Page 226

EAP Policy Manual FFY24 Chapter 11 Data Practices and Records Page 10 described in the procedures required by section 13.05, subdivision 5.” To ensure compliance with the MGDPA, restrictions on accessing private household data for EAP must include, but are not limited to: • Limiting electronic access to data on Service Provider networks and computers. • Protecting private data sent via encrypted or secure email, for example by using a security protocol known as Transport Layer Security (TSL). • Securing household files to prevent: • Access by the public. • Employees, contractors and volunteers from accessing data they do not need to do their jobs. • Cleaning and janitorial worker’s access. • Removing summary data that can identify a household. • Preventing conversations with households and staff from being overheard by others. These restrictions not only protect the households, but protect the Service Provider, the program, and the worker from the liability assigned by the law. Be vigilant to avoid any breach in security or inadvertent disclosure of private data. If a breach in security or inadvertent disclosure of private data is discovered, the Service Provider must notify Commerce immediately. This includes cyberattacks that may have compromised a Service Provider’s IT network. Penalty for Violations of the MGDPA Government entities and their contractors may be subject to penalties when violations of the MGDPA occur. Minn. Stat. § 13.08 states: “a responsible authority or government entity which violates any provision of this chapter is liable to a person or representative of a decedent who suffers any damage as a result of the violation, and the person damaged or a representative in the case of private data on decedents…may bring an action against the responsible authority or government entity to cover any damages sustained, plus costs and reasonable attorney fees. In the case of a willful violation, the government entity shall, in addition, be liable to exemplary damages of not less than $1,000, nor more than $15,000 for each violation.” “Application Consent” to request information A signed application gives consent to Service Provider staff to request and receive the following information for the purposes stated: • Data about the household’s energy account and energy use from the household’s energy vendors for determining eligibility for benefits and benefit amounts.