HF 3487

1st Engrossment - 84th Legislature (2005 - 2006) Posted on 12/15/2009 12:00am

A bill for an act
relating to data practices; classifying data; regulating data use; requiring a
report to the legislature; providing civil remedies; providing criminal penalties;
amending Minnesota Statutes 2005 Supplement, sections 168.346, subdivision
1; 171.12, subdivision 7; 325E.59, subdivisions 1, 3, by adding a subdivision;
proposing coding for new law in Minnesota Statutes, chapters 168; 171; 325F;
repealing Minnesota Statutes 2005 Supplement, section 325E.59, subdivision 2.

BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF MINNESOTA:

Section 1.

Minnesota Statutes 2005 Supplement, section 168.346, subdivision 1,
is amended to read:

Subdivision 1.

Vehicle registration data; federal compliance.

(a) deleted text begin Data on an
individual deleted text end new text begin Personal information and highly restrictive personal information, as defined
in United States Code, title 18, section 2725, clauses (3) and (4), new text end provided to register a
vehicle new text begin is private data on individuals and new text end shall be treated as provided by United States
Code, title 18, section 2721, as in effect on deleted text begin May 23, 2005 deleted text end new text begin March 9, 2006 new text end , and shall be
disclosed as required new text begin by paragraph (b) of United States Code, title 18, section 2721 new text end or new text begin as
new text end permitted by new text begin paragraph (b), clauses (1), (2) to (7), (9), and (14) of new text end that section.

(b) The registered owner of a vehicle who is an individual may consent in writing to
the commissioner to disclose the individual's personal information exempted by United
States Code, title 18, section 2721, to any person who makes a written request for the
personal information. If the registered owner is an individual and so authorizes disclosure,
the commissioner shall implement the request.

(c) deleted text begin If authorized by the registered owner as indicated in paragraph (b), the registered
owner's personal information may be used, rented, or sold solely for bulk distribution
by organizations for business purposes including surveys, marketing, or solicitation. deleted text end new text begin A
recipient of data from the commissioner under this subdivision may use the data only for
the purpose for which it was obtained and the recipient must not resell or redisclose the
data. Resale or redisclosure of data pursuant to a contract that was the purpose of a request
for data under this subdivision is not prohibited by this paragraph.
new text end

new text begin (d) A person who requests disclosure of data under paragraph (a) must identify the
data elements requested and the reason each element is needed and may receive only those
data elements needed to accomplish the purpose of the request. A person requesting data
on 500 or more individuals must document compliance with data security measures as
required by the commissioner. The commissioner shall implement a system for tracking
the sale or disclosure of personal information described in paragraph (a) by those who
receive personal information from the commissioner. The commissioner shall audit
activities of recipients of personal information under paragraph (a) with regard to that
information. Persons who receive personal information from the commissioner must
cooperate with all compliance activities.
new text end

new text begin (e) An individual who registers a vehicle may request that the individual's residence
address not appear on the registration and that a substitute address be used. The
commissioner shall grant the substitution on receipt of a signed statement by the individual
that the substitute address is required for the safety of the individual or the individual's
family, if the statement also provides a valid, existing, substitute address where the
individual consents to receive service of process. The commissioner shall use the
substitute address in place of the residence address in all documents and notices pertaining
to the registration. Any information provided in the substitution request are private data
on individuals and may be provided to requesting law enforcement agencies, probation
and parole agencies, and public authorities, as defined in section 518.54, subdivision 9.
new text end

Sec. 2.

new text begin [168.348] PENALTIES.
new text end

new text begin Subdivision 1. new text end

new text begin Receipt. new text end

new text begin A person who knowingly receives personal information in
violation of section 168.346, subdivision 1, is guilty of a misdemeanor.
new text end

new text begin Subd. 2. new text end

new text begin Resale or redisclosure. new text end

new text begin A person who knowingly resells or rediscloses
personal information in violation of section 168.346, subdivision 1, is guilty of a
misdemeanor.
new text end

new text begin Subd. 3. new text end

new text begin Multiple violations. new text end

new text begin A person who knowingly violates the provisions of
section 168.346, subdivision 1, two or more times is guilty of a gross misdemeanor.
new text end

new text begin Subd. 4. new text end

new text begin Civil penalty. new text end

new text begin A person who knowingly violates the provisions of section
168.346, subdivision 1, is subject to a civil penalty of $5,000 per violation.
new text end

Sec. 3.

Minnesota Statutes 2005 Supplement, section 171.12, subdivision 7, is
amended to read:

Subd. 7.

Privacy of data.

(a) deleted text begin Data on individuals deleted text end new text begin Personal information and highly
restrictive personal information, as defined in United States Code, title 18, section 2725,
clauses (3) and (4), new text end provided to obtain a driver's license new text begin , instruction permit, new text end or Minnesota
identification card new text begin is private data on individuals and new text end shall be treated as provided by United
States Code, title 18, section 2721, as in effect on deleted text begin May 23, 2005 deleted text end new text begin March 9, 2006 new text end , and shall
be disclosed as required new text begin by paragraph (b) of United States code, title 18, section 2721 new text end or
new text begin as new text end permitted by new text begin paragraph (b), clauses (1), (2) to (7), (9), and (14) of new text end that section.

(b) new text begin The commissioner may disclose an applicant's personal information to a
federally certified or designated nonprofit organ procurement organization for use in
connection with the organization's authorized activities.
new text end

new text begin (c) new text end An applicant for a driver's license or a Minnesota identification card may
consent, in writing, to the commissioner to disclose the applicant's personal information
exempted by United States Code, title 18, section 2721, to any person who makes a request
for the personal information. If the applicant so authorizes disclosures, the commissioner
shall implement the request and the information may be used.

deleted text begin (c) If authorized by an applicant for a driver's license or a Minnesota identification
card, as indicated in paragraph (b), the applicant's personal information may be used,
rented, or sold solely for bulk distribution by organizations for business purposes,
including surveys, marketing, or solicitation.
deleted text end

(d) An applicant for a driver's license, instruction permit, or Minnesota identification
card may request that the applicant's residence address deleted text begin be classified as "private data on
individuals," as defined in section 13.02, subdivision 12 deleted text end new text begin not appear in the driver's license,
instruction permit, or Minnesota identification card and that a substitute address be used new text end .
The commissioner shall grant the deleted text begin classification deleted text end new text begin request for a substitute address new text end on receipt
of a signed statement by the deleted text begin individual deleted text end new text begin applicant new text end that the deleted text begin classification deleted text end new text begin substitute address
new text end is required for the safety of the applicant or the applicant's family, if the statement also
provides a valid, existing new text begin substitute new text end address where the applicant consents to receive service
of process. The commissioner shall use the deleted text begin service for process mailing deleted text end new text begin substitute new text end address
in place of the residence address in all documents and notices pertaining to the driver's
license, instruction permit, or Minnesota identification card. The residence address and
any information provided in the deleted text begin classification deleted text end new text begin substitute address new text end request deleted text begin , other than the
mailing address, deleted text end are private data on individuals and may be provided to requesting law
enforcement agencies, probation and parole agencies, and public authorities, as defined
in section 518.54, subdivision 9.

new text begin (e) A recipient of data from the commissioner under this subdivision may use the
data only for the purpose for which it was obtained and the recipient must not resell or
redisclose the data. Resale or redisclosure of data pursuant to a contract that was the
purpose of a request for data under this subdivision is not prohibited by this paragraph.
new text end

new text begin (f) A person who requests disclosure of data under paragraph (a) must identify the
data elements requested and the reason each element is needed and may receive only those
data elements needed to accomplish the purpose of the request. A person requesting data
on 500 or more individuals must document compliance with data security measures as
required by the commissioner. The commissioner may implement a system for tracking
the sale or disclosure of personal information described in paragraph (a) both from the
commissioner and by those who receive personal information from the commissioner. The
commissioner may audit activities of recipients of personal information under paragraph
(a) with regard to that information. Persons who receive personal information from the
commissioner must cooperate with all compliance activities.
new text end

Sec. 4.

new text begin [171.125] PENALTIES.
new text end

new text begin Subdivision 1. new text end

new text begin Receipt. new text end

new text begin A person who receives personal information in violation of
section 171.12, subdivision 7, is guilty of a misdemeanor.
new text end

new text begin Subd. 2. new text end

new text begin Resale or redisclosure. new text end

new text begin A person who knowingly resells or rediscloses
personal information in violation of section 171.12, subdivision 7, is guilty of a
misdemeanor.
new text end

new text begin Subd. 3. new text end

new text begin Multiple violations. new text end

new text begin A person who knowingly violates the provisions of
section 171.12, subdivision 7, two or more times is guilty of a gross misdemeanor.
new text end

new text begin Subd. 4. new text end

new text begin Additional penalty. new text end

new text begin A person who knowingly violates the provisions of
section 171.12, subdivision 7, is subject to a civil penalty of $5,000 per violation.
new text end

Sec. 5.

Minnesota Statutes 2005 Supplement, section 325E.59, subdivision 1, is
amended to read:

Subdivision 1.

Generally.

new text begin (a) new text end A person or entity, not including a government entity,
may not do any of the following:

(1) publicly post or publicly display in any manner an individual's Social Security
number. "Publicly post" or "publicly display" means to intentionally communicate or
otherwise make available to the general public;

(2) print an individual's Social Security number on any card required for the
individual to access products or services provided by the person or entity;

(3) require an individual to transmit the individual's Social Security number over the
Internet, unless the connection is secure or the Social Security number is encrypted;

(4) require an individual to use the individual's Social Security number to access an
Internet Web site, unless a password or unique personal identification number or other
authentication device is also required to access the Internet Web site; deleted text begin or
deleted text end

(5) print a number that the person or entity knows to be an individual's Social
Security number on any materials that are mailed to the individual, unless state or federal
law requires the Social Security number to be on the document to be mailed. If, in
connection with a transaction involving or otherwise relating to an individual, a person
or entity receives a number from a third party, that person or entity is under no duty to
inquire or otherwise determine whether the number is or includes that individual's Social
Security number and may print that number on materials mailed to the individual, unless
the person or entity receiving the number has actual knowledge that the number is or
includes the individual's Social Security number deleted text begin . deleted text end new text begin ;
new text end

new text begin (6) assign or use a number as an account identifier that is identical to or incorporates
an individual's complete Social Security number; or
new text end

new text begin (7) sell Social Security numbers obtained from individuals in the course of business.
new text end

deleted text begin Notwithstanding clauses (1) to (5), Social Security numbers may be included in
applications and forms sent by mail, including documents sent as part of an application or
enrollment process, or to establish, amend, or terminate an account, contract, or policy,
or to confirm the accuracy of the Social Security number. Nothing in this paragraph
authorizes inclusion of a Social Security number on the outside of a mailing.
deleted text end

new text begin (b) A person or entity, not including a government entity, must restrict access to
individual Social Security numbers it holds so that only employees who require the
numbers in order to perform their job duties have access to the numbers.
new text end

deleted text begin Except as provided in subdivision 2, deleted text end new text begin (c) new text end This section applies only to the use of Social
Security numbers on or after July 1, 2007.

Sec. 6.

Minnesota Statutes 2005 Supplement, section 325E.59, subdivision 3, is
amended to read:

Subd. 3.

Coordination with other law.

This section does not prevent new text begin : new text end

new text begin (1) new text end the collection, use, or release of a Social Security number as required by state or
federal law deleted text begin or deleted text end new text begin ;
new text end

new text begin (2) new text end the use of a Social Security number for internal verification or administrative
purposes deleted text begin . deleted text end new text begin ;
new text end

new text begin (3) the use of a Social Security number to access a credit report for purposes allowed
by the federal Fair Credit Reporting Act, United States Code, title 15, section 1681a, if a
Social Security number is required in order to access the credit report; or
new text end

new text begin (4) the use of a Social Security number to access or report information to a person
who maintains a database of information used in connection with the prevention or
detection of fraud.
new text end

Sec. 7.

Minnesota Statutes 2005 Supplement, section 325E.59, is amended by adding a
subdivision to read:

new text begin Subd. 6. new text end

new text begin Penalties. new text end

new text begin (a) A violation of this section is a gross misdemeanor punishable
by a sentence of up to one year, a fine of $3,000, or both.
new text end

new text begin (b) Each subsequent violation is a felony punishable by a sentence of up to five
years, a fine of $5,000, or both.
new text end

new text begin (c) A violation of this section is subject to a $5,000 civil penalty.
new text end

new text begin (d) A violation of this section is a deceptive trade practice under section 325D.44.
new text end

new text begin (e) An individual aggrieved by a violation of this section may bring a civil action
to recover damages, costs, and reasonable attorney fees.
new text end

Sec. 8.

new text begin [325F.696] CUSTOMER SALES OR SERVICE CALL CENTER
REQUIREMENTS.
new text end

new text begin Subdivision 1. new text end

new text begin Definitions. new text end

new text begin For purposes of this section, the following terms have
the meanings given them:
new text end

new text begin (1) "customer sales and service call center" means an entity whose primary purpose
includes the initiating or receiving of telephonic communications on behalf of any person
for the purpose of initiating telephone solicitations as defined in section 325E.311,
subdivision 6;
new text end

new text begin (2) "customer service call center" means an entity whose primary purpose includes
the initiating or receiving of telephonic communications on behalf of any person for the
purposes of providing or receiving services or information necessary in connection with
the providing of services or other benefits; and
new text end

new text begin (3) "customer service employee" means a person employed by or working on behalf
of a customer sales call center or a customer service call center.
new text end

new text begin Subd. 2. new text end

new text begin Customer's right to customer sales or customer service call center
information. new text end

new text begin (a) Any person who receives a telephone call from, or places a telephone
call to, a customer sales call center or a customer service call center, upon request, has
the right to know the identification of the state or country where the customer service
employee is located.
new text end

new text begin (b) A person who receives a telephone solicitation from, or places a telephone call to,
a customer sales call center or a customer service call center located in a foreign country,
which requests the person's financial, credit, or identifying information, shall have the
right to request an alternative option to contact a customer sales and service center located
in the United States before the information is given if the alternative option is available.
new text end

new text begin Subd. 3. new text end

new text begin Violation. new text end

new text begin It is fraud under section 325F.69 for a person to willfully
violate this section.
new text end

new text begin Subd. 4. new text end

new text begin Application to other remedies. new text end

new text begin Nothing in this section changes the
remedies currently available under state or federal law or creates additional or new
remedies.
new text end

new text begin EFFECTIVE DATE. new text end

new text begin This section is effective August 1, 2006.
new text end

Sec. 9. new text begin REPORT TO LEGISLATURE.
new text end

new text begin The commissioner of administration must conduct a comprehensive review of
chapter 13. The commissioner must evaluate the current law in terms of its three competing
purposes: (a) to protect the privacy of individuals; (b) permit government to function;
and (c) promote transparency in government; and make recommendations whether the
current balance in these purposes should be changed. In addition, the report must identify
any changes to chapter 13 that are needed to respond to emerging technologies, including
new methodologies for data storage, retention, and dissemination and whether any of the
recommendations in the 1999 report of the Information Policy Task Force that have not
been adopted should be considered. The report must be submitted to the chair of the House
Civil Law and Elections Committee and the chair of the Senate Judiciary Committee and
the ranking minority members of those committees. The report is due by January 15, 2007.
new text end

Sec. 10. new text begin REPEALER.
new text end

new text begin Minnesota Statutes 2005 Supplement, section 325E.59, subdivision 2, new text end new text begin is repealed.
new text end