January 4, 2022; SouthWest Transit
1/4/2022 12:00:00 PM
Mark R. Krampf requested an advisory opinion from the Commissioner regarding SouthWest Transit’s (SWT) response to a request for a copy of the entity’s written data access policies, as required by Minnesota Statutes, section 13.025, and a request to access stored public and private data about himself made pursuant to the Minnesota Government Data Practices Act, Minnesota Statutes, Chapter 13. SWT submitted comments in response to the advisory opinion request.
On November 5, 2021, Krampf requested SWT to inform him whether he was the subject of stored government data. If he was the subject of stored data, Krampf further requested to inspect the data immediately or within 10 days, excluding Saturdays, Sundays and legal holidays, if immediate inspection was not possible, pursuant to Minnesota Statutes, section 13.04, subdivision 3.
On November 10, Krampf contacted the chair of the SouthWest Transit Commission, the governing board of SWT, to learn about the status of the request. During the conversation, the chair noted that he was not aware of whether SWT maintained a written data access policy nor did he believe he was the responsible authority for SWT. The chair informed Krampf that an employee of SWT would respond to the request to access data.
On November 11, SWT contacted Krampf to confirm receipt of the November 5 request. Krampf then requested on November 11 and 13 that SWT provide him with its written data access policies. SWT acknowledged the requests for its policies on November 15.
At 1:45 p.m. on November 22, SWT sent Krampf an email informing him it had compiled responsive data and proposed times on November 30, December 1, and December 2 to inspect the data at its offices. Krampf promptly responded via email that the 10-day statutory deadline to provide access to the data was that day. SWT then responded by email that the data could be inspected at its offices on November 22 between 4 p.m. and 5 p.m., but, if that time did not work, Krampf could inspect the data at the times previously offered.
On November 29, SWT adopted the Commissioner’s Model Policy for the Public and Model Policy for Data Subjects, and the following day it provided Krampf with the specific links where the policies were posted on its website.
|
Based on the opinion request, the Commissioner agreed to address the following issues:
|
The cities of Eden Prairie, Chanhassen, and Chaska formed SouthWest Transit as a joint powers entity in 1986 pursuant to Minnesota Statutes, section 471.59.
The Commissioner has previously opined that joint powers entities are statewide systems as defined in Minnesota Statutes, section 13.02, subdivision 18. (See Advisory Opinions 95-040 and 07-011.) Therefore, SWT is subject to the requirements of Chapter 13.
Issue 1: Did SouthWest Transit respond appropriately to a request for a copy of its data access policies required under Minnesota Statutes, section 13.025?
Minnesota Statutes, section 13.03, requires a government entity to respond in an appropriate and prompt manner and within a reasonable time when receiving a data request from a requester who is not the subject of the data. (See section 13.03, subdivision 2(a) and Minnesota Rules, part 1205.0300.)
Minnesota Statutes, section 13.025 requires a government entity’s responsible authority to prepare “a written data access policy” (subdivision 2) as well as “a written policy of the rights of data subjects under section 13.04 and the specific procedures used by the government entity for access by the data subject to public or private data on individuals” (subdivision 3). (See also Advisory Opinions 04-049, 05-003, 13-007 and 19-002.)
Further, section 13.025, subdivision 4 requires the policies to be “easily available to the public” by distributing free copies, posting the policies in a conspicuous place within the entity, or posting the policies on the entity’s website.
The Legislature codified the current language of section 13.025 in 2012. Additionally, section 13.025, subdivisions 2 and 3 require an entity’s responsible authority to update these policies “no later than August 1 of each year.”
Minnesota Rules, Chapter 1205 also provides guidance about access procedures for members of the public and data subjects.
In its comments to the Commissioner, SWT wrote:
When these requests were made, SouthWest Transit was in the midst of responding to two other requests by the requester. Given limited staff resources, SouthWest Transit did its best to respond to the requests in a timely fashion. …
In addition, SouthWest Transit acknowledges that, due to a miscommunication and oversight, SouthWest Transit had not previously adopted the data access policies required under Minn. Stat. § 13.025. The request for access to or copies of these policies alerted SouthWest to its failure to have adopted the policies. SouthWest promptly set about to adopt the policies, specifically using the Commissioner’s model policies. …
The requirement for government entities to create and maintain data access policies is long-standing. Here, SWT’s failure to create the required access policies under section 13.025 meant that it could not possibly respond appropriately to Krampf’s request for access made on November 13 nor could it point Krampf to where the policies would be “easily available” to him.
The Commissioner appreciates SWT’s efforts to immediately comply with section 13.025 upon recognizing it had not yet adopted the required data access policies. However, SWT did not respond appropriately to a request for a copy of its data access policies required under Minnesota Statutes, section 13.025.
Issue 2: Did SouthWest Transit respond appropriately to a data request made November 5, 2021, by a data subject, pursuant to Minnesota Statutes, Chapter 13?
Minnesota Statutes, section 13.04, subdivision 3 requires:
Upon request to a responsible authority or designee, an individual shall be informed whether the individual is the subject of stored data on individuals, and whether it is classified as public, private or confidential. Upon further request, an individual who is the subject of stored private or public data on individuals shall be shown the data without charge and, if desired, shall be informed of the content and meaning of that data.
Further, subdivision 3 requires a government entity to “comply immediately, if possible, with any request made pursuant to this subdivision, or within ten days of the date of the request, excluding Saturdays, Sundays and legal holidays, if immediate compliance is not possible.” (Minnesota Statutes, section 13.04, subdivision 3.)
In Advisory Opinion 18-005, the Commissioner observed that “[w]hen a data subject requests access to government data about him/herself, the Data Practices Act sets a strict time limit for the entity to provide access. … Though the amount of data created and maintained by government is ever-increasing due to the transition to electronic and digital records, the strict time limit to provide access to data about data subjects remains the same.” (See also Advisory Opinions 03-026, 04-070, and 14-006.)
Additionally, the Commissioner recognized in Advisory Opinion 03-030 that “circumstances can arise that make it more difficult for government entities to fulfill their duties under Chapter 13. … The statute does not provide additional time for mitigating circumstances.”
In its comments to the Commissioner, SWT wrote:
The deadline [to provide inspection access] was November 22, 2021. The requester appears to agree that this date was the statutory deadline. …
The requester expressly asked SouthWest to search all of its stored data “from the beginning of time.” … Although SouthWest Transit is a relatively small government body, like all government bodies in the digital age, “the amount of data created and maintained by [it] is ever increasing.” … SouthWest Transit asked the requester for assistance to help narrow SouthWest Transit’s search and more quickly identify responsive data. The requester declined to provide any such assistance. …
Southwest Transit notified the requester on November 22, 2021 that the requested data had been collected for inspection. … Accordingly, SouthWest Transit needed to coordinate having an employee available for the inspection. In addition, [when considering personal relationships between the requester and specific SWT staff], SouthWest Transit determined that, in the interests of the safety of its staff and property, a law enforcement officer should be on site whenever the requester is inspecting data. Accordingly, SouthWest Transit needed to coordinate with local law enforcement regarding the dates and times for potential inspection. However, when the requester objected to future dates and times, SouthWest Transit offered to make the data available for inspection on November 22, 2021. The requester chose to refuse to inspect the data on that date.
The requester later requested that the data be made available on December 16 or December 17. SouthWest Transit again needed to coordinate scheduling with both an appropriate employee and local law enforcement. SouthWest Transit proposed December 16, 2021, between 2:30 p.m. and 4:30 p.m., and asked the requester to “respond when you plan to arrive so we can have the necessary staff on site to grant you inspection access.” … [T]he requester arrived during the proposed time without any notice.
… SouthWest Transit permitted the requester to visually inspect the data. …
Accordingly, SouthWest Transit responded appropriately to a data request made November 5, 2021 by a data subject, pursuant to Minnesota Statutes, Chapter 13. [Citations throughout omitted.]
The Commissioner respectfully disagrees.
Section 13.04, subdivision 3 requires government entities to provide access to the subject of stored data “immediately, if possible” or “within ten [business] days of the date of the request.” (Emphasis added.) Based on the plain language of the law, the 10-day deadline is strict and does not provide exceptions for mitigating circumstances despite the challenges it may pose for small government entities that must search through a substantial amount of electronic and digital data.
Here, SWT appeared to agree that it could not provide immediate access to data that Krampf requested. Therefore, it was obligated to provide him with access to the data by the end of its business day on November 22, 2021, under the requirements of section 13.04, subdivision 3.
SWT contacted Krampf in the afternoon of November 22 to schedule a time for inspection beyond the statutorily-required deadline. SWT then offered the opportunity to access the data on November 22 only after Krampf replied that the 10-day deadline expired that day. SWT’s latter response came at 3 p.m. on November 22 and offered the opportunity to inspect data from 4 p.m. to 5 p.m., which presumably was the end of its business day.
Although it may have been possible for Krampf to inspect data on November 22, a meaningful opportunity to inspect data by the expiration of the 10-day deadline was extremely limited. The Commissioner does not believe that SWT’s same-day offer that Krampf could inspect responsive data from 4 p.m. to 5 p.m. on November 22 reasonably met the requirements of section 13.04, subdivision 3 when considering the totality of the facts and the strict requirements of the law.
It is the Commissioner’s understanding that Krampf has since been able to inspect the data about himself maintained by SWT. Nonetheless, SWT did not respond appropriately to a data request made November 5, 2021, by a data subject, pursuant to Minnesota Statutes, Chapter 13.
The Commissioner has an additional note about SWT’s comments in its response regarding the number and size of these requests and “the harassing nature of the requester’s behavior.”
The Data Practices Act does not contain an exception allowing a government entity to deny access to data because a request results in a large amount of data that must be compiled and reviewed. Additionally, both Advisory Opinions 01-031 and 01-034, which SWT cites in its response when asking whether it is obligated to further respond to Krampf’s requests, contained the following disclaimer:
The Commissioner wishes to make clear that the conclusion he reached in this opinion is based on a unique and very specific set of facts. The outcome is in no way intended to suggest that a government entity does not have to respond to a data request merely because responding will be costly or time-consuming.
The Commissioner emphasizes that the outcomes of those opinions cannot be broadly applied, and those opinions considered specific situations where a requester, who had long-standing disputes with the entities at issue, made large requests while rarely following up to access data. Additionally, it is not within the Commissioner’s authority to determine whether particular behavior is harassing. (See also Advisory Opinion 03-046).
However, these limitations — and the requirements of Chapter 13, generally — do not mean that government entities and their staff must tolerate harassing or threatening behavior from data requesters. All entities have discretion to determine how best to insulate employees from overt acts of harassment or hostility.
As noted above, the Data Practices Act does not have a mechanism that relieves entities of their obligation to respond to a request, and all entities must have internal procedures to respond appropriately and promptly to requests. In developing these procedures, government entities may consider their respectful workplace policies and obligations to employees to prohibit harassment or other hostile and threatening acts.
As a final consideration, both data requesters and government entities should act reasonably, respectfully, and in good faith when requesting access to data and during the facilitation of such access. The Commissioner urges all data requesters and government entities to conduct themselves in ways that help achieve the underlying policy goals of the Data Practices Act.
Based on the facts and information provided, the Commissioner’s opinion on the issues are as follows:
Signed:
Alice Roberts-Davis
Commissioner
January 4, 2022
Policies and Procedures
Data subjects
Response to data requests
Data subject access
Data access policy
