Can I collect third-party data from participants in Minnesota? What are the requirements?

To collect third-party data from participants in Minnesota, you must comply with the state’s data privacy laws. The requirements for accessing confidential, public, and private data are outlined in Minnesota Administrative Code (MNAC) 1205.0600, 1205.0300, and 1205.0400, respectively.

Access to Confidential Data

Confidential data can only be accessed by individuals within the entity whose work assignments reasonably require access and entities and agencies who are authorized by statute, including Minnesota Statutes, section 13.05, or federal law to gain access to that specific data ^[1.2]. The responsible authority must establish written procedures to assure that access may be gained only by those parties identified in subpart 2. In the drafting and administration of those procedures, the responsible authority shall provide measures by which data subjects or their authorized representatives shall be informed, upon request, if they are the subjects of confidential data ^[1.2].

Access to Public Data

The responsible authority shall provide access to public data to any person, without regard to the nature of that person’s interest in the data ^[1.3]. The responsible authority shall establish procedures to describe how such access may be gained. The procedures established shall be in compliance with Minnesota Statutes, section 13.03. In such procedures, the responsible authority may limit the time during which access to public data is available to the time during which the normal operations of the agency are conducted ^[1.3].

Access to Private Data

Access to private data shall be available only to the subject of such data, as limited by any applicable statute or federal law; individuals within the entity whose work assignments reasonably require access; entities and agencies as determined by the responsible authority who are authorized by statute, including Minnesota Statutes, section 13.05, subdivision 4, or federal law to gain access to that specific data; and entities or individuals given access by the express written direction of the data subject ^[1.4]. The responsible authority shall establish written procedures to assure that access is gained only by those parties identified in subpart 2. In those procedures, the responsible authority shall provide for reasonable measures to assure, in those instances where an individual who seeks to gain access to private data asserts that he or she is the subject of that data or the authorized representative of the data subject, that the individual making the assertion is in fact the subject of the data or the authorized representative of the data subject ^[1.4].

Based on the above, you can collect third-party data from participants in Minnesota if you comply with the relevant data privacy laws. The specific requirements for accessing the data will depend on whether it is confidential, public, or private data.

Source(s):

• [1.2] ACCESS TO CONFIDENTIAL DATA.
• [1.3] ACCESS TO PUBLIC DATA.
• [1.4] ACCESS TO PRIVATE DATA.

Jurisdiction

Minnesota

• Privacy