1.1 	A bill for an act
1.2 	relating to financial institutions; establishing a nonbank data security law;proposing 
1.3 	coding for new law as Minnesota Statutes, chapter 46A.
1.4 	BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF MINNESOTA:

1.5 	Section 1. [46A.01] DEFINITIONS.
1.6 		Subdivision 1.Terms.  For the purposes of this chapter, the terms defined in this section 
1.7 	have the meanings given them.
1.8 		Subd. 2.Authorized user. "Authorized user" means any employee, contractor, agent, 
1.9 	or other person who: (1) participates in a financial institution's business operations; and (2) 
1.10 	is authorized to access and use any of the financial institution's information systems and 
1.11 	data.
1.12 		Subd. 3.Commissioner. "Commissioner" means the commissioner of commerce.
1.13 		Subd. 4.Consumer. (a) "Consumer" means an individual who obtains or has obtained 
1.14 	from a financial institution a financial product or service that is used primarily for personal, 
1.15 	family, or household purposes, or is used by the individual's legal representative. Consumer 
1.16 	includes but is not limited to an individual who:
1.17 	(1) applies to a financial institution for credit for personal, family, or household purposes, 
1.18 	regardless of whether the credit is extended;
1.19 	(2) provides nonpublic personal information to a financial institution in order to obtain 
1.20 	a determination whether the individual qualifies for a loan used primarily for personal, 
1.21 	family, or household purposes, regardless of whether the loan is extended;
2.1 	(3) provides nonpublic personal information to a financial institution in connection with 
2.2 	obtaining or seeking to obtain financial, investment, or economic advisory services, regardless 
2.3 	of whether the financial institution establishes a continuing advisory relationship with the 
2.4 	individual; or
2.5 	(4) has a loan for personal, family, or household purposes in which the financial institution 
2.6 	has ownership or servicing rights, even if the financial institution or one or more other 
2.7 	institutions that hold ownership or servicing rights in conjunction with the financial institution 
2.8 	hires an agent to collect on the loan.
2.9 	(b) Consumer does not include an individual who:
2.10 	(1) is a consumer of another financial institution that uses a different financial institution 
2.11 	to act solely as an agent for, or provide processing or other services to, the consumer's 
2.12 	financial institution;
2.13 	(2) designates a financial institution solely for the purposes to act as a trustee for a trust;
2.14 	(3) is the beneficiary of a trust for which the financial institution serves as trustee; or
2.15 	(4) is a participant or a beneficiary of an employee benefit plan that the financial 
2.16 	institution sponsors or for which the financial institution acts as a trustee or fiduciary.
2.17 		Subd. 5.Continuing relationship. (a) "Continuing relationship" means a consumer:
2.18 	(1) has a credit or investment account with a financial institution;
2.19 	(2) obtains a loan from a financial institution;
2.20 	(3) purchases an insurance product from a financial institution;
2.21 	(4) holds an investment product through a financial institution, including but not limited 
2.22 	to when the financial institution acts as a custodian for securities or for assets in an individual 
2.23 	retirement arrangement;
2.24 	(5) enters into an agreement or understanding with a financial institution whereby the 
2.25 	financial institution undertakes to arrange or broker a home mortgage loan, or credit to 
2.26 	purchase a vehicle, for the consumer;
2.27 	(6) enters into a lease of personal property on a nonoperating basis with a financial 
2.28 	institution;
2.29 	(7) obtains financial, investment, or economic advisory services from a financial 
2.30 	institution for a fee;
3.1 	(8) becomes a financial institution's client to obtain tax preparation or credit counseling 
3.2 	services from the financial institution;
3.3 	(9) obtains career counseling while: (i) seeking employment with a financial institution 
3.4 	or the finance, accounting, or audit department of any company; or (ii) employed by a 
3.5 	financial institution or department of any company;
3.6 	(10) is obligated on an account that a financial institution purchases from another financial 
3.7 	institution, regardless of whether the account is in default when purchased, unless the 
3.8 	financial institution does not locate the consumer or attempt to collect any amount from the 
3.9 	consumer on the account;
3.10 	(11) obtains real estate settlement services from a financial institution; or
3.11 	(12) has a loan for which a financial institution owns the servicing rights.
3.12 	(b) Continuing relationship does not include situations where:
3.13 	(1) the consumer obtains a financial product or service from a financial institution only 
3.14 	in isolated transactions, including but not limited to: (i) using a financial institution's 
3.15 	automated teller machine to withdraw cash from an account at another financial institution; 
3.16 	(ii) purchasing a money order from a financial institution; (iii) cashing a check with a 
3.17 	financial institution; or (iv) making a wire transfer through a financial institution;
3.18 	(2) a financial institution sells the consumer's loan and does not retain the rights to service 
3.19 	the loan;
3.20 	(3) a financial institution sells the consumer airline tickets, travel insurance, or traveler's 
3.21 	checks in isolated transactions;
3.22 	(4) the consumer obtains onetime personal or real property appraisal services from a 
3.23 	financial institution; or
3.24 	(5) the consumer purchases checks for a personal checking account from a financial 
3.25 	institution.
3.26 		Subd. 6.Customer. "Customer" means a consumer who has a customer relationship 
3.27 	with a financial institution.
3.28 		Subd. 7.Customer information. "Customer information" means any record containing 
3.29 	nonpublic personal information about a financial institution's customer, whether the record 
3.30 	is in paper, electronic, or another form, that is handled or maintained by or on behalf of the 
3.31 	financial institution or the financial institution's affiliates.
4.1 		Subd. 8.Customer relationship. "Customer relationship" means a continuing relationship 
4.2 	between a consumer and a financial institution under which the financial institution provides 
4.3 	to the consumer one or more financial products or services that are used primarily for 
4.4 	personal, family, or household purposes.
4.5 		Subd. 9.Encryption. "Encryption" means the transformation of data into a format that 
4.6 	results in a low probability of assigning meaning without the use of a protective process or 
4.7 	key, consistent with current cryptographic standards and accompanied by appropriate 
4.8 	safeguards for cryptographic key material.
4.9 		Subd. 10.Federally insured depository financial institution. "Federally insured 
4.10 	depository financial institution" means a bank, credit union, savings and loan association, 
4.11 	trust company, savings association, savings bank, industrial bank, or industrial loan company 
4.12 	organized under the laws of the United States or any state of the United States, when the 
4.13 	bank, credit union, savings and loan association, trust company, savings association, savings 
4.14 	bank, industrial bank, or industrial loan company has federally insured deposits.
4.15 		Subd. 11.Financial product or service. "Financial product or service" means any 
4.16 	product or service that a financial holding company could offer by engaging in a financial 
4.17 	activity under section 4(k) of the Bank Holding Company Act of 1956, United States Code, 
4.18 	title 12, section 1843(k). Financial product or service includes a financial institution's 
4.19 	evaluation or brokerage of information that the financial institution collects in connection 
4.20 	with a request or an application from a consumer for a financial product or service.
4.21 		Subd. 12.Financial institution. "Financial institution" means a consumer small loan 
4.22 	lender under section 47.60, a person owning or maintaining electronic financial terminals 
4.23 	under section 47.62, a trust company under chapter 48A, a loan and thrift company under 
4.24 	chapter 53, a currency exchange under chapter 53A, a money transmitter under chapter 53B, 
4.25 	a sales finance company under chapter 53C, a regulated loan lender under chapter 56, a 
4.26 	residential mortgage originator or servicer under chapter 58, a student loan servicer under 
4.27 	chapter 58B, a credit service organization under section 332.54, a debt management service 
4.28 	provider or person providing debt management services under chapter 332A, or a debt 
4.29 	settlement service provider or person providing debt settlement services under chapter 332B.
4.30 		Subd. 13.Information security program. "Information security program" means the 
4.31 	administrative, technical, or physical safeguards a financial institution uses to access, collect, 
4.32 	distribute, process, protect, store, use, transmit, dispose of, or otherwise handle customer 
4.33 	information.
5.1 		Subd. 14.Information system. "Information system" means a discrete set of electronic 
5.2 	information resources organized to collect, process, maintain, use, share, disseminate, or 
5.3 	dispose of electronic information, as well as any specialized system, including but not 
5.4 	limited to industrial process controls systems, telephone switching and private branch 
5.5 	exchange systems, and environmental controls systems, that contains customer information 
5.6 	or that is connected to a system that contains customer information.
5.7 		Subd. 15.Multifactor authentication. "Multifactor authentication" means authentication 
5.8 	through verification of at least two of the following factors:
5.9 	(1) knowledge factors, including but not limited to a password;
5.10 	(2) possession factors, including but not limited to a token; or
5.11 	(3) inherence factors, including but not limited to biometric characteristics.
5.12 		Subd. 16.Nonpublic personal information. (a) "Nonpublic personal information" 
5.13 	means:
5.14 	(1) personally identifiable financial information; or
5.15 	(2) any list, description, or other grouping of consumers, including publicly available 
5.16 	information pertaining to the list, description, or other grouping of consumers, that is derived 
5.17 	using personally identifiable financial information that is not publicly available.
5.18 	(b) Nonpublic personal information includes but is not limited to any list of individuals' 
5.19 	names and street addresses that is derived in whole or in part using personally identifiable 
5.20 	financial information that is not publicly available, including account numbers.
5.21 	(c) Nonpublic personal information does not include:
5.22 	(1) publicly available information, except as included on a list described in paragraph 
5.23 	(a), clause (2);
5.24 	(2) any list, description, or other grouping of consumers, including publicly available 
5.25 	information pertaining to the list, description, or other grouping of consumers, that is derived 
5.26 	without using any personally identifiable financial information that is not publicly available; 
5.27 	or
5.28 	(3) any list of individuals' names and addresses that contains only publicly available 
5.29 	information, is not derived in whole or in part using personally identifiable financial 
5.30 	information that is not publicly available, and is not disclosed in a manner that indicates 
5.31 	that any individual on the list is the financial institution's consumer.
6.1 		Subd. 17.Notification event. "Notification event" means the acquisition of unencrypted 
6.2 	customer information without the authorization of the individual to which the information 
6.3 	pertains. Customer information is considered unencrypted for this purpose if the encryption 
6.4 	key was accessed by an unauthorized person. Unauthorized acquisition is presumed to 
6.5 	include unauthorized access to unencrypted customer information unless the financial 
6.6 	institution has reliable evidence showing that there has not been, or could not reasonably 
6.7 	have been, unauthorized acquisition of customer information.
6.8 		Subd. 18.Penetration testing. "Penetration testing" means a test methodology in which 
6.9 	assessors attempt to circumvent or defeat the security features of an information system by 
6.10 	attempting to penetrate databases or controls from outside or inside a financial institution's 
6.11 	information systems.
6.12 		Subd. 19.Personally identifiable financial information. (a) "Personally identifiable 
6.13 	financial information" means any information:
6.14 	(1) a consumer provides to a financial institution to obtain a financial product or service;
6.15 	(2) about a consumer resulting from any transaction involving a financial product or 
6.16 	service between a financial institution and a consumer; or
6.17 	(3) a financial institution otherwise obtains about a consumer in connection with providing 
6.18 	a financial product or service to the customer.
6.19 	(b) Personally identifiable financial information includes:
6.20 	(1) information a consumer provides to a financial institution on an application to obtain 
6.21 	a loan, credit card, or other financial product or service;
6.22 	(2) account balance information, payment history, overdraft history, and credit or debit 
6.23 	card purchase information;
6.24 	(3) the fact that an individual is or has been a financial institution's customer or has 
6.25 	obtained a financial product or service from the financial institution;
6.26 	(4) any information about a financial institution's consumer, if the information is disclosed 
6.27 	in a manner that indicates that the individual is or has been the financial institution's 
6.28 	consumer;
6.29 	(5) any information that a consumer provides to a financial institution or that a financial 
6.30 	institution or a financial institution's agent otherwise obtains in connection with collecting 
6.31 	on or servicing a credit account;
7.1 	(6) any information a financial institution collects through an Internet information 
7.2 	collecting device from a web server; and
7.3 	(7) information from a consumer report.
7.4 	(c) Personally identifiable financial information does not include:
7.5 	(1) a list of customer names and addresses for an entity that is not a financial institution; 
7.6 	and
7.7 	(2) information that does not identify a consumer, including but not limited to aggregate 
7.8 	information or blind data that does not contain personal identifiers, including account 
7.9 	numbers, names, or addresses.
7.10 		Subd. 20.Publicly available information. (a) "Publicly available information" means 
7.11 	any information that a financial institution has a reasonable basis to believe is lawfully made 
7.12 	available to the general public from:
7.13 	(1) federal, state, or local government records;
7.14 	(2) widely distributed media; or
7.15 	(3) disclosures to the general public that are required under federal, state, or local law.
7.16 	(b) Publicly available information includes but is not limited to:
7.17 	(1) with respect to government records, information in government real estate records 
7.18 	and security interest filings; and
7.19 	(2) with respect to widely distributed media, information from a telephone book, a 
7.20 	television or radio program, a newspaper, or a website that is available to the general public 
7.21 	on an unrestricted basis. A website is not restricted merely because an Internet service 
7.22 	provider or a site operator requires a fee or a password, provided that access is available to 
7.23 	the general public.
7.24 	(c) For purposes of this subdivision, a financial institution has a reasonable basis to 
7.25 	believe that information is lawfully made available to the general public if the financial 
7.26 	institution has taken steps to determine: (1) that the information is of the type that is available 
7.27 	to the general public; and (2) whether an individual can direct that the information not be 
7.28 	made available to the general public and, if so, that the financial institution's consumer has 
7.29 	not directed that the information not be made available to the general public. A financial 
7.30 	institution has a reasonable basis to believe that mortgage information is lawfully made 
7.31 	available to the general public if the financial institution determines the information is of 
7.32 	the type included on the public record in the jurisdiction where the mortgage would be 
8.1 	recorded. A financial institution has a reasonable basis to believe that an individual's 
8.2 	telephone number is lawfully made available to the general public if the financial institution 
8.3 	has located the telephone number in the telephone book or the consumer has informed the 
8.4 	financial institution that the telephone number is not unlisted.
8.5 		Subd. 21.Qualified individual. "Qualified individual" means the individual designated 
8.6 	by a financial institution to oversee, implement, and enforce the financial institution's 
8.7 	information security program.
8.8 		Subd. 22.Security event. "Security event" means an event resulting in unauthorized 
8.9 	access to, or disruption or misuse of: (1) an information system or information stored on an 
8.10 	information system; or (2) customer information held in physical form.
8.11 		Subd. 23.Service provider. "Service provider" means any person or entity that receives, 
8.12 	maintains, processes, or otherwise is permitted access to customer information through the 
8.13 	service provider's provision of services directly to a financial institution that is subject to 
8.14 	this chapter.

8.15 	Sec. 2. [46A.02] SAFEGUARDING CUSTOMER INFORMATION; STANDARDS.
8.16 		Subdivision 1.Information security program. (a) A financial institution must develop, 
8.17 	implement, and maintain a comprehensive information security program.
8.18 	(b) The information security program must: (1) be written in one or more readily 
8.19 	accessible parts; and (2) contain administrative, technical, and physical safeguards that are 
8.20 	appropriate to the financial institution's size and complexity, the nature and scope of the 
8.21 	financial institution's activities, and the sensitivity of any customer information at issue.
8.22 	(c) The information security program must include the elements set forth in section 
8.23 	46A.03 and must be reasonably designed to achieve the objectives of this chapter, as 
8.24 	established under subdivision 2.
8.25 		Subd. 2.Objectives. The objectives of this chapter are to:
8.26 	(1) ensure the security and confidentiality of customer information;
8.27 	(2) protect against any anticipated threats or hazards to the security or integrity of 
8.28 	customer information; and
8.29 	(3) protect against unauthorized access to or use of customer information that might 
8.30 	result in substantial harm or inconvenience to a customer.

9.1 	Sec. 3. [46A.03] ELEMENTS.
9.2 		Subdivision 1.Generally. In order to develop, implement, and maintain an information 
9.3 	security program, a financial institution must comply with this section.
9.4 		Subd. 2.Qualified individual. (a) A financial institution must designate a qualified 
9.5 	individual responsible for overseeing, implementing, and enforcing the financial institution's 
9.6 	information security program. The qualified individual may be employed by the financial 
9.7 	institution, an affiliate, or a service provider.
9.8 	(b) If a financial institution designates an individual employed by an affiliate or service 
9.9 	provider as the financial institution's qualified individual, the financial institution must:
9.10 	(1) retain responsibility for complying with this chapter;
9.11 	(2) designate a senior member of the financial institution's personnel to be responsible 
9.12 	for directing and overseeing the qualified individual's activities; and
9.13 	(3) require the service provider or affiliate to maintain an information security program 
9.14 	that protects the financial institution in a manner that complies with the requirements of 
9.15 	this chapter.
9.16 		Subd. 3.Security risk assessment. (a) A financial institution must base the financial 
9.17 	institution's information security program on a risk assessment that:
9.18 	(1) identifies reasonably foreseeable internal and external risks to the security, 
9.19 	confidentiality, and integrity of customer information that might result in the unauthorized 
9.20 	disclosure, misuse, alteration, destruction, or other compromise of customer information; 
9.21 	and
9.22 	(2) assesses the sufficiency of any safeguards in place to control the risks identified 
9.23 	under clause (1).
9.24 	(b) The risk assessment must be made in writing and must include:
9.25 	(1) criteria to evaluate and categorize identified security risks or threats the financial 
9.26 	institution faces;
9.27 	(2) criteria to assess the confidentiality, integrity, and availability of the financial 
9.28 	institution's information systems and customer information, including the adequacy of 
9.29 	existing controls in the context of the identified risks or threats the financial institution 
9.30 	faces; and
9.31 	(3) requirements describing how:
10.1 	(i) identified risks are mitigated or accepted based on the risk assessment; and
10.2 	(ii) the information security program addresses the risks.
10.3 	(c) A financial institution must periodically perform additional risk assessments that:
10.4 	(1) reexamine the reasonably foreseeable internal and external risks to the security, 
10.5 	confidentiality, and integrity of customer information that might result in the unauthorized 
10.6 	disclosure, misuse, alteration, destruction, or other compromise of customer information; 
10.7 	and
10.8 	(2) reassess the sufficiency of any safeguards in place to control the risks identified 
10.9 	under clause (1).
10.10 		Subd. 4.Risk control. A financial institution must design and implement safeguards to 
10.11 	control the risks the financial institution identifies through the risk assessment under 
10.12 	subdivision 3, including by:
10.13 	(1) implementing and periodically reviewing access controls, including technical and, 
10.14 	as appropriate, physical controls to:
10.15 	(i) authenticate and permit access only to authorized users to protect against the 
10.16 	unauthorized acquisition of customer information; and
10.17 	(ii) limit an authorized user's access to only customer information that the authorized 
10.18 	user needs to perform the authorized user's duties and functions or, in the case of a customer, 
10.19 	to limit access to the customer's own information;
10.20 	(2) identifying and managing the data, personnel, devices, systems, and facilities that 
10.21 	enable the financial institution to achieve business purposes in accordance with the business 
10.22 	purpose's relative importance to business objectives and the financial institution's risk 
10.23 	strategy;
10.24 	(3) protecting by encryption all customer information held or transmitted by the financial 
10.25 	institution both in transit over external networks and at rest. To the extent a financial 
10.26 	institution determines that encryption of customer information either in transit over external 
10.27 	networks or at rest is infeasible, the financial institution may secure the customer information 
10.28 	using effective alternative compensating controls that have been reviewed and approved by 
10.29 	the financial institution's qualified individual;
10.30 	(4) adopting: (i) secure development practices for in-house developed applications 
10.31 	utilized by the financial institution to transmit, access, or store customer information; and 
11.1 	(ii) procedures to evaluate, assess, or test the security of externally developed applications 
11.2 	the financial institution uses to transmit, access, or store customer information;
11.3 	(5) implementing multifactor authentication for any individual that accesses any 
11.4 	information system, unless the financial institution's qualified individual has approved in 
11.5 	writing the use of a reasonably equivalent or more secure access control;
11.6 	(6) developing, implementing, and maintaining procedures to securely dispose of 
11.7 	customer information in any format no later than two years after the last date the information 
11.8 	is used in connection with providing a product or service to the customer which relates, 
11.9 	unless the information is necessary for business operations or for other legitimate business 
11.10 	purposes, is otherwise required to be retained by law or regulation, or if targeted disposal 
11.11 	is not reasonably feasible due to the manner in which the information is maintained;
11.12 	(7) periodically reviewing the financial institution's data retention policy to minimize 
11.13 	the unnecessary retention of data;
11.14 	(8) adopting procedures for change management; and
11.15 	(9) implementing policies, procedures, and controls designed to: (i) monitor and log the 
11.16 	activity of authorized users; and (ii) detect unauthorized access to, use of, or tampering with 
11.17 	customer information by authorized users.
11.18 		Subd. 5.Testing and monitoring. (a) A financial institution must regularly test or 
11.19 	otherwise monitor the effectiveness of the safeguards' key controls, systems, and procedures, 
11.20 	including the controls, systems, and procedures that detect actual and attempted attacks on, 
11.21 	or intrusions into, information systems.
11.22 	(b) For information systems, monitoring and testing must include continuous monitoring 
11.23 	or periodic penetration testing and vulnerability assessments. Absent effective continuous 
11.24 	monitoring or other systems to detect on an ongoing basis any changes in information 
11.25 	systems that may create vulnerabilities, a financial institution must conduct:
11.26 	(1) annual penetration testing of the financial institution's information systems, based 
11.27 	on relevant identified risks in accordance with the risk assessment; and
11.28 	(2) vulnerability assessments, including systemic scans or information systems reviews 
11.29 	that are reasonably designed to identify publicly known security vulnerabilities in the 
11.30 	financial institution's information systems based on the risk assessment, at least every six 
11.31 	months, whenever a material change to the financial institution's operations or business 
11.32 	arrangements occurs, and whenever the financial institution knows or has reason to know 
12.1 	circumstances exist that may have a material impact on the financial institution's information 
12.2 	security program.
12.3 		Subd. 6.Internal policies and procedures. A financial institution must implement 
12.4 	policies and procedures to ensure that the financial institution's personnel are able to enact 
12.5 	the financial institution's information security program by:
12.6 	(1) providing the financial institution's personnel with security awareness training that 
12.7 	is updated as necessary to reflect risks identified by the risk assessment;
12.8 	(2) utilizing qualified information security personnel employed by the financial institution, 
12.9 	an affiliate, or a service provider sufficient to manage the financial institution's information 
12.10 	security risks and to perform or oversee the information security program;
12.11 	(3) providing information security personnel with security updates and training sufficient 
12.12 	to address relevant security risks; and
12.13 	(4) verifying that key information security personnel take steps to maintain current 
12.14 	knowledge of changing information security threats and countermeasures.
12.15 		Subd. 7.Provider oversight. A financial institution must oversee service providers by:
12.16 	(1) taking reasonable steps to select and retain service providers that are capable of 
12.17 	maintaining appropriate safeguards for the customer information at issue;
12.18 	(2) requiring by contract the financial institution's service providers to implement and 
12.19 	maintain appropriate safeguards; and
12.20 	(3) periodically assessing the financial institution's service providers based on the risk 
12.21 	the service providers present and the continued adequacy of the service providers' safeguards.
12.22 		Subd. 8.Information security program; evaluation; adjustment. A financial institution 
12.23 	must evaluate and adjust the financial institution's information security program to reflect: 
12.24 	(1) the results of the testing and monitoring required under subdivision 5; (2) any material 
12.25 	changes to the financial institution's operations or business arrangements; (3) the results of 
12.26 	risk assessments performed under subdivision 3, paragraph (c); or (4) any other circumstances 
12.27 	that the financial institution knows or has reason to know may have a material impact on 
12.28 	the financial institution's information security program.
12.29 		Subd. 9.Incident response plan. A financial institution must establish a written incident 
12.30 	response plan designed to promptly respond to and recover from any security event materially 
12.31 	affecting the confidentiality, integrity, or availability of customer information the financial 
12.32 	institution controls. An incident response plan must address:
13.1 	(1) the goals of the incident response plan;
13.2 	(2) the internal processes to respond to a security event;
13.3 	(3) clear roles, responsibilities, and levels of decision making authority;
13.4 	(4) external and internal communications and information sharing;
13.5 	(5) requirements to remediate any identified weaknesses in information systems and 
13.6 	associated controls;
13.7 	(6) documentation and reporting regarding security events and related incident response 
13.8 	activities; and
13.9 	(7) evaluation and revision of the incident response plan as necessary after a security 
13.10 	event.
13.11 		Subd. 10.Annual report. (a) A financial institution must require the financial institution's 
13.12 	qualified individual to report at least annually in writing to the financial institution's board 
13.13 	of directors or equivalent governing body. If a board of directors or equivalent governing 
13.14 	body does not exist, the report under this subdivision must be timely presented to a senior 
13.15 	officer responsible for the financial institution's information security program.
13.16 	(b) The report made under this subdivision must include the following information:
13.17 	(1) the overall status of the financial institution's information security program, including 
13.18 	compliance with this chapter and associated administrative rules; and
13.19 	(2) material matters related to the financial institution's information security program, 
13.20 	including but not limited to addressing issues pertaining to: (i) the risk assessment; (ii) risk 
13.21 	management and control decisions; (iii) service provider arrangements; (iv) testing results; 
13.22 	(v) security events or violations and management's responses to the security event or 
13.23 	violation; and (vi) recommendations for changes in the information security program.
13.24 		Subd. 11.Business continuity; disaster recovery. A financial institution must establish 
13.25 	a written plan addressing business continuity and disaster recovery.

13.26 	Sec. 4. [46A.04] EXCEPTIONS AND EXEMPTIONS.
13.27 	(a) The requirements under section 46A.03, subdivisions 3; 5, paragraph (a); 9; and 10, 
13.28 	do not apply to financial institutions that maintain customer information concerning fewer 
13.29 	than five thousand consumers.
13.30 	(b) This chapter does not apply to credit unions or federally insured depository 
13.31 	institutions.

14.1 	Sec. 5. [46A.05] ALTERATION OF FEDERAL REGULATION.
14.2 	(a) If an amendment to Code of Federal Regulations, title 16, part 314, results in a 
14.3 	complete lack of federal regulations in the area, the version of the state requirements in 
14.4 	effect at the time of the amendment remain in effect for two years from the date the 
14.5 	amendment becomes effective.
14.6 	(b) During the time period under paragraph (a), the department must adopt replacement 
14.7 	administrative rules as necessary and appropriate.

14.8 	Sec. 6. [46A.06] NOTIFICATION EVENT.
14.9 		Subdivision 1.Notification requirement. (a) Upon discovering a notification event as 
14.10 	described in subdivision 2, if the notification event involves the information of at least 500 
14.11 	consumers, a financial institution must notify the commissioner as soon as possible, but no 
14.12 	later than 30 days after the date the event is discovered. The notice must be made (1) in a 
14.13 	format specified by the commissioner, and (2) electronically on a form located on the 
14.14 	department's website.
14.15 	(b) The notice must include:
14.16 	(1) the name and contact information of the reporting financial institution;
14.17 	(2) a description of the types of information involved in the notification event;
14.18 	(3) if possible to determine, the date or date range of the notification event;
14.19 	(4) the number of consumers affected or potentially affected by the notification event;
14.20 	(5) a general description of the notification event; and
14.21 	(6) a statement (i) disclosing whether a law enforcement official has provided the financial 
14.22 	institution with a written determination indicating that providing notice to the public regarding 
14.23 	the breach would impede a criminal investigation or cause damage to national security, and 
14.24 	(ii) if a written determination described under item (i) was provided to the financial 
14.25 	institution, providing contact information that enables the commissioner to contact the law 
14.26 	enforcement official. A law enforcement official may request an initial delay of up to 30 
14.27 	days following the date that notice was provided to the commissioner. The delay may be 
14.28 	extended for an additional period of up to 60 days if the law enforcement official seeks an 
14.29 	extension in writing. An additional delay may be permitted only if the commissioner 
14.30 	determines that public disclosure of a security event continues to impede a criminal 
14.31 	investigation or cause damage to national security.
15.1 		Subd. 2.Notification event treated as discovered. A notification event must be treated 
15.2 	as discovered on the first day when the event is known to a financial institution. A financial 
15.3 	institution is deemed to have knowledge of a notification event if the event is known to any 
15.4 	person, other than the person committing the breach, who is the financial institution's 
15.5 	employee, officer, or other agent.

15.6 	Sec. 7. [46A.07] COMMISSIONER'S POWERS.
15.7 	(a) The commissioner has the power to examine and investigate the affairs of any covered 
15.8 	financial institution to determine whether the financial institution has been or is engaged in 
15.9 	any conduct that violates this chapter. This power is in addition to the powers granted to 
15.10 	the commissioner under section 46.01.
15.11 	(b) If the commissioner has reason to believe that a financial institution has been or is 
15.12 	engaged in conduct in Minnesota that violates this chapter, the commissioner may take 
15.13 	action necessary or appropriate to enforce this chapter.

15.14 	Sec. 8. [46A.08] CONFIDENTIALITY.
15.15 		Subdivision 1.Financial institution information. (a) Any documents, materials, or 
15.16 	other information in the control or possession of the department that are furnished by a 
15.17 	licensee or a licensee's employee or agent acting on behalf of a financial institution pursuant 
15.18 	to section 46A.06 or that are obtained by the commissioner in an investigation or examination 
15.19 	pursuant to section 46A.07: (1) are classified as confidential, protected nonpublic, or both; 
15.20 	(2) are not subject to subpoena; and (3) are not subject to discovery or admissible in evidence 
15.21 	in any private civil action.
15.22 	(b) Notwithstanding paragraph (a), clauses (1) to (3), the commissioner is authorized to 
15.23 	use the documents, materials, or other information in the furtherance of any regulatory or 
15.24 	legal action brought as a part of the commissioner's duties.
15.25 		Subd. 2.Certain testimony prohibited. Neither the commissioner nor any person who 
15.26 	received documents, materials, or other information while acting under the authority of the 
15.27 	commissioner is permitted or required to testify in a private civil action concerning 
15.28 	confidential documents, materials, or information subject to subdivision 1.
15.29 		Subd. 3.Information sharing. In order to assist in the performance of the commissioner's 
15.30 	duties under sections 46A.01 to 46A.08, the commissioner may:
15.31 	(1) share documents, materials, or other information, including the confidential and 
15.32 	privileged documents, materials, or information subject to subdivision 1, with other state, 
16.1 	federal, and international regulatory agencies, with the Conference of State Bank Supervisors, 
16.2 	the Conference of State Bank Supervisors' affiliates or subsidiaries, and with state, federal, 
16.3 	and international law enforcement authorities, provided that the recipient agrees in writing 
16.4 	to maintain the confidentiality and privileged status of the document, material, or other 
16.5 	information;
16.6 	(2) receive documents, materials, or information, including otherwise confidential and 
16.7 	privileged documents, materials, or information, from the Conference of State Bank 
16.8 	Supervisors, the Conference of State Bank Supervisors' affiliates or subsidiaries, and from 
16.9 	regulatory and law enforcement officials of other foreign or domestic jurisdictions, and 
16.10 	must maintain as confidential or privileged any document, material, or information received 
16.11 	with notice or the understanding that the document, material, or information is confidential 
16.12 	or privileged under the laws of the jurisdiction that is the source of the document, material, 
16.13 	or information;
16.14 	(3) share documents, materials, or other information subject to subdivision 1 with a 
16.15 	third-party consultant or vendor, provided the consultant agrees in writing to maintain the 
16.16 	confidentiality and privileged status of the document, material, or other information; and
16.17 	(4) enter into agreements governing the sharing and use of information that are consistent 
16.18 	with this subdivision.
16.19 		Subd. 4.No waiver of privilege or confidentiality; information retention. (a) The 
16.20 	disclosure of documents, materials, or information to the commissioner under this section 
16.21 	or as a result of sharing as authorized in subdivision 3 does not result in a waiver of any 
16.22 	applicable privilege or claim of confidentiality in the documents, materials, or information.
16.23 	(b) A document, material, or information disclosed to the commissioner under this section 
16.24 	about a cybersecurity event must be retained and preserved by the financial institution for 
16.25 	five years.
16.26 		Subd. 5.Certain actions public. Nothing in sections 46A.01 to 46A.08 prohibits the 
16.27 	commissioner from releasing final, adjudicated actions that are open to public inspection 
16.28 	pursuant to chapter 13 to a database or other clearinghouse service maintained by the 
16.29 	Conference of State Bank Supervisors, the Conference of State Bank Supervisors' affiliates, 
16.30 	or the Conference of State Bank Supervisors' subsidiaries.
16.31 		Subd. 6.Classification, protection, and use of information by others. Documents, 
16.32 	materials, or other information in the possession or control of the Conference of State Bank 
16.33 	Supervisors or a third-party consultant pursuant to sections 46A.01 to 46A.08: (1) are 
17.1 	classified as confidential, protected nonpublic, and privileged; (2) are not subject to subpoena; 
17.2 	and (3) are not subject to discovery or admissible in evidence in a private civil action.