What is a “Data Subject”?
When government has information recorded in any form (paper, hard drive, voicemail, video, email, etc.), that information is called “government data” under the Government Data Practices Act (Minnesota Statutes, Chapter 13). When you are identified in government data, you are the “data subject” of that data. The Data Practices Act gives you , as a data subject, certain rights. This policy explains your rights as a data subject, and tells you how to request data about you, your minor child, or someone for whom you are the legal guardian.
When MDA Has Data About You
MDA has data on many people, such as employees, job applicants, and individual licensees. We can collect and keep data about you only when we have a business purpose to have the data. MDA must also keep all government data in a way that makes it easy for you to have access to data about you.
Government data about an individual have one of three “classifications.” These classifications determine who is legally allowed to see the data. Data about you are classified by state law as public, private, or confidential. Here are some examples:
Public Data
The Data Practices Act presumes that all government data are public unless a state or federal law says that the data are not public. We must give public data to anyone who asks. It does not matter who is asking for the data or why the person wants the data. The following are examples of public data about you that we might have:
- Your name and salary, if you are an MDA employee
- Your name as an MDA-issued license holder
Private data
We cannot give private data to the general public. We can share your private data with you, with someone who has your permission, with our government entity staff whose job requires or permits them to see the data, and with others as permitted by law or court order. The following are examples of private data about you that we might have:
- Your performance evaluations, if you are an MDA employee
- Your Social Security Number
- Certain license application data, prior to the approval/denial of the license
Confidential Data
Confidential data have the most protection. Neither the public nor you can access confidential data even when the confidential data are about you. We can share confidential data about you with our government entity staff who have a work assignment to see the data, and to others as permitted by law or court order. The following is an example of confidential data about you:
- Data collected about you as part of an active civil investigation
- The identity of the person making a complaint regarding the use of real property
Your Rights Under the Government Data Practices Act
As a data subject, you have the following rights.
Access to Your Data
You have the right to look at (inspect), free of charge, public and private data that we keep about you. You also have the right to get copies of public and private data about you. The Data Practices Act allows us to charge for copies.
Also, if you ask, we will tell you whether we keep data about you and whether the data are public, private, or confidential.
As a parent, you have the right to look at and get copies of public and private data about your minor children (under the age of 18). As a legally appointed guardian, you have the right to look at and get copies of public and private data about an individual for whom you are appointed guardian.
Minors have the right to ask us not to give data about them to their parent or guardian. If you are a minor, we will tell you that you have this right. We will ask you to put your request in writing and to include the reasons that we should deny your parents access to the data. We will make the final decision about your request based on your best interests.
When We Collect Data From You
When we ask you to provide data about yourself that are not public, we must give you a notice called a Tennessen warning. The notice controls what we do with the data that we collect from you. Usually, we can use and release the data only in the ways described in the notice.
We will ask for your written permission if we need to use or release private data about you in a different way, or if you ask us to release the data to another person. This permission is called informed consent.
Protecting Your Data
The Data Practices Act requires us to protect your data. We have established appropriate safeguards to ensure that your data are safe.
In the unfortunate event that we determine a security breach has occurred that may have impacted you, we will notify you as required by law.
When Your Data are Inaccurate or Incomplete
You have the right to challenge the accuracy and/or completeness of public and private data about you. You also have the right to appeal our decision. If you are a minor, your parent or guardian has the right to challenge data about you.
How to Make a Request For Your Data
You can ask to look at (inspect) data at our offices, or ask for copies of data that we have about you, your minor child, or an individual for whom you have been appointed legal guardian. Data requests must be in writing, and must be mailed or emailed to the appropriate Division designee listed in the Data Practices Contacts. If you have any questions about making a data request, or are unsure of which designee to direct your data request, contact MDA’s Data Practices Compliance Official.
We recommend using the sample Data Request Form – Data Subjects. If you do not choose to use the data request form, your request should:
- Say that you are making a request as a data subject, for data about you (or your child, or person for whom you are the legal guardian), under the Government Data Practices Act (Minnesota Statutes, Chapter 13).
- Include whether you would like to inspect the data, have copies of the data, or both.
- Provide a clear description of the data you would like to inspect or have copied.
- Provide proof that you are the data subject or data subject’s parent/legal guardian.
We require proof of your identity before we can respond to your request for data. If you are requesting data about your minor child, you must show proof that you are the minor’s parent. If you are a legal guardian, you must show legal documentation of your guardianship. Please see the Standards for Verifying Identity. If you do not provide proof that you are the data subject, we cannot respond to your request.
How We Respond to a Data Request
Upon receiving your request, we will review it.
- We may ask you to clarify what data you are requesting.
- We will ask you to confirm your identity as the data subject.
- If we do not have the data, we will notify you within 10 business days.
- If we have the data, but the data are confidential or not public data about someone else, we will notify you within 10 business days and identify the law that prevents us from providing the data.
- If we have the data, and the data are public or private data about you, we will respond to your request within 10 business days by doing one of the following:
- Arrange a date, time, and place to inspect data in our offices, for free, or
- Tell you how much the copies cost, and then provide you with copies of the data within 10 business days and upon payment of charges for the copies. You may choose to pick up your copies, or have us mail or email them to you. We will provide electronic copies (such as email or CD-ROM) upon request, if we keep the data in electronic format and we can reasonably make a copy.
- Following our response, if you do not make arrangements within 15 business days to inspect the data or pay for the copies, we will conclude that you no longer want the data and will consider your request closed.
- After we have provided you with your requested data, we do not have to show you the same data again for 6 months unless there is a dispute about the data or we collect or create new data about you.
If you do not understand some of the data (technical terminology, abbreviations, or acronyms), please contact the person who provided the data to you. We will give you an explanation if you ask.
The Data Practices Act does not require us to create or collect new data in response to a data request, or to provide data in a specific form or arrangement if we do not keep the data in that form or arrangement. For example, if the data you request are on paper only, we are not required to create electronic documents to respond to your request. If we agree to create data in response to your request, the requirements of the Data Practices Act do not apply and we will contact you to discuss timing and payment details.
The Data Practices Act also does not require MDA to respond to questions, with the exception of those that are necessary to understand the meaning of responsive data.
Copy Costs – Data Subjects
We charge for copies of government data when the total charges are $50.00 or more. Minnesota Statutes, section 13.04, subdivision 3 allows us to charge for copies. Copy costs must be paid in full before MDA will provide the requested copies.
Actual Cost of Making the Copies
We will charge the actual cost of making copies for data about you. In determining the actual cost, we include the employee-time to create and send the copies, the cost of the materials onto which we are copying the data (paper, CD, DVD, etc.), and mailing costs such as postage (if any).
If your request is for copies of data that we cannot copy ourselves, such as photographs, we will charge you the actual cost we must pay an outside vendor for the copies.
