Data Inventory:
Under the requirement in Minnesota Statutes, section 13.025, subd. 1, SCSU has prepared a Data Inventory which identifies and describes all not public data on individuals maintained by SCSU. To comply with the requirement in section 13.05, subd. 5, SCSU has also modified its Data Inventory to identify the employees who have access to not public data.
In the event of a temporary duty as assigned by a manager or supervisor, an employee may access certain not public data, for as long as the work is assigned to the employee.
In addition to the employees listed in SCSU’s Data Inventory, the Responsible Authority, the Data Practices Compliance Official (DPCO), SCSU Administrators, and Minnesota State staff to include the General Counsel and Attorney General, may have access to all not public data maintained by SCSU if necessary for specified duties. Any access to not public data will be strictly limited to the data necessary to complete the work assignment.
Employee Position Descriptions:
Position descriptions may contain provisions identifying any not public data accessible to the employee when a work assignment reasonably requires access.
Data Sharing with Authorized Entities or Individuals:
State or federal law may authorize the sharing of not public data in specific circumstances. Not public data may be shared with another entity if a federal or state law allows or mandates it. Individuals will have notice of any sharing in applicable Tennessen warnings (see Minnesota Statutes, section 13.04) or SCSU will obtain the individual’s informed consent. Any sharing of not public data will be strictly limited to the data necessary or required to comply with the applicable law.
Ensuring That Not Public Data Are Not Accessed Without a Work Assignment:
Within SCSU, divisions may assign tasks by employee or by job classification. If a division maintains not public data and not all employees within its division have a work assignment allowing access to the data, the division will ensure that the not public data are secure. This policy also applies to divisions that share workspaces with other divisions within SCSU where not public data are maintained.
Recommended actions for ensuring appropriate access include:
- Assigning appropriate security roles, limiting access to appropriate shared network drives, and implementing password protections for not public electronic data
- Password protecting employee computers and locking computers before leaving workstations
- Securing not public data within locked work spaces and in locked file cabinets
- Shredding not public documents before disposing of them
Penalties for Unlawfully Accessing Not Public Data:
SCSU will utilize the penalties for unlawful access to not public data as provided for in Minnesota Statutes, section 13.09, if necessary. Penalties include suspension, dismissal, or referring the matter to the appropriate prosecutorial authority who may pursue a criminal misdemeanor charge.