1.1 	A bill for an act
1.2 	relating to consumer protection; regulating the disclosure of personal information 
1.3 	by data warehouses; providing notice content requirements; removing an 
1.4 	exemption for financial institutions and health care entities;amending Minnesota 
1.5 	Statutes 2005 Supplement, section 325E.61, subdivision 1, by adding a 
1.6 	subdivision; repealing Minnesota Statutes 2005 Supplement, section 325E.61, 
1.7 	subdivision 4.
1.8 	BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF MINNESOTA:

1.9 	Section 1. Minnesota Statutes 2005 Supplement, section 325E.61, subdivision 1, is 
1.10 	amended to read:
1.11 		Subdivision 1.Disclosure of personal information; notice required. (a) Any 
1.12 	person or business that conducts business in this state, and that owns or licenses data that 
1.13 	includes personal information, shall disclose any breach of the security of the system 
1.14 	following discovery or notification of the breach in the security of the data to any resident 
1.15 	of this state whose unencrypted personal information was, or is reasonably believed to 
1.16 	have been, acquired by an unauthorized person. The disclosure must be made in the most 
1.17 	expedient time possible and without unreasonable delay, consistent with the legitimate 
1.18 	needs of law enforcement, as provided in paragraph (c), or with any measures necessary 
1.19 	to determine the scope of the breach, identify the individuals affected, and restore the 
1.20 	reasonable integrity of the data system.
1.21 	(b) Any person or business that maintains data that includes personal information 
1.22 	that the person or business does not own shall notify the owner or licensee of the 
1.23 	information of any breach of the security of the data immediately following discovery, 
1.24 	if the personal information was, or is reasonably believed to have been, acquired by 
1.25 	an unauthorized person.
2.1 	(c) The notification required by this section may be delayed to a date certain if a law 
2.2 	enforcement agency affirmatively determines that the notification will impede a criminal 
2.3 	investigation.
2.4 	(d) For purposes of this section, "breach of the security of the system" means 
2.5 	unauthorized acquisition of computerized data that compromises the security, 
2.6 	confidentiality, or integrity of personal information maintained by the person or business. 
2.7 	Good faith acquisition of personal information by an employee or agent of the person or 
2.8 	business for the purposes of the person or business is not a breach of the security system, 
2.9 	provided that the personal information is not used or subject to further unauthorized 
2.10 	disclosure.
2.11 	(e) For purposes of this section, "personal information" means an individual's first 
2.12 	name or first initial and last name in combination with any one or more of the following 
2.13 	data elements, when either the name or the data elements is not encrypted or is encrypted 
2.14 	with an encryption key that was also acquired:
2.15 	(1) Social Security number;
2.16 	(2) driver's license number or Minnesota identification card number; or
2.17 	(3) account number or credit or debit card number, in combination with any required 
2.18 	security code, access code, or password that would permit access to an individual's 
2.19 	financial account.;
2.20 	(4) account passwords, personal identification numbers, or other access codes; or
2.21 	(5) biometric data. For purposes of this clause, "biometric data" means biological 
2.22 	data derived from direct measurement of a part of the human body. Direct measurement 
2.23 	technologies include, but are not limited to, fingerprinting, iris recognition, hand geometry, 
2.24 	and facial recognition.
2.25 	(f) For purposes of this section, "personal information" does not include publicly 
2.26 	available information that is lawfully made available to the general public from federal, 
2.27 	state, or local government records.
2.28 	(g) For purposes of this section, "notice" may be provided by one of the following 
2.29 	methods:
2.30 	(1) written notice to the most recent available address the person or business has 
2.31 	in its records;
2.32 	(2) electronic notice, if the notice provided is consistent with the provisions 
2.33 	regarding electronic records and signatures in United States Code, title 15, section 7001; or
2.34 	(3) substitute notice, if the person or business demonstrates that the cost of providing 
2.35 	notice would exceed $250,000, or that the affected class of subject persons to be notified 
3.1 	exceeds 500,000, or the person or business does not have sufficient contact information. 
3.2 	Substitute notice must consist of all of the following:
3.3 	(i) e-mail notice when the person or business has an e-mail address for the subject 
3.4 	persons;
3.5 	(ii) conspicuous posting of the notice on the Web site page of the person or business, 
3.6 	if the person or business maintains one; and
3.7 	(iii) notification to major statewide media.
3.8 	(h) Notwithstanding paragraph (g), a person or business that maintains its own 
3.9 	notification procedures as part of an information security policy for the treatment of 
3.10 	personal information and is otherwise consistent with the timing and content requirements 
3.11 	of this section, shall be deemed to be in compliance with the notification requirements 
3.12 	of this section if the person or business notifies subject persons in accordance with its 
3.13 	policies in the event of a breach of security of the system.

3.14 	Sec. 2. Minnesota Statutes 2005 Supplement, section 325E.61, is amended by adding a 
3.15 	subdivision to read:
3.16 		Subd. 1a.Content of notice. The notice required by this section must be clear 
3.17 	and conspicuous. The notice must include:
3.18 	(a) to the extent possible, a description of the categories of information that were, or 
3.19 	are reasonably believed to have been, acquired by an unauthorized person, including Social 
3.20 	Security numbers, driver's license or state identification numbers, and financial data;
3.21 	(b) the steps taken by the person or business to protect personal information from 
3.22 	further unauthorized access;
3.23 	(c) a toll-free telephone number:
3.24 	(1) that the individual may use to contact a live representative of the agency or 
3.25 	person; and
3.26 	(2) from whom the individual may learn:
3.27 	(i) what types of information the agency or person maintained about that individual 
3.28 	or about individuals in general; and
3.29 	(ii) whether the agency or person maintained information about that individual;
3.30 	(d) the toll-free telephone numbers and addresses for the major consumer reporting 
3.31 	agencies, along with a description of, and an explanation of how to exercise, the following 
3.32 	rights under the federal Fair Credit Reporting Act:
3.33 	(1) the right to obtain a credit report free of charge from each nationwide credit 
3.34 	reporting agency;
4.1 	(2) the right to place a fraud alert in consumer reports to put creditors on notice that 
4.2 	the individual may be a victim of fraud; and
4.3 	(3) the right to block or delete specific items in consumer reports relating to 
4.4 	fraudulent transactions; and
4.5 	(e) the toll-free telephone number and Web site address of the Federal Trade 
4.6 	Commission, along with a recommendation that the individual should report any incidents 
4.7 	of identity theft to a local law enforcement agency and the Federal Trade Commission.

4.8 	Sec. 3.  REPEALER.
 4.9 	Minnesota Statutes 2005 Supplement, section 325E.61, subdivision 4, is repealed.