity The following constitute proof of identity. • An adult individual must provide a valid photo ID, such as o a state driver's license o a military ID o a passport o a Minnesota ID o a Minnesota tribal ID • A minor individual must provide a valid photo ID, such as o a state driver's license o a military ID o a passport o a Minnesota ID o a Minnesota Tribal ID o a Minnesota school ID • The parent or guardian of a minor must provide a valid photo ID and either o a certified copy of the minor's birth certificate or o a certified copy of documents that establish the parent or guardian's relationship to the child, such as ❖ a court order relating to divorce, separation, custody, foster care ❖ a foster care contract ❖ an affidavit of parentage • The legal guardian for an individual must provide a valid photo ID and a certified copy of appropriate documentation of formal or informal appointment as guardian, such as o court order(s) o valid power of attorney Note: Individuals who do not exercise their data practices rights in person must provide either notarized or certified copies of the documents that are required or an affidavit of ID. Policy required by Minnesota Statutes, section 13.025, subdivision 3. Page 8 CITY OF LAKEVILLE Policy for Ensuring the Security of Not Public Data Legal requirement The adoption of this policy by the City of Lakeville (Lakeville) satisfies the requirement in Minnesota Statutes, section 13.05, subd. 5, to establish procedures ensuring appropriate access to not public data. By incorporating employee access to not public data in Lakeville's Data Inventory (required by Minnesota Statutes, section 13.025, subd. 1), in the individual employee's position description, or both, Lakeville's policy limits access to not public data to employees whose work assignment reasonably requires access. Please direct all questions regarding this policy to the City of Lakeville's Data Practices Compliance Official: Charlene Friedges cfriedges@lakevillemn.gov 952-985-4404 20195 Holyoke Avenue Lakeville, MN 55044 Procedures implementing this policy Data Inventory Under the requirement in Minnesota Statutes, section 13.025, subd. 1, Lakeville has prepared a Data Inventory which identifies and describes all not public data on individuals maintained by Lakeville. To comply with the requirement in section 13.05, subd. 5, Lakeville has also modified its Data Inventory to represent the employees who have access to not public data. In the event of a temporary duty as assigned by a manager or supervisor, an employee may access certain not public data for as long as the work is assigned to the employee. In addition to the employees listed in Lakeville's Data Inventory, the Responsible Authority, Data Practices Compliance Official, City Administrator, Human Resources Manager and Information Systems Manager may have access to all not public data maintained by Lakeville if necessary for specified duties. Any access to not public data will be strictly limited to the data necessary to complete the work assignment. Employee Position Descriptions All employees are required to adhere to Minnesota Statute Chapter 13, the Government Data Practices Act. Position descriptions may contain provisions identifying any not public data accessible to the employee when a work assignment reasonably requires access. Data Sharing with Authorized Entities or Individuals State or federal law may authorize the sharing of not public data in specific circumstances. Not public data may be shared with another entity if a federal or state law allows or mandates it. Individuals will have notice of any sharing in applicable Tennessen warnings (see Minnesota Statutes, section 13.04) or Lakeville will obtain the individual's informed consent. Any sharing of not public data will be strictly limited to the data necessary or required to comply with the applicable law. Ensuring that not public data are not accessed without a work assignment Within Lakeville, departments may assign tasks by employees or by job classification. If a department maintains not public data that all employees within its department do not have a work assignment allowing access to the data, the department will ensure that the not public data are secure. This policy also applies to departments that share work spaces with other departments within Lakeville where not public data are maintained. Recommended actions for ensuring appropriate access include: • Assigning appropriate security roles, limiting access to appropriate shared network drives, and implementing password protections for not public electronic data • Password protecting employee computers and locking computers before leaving work stations • Securing not public data within locked work spaces and in locked file cabinets • Shredding not public documents before disposing of them Penalties for unlawfully accessing not public data Lakeville will utilize the penalties for unlawful access to not public data as provided for in Minnesota Statutes, section 13.09, if necessary. Penalties include suspension, dismissal, or referring the matter to the appropriate prosecutorial authority, which may pursue a criminal misdemeanor charge.