1.1 	A bill for an act
1.2 	relating to commerce; requiring telecommunications service providers to comply 
1.3 	with Internet privacy requirements; defining terms and modifying definitions; 
1.4 	requiring express approval of disclosure of personally identifiable information; 
1.5 	increasing civil liability threshold;amending Minnesota Statutes 2018, sections 
1.6 	325M.01; 325M.02; 325M.03; 325M.04; 325M.05; 325M.07; 325M.08.
1.7 	BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF MINNESOTA:

1.8 	Section 1. Minnesota Statutes 2018, section 325M.01, is amended to read:
1.9 	325M.01 DEFINITIONS.
1.10 		Subdivision 1.Scope. The terms used in this chapter have the meanings given them in 
1.11 	this section.
1.12 		Subd. 2.Consumer. "Consumer" means a person who agrees to pay a fee to an Internet 
1.13 	service provider for access to the Internet for personal, family, or household purposes, and 
1.14 	who does not resell access. provides, knowingly or unknowingly, personally identifiable 
1.15 	information to an Internet service provider or telecommunications service provider, with 
1.16 	or without an exchange of consideration.
1.17 		Subd. 2a.Express approval. "Express approval" means an affirmative act of the 
1.18 	consumer provided in writing or by electronic means. The affirmative act providing express 
1.19 	approval must be made in a document or form separate and distinct from any document or 
1.20 	form setting forth other legal or financial obligations of the customer and that contains no 
1.21 	approval by a consumer of any other contractual provision.
1.22 		Subd. 3.Internet service provider. "Internet service provider" means a business or 
1.23 	person who provides consumers authenticated access to, or presence on, the Internet by 
2.1 	means of a switched or dedicated telecommunications channel upon which the provider 
2.2 	provides transit routing of Internet Protocol (IP) packets for and on behalf of the consumer. 
2.3 	Internet service provider does not include the offering, on a common carrier basis, of 
2.4 	telecommunications facilities or of telecommunications by means of these facilities.
2.5 		Subd. 4.Ordinary course of business. "Ordinary course of business" means 
2.6 	debt-collection activities, order fulfillment, request processing, or the transfer of ownership.
2.7 		Subd. 5.Personally identifiable information. "Personally identifiable information" 
2.8 	means information that identifies:
2.9 	(1) a consumer or the consumer's spouse or children, by physical or electronic address 
2.10 	or, telephone number, name, date of birth, Social Security number, or other information 
2.11 	that would allow another person to identify the consumer, consumer's spouse, or children;
2.12 	(2) a consumer as having requested or obtained specific materials or services from an 
2.13 	Internet service provider, telecommunications service provider, or any other entity;
2.14 	(3) Internet or online sites visited or browsing cache, cookies, or history of a consumer, 
2.15 	including the content on an Internet site viewed by a consumer; or
2.16 	(4) any of the contents of a consumer's data-storage devices. or the Internet protocol 
2.17 	address associated with an electronic device that belongs to the consumer;
2.18 	(5) a consumer's occupation, credit history, financial account information, medical 
2.19 	history, political party affiliation, disability, or other status protected under chapter 363A;
2.20 	(6) the physical location of a consumer at any time; or
2.21 	(7) a consumer, or the consumer's spouse or children, by aggregating any personal 
2.22 	information to create a profile of that person.
2.23 		Subd. 6.Telecommunications service provider. "Telecommunications service provider" 
2.24 	has the meaning given in section 237.01, subdivision 6b.

2.25 	EFFECTIVE DATE. This section is effective the day following final enactment.

2.26 	Sec. 2. Minnesota Statutes 2018, section 325M.02, is amended to read:
2.27 	325M.02 WHEN DISCLOSURE OF PERSONAL INFORMATION PROHIBITED.
2.28 	Except as provided in sections 325M.03 and 325M.04, an Internet service provider or 
2.29 	telecommunications service provider may not knowingly disclose personally identifiable 
2.30 	information concerning a consumer of the Internet service provider or telecommunications 
2.31 	service provider.

3.1 	EFFECTIVE DATE. This section is effective the day following final enactment.

3.2 	Sec. 3. Minnesota Statutes 2018, section 325M.03, is amended to read:
3.3 	325M.03 WHEN DISCLOSURE OF PERSONAL INFORMATION REQUIRED.
3.4 	An Internet service provider or telecommunications service provider shall disclose 
3.5 	personally identifiable information concerning a consumer:
3.6 	(1) pursuant to a grand jury subpoena;
3.7 	(2) to an investigative or law enforcement officer as defined in section 626A.01, 
3.8 	subdivision 7, while acting as authorized by law;
3.9 	(3) pursuant to a court order in a civil proceeding upon a showing of compelling need 
3.10 	for the information that cannot be accommodated by other means;
3.11 	(4) to a court in a civil action for conversion commenced by the Internet service provider 
3.12 	or in a civil action to enforce collection of unpaid subscription fees or purchase amounts, 
3.13 	and then only to the extent necessary to establish the fact of the subscription delinquency 
3.14 	or purchase agreement, and with appropriate safeguards against unauthorized disclosure;
3.15 	(5) to the consumer who is the subject of the information, upon written or electronic 
3.16 	request and upon payment of a fee not to exceed the actual cost of retrieving the information;
3.17 	(6) pursuant to subpoena, including an administrative subpoena, issued under authority 
3.18 	of a law of this state or another state or the United States; or
3.19 	(7) pursuant to a warrant or court order.

3.20 	EFFECTIVE DATE. This section is effective the day following final enactment.

3.21 	Sec. 4. Minnesota Statutes 2018, section 325M.04, is amended to read:
3.22 	325M.04 WHEN DISCLOSURE OF PERSONAL INFORMATION PERMITTED; 
3.23 	AUTHORIZATION.
3.24 		Subdivision 1.Conditions of disclosure. An Internet service provider or 
3.25 	telecommunications service provider may disclose personally identifiable information 
3.26 	concerning a consumer to:
3.27 	(1) any person if the disclosure is incident to the ordinary course of business of the 
3.28 	Internet service provider or telecommunications service provider;
3.29 	(2) another Internet service provider or telecommunications service provider for purposes 
3.30 	of reporting or preventing violations of the published acceptable use policy or customer 
4.1 	service agreement of the Internet service provider or telecommunications service provider; 
4.2 	except that the recipient may further disclose the personally identifiable information only 
4.3 	as provided by this chapter;
4.4 	(3) any person with the authorization of the consumer; or
4.5 	(4) as provided by section 626A.27.
4.6 		Subd. 2.Authorization. The An Internet service provider or telecommunications service 
4.7 	provider may obtain the consumer's authorization of the disclosure of personally identifiable 
4.8 	information in writing or by electronic means. The request for authorization must reasonably 
4.9 	describe the types of persons to whom personally identifiable information may be disclosed 
4.10 	and the anticipated uses of the information. In order for an authorization to be effective, a 
4.11 	contract between an Internet service provider and the consumer must state either that the 
4.12 	authorization will be obtained by an affirmative act of the consumer or that failure of the 
4.13 	consumer to object after the request has been made constitutes authorization of disclosure. 
4.14 	The provision in the contract must be conspicuous. Authorization may be obtained in a 
4.15 	manner consistent with self-regulating guidelines issued by representatives of the Internet 
4.16 	service provider or online industries, or in any other manner reasonably designed to comply 
4.17 	with this subdivision. the consumer must provide express approval to the Internet service 
4.18 	provider or telecommunications service provider.
4.19 		Subd. 3.Prohibition. An Internet service provider or telecommunications service 
4.20 	provider shall not refuse to provide service to, charge a higher rate to, impose a higher fee 
4.21 	on, include an additional charge to, or otherwise penalize or discriminate against, a customer 
4.22 	solely because the customer does not provide express approval for the disclosure of personally 
4.23 	identifiable data under this section.

4.24 	EFFECTIVE DATE. This section is effective the day following final enactment.

4.25 	Sec. 5. Minnesota Statutes 2018, section 325M.05, is amended to read:
4.26 	325M.05 SECURITY OF INFORMATION.
4.27 	The An Internet service provider or telecommunications service provider shall take 
4.28 	reasonable steps to maintain the security and privacy of a consumer's personally identifiable 
4.29 	information. The Internet service provider or telecommunications service provider is not 
4.30 	liable for actions that would constitute a violation of section 609.88, 609.89, or 609.891, if 
4.31 	the Internet service provider or telecommunications service provider does not participate 
4.32 	in, authorize, or approve the actions.

4.33 	EFFECTIVE DATE. This section is effective the day following final enactment.

5.1 	Sec. 6. Minnesota Statutes 2018, section 325M.07, is amended to read:
5.2 	325M.07 ENFORCEMENT; CIVIL LIABILITY; DEFENSE.
5.3 	A consumer who prevails or substantially prevails in an action brought under this chapter 
5.4 	is entitled to the greater of $500 $1,000 or actual damages. Costs, disbursements, and 
5.5 	reasonable attorney fees may be awarded to a party awarded damages for a violation of this 
5.6 	section. No class action shall be brought under this chapter.
5.7 	In an action under this chapter, it is a defense that the defendant has established and 
5.8 	implemented reasonable practices and procedures to prevent violations of this chapter.

5.9 	EFFECTIVE DATE. This section is effective the day following final enactment.

5.10 	Sec. 7. Minnesota Statutes 2018, section 325M.08, is amended to read:
5.11 	325M.08 OTHER LAW.
5.12 	This chapter does not limit any greater protection of the privacy of information under 
5.13 	other law, except that:
5.14 	(1) nothing in this chapter limits the authority under other state or federal law of law 
5.15 	enforcement or prosecuting authorities to obtain information; and.
5.16 	(2) if federal law is enacted that regulates the release of personally identifiable information 
5.17 	by Internet service providers but does not preempt state law on the subject, the federal law 
5.18 	supersedes any conflicting provisions of this chapter.

5.19 	EFFECTIVE DATE. This section is effective the day following final enactment.