Tennessen Warning Notice
What is a Tennessen warning notice and when is it required?
When a government entity collects private/confidential data from an individual about that individual, the entity must give him/her a Tennessen warning notice (see Minnesota Statutes, section 13.04, subdivision 2). The purpose of the notice is to enable an individual to make an informed decision about whether to give data about her/himself to the government entity. A government entity may not collect data on individuals unless the collection is necessary to carry out its duties under a program specifically authorized by the legislature or local governing body or mandated by the federal government (see Minnesota Statutes, section 13.05, subdivision 3).
When does a government entity not have to give a Tennessen warning notice?
- The individual volunteers the data, the entity didn’t ask for it
- The data are not about the individual being asked
- The data about the individual are public
- The individual is asked to provide criminal investigative data to a law enforcement officer under Minnesota Statutes, section 13.82
What must a government entity include in the Tennessen warning notice?
- The purpose and intended use of the data, i.e., why the government entity is collecting the data from the individual, and how it plans to use the data within the entity
- Whether the individual is legally required to provide the data, or may refuse to do so
- Any consequences known to the government entity if the individual provides the asked-for data
- Any consequences known to the government entity if the individual does not provide the asked-for data
- The identities of other persons or outside entities known to the government entity that are authorized by law to have access to the data. All Tennessen warning notices should include, for example, that data may be shared upon court order or provided to the state or legislative auditor, but the warning notice must also list those persons specifically authorized to access the data under state or federal laws.
What are the consequences to a government entity for failing to give a Tennessen warning notice?
With limited exceptions, a government entity may not collect, store, use, or disseminate private or confidential data for any purpose other than those specified in the Tennessen warning notice, or per section 13.05, subdivision 4. (Advisory Opinion 95-028) If an agency fails to give the Tennessen warning notice, the agency may not use or store the information received for any purpose.
What is the connection between a Tennessen Warning notice and an informed consent?
After giving a Tennessen warning notice and collecting data from an individual, a government entity may wish to use the data differently than it described, or may wish to release the data to a different entity or person other than it described in the notice. In either of these situations, the government entity would need to obtain informed consent from the data subject.
What else should a government entity consider when creating Tennessen warning notices?
- A government entity should seek legal advice when developing Tennessen warning notices to ensure that they are tailored to meet the entity’s specific needs for that data collection.
- A government entity should not try to develop an all-purpose Tennessen warning notice. Most government entities need to develop several Tennessen warnings, each one tailored for the specific program or reason for collecting the data.
- A government entity should consult its legal advisors to identify the specific legal authority to collect the data, which will help determine the specific reasons for which the entity is collecting the data, how it will use the data within the entity, and who outside the entity is authorized to get access to the data.
- The law does not require written Tennessen warning notices, but written documentation is recommended. It’s a good idea to ask the individual to sign and date the notice, and give her/him a copy. If the Tennessen warning notice is given in electronic format, an e-form should provide a way for the individual to indicate that s/he has read and understands the notice.
Entities are not required to provide notice when they collect public data; however, entities might consider providing a so-called “reverse Tennessen warning” in certain circumstances. For example, data about a member of the public requesting access to public data are presumptively public and an entity could explain that to a data requester.