Law / United States / 
Minnesota
Campus sexual misconduct reports: private data, role-based access and data audit trail
Minn. Stat. § 135A.15, subdivisions 5 and 7
In force since .
A sensitive categories rule binding public and private bodies.
- Obligation class
- Access restriction, Governance, Disclosure
- Audit expectation
- none
What it requires
- If you are an institution governed by the Board of Trustees of the Minnesota State Colleges and Universities, or a private postsecondary institution that offers in-person courses on a campus in Minnesota, is an eligible institution under section 136A.103, subdivision 1, paragraph (a) and participates in a Title IV program (the Board of Regents of the University of Minnesota is requested to comply), provide an online reporting system for complaints of sexual misconduct from students and employees that permits anonymous reports (Minn. Stat. 135A.15, subds. 1 and 5(a)).
- Tell students who report through the system who will receive and have access to the reports, how the information gathered will be used, and how to reach on-campus and off-campus organizations serving victims (Minn. Stat. 135A.15, subd. 5(b)).
- Treat data collected through the online reporting system as private data on individuals under section 13.02, subdivision 12, and, if you are not otherwise subject to chapter 13, limit access to the data subject and persons whose work assignments reasonably require access (Minn. Stat. 135A.15, subd. 5(c)).
- Treat data on sexual misconduct incidents shared with campus security officers or the administrators who investigate or adjudicate complaints as private data on individuals if you are subject to chapter 13, and otherwise limit access to the data subject and persons whose work assignments reasonably require access (Minn. Stat. 135A.15, subd. 7(a)).
- Allow only individuals with explicit authorization from the institution to enter, update or access electronic data on a sexual misconduct incident, and limit that ability through role-based access that corresponds to the individual's official duties or training level and the institutional authorization (Minn. Stat. 135A.15, subd. 7(b)).
- Record in a data audit trail every action in which data on a sexual misconduct incident are entered, updated, accessed, shared or disseminated outside of the institution (Minn. Stat. 135A.15, subd. 7(b)).
- Immediately and permanently revoke the authorization of any individual determined to have willfully entered, updated, accessed, shared or disseminated the data in violation of the subdivision or any provision of chapter 13 (Minn. Stat. 135A.15, subd. 7(b)).
These lines are LexLint's reading of the law's text.
What record it asks for
What the log must hold
Access record
Logging duty
Subdivision 7(b) requires every action in which data related to an incident of sexual misconduct are entered, updated, accessed, shared or disseminated outside of the institution to be recorded in a data audit trail. The sentence names no field of the record beyond the actions themselves, and states no retention period, audit schedule or report.
- Kind
- Explicit
- As of
- Provision
- Minn. Stat. sec. 135A.15, subd. 7(b), a data audit trail of actions on sexual misconduct incident data
- Trigger
- personal_data_processing
What this law does
Section 135A.15 applies to institutions governed by the Board of Trustees of the Minnesota State Colleges and Universities and to private postsecondary institutions that offer in-person courses on a campus located in Minnesota and are eligible institutions participating in the federal Title IV program, and institutions governed by the Board of Regents of the University of Minnesota are requested to comply with this section.
A postsecondary institution must provide an online reporting system to receive complaints of sexual misconduct from students and employees. Data collected through the online reporting system is classified as private data on individuals as defined by section 13.02, subdivision 12. Postsecondary institutions not otherwise subject to chapter 13 must limit access to the data to only the data subject and persons whose work assignments reasonably require access.
Data on incidents of sexual misconduct shared with campus security officers or campus administrators responsible for investigating or adjudicating complaints of sexual misconduct are classified as private data on individuals as defined by section 13.02, subdivision 12 , for the purposes of postsecondary institutions subject to the requirements of chapter 13.
Only individuals with explicit authorization from an institution may enter, update, or access electronic data related to an incident of sexual misconduct collected, created, or maintained under this section. All actions in which the data related to an incident of sexual misconduct are entered, updated, accessed, shared, or disseminated outside of the institution must be recorded in a data audit trail.
An institution shall immediately and permanently revoke the authorization of any individual determined to have willfully entered, updated, accessed, shared, or disseminated data in violation of the subdivision or any provision of chapter 13. The online reporting system and the access and audit trail subdivisions were added by Laws 2015, chapter 69, article 4, section 2, which is effective .
When LexLint raises it
When your app profile says your app serves colleges and universities.
Back to the example · Lint your app
Page updated .