HF 3686

as introduced - 84th Legislature (2005 - 2006) Posted on 12/15/2009 12:00am

A bill for an act
relating to consumer protection; creating standards for disposal of personal
information to limit the potential for identity theft; proposing coding for new law
in Minnesota Statutes, chapter 325E.

BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF MINNESOTA:

Section 1.

new text begin [325E.62] PERSONAL RECORDS DESTRUCTION.
new text end

new text begin Subdivision 1. new text end

new text begin Definitions. new text end

new text begin (a) For the purposes of this section, the terms in
paragraphs (b) to (f) have the meanings given them.
new text end

new text begin (b) "Firm" means sole proprietorship, partnership, corporation, association, or other
group however organized and whether or not organized to operate at a profit.
new text end

new text begin (c) "Destruction" includes:
new text end

new text begin (1) the discarding or abandonment of records containing personal information; and
new text end

new text begin (2) the sale, donation, discarding, or transfer of any medium, including computer
equipment or computer media, containing records of personal information, or other
nonpaper media upon which records of personal information is stored, or other equipment
for nonpaper storage of information.
new text end

new text begin (d) "Personal information" means any information that identifies, relates to,
describes, or is capable of being associated with a particular individual, including, but
not limited to, a name, signature, Social Security number, fingerprint and other biometric
information, photograph or computerized image, physical characteristic or description,
address, telephone number, passport number, driver's license or state identification card
number, date of birth, medical information, bank account number, credit card number,
debit card number, or any other financial information.
new text end

new text begin (e) "Records" means any material on which written, drawn, spoken, visual, or
electromagnetic information is recorded or preserved, regardless of physical form or
characteristics. "Records" does not include publicly available directories containing
information an individual has voluntarily consented to have publicly disseminated or
listed, such as name, address, or telephone number.
new text end

new text begin (f) "Record destruction firm" means a business whose primary purpose is disposal or
destruction of records with personal information.
new text end

new text begin Subd. 2. new text end

new text begin Disposal of records containing personal information. new text end

new text begin Any firm
that conducts business in this state and maintains or otherwise possesses personal
information of residents of Minnesota shall take all reasonable measures to protect against
unauthorized access to or use of the information in connection with or after its destruction.
Reasonable measures include, but are not limited to:
new text end

new text begin (1) implementing and monitoring compliance with policies and procedures that
require burning, pulverizing, or shredding of papers containing personal information so
that the information cannot be read or reconstructed;
new text end

new text begin (2) implementing and monitoring compliance with policies and procedures that
require the destruction or erasure of electronic media and other nonpaper media containing
personal information so that the information cannot be read or reconstructed; and
new text end

new text begin (3) after due diligence, entering into and monitoring compliance with a contract with
a record destruction firm to destroy personal information in a manner consistent with this
section, including protection against unauthorized access to or use of personal information
during or after the collection, transportation, and destruction of the information.
new text end

new text begin For purposes of this clause, "due diligence" means taking appropriate measures to
determine the competency and integrity of the record destruction firm, including at least
one of the following:
new text end

new text begin (i) reviewing an independent audit of the operations of the record destruction firm
and/or its compliance with this section;
new text end

new text begin (ii) obtaining information about the record destruction firm from several references
or other reliable sources and requiring that the record destruction firm be certified by a
recognized trade association or similar third party with a reputation for high standards of
quality review; or
new text end

new text begin (iii) reviewing and evaluating the information security policies or procedures of the
record destruction firm.
new text end

new text begin Subd. 3. new text end

new text begin Record destruction policy. new text end

new text begin The record destruction firm shall adopt as
official policy, and provide to new employees, a comprehensive description of procedures
relating to the adequate destruction or proper disposal of personal records.
new text end

new text begin Subd. 4. new text end

new text begin Penalties and remedies. new text end

new text begin A person violating this section is subject to
the penalties and remedies in section 8.31.
new text end