1.1 	A bill for an act
1.2 	relating to consumer protection; authorizing a
1.3 	consumer to place a security freeze on the consumer's
1.4 	credit report; providing notice of this right;
1.5 	providing protections against identity theft;
1.6 	providing Social Security number protections;
1.7 	providing credit monitoring; providing for the
1.8 	adequate destruction of personal records; providing
1.9 	civil and criminal penalties; proposing coding for new
1.10 	law in Minnesota Statutes, chapters 13C; 325E.
1.11 	BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF MINNESOTA:

1.12 	Section 1. [13C.05] SECURITY FREEZE ON CONSUMER CREDIT
1.13 	REPORTS.
1.14 		Subdivision 1.Definitions. For the purposes of this
1.15 	section, the following terms have the meanings given them:
1.16 	(1) "security freeze" means a notice, at the request of the
1.17 	consumer and subject to certain exceptions, prohibiting the
1.18 	consumer reporting agency from releasing all or any part of the
1.19 	consumer's credit report or any information derived from it
1.20 	without the express authorization of the consumer.  If a
1.21 	security freeze is in place, such a report or information may
1.22 	not be released to a third party without prior express
1.23 	authorization from the consumer.  This subdivision does not
1.24 	prevent a consumer reporting agency from advising a third party
1.25 	that a security freeze is in effect with respect to the
1.26 	consumer's credit report; and 
1.27 	(2) "reviewing the account" or "account review" includes
1.28 	activities related to account maintenance, monitoring, credit
2.1 	line increases, and upgrades and enhancements.
2.2 		Subd. 2.Timing; covered entities; cost. (a) A consumer
2.3 	may elect to place a security freeze on a credit report by:
2.4 	(1) making a request by certified mail;
2.5 	(2) making a request by telephone by providing certain
2.6 	personal identification; or 
2.7 	(3) making a request directly to the consumer reporting
2.8 	agency through a secure electronic mail connection if the
2.9 	connection is made available by the agency.
2.10 	(b) A consumer reporting agency shall place a security
2.11 	freeze on a consumer's credit report no later than five business
2.12 	days after receiving a written or telephone request from the
2.13 	consumer or three business days after receiving a secure
2.14 	electronic mail request.
2.15 	(c) The consumer reporting agency shall send a written
2.16 	confirmation of the security freeze to the consumer within five
2.17 	business days of placing the freeze and at the same time shall
2.18 	provide the consumer with a unique personal identification
2.19 	number or password to be used by the consumer when providing
2.20 	authorization for the release of the consumer's credit for a
2.21 	specific party or period of time.
2.22 	(d) If the consumer wishes to allow the consumer's credit
2.23 	report to be accessed for a specific party or period of time
2.24 	while a freeze is in place, the consumer shall contact the
2.25 	consumer reporting agency via telephone, certified mail, or
2.26 	secure electronic mail; request that the freeze be temporarily
2.27 	lifted; and provide the following:
2.28 	(1) proper identification;
2.29 	(2) the unique personal identification number or password
2.30 	provided by the consumer reporting agency pursuant to paragraph
2.31 	(c); and 
2.32 	(3) the proper information regarding the third party who is
2.33 	to receive the credit report or the time period for which the
2.34 	report must be available to users of the credit report.
2.35 	(e) A consumer reporting agency that receives a request
2.36 	from a consumer to temporarily lift a freeze on a credit report
3.1 	pursuant to paragraph (d) shall comply with the request no later
3.2 	than three business days after receiving the request.
3.3 	(f) A consumer reporting agency may develop procedures
3.4 	involving the use of telephone or fax, or upon the consent of
3.5 	the consumer in the manner required by the Electronic Signatures
3.6 	in Global and National Commerce Act, United States Code, title
3.7 	15, section 7001 et seq., for legally required notices, by the
3.8 	Internet, e-mail, or other electronic media to receive and
3.9 	process a request from a consumer to temporarily lift a freeze
3.10 	on a credit report pursuant to paragraph (d) in an expedited
3.11 	manner.
3.12 	(g) A consumer reporting agency shall remove or temporarily
3.13 	lift a freeze placed on a consumer's credit report only in the
3.14 	following cases:
3.15 	(1) upon consumer request, pursuant to paragraph (d) or
3.16 	(j); or 
3.17 	(2) if the freeze was due to a material misrepresentation
3.18 	of fact by the consumer.
3.19 	If a consumer reporting agency intends to remove a freeze upon a
3.20 	consumer's credit report pursuant to this paragraph, the
3.21 	consumer reporting agency shall notify the consumer in writing
3.22 	five business days before removing the freeze on the consumer's
3.23 	credit report.
3.24 	(h) If a third party requests access to a consumer credit
3.25 	report on which a security freeze is in effect, and this request
3.26 	is in connection with an application for credit or any other
3.27 	use, and the consumer does not allow the consumer's credit
3.28 	report to be accessed for that specific party or period of time,
3.29 	the third party may treat the application as incomplete.
3.30 	(i) If a third party requests access to a consumer credit
3.31 	report on which a security freeze is in effect for the purpose
3.32 	of receiving, extending, or otherwise using the credit in the
3.33 	report, and not for the sole purpose of account review, the
3.34 	consumer reporting agency must notify the consumer that an
3.35 	attempt has been made to access the credit report.
3.36 	(j) Except as otherwise provided in paragraph (g), clause
4.1 	(2), a security freeze shall remain in place until the consumer
4.2 	requests that the security freeze be removed.  A consumer
4.3 	reporting agency shall remove a security freeze within three
4.4 	business days of receiving a request for removal from the
4.5 	consumer, who provides both of the following:
4.6 	(1) proper identification; and 
4.7 	(2) the unique personal identification number or password
4.8 	provided by the consumer reporting agency pursuant to paragraph
4.9 	(c).
4.10 	(k) A consumer reporting agency shall require proper
4.11 	identification of the person making a request to place or remove
4.12 	a security freeze.
4.13 	(l) A consumer reporting agency may not suggest or
4.14 	otherwise state or imply to a third party that the consumer's
4.15 	security freeze reflects a negative credit score, history,
4.16 	report, or rating.
4.17 	(m) This section does not apply to the use of a consumer
4.18 	credit report by any of the following:
4.19 	(1) a person, or the person's subsidiary, affiliate, agent,
4.20 	or assignee with which the consumer has or, prior to assignment,
4.21 	had an account, contract, or debtor-creditor relationship for
4.22 	the purposes of reviewing the account or collecting the
4.23 	financial obligation owing for the account, contract, or debt;
4.24 	(2) a subsidiary, affiliate, agent, assignee, or
4.25 	prospective assignee of a person to whom access has been granted
4.26 	under paragraph (d) for purposes of facilitating the extension
4.27 	of credit or other permissible use;
4.28 	(3) any person acting pursuant to a court order, warrant,
4.29 	or subpoena;
4.30 	(4) a state or local agency which administers a program for
4.31 	establishing and enforcing child support obligations;
4.32 	(5) the Department of Health or its agents or assigns
4.33 	acting to investigate fraud;
4.34 	(6) the Department of Revenue or its agents or assigns
4.35 	acting to investigate or collect delinquent taxes or unpaid
4.36 	court orders to fulfill any of its other statutory
5.1 	responsibilities;
5.2 	(7) a person for the purpose of prescreening as defined by
5.3 	the federal Fair Credit Reporting Act;
5.4 	(8) any person or entity administering a credit file
5.5 	monitoring subscription service to which the consumer has
5.6 	subscribed; and 
5.7 	(9) any person or entity for the purpose of providing a
5.8 	consumer with a copy of the consumer's credit report upon the
5.9 	consumer's request.
5.10 	(n) A consumer may not be charged for any security freeze
5.11 	services, including but not limited to the placement or lifting
5.12 	of a security freeze.  A consumer may be charged no more than $5
5.13 	only if the consumer fails to retain the original personal
5.14 	identification number given to the the consumer by the agency,
5.15 	but the consumer may not be charged for a onetime reissue of the
5.16 	same or a new personal identification number.  The consumer may
5.17 	be charged no more than $5 for subsequent instances of loss of
5.18 	the personal identification number.
5.19 		Subd. 3.Notice of rights. At any time that a consumer
5.20 	is required to receive a summary of rights required under
5.21 	section 609 of the federal Fair Credit Reporting Act, the
5.22 	following notice must be included:
5.23 	"Minnesota Consumers Have the Right
5.24 	 to Obtain a Security Freeze 
5.25 	You may obtain a security freeze on your credit report at
5.26 	no charge to protect your privacy and ensure that credit is not
5.27 	granted in your name without your knowledge.  You have a right
5.28 	to place a "security freeze" on your credit report pursuant to
5.29 	........
5.30 	The security freeze will prohibit a consumer reporting
5.31 	agency from releasing any information in your credit report
5.32 	without your express authorization or approval.
5.33 	The security freeze is designed to prevent credit, loans,
5.34 	and services from being approved in your name without your
5.35 	consent.  When you place a security freeze on your credit
5.36 	report, within five business days you will be provided a
6.1 	personal identification number or password to use if you choose
6.2 	to remove the freeze on your credit report or to temporarily
6.3 	authorize the release of your credit report for a specific
6.4 	party, parties, or period of time after the freeze is in place.
6.5 	To provide that authorization, you must contact the consumer
6.6 	reporting agency and provide all of the following:
6.7 	(1) the unique personal identification number or password
6.8 	provided by the consumer reporting agency;
6.9 	(2) proper identification to verify your identity; and 
6.10 	(3) the proper information regarding the third party or
6.11 	parties who are to receive the credit report or the period of
6.12 	time for which the report shall be available to users of the
6.13 	credit report.
6.14 	A consumer reporting agency that receives a request from a
6.15 	consumer to lift temporarily a freeze on a credit report shall
6.16 	comply with the request no later than three business days after
6.17 	receiving the request.
6.18 	A security freeze does not apply to circumstances where you
6.19 	have an existing account relationship and a copy of your report
6.20 	is requested by your existing creditor or its agents or
6.21 	affiliates for certain types of account review, collection,
6.22 	fraud control, or similar activities.
6.23 	If you are actively seeking credit, you should understand
6.24 	that the procedures involved in lifting a security freeze may
6.25 	slow your own application for credit.  You should plan ahead and
6.26 	lift a freeze, either completely if you are shopping around, or
6.27 	specifically for a certain creditor, a few days before actually
6.28 	applying for new credit.
6.29 	You have a right to bring a civil action against someone
6.30 	who violates your rights under the credit reporting laws.  The
6.31 	action can be brought against a consumer reporting agency or a
6.32 	user of your credit report.
6.33 		Subd. 4.Violations; penalties. (a) If a consumer
6.34 	reporting agency erroneously, whether by accident or design,
6.35 	violates the security freeze by releasing credit information
6.36 	that has been placed under a security freeze, the affected
7.1 	consumer is entitled to:
7.2 	(1) notification within five business days of the release
7.3 	of the information, including specificity as to the information
7.4 	released and the third-party recipient of the information;
7.5 	(2) file a complaint with the Federal Trade Commission, the
7.6 	state attorney general, and the Department of Commerce; and 
7.7 	(3) in a civil action against the consumer reporting agency
7.8 	recover:
7.9 	(i) injunctive relief to prevent or restrain further
7.10 	violation of the security freeze;
7.11 	(ii) a civil penalty in an amount not to exceed $10,000 for
7.12 	each violation plus any damages available under other civil
7.13 	laws; and 
7.14 	(iii) reasonable expenses, court costs, investigative
7.15 	costs, and attorney fees.
7.16 	(b) Each violation of the security freeze must be counted
7.17 	as a separate incident for purposes of imposing penalties under
7.18 	this section.

7.19 	Sec. 2. [325E.60] DEFINITIONS.
7.20 		Subdivision 1.Scope. For the purposes of sections
7.21 	325E.60 to 325E.62, the terms in subdivisions 2 to 10 have the
7.22 	meanings given.
7.23 		Subd. 2.Person. "Person" means any individual,
7.24 	partnership, corporation, trust, estate, cooperative,
7.25 	association, government or governmental subdivision or agency,
7.26 	or other entity.
7.27 		Subd. 3.Consumer. "Consumer" means an individual.
7.28 		Subd. 4.Consumer reporting agency. "Consumer reporting
7.29 	agency" means any person which, for monetary fees, dues, or on a
7.30 	cooperative nonprofit basis, regularly engages in whole or in
7.31 	part in the practice of assembling or evaluating consumer credit
7.32 	information or other information on consumers for the purpose of
7.33 	furnishing consumer reports to third parties, and which uses any
7.34 	means or facility of interstate commerce for the purpose of
7.35 	preparing or furnishing consumer reports.
7.36 		Subd. 5.Consumer report; credit report. "Consumer
8.1 	report" or "credit report" means any written, oral, or other
8.2 	communication of any information by a consumer reporting agency
8.3 	bearing on a consumer's creditworthiness, credit standing,
8.4 	credit capacity, character, general reputation, personal
8.5 	characteristics, or mode of living which is used or expected to
8.6 	be used or collected in whole or in part for the purpose of
8.7 	serving as a factor in establishing the consumer's eligibility
8.8 	for:
8.9 	(1) credit or insurance to be used primarily for personal,
8.10 	family, or household purposes, except that nothing in sections
8.11 	325E.60 to 325E.62 authorizes the use of credit evaluations or
8.12 	credit scoring in the underwriting of personal lines of property
8.13 	or casualty insurance;
8.14 	(2) employment purposes; or 
8.15 	(3) any other purpose authorized under United States Code,
8.16 	title 15, section 1681b.
8.17 		Subd. 6.Identity theft. "Identity theft" means theft,
8.18 	fraud, or attempted theft or fraud committed using any
8.19 	identifying information of another person.
8.20 		Subd. 7.Nonpublic personal information. "Nonpublic
8.21 	personal information" has the meaning given the term under
8.22 	section 509(4) of the Gramm-Leach-Bliley Act, which defines
8.23 	"nonpublic personal information" to mean personally identifiable
8.24 	financial information that is provided by a consumer to a
8.25 	financial institution, results from any transaction with the
8.26 	consumer or any service performed for the consumer, or is
8.27 	otherwise obtained by the financial institution.  It also
8.28 	includes any list, description, or other grouping of consumers
8.29 	(and publicly available information pertaining to them) that is
8.30 	derived using any nonpublic personal information other than
8.31 	publicly available information.
8.32 		Subd. 8.Credit card. "Credit card" has the same meaning
8.33 	as in section 103 of the Truth in Lending Act.
8.34 		Subd. 9.Debit card. "Debit card" means any card or
8.35 	device issued by a financial institution to a consumer for use
8.36 	in initiating an electronic fund transfer from the account
9.1 	holding assets of the consumer at such financial institution,
9.2 	for the purpose of transferring money between accounts or
9.3 	obtaining money, property, labor, or services.
9.4 		Subd. 10.Credit history. "Credit history" means any
9.5 	written, oral, or other communication of any information by a
9.6 	consumer reporting agency bearing on a consumer's
9.7 	creditworthiness, credit standing, or credit capacity that is
9.8 	used or expected to be used, or collected in whole or in part,
9.9 	for the purpose of determining personal lines insurance premiums
9.10 	or eligibility for coverage.

9.11 	Sec. 3. [325E.61] POLICE REPORT REGARDING IDENTITY
9.12 	THEFT.
9.13 		Subdivision 1.Right to file. A person who has learned
9.14 	or reasonably suspects that he or she has been the victim of
9.15 	identity theft may contact the local law enforcement agency that
9.16 	has jurisdiction over his or her actual residence.  The local
9.17 	law enforcement agency shall make a written report of the
9.18 	matter, and provide the complainant with a copy of that report.
9.19 	Notwithstanding the fact that jurisdiction may lie elsewhere for
9.20 	investigation and prosecution of a crime of identity theft, the
9.21 	local law enforcement agency shall take the complaint and
9.22 	provide the complainant with a copy of the complaint and may
9.23 	refer the complaint to a law enforcement agency in that
9.24 	different jurisdiction.
9.25 		Subd. 2.Consequences. Nothing in this section
9.26 	interferes with the discretion of a local police department to
9.27 	allocate resources for investigations of crimes.  A complaint
9.28 	filed under this section is not required to be counted as an
9.29 	open case for purposes such as compiling open case statistics.

9.30 	Sec. 4. [325E.62] FACTUAL DECLARATION OF INNOCENCE AFTER
9.31 	IDENTITY THEFT.
9.32 		Subdivision 1.Judicial determination. A person who
9.33 	reasonably believes that he or she is the victim of identity
9.34 	theft may petition a court, or the court, on its own motion or
9.35 	upon application of the prosecuting attorney, may move for an
9.36 	expedited judicial determination of his or her factual
10.1 	innocence, where the perpetrator of the identity theft was
10.2 	arrested for, cited for, or convicted of a crime under the
10.3 	victim's identity, or where a criminal complaint has been filed
10.4 	against the perpetrator in the victim's name, or where the
10.5 	victim's identity has been mistakenly associated with a record
10.6 	of criminal conviction.  Any judicial determination of factual
10.7 	innocence made pursuant to this section may be heard and
10.8 	determined upon declarations, affidavits, police reports, or
10.9 	other material, relevant, and reliable information submitted by
10.10 	the parties or ordered to be part of the record by the court.
10.11 	Where the court determines that the petition or motion is
10.12 	meritorious and that there is no reasonable cause to believe
10.13 	that the victim committed the offense for which the perpetrator
10.14 	of the identity theft was arrested, cited, convicted, or subject
10.15 	to a criminal complaint in the victim's name, or that the
10.16 	victim's identity has been mistakenly associated with a record
10.17 	of criminal conviction, the court shall find the victim
10.18 	factually innocent of that offense.  If the victim is found
10.19 	factually innocent, the court shall issue an order certifying
10.20 	this determination.
10.21 		Subd. 2.Court order. After a court has issued a
10.22 	determination of factual innocence pursuant to this section, the
10.23 	court may order the name and associated personal identifying
10.24 	information contained in court records, files, and indexes
10.25 	accessible by the public deleted, sealed, or labeled to show
10.26 	that the data is impersonated and does not reflect the
10.27 	defendant's identity.
10.28 		Subd. 3.Documentation. Upon making a determination of
10.29 	factual innocence, the court must provide the consumer written
10.30 	documentation of such order.
10.31 		Subd. 4.Vacating determination. A court that has issued
10.32 	a determination of factual innocence pursuant to this section
10.33 	may at any time vacate that determination if the petition, or
10.34 	any information submitted in support of the petition, is found
10.35 	to contain any material misrepresentation or fraud.
10.36 		Subd. 5.Form. The Supreme Court shall develop a form
11.1 	for use in issuing an order pursuant to this section.
11.2 		Subd. 6.Database. The Department of Public Safety shall
11.3 	establish and maintain a database of individuals who have been
11.4 	victims of identity theft and that have received determinations
11.5 	of factual innocence.  The Department of Public Safety shall
11.6 	provide a victim of identity theft or his or her authorized
11.7 	representative access to the database in order to establish that
11.8 	the individual has been a victim of identity theft.  Access to
11.9 	the database shall be limited to criminal justice agencies,
11.10 	victims of identity theft, and individuals and agencies
11.11 	authorized by the victims.

11.12 	Sec. 5. [325E.63] CONSUMER-DRIVEN CREDIT MONITORING.
11.13 		Subdivision 1.Disclosures. Every consumer credit
11.14 	reporting agency shall, upon request from a consumer that is not
11.15 	covered by the free disclosures provided in United States Code,
11.16 	title 15, section 1681j, subsections (a) to (d), clearly and
11.17 	accurately disclose to the consumer:
11.18 	(1) all information in the consumer's file at the time of
11.19 	the request, except that nothing in this subdivision requires a
11.20 	consumer reporting agency to disclose to a consumer any
11.21 	information concerning credit scores or other risk scores or
11.22 	predictors that are governed by United States Code, title 15,
11.23 	section 1681g(f);
11.24 	(2) the sources of the information;
11.25 	(3) identification of each person, including each end-user
11.26 	identified under United States Code, title 15, section 1681e,
11.27 	that procured a consumer report:
11.28 	(i) for employment purposes, during the two-year period
11.29 	preceding the date on which the request is made; or 
11.30 	(ii) for any purpose, during the one-year period preceding
11.31 	the date on which the request is made;
11.32 	(4) an identification of a person under clause (3) shall
11.33 	include:
11.34 	(i) the name of the person or, if applicable, the trade
11.35 	name (written in full) under which such person conducts
11.36 	business; and 
12.1 	(ii) upon request of the consumer, the address and
12.2 	telephone number of the person;
12.3 	(5) clause (3) does not apply if:
12.4 	(i) the end user is an agency or department of the United
12.5 	States government that procures the report from the person for
12.6 	purposes of determining the eligibility of the consumer to whom
12.7 	the report relates to receive access or continued access to
12.8 	classified information (as defined in United States Code, title
12.9 	15, section 1681b(b)(4)(E)(i)); and 
12.10 	(ii) the head of the agency or department makes a written
12.11 	finding as prescribed under United States Code, title 15,
12.12 	section 1681b(b)(4)(A);
12.13 	(6) the dates, original payees, and amounts of any checks
12.14 	upon which is based any adverse characterization of the
12.15 	consumer, included in the file at the time of the disclosure or
12.16 	which can be inferred from the file;
12.17 	(7) a record of all inquiries received by the agency during
12.18 	the one-year period preceding the request that identified the
12.19 	consumer in connection with a credit or insurance transaction
12.20 	that was not initiated by the consumer;
12.21 	(8) if the consumer requests the credit file and not the
12.22 	credit score, a statement that the consumer may request and
12.23 	obtain a credit score.
12.24 		Subd. 2.Cost of disclosure. In the case of a request
12.25 	under subdivision 1, a consumer reporting agency may impose a
12.26 	reasonable charge on a consumer for making a disclosure pursuant
12.27 	to this section, which charge must:
12.28 	(1) not exceed $3 for each of the first 12 requests from
12.29 	the consumer in a calendar year;
12.30 	(2) not exceed $8 for any additional request beyond the
12.31 	initial 12 requests from the consumer in a calendar year; and 
12.32 	(3) be indicated to the consumer before making the
12.33 	disclosure.
12.34 		Subd. 3.Format of disclosure. In the case of a request
12.35 	under subdivision 1, a consumer reporting agency must provide
12.36 	the consumer with an opportunity to access his or her report
13.1 	through the following means:
13.2 	(1) in writing;
13.3 	(2) in person, upon the appearance of the consumer at the
13.4 	place of business of the consumer reporting agency where
13.5 	disclosures are regularly provided, during normal business
13.6 	hours, and on reasonable notice;
13.7 	(3) by telephone, if the consumer has made a written
13.8 	request for disclosure;
13.9 	(4) by electronic means, if the agency offers electronic
13.10 	access for any other purpose;
13.11 	(5) by any other reasonable means that is available from
13.12 	the agency.
13.13 		Subd. 4.Timing of disclosure. A consumer reporting
13.14 	agency shall provide a consumer report under subdivision 1 no
13.15 	later than:
13.16 	(1) 24 hours after the date on which the request is made,
13.17 	if the disclosure is made by electronic means, as requested
13.18 	under subdivision 3, clause (4); and 
13.19 	(2) five days after the date on which the request is made,
13.20 	if the disclosure is made in writing, in person, by telephone,
13.21 	or by any other reasonable means that is available from the
13.22 	agency.

13.23 	Sec. 6. [325E.64] PREVENTION OF AND PROTECTION FROM
13.24 	SECURITY BREACHES.
13.25 		Subdivision 1.Definitions. For the purposes of this
13.26 	section, the following terms shall have the following meanings:
13.27 	(1) "data collector" may include but is not limited to
13.28 	government agencies, public and private universities, privately
13.29 	and publicly held corporations, financial institutions, retail
13.30 	operators, and any other entity which, for any purpose, whether
13.31 	by automated collection or otherwise, handles, collects,
13.32 	disseminates, or otherwise deals with nonpublic personal
13.33 	information;
13.34 	(2) "breach of the security of the system data" means
13.35 	unauthorized acquisition of computerized data that compromises
13.36 	the security, and confidentiality, or integrity of personal
14.1 	information maintained by the agency.  Good faith acquisition of
14.2 	personal information by an employee or agent of the agency for a
14.3 	legitimate purpose of the agency is not a breach of the security
14.4 	of the system data, provided that the personal information is
14.5 	not used for a purpose unrelated to the agency or subject to
14.6 	further unauthorized disclosure.  Breach of the security of
14.7 	noncomputerized data may include but is not limited to
14.8 	unauthorized photocopying, facsimiles, or other paper-based
14.9 	transmittal of documents;
14.10 	(3) "personal information" means an individual's first name
14.11 	or first initial and last name in combination with any one or
14.12 	more of the following data elements, when either the name or the
14.13 	data elements are not encrypted or redacted:
14.14 	(i) Social Security number;
14.15 	(ii) driver's license number or state identification card
14.16 	number;
14.17 	(iii) account number, credit or debit card number, if
14.18 	circumstances exist wherein such a number could be used without
14.19 	additional identifying information, access codes, or passwords;
14.20 	(iv) account passwords or personal identification numbers
14.21 	(PINs) or other access codes;
14.22 	(v) any of items (i) to (iv) when not in connection with
14.23 	the individual's first name or first initial and last name, if
14.24 	the information compromised would be sufficient to perform or
14.25 	attempt to perform identity theft against the person whose
14.26 	information was compromised.
14.27 	"Personal information" does not include publicly available
14.28 	information that is lawfully made available to the general
14.29 	public from federal, state, or local government records.
14.30 		Subd. 2.Notice of breach. (a) Except as provided in
14.31 	paragraph (b), any data collector that owns or uses personal
14.32 	information in any form, whether computerized, paper, or
14.33 	otherwise, that includes personal information concerning a
14.34 	Minnesota resident shall notify the resident that there has been
14.35 	a breach of the security that data following discovery or
14.36 	notification of the breach, without regard for whether or not
15.1 	the data has or has not been accessed by an unauthorized third
15.2 	party for legal or illegal purposes.  The disclosure
15.3 	notification must be made in the most expedient time possible
15.4 	and without unreasonable delay, consistent with the legitimate
15.5 	needs of law enforcement, as provided in paragraph (b), or with
15.6 	any measures necessary to determine the scope of the breach and
15.7 	restore the reasonable integrity, security, and confidentiality
15.8 	of the data system.
15.9 	(b) The notification required by this section may be
15.10 	delayed if a law enforcement agency determines that the
15.11 	notification may impede a criminal investigation.  The
15.12 	notification required by this section shall be made after the
15.13 	law enforcement agency determines that it will not compromise
15.14 	the investigation.
15.15 	(c) For purposes of this section, "notice" to consumers may
15.16 	be provided by one of the following methods:
15.17 	(1) written notice;
15.18 	(2) electronic notice, if the notice provided is consistent
15.19 	with the provisions regarding electronic records and signatures,
15.20 	for notices legally required to be in writing, set forth in
15.21 	United States Code, title 15, section 7001;
15.22 	(3) substitute notice, if the agency demonstrates that the
15.23 	cost of providing notice would exceed $250,000 or that the
15.24 	affected class of subject persons to be notified exceeds
15.25 	500,000, or the agency does not have sufficient contact
15.26 	information.  Substitute notice consists of all of the following:
15.27 	(i) e-mail notice when the agency has an e-mail address for
15.28 	the subject persons;
15.29 	(ii) conspicuous posting of the notice on the agency's Web
15.30 	site page, if the agency maintains one; and 
15.31 	(iii) notification to major statewide media.

15.32 	Sec. 7. [325E.65] SOCIAL SECURITY NUMBER PROTECTION.
15.33 		Subdivision 1.Prohibitions. Except as provided in
15.34 	subdivision 2, a person or entity, including a state or local
15.35 	agency, may not do any of the following:
15.36 	(1) intentionally communicate or otherwise make available
16.1 	to the general public an individual's Social Security number;
16.2 	(2) print an individual's Social Security number on any
16.3 	card required for the individual to access products or services
16.4 	provided by the person or entity;
16.5 	(3) require an individual to transmit his or her Social
16.6 	Security number over the Internet, unless the connection is
16.7 	secure or the Social Security number is encrypted;
16.8 	(4) require an individual to use his or her Social Security
16.9 	number to access an Internet Web site, unless a password or
16.10 	unique personal identification number or other authentication
16.11 	device is also required to access the Internet Web site;
16.12 	(5) print an individual's Social Security number on any
16.13 	materials that are mailed to the individual, unless state or
16.14 	federal law requires the Social Security number to be on the
16.15 	document to be mailed; or 
16.16 	(6) sell, lease, loan, trade, rent, or otherwise disclose
16.17 	an individual's Social Security number to a third party for any
16.18 	purpose without written consent to the disclosure from the
16.19 	individual.
16.20 		Subd. 2.Nonapplication. This section does not apply to
16.21 	documents that are recorded or required to be open to the public
16.22 	pursuant to chapter 13.  This section does not apply to records
16.23 	that are required by statute, case law, or court order to be
16.24 	made available to the public by entities provided for in the
16.25 	Minnesota Constitution.
16.26 		Subd. 3.Health care services. In the case of a health
16.27 	care service plan, a provider of health care, an insurer or a
16.28 	pharmacy benefits manager, a contractor, or the provision by any
16.29 	person or entity of administrative or other services relative to
16.30 	health care or insurance products or services, including
16.31 	third-party administration or administrative services only, this
16.32 	section shall become operative no later than July 1, 20...
16.33 		Subd. 4.Cooperation. Any entity covered by this section
16.34 	shall make reasonable efforts to cooperate, through systems
16.35 	testing and other means, to ensure that the requirements of this
16.36 	section are implemented on or before the dates specified in this
17.1 	section.
17.2 		Subd. 5.Penalties for violations of this section. (a) A
17.3 	person who violates this section is subject to a civil penalty
17.4 	of not more than $3,000.
17.5 	(b) A person who knowingly violates this section is guilty
17.6 	of a misdemeanor punishable by imprisonment for not more than ..
17.7 	days or a fine of not more than $5,000 or both.
17.8 	(c) An individual may bring a civil action against a person
17.9 	who violates this act and may recover actual damages or $5,000,
17.10 	whichever is greater, plus reasonable court costs and attorney
17.11 	fees.

17.12 	Sec. 8. [325E.66] ADEQUATE DESTRUCTION OF PERSONAL
17.13 	RECORDS.
17.14 		Subdivision 1.Definitions. For the purposes of this
17.15 	section, the following terms shall have the meanings given them:
17.16 	(a) "Business" means sole proprietorship, partnership,
17.17 	corporation, association, or other group, however organized and
17.18 	whether or not organized to operate at a profit.  The term
17.19 	includes a financial institution organized, chartered, or
17.20 	holding a license or authorization certificate under the laws of
17.21 	this state, any other state, the United States, or any other
17.22 	country, or the parent or the subsidiary of any such financial
17.23 	institution.  The term also includes an entity that destroys
17.24 	records.
17.25 	(b) "Dispose" includes:
17.26 	(1) the discarding or abandonment of records containing
17.27 	personal information; and 
17.28 	(2) the sale, donation, discarding, or transfer of any
17.29 	medium, including computer equipment, or computer media,
17.30 	containing records of personal information, or other nonpaper
17.31 	media upon which records of personal information is stored, or
17.32 	other equipment for nonpaper storage of information.
17.33 	(c) "Personal information" means any information that
17.34 	identifies, relates to, describes, or is capable of being
17.35 	associated with a particular individual, including, but not
17.36 	limited to, a name, signature, Social Security number,
18.1 	fingerprint, photograph or computerized image, physical
18.2 	characteristics or description, address, telephone number,
18.3 	passport number, driver's license or state identification card
18.4 	number, date of birth, medical information, bank account number,
18.5 	credit card number, debit card number, or any other financial
18.6 	information.
18.7 	(d) "Records" means any material on which written, drawn,
18.8 	spoken, visual, or electromagnetic information is recorded or
18.9 	preserved, regardless of physical form or characteristics.
18.10 	"Records" does not include publicly available directories
18.11 	containing information an individual has voluntarily consented
18.12 	to have publicly disseminated or listed, such as name, address,
18.13 	or telephone number.
18.14 		Subd. 2.Disposal of records containing personal
18.15 	information. Any business that conducts business in Minnesota
18.16 	and any business that maintains or otherwise possesses personal
18.17 	information of residents of Minnesota must take all reasonable
18.18 	measures to protect against unauthorized access to or use of the
18.19 	information in connection with, or after its disposal.  Such
18.20 	reasonable measures must include, but may not be limited to:
18.21 	(1) implementing and monitoring compliance with policies
18.22 	and procedures that require the burning, pulverizing, or
18.23 	shredding of papers containing personal information so that the
18.24 	information cannot practicably be read or reconstructed;
18.25 	(2) implementing and monitoring compliance with policies
18.26 	and procedures that require the destruction or erasure of
18.27 	electronic media and other nonpaper media containing personal
18.28 	information so that the information cannot practicably be read
18.29 	or reconstructed;
18.30 	(3) after due diligence, entering into and monitoring
18.31 	compliance with a written contract with another party engaged in
18.32 	the business of record destruction to dispose of personal
18.33 	information in a manner consistent with this statute.  Due
18.34 	diligence should ordinarily include, but may not be limited to,
18.35 	one or more of the following:  reviewing an independent audit of
18.36 	the disposal company's operations and/or its compliance with
19.1 	this statute or its equivalent; obtaining information about the
19.2 	disposal company from several references or other reliable
19.3 	sources and requiring that the disposal company be certified by
19.4 	a recognized trade association or similar third party with a
19.5 	reputation for high standards of quality review; reviewing and
19.6 	evaluating the disposal company's information security policies
19.7 	or procedures; or taking other appropriate measures to determine
19.8 	the competency and integrity of the disposal company; and 
19.9 	(4) for disposal companies explicitly hired to dispose of
19.10 	records containing personal information:  implementing and
19.11 	monitoring compliance with policies and procedures that protect
19.12 	against unauthorized access to or use of personal information
19.13 	during or after the collection and transportation and disposing
19.14 	of such information in accordance with clauses (1) and (2).
19.15 		Subd. 3.Business policy. Procedures relating to the
19.16 	adequate destruction or proper disposal of personal records must
19.17 	be comprehensively described and classified as official policy
19.18 	in the writings of the business entity, including corporate and
19.19 	employee handbooks and similar corporate documents.
19.20 		Subd. 4.Penalties and civil liability. (a) Any person
19.21 	or business that violates this section is subject to a civil
19.22 	penalty of not more than $3,000.
19.23 	(b) Any individual aggrieved by a violation may bring a
19.24 	civil action in district court to enjoin further violations and
19.25 	to recover actual damages, costs, and reasonable attorney fees.

19.26 	Sec. 9. SEVERABILITY.
 19.27 	The provisions of this act are severable.  If any phrase,
19.28 	clause, sentence, provision, or section is declared to be
19.29 	invalid or is preempted by federal law or regulation, the
19.30 	remaining provisions of the act remain valid.