HF 1758

1st Unofficial Engrossment - 85th Legislature (2007 - 2008)

Posted on 12/15/2009 12:00 a.m.

1.1A bill for an act 1.2relating to commerce; regulating access devices; establishing liability for 1.3security breaches; providing enforcement powers; proposing coding for new law 1.4in Minnesota Statutes, chapter 325E. 1.5BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF MINNESOTA: 1.6    Section 1. new text begin [325E.64] ACCESS DEVICES; BREACH OF SECURITY. new text end 1.7     new text begin Subdivision 1. new text end new text begin Definitions. new text end new text begin (a) For purposes of this section, the terms defined in this new text end 1.8 new text begin subdivision have the meanings given them. new text end 1.9     new text begin (b) "Access device" means a card issued by a financial institution that contains a new text end 1.10 new text begin magnetic stripe, microprocessor chip, or other means for storage of information which new text end 1.11 new text begin includes, but is not limited to, a credit card, debit card, or stored value card. new text end 1.12     new text begin (c) "Breach of the security of the system" has the meaning given in section 325E.61, new text end 1.13 new text begin subdivision 1, paragraph (d). new text end 1.14     new text begin (d) "Card security code" means the three-digit or four-digit value printed on an access new text end 1.15 new text begin device or contained in the microprocessor chip or magnetic stripe of an access device new text end 1.16 new text begin which is used to validate access device information during the authorization process. new text end 1.17     new text begin (e) "Financial institution" means any office of a bank, bank and trust, trust company new text end 1.18 new text begin with banking powers, savings bank, industrial loan company, savings association, credit new text end 1.19 new text begin union, or regulated lender. new text end 1.20     new text begin (f) "Microprocessor chip data" means the data contained in the microprocessor new text end 1.21 new text begin chip of an access device. new text end 1.22     new text begin (g) "Magnetic stripe data" means the data contained in the magnetic stripe of an new text end 1.23 new text begin access device. new text end 1.24     new text begin (h) "PIN" means a personal identification code that identifies the cardholder. new text end 2.1     new text begin (i) "PIN verification code number" means the data used to verify cardholder identity new text end 2.2 new text begin when a PIN is used in a transaction. new text end 2.3     new text begin (j) "Service provider" means a person or entity that stores, processes, or transmits new text end 2.4 new text begin access device data on behalf of another person or entity. new text end 2.5     new text begin Subd. 2. new text end new text begin Security or identification information; retention prohibited. new text end new text begin No person new text end 2.6 new text begin or entity conducting business in Minnesota that accepts an access device in connection new text end 2.7 new text begin with a transaction shall retain the card security code data, the PIN verification code new text end 2.8 new text begin number, or the full contents of any track of magnetic stripe data, subsequent to the new text end 2.9 new text begin authorization of the transaction or in the case of a PIN debit transaction, subsequent new text end 2.10 new text begin to 48 hours after authorization of the transaction. A person or entity is in violation of new text end 2.11 new text begin this section if its service provider retains such data subsequent to the authorization of new text end 2.12 new text begin the transaction or in the case of a PIN debit transaction, subsequent to 48 hours after new text end 2.13 new text begin authorization of the transaction. new text end 2.14     new text begin Subd. 3. new text end new text begin Liability. new text end new text begin Whenever there is a breach of the security of the system of a new text end 2.15 new text begin person or entity that has violated this section, or that person's or entity's service provider, new text end 2.16 new text begin that person or entity shall reimburse the financial institution that issued any access devices new text end 2.17 new text begin affected by the breach for the costs of reasonable actions undertaken by the financial new text end 2.18 new text begin institution as a result of the breach in order to protect the information of its cardholders new text end 2.19 new text begin or to continue to provide services to cardholders, including but not limited to, any cost new text end 2.20 new text begin incurred in connection with: new text end 2.21     new text begin (1) the cancellation or reissuance of any access device affected by the breach; new text end 2.22     new text begin (2) the closure of any deposit, transaction, share draft, or other accounts affected new text end 2.23 new text begin by the breach and any action to stop payments or block transactions with respect to the new text end 2.24 new text begin accounts; new text end 2.25     new text begin (3) the opening or reopening of any deposit, transaction, share draft, or other new text end 2.26 new text begin accounts affected by the breach; new text end 2.27     new text begin (4) any refund or credit made to a cardholder to cover the cost of any unauthorized new text end 2.28 new text begin transaction relating to the breach; and new text end 2.29     new text begin (5) the notification of cardholders affected by the breach. new text end 2.30 new text begin The financial institution is also entitled to recover costs for damages paid by the financial new text end 2.31 new text begin institution to cardholders injured by a breach of the security of the system of a person or new text end 2.32 new text begin entity that has violated this section. Costs do not include any amounts recovered from new text end 2.33 new text begin a credit card company by a financial institution. The remedies under this subdivision new text end 2.34 new text begin are cumulative and do not restrict any other right or remedy otherwise available to the new text end 2.35 new text begin financial institution. new text end 3.1 new text begin EFFECTIVE DATES; APPLICATION. new text end new text begin Subdivisions 1 and 2 are effective August new text end 3.2 new text begin 1, 2007. Subdivision 3 is effective August 1, 2008, and applies to breaches of the security new text end 3.3 new text begin of a system occurring on or after that date. new text end