<a id="pl.1.3"></a><var>1.3</var>security breaches; providing enforcement powers; proposing coding for new law <br/>
<a id="pl.1.4"></a><var>1.4</var>in Minnesota Statutes, chapter 325E.<br/>
<a id="pl.1.5"></a><var>1.5</var>BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF MINNESOTA:<br/>
<br/>
<a id="bill.0.1.0"></a><a id="pl.1.6"></a><var>1.6</var>    Section 1. <b>[325E.64] ACCESS DEVICES; BREACH OF SECURITY.</b><br/>
<a id="pl.1.7"></a><var>1.7</var>    Subdivision 1. <b>Definitions.</b> (a) For purposes of this section, the terms defined in this <br/>
<a id="pl.1.8"></a><var>1.8</var>subdivision have the meanings given them.<br/>
<a id="pl.1.9"></a><var>1.9</var>    (b) "Access device" means a card issued by a financial institution that contains a <br/>
<a id="pl.1.10"></a><var>1.10</var>magnetic stripe, microprocessor chip, or other means for storage of information which <br/>
<a id="pl.1.11"></a><var>1.11</var>includes, but is not limited to, a credit card, debit card, or stored value card.<br/>
<a id="pl.1.12"></a><var>1.12</var>    (c) "Breach of the security of the system" has the meaning given in section 325E.61, <br/>
<a id="pl.1.13"></a><var>1.13</var>subdivision 1, paragraph (d).<br/>
<a id="pl.1.14"></a><var>1.14</var>    (d) "Card security code" means the three-digit or four-digit value printed on an access <br/>
<a id="pl.1.15"></a><var>1.15</var>device or contained in the microprocessor chip or magnetic stripe of an access device <br/>
<a id="pl.1.16"></a><var>1.16</var>which is used to validate access device information during the authorization process.<br/>
<a id="pl.1.17"></a><var>1.17</var>    (e) "Financial institution" means any office of a bank, bank and trust, trust company <br/>
<a id="pl.1.18"></a><var>1.18</var>with banking powers, savings bank, industrial loan company, savings association, credit <br/>
<a id="pl.1.19"></a><var>1.19</var>union, or regulated lender.<br/>
<a id="pl.1.20"></a><var>1.20</var>    (f) "Microprocessor chip data" means the data contained in the microprocessor <br/>
<a id="pl.1.21"></a><var>1.21</var>chip of an access device.<br/>
<a id="pl.1.22"></a><var>1.22</var>    (g) "Magnetic stripe data" means the data contained in the magnetic stripe of an <br/>
<a id="pl.1.23"></a><var>1.23</var>access device.<br/>
<a id="pl.1.24"></a><var>1.24</var>    (h) "PIN" means a personal identification code that identifies the cardholder.<br/>
<a id="pl.2.1"></a><var>2.1</var>    (i) "PIN verification code number" means the data used to verify cardholder identity <br/>
<a id="pl.2.2"></a><var>2.2</var>when a PIN is used in a transaction.<br/>
<a id="pl.2.3"></a><var>2.3</var>    (j) "Service provider" means a person or entity that stores, processes, or transmits <br/>
<a id="pl.2.4"></a><var>2.4</var>access device data on behalf of another person or entity.<br/>
<a id="pl.2.5"></a><var>2.5</var>    Subd. 2. <b>Security or identification information; retention prohibited.</b> No person <br/>
<a id="pl.2.6"></a><var>2.6</var>or entity conducting business in Minnesota that accepts an access device in connection <br/>
<a id="pl.2.7"></a><var>2.7</var>with a transaction shall retain the card security code data, the PIN verification code <br/>
<a id="pl.2.8"></a><var>2.8</var>number, or the full contents of any track of magnetic stripe data, subsequent to the <br/>
<a id="pl.2.9"></a><var>2.9</var>authorization of the transaction or in the case of a PIN debit transaction, subsequent <br/>
<a id="pl.2.10"></a><var>2.10</var>to 48 hours after authorization of the transaction. A person or entity is in violation of <br/>
<a id="pl.2.11"></a><var>2.11</var>this section if its service provider retains such data subsequent to the authorization of <br/>
<a id="pl.2.12"></a><var>2.12</var>the transaction or in the case of a PIN debit transaction, subsequent to 48 hours after <br/>
<a id="pl.2.13"></a><var>2.13</var>authorization of the transaction.<br/>
<a id="pl.2.14"></a><var>2.14</var>    Subd. 3. <b>Liability.</b> Whenever there is a breach of the security of the system of a <br/>
<a id="pl.2.15"></a><var>2.15</var>person or entity that has violated this section, or that person's or entity's service provider, <br/>
<a id="pl.2.16"></a><var>2.16</var>that person or entity shall reimburse the financial institution that issued any access devices <br/>
<a id="pl.2.17"></a><var>2.17</var>affected by the breach for the costs of reasonable actions undertaken by the financial <br/>
<a id="pl.2.18"></a><var>2.18</var>institution as a result of the breach in order to protect the information of its cardholders <br/>
<a id="pl.2.19"></a><var>2.19</var>or to continue to provide services to cardholders, including but not limited to, any cost <br/>
<a id="pl.2.20"></a><var>2.20</var>incurred in connection with:<br/>
<a id="pl.2.21"></a><var>2.21</var>    (1) the cancellation or reissuance of any access device affected by the breach;<br/>
<a id="pl.2.22"></a><var>2.22</var>    (2) the closure of any deposit, transaction, share draft, or other accounts affected <br/>
<a id="pl.2.23"></a><var>2.23</var>by the breach and any action to stop payments or block transactions with respect to the <br/>
<a id="pl.2.24"></a><var>2.24</var>accounts;<br/>
<a id="pl.2.25"></a><var>2.25</var>    (3) the opening or reopening of any deposit, transaction, share draft, or other <br/>
<a id="pl.2.26"></a><var>2.26</var>accounts affected by the breach;<br/>
<a id="pl.2.27"></a><var>2.27</var>    (4) any refund or credit made to a cardholder to cover the cost of any unauthorized <br/>
<a id="pl.2.28"></a><var>2.28</var>transaction relating to the breach; and<br/>
<a id="pl.2.29"></a><var>2.29</var>    (5) the notification of cardholders affected by the breach.<br/>
<a id="pl.2.30"></a><var>2.30</var>The financial institution is also entitled to recover costs for damages paid by the financial <br/>
<a id="pl.2.31"></a><var>2.31</var>institution to cardholders injured by a breach of the security of the system of a person or <br/>
<a id="pl.2.32"></a><var>2.32</var>entity that has violated this section. Costs do not include any amounts recovered from <br/>
<a id="pl.2.33"></a><var>2.33</var>a credit card company by a financial institution. The remedies under this subdivision <br/>
<a id="pl.2.34"></a><var>2.34</var>are cumulative and do not restrict any other right or remedy otherwise available to the <br/>
<a id="pl.2.35"></a><var>2.35</var>financial institution.<br/>
<a id="pl.3.1"></a><var>3.1</var><b>EFFECTIVE DATES; APPLICATION.</b>Subdivisions 1 and 2 are effective August <br/>
<a id="pl.3.2"></a><var>3.2</var>1, 2007. Subdivision 3 is effective August 1, 2008, and applies to breaches of the security <br/>
<a id="pl.3.3"></a><var>3.3</var>of a system occurring on or after that date.<br/>