1.1 	A bill for an act
1.2 	relating to consumer protection; regulating identity theft; authorizing credit 
1.3 	blocks in cases of identity theft; authorizing a consumer to place a security 
1.4 	freeze on the consumer's credit report; providing notice of this right; providing 
1.5 	protections against identity theft; providing Social Security number protections; 
1.6 	providing credit monitoring; providing for the adequate destruction of personal 
1.7 	records; providing civil and criminal penalties; regulating data warehouses; 
1.8 	modifying notice requirements;amending Minnesota Statutes 2004, section 
1.9 	13.6905, by adding a subdivision; Minnesota Statutes 2005 Supplement, section 
1.10 	325E.61, subdivisions 1, 4, by adding a subdivision; proposing coding for new 
1.11 	law in Minnesota Statutes, chapters 13C; 325E; 325G.
1.12 	BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF MINNESOTA:

1.13 	ARTICLE 1
1.14 	IDENTITY THEFT

1.15 	Section 1. Minnesota Statutes 2004, section 13.6905, is amended by adding a 
1.16 	subdivision to read:
1.17 		Subd. 33.Victim of identity theft data. Data maintained by the Department of 
1.18 	Public Safety that document victims of identity theft and determinations of innocence are 
1.19 	classified under section 325E.66, subdivision 6.

1.20 	Sec. 2. [13C.032] IDENTITY THEFT; CREDIT BLOCKS.
1.21 	(a) If a consumer submits to a credit reporting agency a copy of a valid police report, 
1.22 	or a valid investigative report made by an investigator with peace officer status, the 
1.23 	consumer credit reporting agency shall promptly and permanently block reporting any 
1.24 	information that the consumer alleges appears on the consumer's credit report as a result 
1.25 	of a violation of section 609.527 so that the information cannot be reported.  The consumer 
2.1 	credit reporting agency shall promptly notify the furnisher of the information that the 
2.2 	information has been blocked.  Furnishers of information and consumer credit reporting 
2.3 	agencies shall ensure that information is unblocked only upon a preponderance of the 
2.4 	evidence establishing the facts required under paragraph (b), clause (1), (2), or (3).
2.5 	(b) The permanently blocked information must be unblocked only if:
2.6 	(1) the information was blocked due to a material misrepresentation of fact by the 
2.7 	consumer or fraud;
2.8 	(2) the consumer agrees that the blocked information, or  portions of the blocked 
2.9 	information, were blocked in error; or 
2.10 	(3) the consumer knowingly obtained possession of goods, services, or money as 
2.11 	a result of the blocked transaction or transactions or the consumer should have known 
2.12 	that the consumer obtained possession of goods, services, or money as a result of the 
2.13 	blocked transaction or transactions.
2.14 	(c) If blocked information is unblocked pursuant to this section, the consumer must 
2.15 	be promptly notified.  The prior presence of the blocked information in the consumer credit 
2.16 	reporting agency's file on the consumer is not evidence of whether the consumer knew 
2.17 	or should have known that the consumer obtained possession of any goods, services, or 
2.18 	money.  For the purposes of this section, fraud may be demonstrated by circumstantial 
2.19 	evidence.  In unblocking information pursuant to this section, furnishers and consumer 
2.20 	credit reporting agencies are subject to their respective requirements pursuant to this 
2.21 	chapter regarding the completeness and accuracy of information.

2.22 	Sec. 3. [13C.05] SECURITY FREEZE ON CONSUMER CREDIT REPORTS.
2.23 		Subdivision 1.Definitions. For the purposes of this section, the following terms 
2.24 	have the meanings given them:
2.25 	(1) "security freeze" means a notice, at the request of the consumer and subject to 
2.26 	certain exceptions, prohibiting the consumer reporting agency from releasing all or any 
2.27 	part of the consumer's credit report or any information derived from it without the express 
2.28 	authorization of the consumer. If a security freeze is in place, the report or information 
2.29 	may not be released to a third party without prior express authorization from the consumer. 
2.30 	This subdivision does not prevent a consumer reporting agency from advising a third party 
2.31 	that a security freeze is in effect with respect to the consumer's credit report; and 
2.32 	(2) "reviewing the account" or "account review" includes activities related to account 
2.33 	maintenance, monitoring, credit line increases, and upgrades and enhancements.
2.34 		Subd. 2.Timing; covered entities; cost. (a) A consumer may elect to place a 
2.35 	security freeze on a credit report by:
3.1 	(1) making a request by certified mail;
3.2 	(2) making a request by telephone by providing certain personal identification; or 
3.3 	(3) making a request directly to the consumer reporting agency through a secure 
3.4 	electronic mail connection if the connection is made available by the agency.
3.5 	(b) A consumer reporting agency shall place a security freeze on a consumer's credit 
3.6 	report no later than five business days after receiving a written or telephone request from 
3.7 	the consumer or three business days after receiving a secure electronic mail request.
3.8 	(c) The consumer reporting agency shall send a written confirmation of the security 
3.9 	freeze to the consumer within five business days of placing the freeze and at the same time 
3.10 	shall provide the consumer with a unique personal identification number or password to 
3.11 	be used by the consumer when providing authorization for the release of the consumer's 
3.12 	credit for a specific party or period of time.
3.13 	(d) If the consumer wishes to allow the consumer's credit report to be accessed for a 
3.14 	specific party or period of time while a freeze is in place, the consumer shall contact the 
3.15 	consumer reporting agency via telephone, certified mail, or secure electronic mail; request 
3.16 	that the freeze be temporarily lifted; and provide the following:
3.17 	(1) proper identification;
3.18 	(2) the unique personal identification number or password provided by the consumer 
3.19 	reporting agency pursuant to paragraph (c); and 
3.20 	(3) the proper information regarding the third party who is to receive the credit report 
3.21 	or the time period for which the report must be available to users of the credit report.
3.22 	(e) A consumer reporting agency that receives a request from a consumer to 
3.23 	temporarily lift a freeze on a credit report pursuant to paragraph (d) shall comply with the 
3.24 	request no later than three business days after receiving the request.
3.25 	(f) A consumer reporting agency may develop procedures involving the use of 
3.26 	telephone or fax, or upon the consent of the consumer in the manner required by the 
3.27 	Electronic Signatures in Global and National Commerce Act, United States Code, title 15, 
3.28 	section 7001 et seq., for legally required notices, by the Internet, e-mail, or other electronic 
3.29 	media to receive and process a request from a consumer to temporarily lift a freeze on a 
3.30 	credit report pursuant to paragraph (d) in an expedited manner.
3.31 	(g) A consumer reporting agency shall remove or temporarily lift a freeze placed 
3.32 	on a consumer's credit report only in the following cases:
3.33 	(1) upon consumer request, pursuant to paragraph (d) or (j); or 
3.34 	(2) if the freeze was due to a material misrepresentation of fact by the consumer.
4.1 	If a consumer reporting agency intends to remove a freeze upon a consumer's credit report 
4.2 	pursuant to this paragraph, the consumer reporting agency shall notify the consumer in 
4.3 	writing five business days before removing the freeze on the consumer's credit report.
4.4 	(h) If a third party requests access to a consumer credit report on which a security 
4.5 	freeze is in effect, and this request is in connection with an application for credit or any 
4.6 	other use, and the consumer does not allow the consumer's credit report to be accessed for 
4.7 	that specific party or period of time, the third party may treat the application as incomplete.
4.8 	(i) If a third party requests access to a consumer credit report on which a security 
4.9 	freeze is in effect for the purpose of receiving, extending, or otherwise using the credit in 
4.10 	the report, and not for the sole purpose of account review, the consumer reporting agency 
4.11 	must notify the consumer that an attempt has been made to access the credit report.
4.12 	(j) Except as otherwise provided in paragraph (g), clause (2), a security freeze shall 
4.13 	remain in place until the consumer requests that the security freeze be removed.  A 
4.14 	consumer reporting agency shall remove a security freeze within three business days of 
4.15 	receiving a request for removal from the consumer, who provides both of the following:
4.16 	(1) proper identification; and 
4.17 	(2) the unique personal identification number or password provided by the consumer 
4.18 	reporting agency pursuant to paragraph (c).
4.19 	(k) A consumer reporting agency shall require proper identification of the person 
4.20 	making a request to place or remove a security freeze.
4.21 	(l) A consumer reporting agency may not suggest or otherwise state or imply to a 
4.22 	third party that the consumer's security freeze reflects a negative credit score, history, 
4.23 	report, or rating.
4.24 	(m) This section does not apply to the use of a consumer credit report by any of 
4.25 	the following:
4.26 	(1) a person, or the person's subsidiary, affiliate, agent, or assignee with which 
4.27 	the consumer has or, prior to assignment, had an account, contract, or debtor-creditor 
4.28 	relationship for the purposes of reviewing the account or collecting the financial obligation 
4.29 	owing for the account, contract, or debt;
4.30 	(2) a subsidiary, affiliate, agent, assignee, or prospective assignee of a person to 
4.31 	whom access has been granted under paragraph (d) for purposes of facilitating the 
4.32 	extension of credit or other permissible use;
4.33 	(3) any person acting pursuant to a court order, warrant, or subpoena;
4.34 	(4) a state or local agency which administers a program for establishing and 
4.35 	enforcing child support obligations;
4.36 	(5) the Department of Health or its agents or assigns acting to investigate fraud;
5.1 	(6) the Department of Revenue or its agents or assigns acting to investigate or collect 
5.2 	delinquent taxes or unpaid court orders to fulfill any of its other statutory responsibilities;
5.3 	(7) a person for the purpose of prescreening as defined by the federal Fair Credit 
5.4 	Reporting Act;
5.5 	(8) any person  administering a credit file monitoring subscription service to which 
5.6 	the consumer has subscribed; and 
5.7 	(9) any person  for the purpose of providing a consumer with a copy of the 
5.8 	consumer's credit report upon the consumer's request.
5.9 	(n) A consumer may not be charged for any security freeze services, including but 
5.10 	not limited to the placement or lifting of a security freeze.  A consumer may be charged no 
5.11 	more than $5 only if the consumer fails to retain the original personal identification number 
5.12 	given to the consumer by the agency, but the consumer may not be charged for a onetime 
5.13 	reissue of the same or a new personal identification number.  The consumer may be charged 
5.14 	no more than $5 for subsequent instances of loss of the personal identification number.
5.15 		Subd. 3.Notice of rights. At any time that a consumer is required to receive a 
5.16 	summary of rights required under section 609 of the federal Fair Credit Reporting Act, the 
5.17 	following notice must be included:
5.18 	"Minnesota Consumers Have the Right to Obtain a Security Freeze 
5.19 	You may obtain a security freeze on your credit report at no charge to protect your 
5.20 	privacy and ensure that credit is not granted in your name without your knowledge.  You 
5.21 	have a right to place a "security freeze" on your credit report pursuant to Minnesota 
5.22 	Statutes, section 13C.05.
5.23 	The security freeze will prohibit a consumer reporting agency from releasing any 
5.24 	information in your credit report without your express authorization or approval.
5.25 	The security freeze is designed to prevent credit, loans, and services from being 
5.26 	approved in your name without your consent.  When you place a security freeze on your 
5.27 	credit report, within five business days you will be provided a personal identification 
5.28 	number or password to use if you choose to remove the freeze on your credit report or 
5.29 	to temporarily authorize the release of your credit report for a specific party, parties, or 
5.30 	period of time after the freeze is in place. To provide that authorization, you must contact 
5.31 	the consumer reporting agency and provide all of the following:
5.32 	(1) the unique personal identification number or password provided by the consumer 
5.33 	reporting agency;
5.34 	(2) proper identification to verify your identity; and 
6.1 	(3) the proper information regarding the third party or parties who are to receive 
6.2 	the credit report or the period of time for which the report shall be available to users 
6.3 	of the credit report.
6.4 	A consumer reporting agency that receives a request from a consumer to lift 
6.5 	temporarily a freeze on a credit report shall comply with the request no later than three 
6.6 	business days after receiving the request.
6.7 	A security freeze does not apply to circumstances where you have an existing 
6.8 	account relationship and a copy of your report is requested by your existing creditor 
6.9 	or its agents or affiliates for certain types of account review, collection, fraud control, 
6.10 	or similar activities.
6.11 	If you are actively seeking credit, you should understand that the procedures 
6.12 	involved in lifting a security freeze may slow your own application for credit.  You should 
6.13 	plan ahead and lift a freeze, either completely if you are shopping around, or specifically 
6.14 	for a certain creditor, a few days before actually applying for new credit.
6.15 	You have a right to bring a civil action against someone who violates your rights 
6.16 	under the credit reporting laws.  The action can be brought against a consumer reporting 
6.17 	agency or a user of your credit report.
6.18 		Subd. 4.Violations; penalties. (a) If a consumer reporting agency erroneously, 
6.19 	whether by accident or design, violates the security freeze by releasing credit information 
6.20 	that has been placed under a security freeze, the affected consumer is entitled to:
6.21 	(1) notification within five business days of the release of the information, including 
6.22 	specificity as to the information released and the third-party recipient of the information;
6.23 	(2) file a complaint with the Federal Trade Commission, the state attorney general, 
6.24 	and the Department of Commerce; and 
6.25 	(3) in a civil action against the consumer reporting agency recover:
6.26 	(i) injunctive relief to prevent or restrain further violation of the security freeze;
6.27 	(ii) a civil penalty in an amount not to exceed $10,000 for each violation plus any 
6.28 	damages available under other civil laws; and 
6.29 	(iii) reasonable expenses, court costs, investigative costs, and attorney fees.
6.30 	(b) Each violation of the security freeze must be counted as a separate incident for 
6.31 	purposes of imposing penalties under this section.

6.32 	Sec. 4. [325E.65] DEFINITIONS.
6.33 		Subdivision 1.Scope. For the purposes of sections 325E.65 to 325E.67, the terms in 
6.34 	subdivisions 2 to 6 have the meanings given.
7.1 		Subd. 2.Person. "Person" means any individual, partnership, corporation, trust, 
7.2 	estate, cooperative, association,  or other entity.
7.3 		Subd. 3.Consumer. "Consumer" means an individual.
7.4 		Subd. 4.Consumer reporting agency. "Consumer reporting agency" means any 
7.5 	person which, for monetary fees, dues, or on a cooperative nonprofit basis, regularly 
7.6 	engages in whole or in part in the practice of assembling or evaluating consumer credit 
7.7 	information or other information on consumers for the purpose of furnishing consumer 
7.8 	reports to third parties.
7.9 		Subd. 5.Consumer report; credit report. "Consumer report" or "credit report" 
7.10 	means any written, oral, or other communication of any information by a consumer 
7.11 	reporting agency bearing on a consumer's creditworthiness, credit standing, credit 
7.12 	capacity, character, general reputation, personal characteristics, or mode of living which 
7.13 	is used or expected to be used or collected in whole or in part for the purpose of serving 
7.14 	as a factor in establishing the consumer's eligibility for:
7.15 	(1) credit or insurance to be used primarily for personal, family, or household 
7.16 	purposes, except that nothing in sections 325E.65 to 325E.67 authorizes the use of credit 
7.17 	evaluations or credit scoring in the underwriting of personal lines of property or casualty 
7.18 	insurance;
7.19 	(2) employment purposes; or 
7.20 	(3) any other purpose authorized under United States Code, title 15, section 1681b.
7.21 		Subd. 6.Identity theft. "Identity theft" means theft, fraud, or attempted theft or 
7.22 	fraud committed using any identifying information of another person.

7.23 	Sec. 5. [325E.66] FACTUAL DECLARATION OF INNOCENCE AFTER 
7.24 	IDENTITY THEFT.
7.25 		Subdivision 1.Judicial determination. A person who reasonably believes that  the 
7.26 	person is the victim of identity theft may petition a court, or the court, on its own motion 
7.27 	or upon application of the prosecuting attorney, may move for an expedited judicial 
7.28 	determination of the person's factual innocence, where the perpetrator of the identity theft 
7.29 	was arrested for, cited for, or convicted of a crime under the victim's identity, or where a 
7.30 	criminal complaint has been filed against the perpetrator in the victim's name, or where 
7.31 	the victim's identity has been mistakenly associated with a record of criminal conviction. 
7.32 	Any judicial determination of factual innocence made pursuant to this section may be 
7.33 	heard and determined upon declarations, affidavits, police reports, or other material, 
7.34 	relevant, and reliable information submitted by the parties or ordered to be part of the 
7.35 	record by the court. Where the court determines that the petition or motion is meritorious 
8.1 	and that there is no reasonable cause to believe that the victim committed the offense for 
8.2 	which the perpetrator of the identity theft was arrested, cited, convicted, or subject to a 
8.3 	criminal complaint in the victim's name, or that the victim's identity has been mistakenly 
8.4 	associated with a record of criminal conviction, the court shall find the victim factually 
8.5 	innocent of that offense.  If the victim is found factually innocent, the court shall issue an 
8.6 	order certifying this determination.
8.7 		Subd. 2.Court order. After a court has issued a determination of factual innocence 
8.8 	pursuant to this section, the court may order the name and associated personal identifying 
8.9 	information contained in court records, files, and indexes accessible by the public 
8.10 	deleted, sealed, or labeled to show that the data is impersonated and does not reflect 
8.11 	the defendant's identity.
8.12 		Subd. 3.Documentation. Upon making a determination of factual innocence, the 
8.13 	court must provide the consumer written documentation of such order.
8.14 		Subd. 4.Vacating determination. A court that has issued a determination of 
8.15 	factual innocence pursuant to this section may at any time vacate that determination if 
8.16 	the petition, or any information submitted in support of the petition, is found to contain 
8.17 	any material misrepresentation or fraud.
8.18 		Subd. 5.Form. The Supreme Court shall develop a form for use in issuing an order 
8.19 	pursuant to this section.
8.20 		Subd. 6.Database. The Department of Public Safety shall establish and maintain a 
8.21 	database of individuals who have been victims of identity theft and that have received 
8.22 	determinations of factual innocence. The data are private data on individuals as defined in 
8.23 	section 13.02, subdivision 12. Law enforcement agencies have access to the data in order 
8.24 	to assist victims of identify theft. 

8.25 	Sec. 6. [325E.67] CONSUMER-DRIVEN CREDIT MONITORING.
8.26 		Subdivision 1.Disclosures. Every consumer credit reporting agency shall, upon 
8.27 	request from a consumer that is not covered by the free disclosures provided in United 
8.28 	States Code, title 15, section 1681j, subsections (a) to (d), clearly and accurately disclose 
8.29 	to the consumer:
8.30 	(1) all information in the consumer's file at the time of the request, except that 
8.31 	nothing in this subdivision requires a consumer reporting agency to disclose to a consumer 
8.32 	any information concerning credit scores or other risk scores or predictors that are 
8.33 	governed by United States Code, title 15, section 1681g(f);
8.34 	(2) the sources of the information;
9.1 	(3) identification of each person, including each end-user identified under United 
9.2 	States Code, title 15, section 1681e, that procured a consumer report:
9.3 	(i) for employment purposes, during the two-year period preceding the date on 
9.4 	which the request is made; or 
9.5 	(ii) for any purpose, during the one-year period preceding the date on which the 
9.6 	request is made;
9.7 	(4) an identification of a person under clause (3) shall include:
9.8 	(i) the name of the person or, if applicable, the trade name (written in full) under 
9.9 	which the person conducts business; and 
9.10 	(ii) upon request of the consumer, the address and telephone number of the person;
9.11 	(5) clause (3) does not apply if:
9.12 	(i) the end user is an agency or department of the United States government that 
9.13 	procures the report from the person for purposes of determining the eligibility of the 
9.14 	consumer to whom the report relates to receive access or continued access to classified 
9.15 	information (as defined in United States Code, title 15, section 1681b(b)(4)(E)(i)); and 
9.16 	(ii) the head of the agency or department makes a written finding as prescribed under 
9.17 	United States Code, title 15, section 1681b(b)(4)(A);
9.18 	(6) the dates, original payees, and amounts of any checks upon which is based any 
9.19 	adverse characterization of the consumer, included in the file at the time of the disclosure 
9.20 	or which can be inferred from the file;
9.21 	(7) a record of all inquiries received by the agency during the one-year period 
9.22 	preceding the request that identified the consumer in connection with a credit or insurance 
9.23 	transaction that was not initiated by the consumer;
9.24 	(8) if the consumer requests the credit file and not the credit score, a statement that 
9.25 	the consumer may request and obtain a credit score.
9.26 		Subd. 2.Cost of disclosure. In the case of a request under subdivision 1, a 
9.27 	consumer reporting agency may impose a reasonable charge on a consumer for making 
9.28 	a disclosure pursuant to this section, which charge must:
9.29 	(1) not exceed $3 for each of the first 12 requests from the consumer in a calendar 
9.30 	year;
9.31 	(2) not exceed $8 for any additional request beyond the initial 12 requests from the 
9.32 	consumer in a calendar year; and 
9.33 	(3) be indicated to the consumer before making the disclosure.
9.34 		Subd. 3.Format of disclosure. In the case of a request under subdivision 1, a 
9.35 	consumer reporting agency must provide the consumer with an opportunity to access  the 
9.36 	consumer's report through the following means:
10.1 	(1) in writing;
10.2 	(2) in person, upon the appearance of the consumer at the place of business of the 
10.3 	consumer reporting agency where disclosures are regularly provided, during normal 
10.4 	business hours, and on reasonable notice;
10.5 	(3) by telephone, if the consumer has made a written request for disclosure;
10.6 	(4) by electronic means, if the agency offers electronic access for any other purpose;
10.7 	(5) by any other reasonable means that is available from the agency.
10.8 		Subd. 4.Timing of disclosure. A consumer reporting agency shall provide a 
10.9 	consumer report under subdivision 1 no later than:
10.10 	(1) 24 hours after the date on which the request is made, if the disclosure is made by 
10.11 	electronic means, as requested under subdivision 3, clause (4); and 
10.12 	(2) five days after the date on which the request is made, if the disclosure is made 
10.13 	in writing, in person, by telephone, or by any other reasonable means that is available 
10.14 	from the agency.

10.15 	Sec. 7. [325E.68] ADEQUATE DESTRUCTION OF PERSONAL RECORDS.
10.16 		Subdivision 1.Definitions. For the purposes of this section, the following terms 
10.17 	shall have the meanings given them:
10.18 	(a) "Business" means sole proprietorship, partnership, corporation, association, 
10.19 	or other group, however organized and whether or not organized to operate at a profit. 
10.20 	The term includes a financial institution organized, chartered, or holding a license or 
10.21 	authorization certificate under the laws of this state, any other state, the United States, or 
10.22 	any other country, or the parent or the subsidiary of the financial institution. The term also 
10.23 	includes an entity that destroys records.
10.24 	(b) "Dispose" includes:
10.25 	(1) the discarding or abandonment of records containing personal information; and 
10.26 	(2) the sale, donation, discarding, or transfer of any medium, including computer 
10.27 	equipment, or computer media, containing records of personal information, or other 
10.28 	nonpaper media upon which records of personal information is stored, or other equipment 
10.29 	for nonpaper storage of information.
10.30 	(c) "Personal information" means any information that identifies, relates to, 
10.31 	describes, or is capable of being associated with a particular individual, including, but 
10.32 	not limited to, a name, signature, Social Security number, fingerprint, photograph or 
10.33 	computerized image, physical characteristics or description, address, telephone number, 
10.34 	passport number, driver's license or state identification card number, date of birth, medical 
11.1 	information, bank account number, credit card number, debit card number, or any other 
11.2 	financial information.
11.3 	(d) "Records" means any material on which written, drawn, spoken, visual, or 
11.4 	electromagnetic information is recorded or preserved, regardless of physical form or 
11.5 	characteristics. "Records" does not include publicly available directories containing 
11.6 	information an individual has voluntarily consented to have publicly disseminated or 
11.7 	listed, such as name, address, or telephone number.
11.8 		Subd. 2.Disposal of records containing personal information. Any business that 
11.9 	conducts business in Minnesota and any business that maintains or otherwise possesses 
11.10 	personal information of residents of Minnesota must take all reasonable measures to 
11.11 	protect against unauthorized access to or use of the information in connection with, or 
11.12 	after its disposal. Reasonable measures must include, but are not limited to:
11.13 	(1) implementing and monitoring compliance with policies and procedures that 
11.14 	require the burning, pulverizing, or shredding of papers containing personal information 
11.15 	so that the information cannot practicably be read or reconstructed;
11.16 	(2) implementing and monitoring compliance with policies and procedures that 
11.17 	require the destruction or erasure of electronic media and other nonpaper media containing 
11.18 	personal information so that the information cannot practicably be read or reconstructed;
11.19 	(3) after due diligence, entering into and monitoring compliance with a written 
11.20 	contract with another party engaged in the business of record destruction to dispose of 
11.21 	personal information in a manner consistent with this statute.  Due diligence should 
11.22 	ordinarily include, but may not be limited to, one or more of the following:  reviewing 
11.23 	an independent audit of the disposal company's operations or its compliance with this 
11.24 	statute or its equivalent; obtaining information about the disposal company from several 
11.25 	references or other reliable sources and requiring that the disposal company be certified by 
11.26 	a recognized trade association or similar third party with a reputation for high standards 
11.27 	of quality review; reviewing and evaluating the disposal company's information security 
11.28 	policies or procedures; or taking other appropriate measures to determine the competency 
11.29 	and integrity of the disposal company; and 
11.30 	(4) for disposal companies explicitly hired to dispose of records containing personal 
11.31 	information:  implementing and monitoring compliance with policies and procedures that 
11.32 	protect against unauthorized access to or use of personal information during or after 
11.33 	the collection and transportation and disposing of the information in accordance with 
11.34 	clauses (1) and (2).
11.35 		Subd. 3.Business policy. Procedures relating to the adequate destruction or proper 
11.36 	disposal of personal records must be comprehensively described and classified as official 
12.1 	policy in the writings of the business entity, including corporate and employee handbooks 
12.2 	and similar corporate documents.
12.3 		Subd. 4.Penalties and civil liability. (a) Any person or business that violates this 
12.4 	section is subject to a civil penalty of not more than $3,000.
12.5 	(b) Any individual aggrieved by a violation may bring a civil action in district 
12.6 	court to enjoin further violations and to recover actual damages, costs, and reasonable 
12.7 	attorney fees.

12.8 	Sec. 8. [325G.052] CREDIT CARD OFFERS AND SOLICITATIONS; ADDRESS 
12.9 	VERIFICATIONS.
12.10 	(a) A credit card issuer that mails an offer or solicitation to receive a credit card and, 
12.11 	in response, receives a completed application for a credit card that lists an address that is 
12.12 	different from the address on the offer or solicitation shall verify the change of address 
12.13 	before issuing a credit card.
12.14 	(b) Notwithstanding any other provision of law, a person to whom an offer or 
12.15 	solicitation to receive a credit card is made is not liable for the unauthorized use of a credit 
12.16 	card issued in response to that offer or solicitation if the credit card issuer does not verify 
12.17 	the change of address before issuing a credit card.
12.18 	(c) When a credit card issuer receives a written or oral request for a change of the 
12.19 	cardholder's billing address and then receives a written or oral request for an additional 
12.20 	credit  card within ten days after the requested address change, the credit card issuer shall 
12.21 	not mail the requested additional credit card to the new address or, alternatively, activate 
12.22 	the requested additional credit card, unless the credit card issuer has verified the change 
12.23 	of address.

12.24 	ARTICLE 2
12.25 	DATA WAREHOUSES

12.26 	Section 1. Minnesota Statutes 2005 Supplement, section 325E.61, subdivision 1, is 
12.27 	amended to read:
12.28 		Subdivision 1.Disclosure of personal information; notice required. (a) Any 
12.29 	person or business that conducts business in this state, and that owns or licenses data that 
12.30 	includes personal information, shall disclose any breach of the security of the system 
12.31 	following discovery or notification of the breach in the security of the data to any resident 
12.32 	of this state whose unencrypted personal information was, or is reasonably believed to 
12.33 	have been, acquired by an unauthorized person. The disclosure must be made in the most 
12.34 	expedient time possible and without unreasonable delay, consistent with the legitimate 
13.1 	needs of law enforcement, as provided in paragraph (c), or with any measures necessary 
13.2 	to determine the scope of the breach, identify the individuals affected, and restore the 
13.3 	reasonable integrity of the data system.
13.4 	(b) Any person or business that maintains data that includes personal information 
13.5 	that the person or business does not own shall notify the owner or licensee of the 
13.6 	information of any breach of the security of the data immediately following discovery, 
13.7 	if the personal information was, or is reasonably believed to have been, acquired by 
13.8 	an unauthorized person.
13.9 	(c) The notification required by this section may be delayed to a date certain if a law 
13.10 	enforcement agency affirmatively determines that the notification will impede a criminal 
13.11 	investigation.
13.12 	(d) For purposes of this section, "breach of the security of the system" means 
13.13 	unauthorized acquisition of computerized data that compromises the security, 
13.14 	confidentiality, or integrity of personal information maintained by the person or business. 
13.15 	Good faith acquisition of personal information by an employee or agent of the person or 
13.16 	business for the purposes of the person or business is not a breach of the security system, 
13.17 	provided that the personal information is not used or subject to further unauthorized 
13.18 	disclosure.
13.19 	(e) For purposes of this section, "personal information" means an individual's first 
13.20 	name or first initial and last name in combination with any one or more of the following 
13.21 	data elements, when either the name or the data elements is not encrypted or is encrypted 
13.22 	with an encryption key that was also acquired:
13.23 	(1) Social Security number;
13.24 	(2) driver's license number or Minnesota identification card number; or
13.25 	(3) account number or credit or debit card number, in combination with any required 
13.26 	security code, access code, or password that would permit access to an individual's 
13.27 	financial account.;
13.28 	(4) account passwords, personal identification numbers, or other access codes; or
13.29 	(5) biometric data. For purposes of this clause, "biometric data" means biological 
13.30 	data derived from direct measurement of a part of the human body. Direct measurement 
13.31 	technologies include, but are not limited to, fingerprinting, iris recognition, hand geometry, 
13.32 	and facial recognition.
13.33 	(f) For purposes of this section, "personal information" does not include publicly 
13.34 	available information that is lawfully made available to the general public from federal, 
13.35 	state, or local government records.
14.1 	(g) For purposes of this section, "notice" may be provided by one of the following 
14.2 	methods:
14.3 	(1) written notice to the most recent available address the person or business has 
14.4 	in its records;
14.5 	(2) electronic notice, if the notice provided is consistent with the provisions 
14.6 	regarding electronic records and signatures in United States Code, title 15, section 7001; or
14.7 	(3) substitute notice, if the person or business demonstrates that the cost of providing 
14.8 	notice would exceed $250,000, or that the affected class of subject persons to be notified 
14.9 	exceeds 500,000, or the person or business does not have sufficient contact information. 
14.10 	Substitute notice must consist of all of the following:
14.11 	(i) e-mail notice when the person or business has an e-mail address for the subject 
14.12 	persons;
14.13 	(ii) conspicuous posting of the notice on the Web site page of the person or business, 
14.14 	if the person or business maintains one; and
14.15 	(iii) notification to major statewide media.
14.16 	(h) Notwithstanding paragraph (g), a person or business that maintains its own 
14.17 	notification procedures as part of an information security policy for the treatment of 
14.18 	personal information and is otherwise consistent with the timing and content requirements 
14.19 	of this section, shall be deemed to be in compliance with the notification requirements 
14.20 	of this section if the person or business notifies subject persons in accordance with its 
14.21 	policies in the event of a breach of security of the system.

14.22 	Sec. 2. Minnesota Statutes 2005 Supplement, section 325E.61, is amended by adding a 
14.23 	subdivision to read:
14.24 		Subd. 1a.Content of notice. The notice required by this section must be clear 
14.25 	and conspicuous. The notice must include:
14.26 	(a) to the extent possible, a description of the categories of information that were, or 
14.27 	are reasonably believed to have been, acquired by an unauthorized person, including Social 
14.28 	Security numbers, driver's license or state identification numbers, and financial data;
14.29 	(b) the steps taken by the person or business to protect personal information from 
14.30 	further unauthorized access;
14.31 	(c) a toll-free telephone number:
14.32 	(1) that the individual may use to contact a live representative of the agency or 
14.33 	person; and
14.34 	(2) from whom the individual may learn:
15.1 	(i) what types of information the agency or person maintained about that individual 
15.2 	or about individuals in general; and
15.3 	(ii) whether the agency or person maintained information about that individual;
15.4 	(d) the toll-free telephone numbers and addresses for the major consumer reporting 
15.5 	agencies, along with a description of, and an explanation of how to exercise, the following 
15.6 	rights under the federal Fair Credit Reporting Act:
15.7 	(1) the right to obtain a credit report free of charge from each nationwide credit 
15.8 	reporting agency;
15.9 	(2) the right to place a fraud alert in consumer reports to put creditors on notice that 
15.10 	the individual may be a victim of fraud; and
15.11 	(3) the right to block or delete specific items in consumer reports relating to 
15.12 	fraudulent transactions; and
15.13 	(e) the toll-free telephone number and Web site address of the Federal Trade 
15.14 	Commission, along with a recommendation that the individual should report any incidents 
15.15 	of identity theft to a local law enforcement agency and the Federal Trade Commission.

15.16 	Sec. 3. Minnesota Statutes 2005 Supplement, section 325E.61, subdivision 4, is 
15.17 	amended to read:
15.18 		Subd. 4.Exemption. This section does not apply to any "financial institution" 
15.19 	as defined by United States Code, title 15, section 6809(3), and to entities subject to 
15.20 	the federal privacy and security regulations adopted under the federal Health Insurance 
15.21 	Portability and Accountability Act of 1996, Public Law 104-191.