SF 2454

1st Engrossment - 79th Legislature (1995 - 1996) Posted on 12/15/2009 12:00am

  1.1                          A bill for an act 
  1.2             relating to consumer privacy; regulating the use and 
  1.3             dissemination of personally identifiable information 
  1.4             on consumers of computer information services; 
  1.5             proposing coding for new law as Minnesota Statutes, 
  1.6             chapter 13D. 
  1.7   BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF MINNESOTA: 
  1.8      Section 1.  [13D.01] [DEFINITIONS.] 
  1.9      Subdivision 1.  [SCOPE.] The definitions in this section 
  1.10  apply to this chapter. 
  1.11     Subd. 2.  [CONSUMER.] "Consumer" means a purchaser or 
  1.12  subscriber of goods or services from an information service. 
  1.13     Subd. 3.  [ORDINARY COURSE OF BUSINESS.] "Ordinary course 
  1.14  of business" means debt collection activities, order 
  1.15  fulfillment, the transfer of information among entities having 
  1.16  common ownership or control, request processing, or the transfer 
  1.17  of ownership. 
  1.18     Subd. 4.  [PERSONALLY IDENTIFIABLE INFORMATION.] 
  1.19  "Personally identifiable information" means information that: 
  1.20     (1) identifies a person by physical or electronic address 
  1.21  or telephone number; 
  1.22     (2) identifies a person as having requested or obtained 
  1.23  specific materials or services from an information service; 
  1.24     (3) identifies internet sites visited by a person; or 
  1.25     (4) identifies any of the contents of a subscriber's data 
  1.26  storage devices. 
  2.1      Subd. 5.  [INFORMATION SERVICE.] "Information service" 
  2.2   means the offering of a capability for generating, acquiring, 
  2.3   storing, transforming, processing, retrieving, utilizing, or 
  2.4   making available information via telecommunications, and 
  2.5   includes electronic publishing, but does not include any use of 
  2.6   any such capability for the management, control, or operation of 
  2.7   a telecommunications system or the management of a 
  2.8   telecommunications service. 
  2.9      Subd. 6.  [TELECOMMUNICATIONS SERVICE.] "Telecommunications 
  2.10  service" means the offering, on a common carrier basis, of 
  2.11  telecommunications facilities, or of telecommunications by means 
  2.12  of such facilities.  It does not include an information service. 
  2.13     Sec. 2.  [13D.02] [LIMITS ON ACCESS TO CONSUMER'S 
  2.14  PERSONALLY IDENTIFIABLE INFORMATION.] 
  2.15     The information service may require from the consumer the 
  2.16  following personally identifiable information for purposes of 
  2.17  its ordinary course of business:  name, home telephone number, 
  2.18  home address, and electronic address.  Any further consumer 
  2.19  information provided shall be optional at the discretion of the 
  2.20  consumer. 
  2.21     Sec. 3.  [13D.03] [DISCLOSURE OF CONSUMER'S PERSONALLY 
  2.22  IDENTIFIABLE INFORMATION.] 
  2.23     Subdivision 1.  [DISCLOSURE PROHIBITED.] Except as provided 
  2.24  in subdivisions 3 and 4, an information service who knowingly 
  2.25  discloses, to any person, other than the consumer, personally 
  2.26  identifiable information concerning any consumer of the 
  2.27  information service is liable to the consumer for the relief 
  2.28  provided in section 4. 
  2.29     Subd. 2.  [DISCLOSURE REQUIRED.] An information service 
  2.30  shall disclose personally identifiable information concerning 
  2.31  any consumer: 
  2.32     (1) to a grand jury pursuant to a grand jury subpoena; 
  2.33     (2) to an investigative or law enforcement officer as 
  2.34  defined in section 626A.01, subdivision 7, carrying out conduct 
  2.35  authorized by chapter 626A or United States Code, title 18, 
  2.36  sections 2510 to 2521; 
  3.1      (3) pursuant to a court order in a civil proceeding upon a 
  3.2   showing of compelling need for the information that cannot be 
  3.3   accommodated by other means; or 
  3.4      (4) to a court in a civil action for conversion commenced 
  3.5   by the information service or in a civil action to enforce 
  3.6   collection of unpaid subscription fees or purchase amounts; and 
  3.7   then only to the extent necessary to establish the fact of the 
  3.8   subscription delinquency or purchase agreement, and with 
  3.9   appropriate safeguards against unauthorized disclosure. 
  3.10     Subd. 3.  [DISCLOSURE PERMITTED.] (a) An information 
  3.11  service may disclose personally identifiable information 
  3.12  concerning any consumer: 
  3.13     (1) to the consumer; 
  3.14     (2) to any person with the informed, documented consent of 
  3.15  the consumer as provided in subdivision 4; or 
  3.16     (3) to any person if the disclosure is incident to the 
  3.17  ordinary course of business of the information service.  
  3.18     (b) A telecommunications service may disclose published 
  3.19  telephone numbers and physical addresses without the informed, 
  3.20  documented consent of the consumer, if the telecommunications 
  3.21  service provides consumers the alternative of an unpublished 
  3.22  listing. 
  3.23     Subd. 4.  [PROCEDURE FOR INFORMED, DOCUMENTED CONSENT OF 
  3.24  CONSUMER.] (a) For purposes of subdivision 3, paragraph (a), 
  3.25  clause (2), in order to obtain the informed documented consent 
  3.26  of the consumer, the information service, before furnishing any 
  3.27  information services, must offer the consumer an opportunity 
  3.28  conforming to the notice contained in this subdivision to refuse 
  3.29  to have personally identifiable information disclosed.  The 
  3.30  notice must be in an introductory portion of the information 
  3.31  service's subscriber section with the title "Privacy Policy."  
  3.32  This notice applies to any membership, subscription, rental, or 
  3.33  purchase agreement between the consumer and the information 
  3.34  service and, must be completed by the consumer before service 
  3.35  can be provided.  The notice must read as follows: 
  3.36                          Privacy Policy
  4.1      This information service occasionally provides to marketers 
  4.2   of goods and services, or organizations with similar goals, 
  4.3   lists of the names, physical addresses, telephone numbers, and 
  4.4   electronic addresses of consumers and material accessed or 
  4.5   purchased by the consumer.  We respect the consumer's right not 
  4.6   to have name, physical address, electronic address, or 
  4.7   information regarding material accessed or purchased included in 
  4.8   these lists.  This election may be changed by you the consumer 
  4.9   at any time. 
  4.10  -I do/do not object to the release of my name, telephone number, 
  4.11  and physical address. 
  4.12  -I do/do not object to the release of my name and electronic 
  4.13  address. 
  4.14  -I do/do not object to the release of my name and information 
  4.15  about services I use, including internet sites visited, or 
  4.16  information obtained or purchased by me. 
  4.17  -I do/do not object to the release of my name and information 
  4.18  about the contents of my computer's electronic storage device or 
  4.19  devices, such as a hard disk drive. 
  4.20  Full name: 
  4.21  Account name: 
  4.22  Electronic verification: 
  4.23  Repeat electronic verification: 
  4.24     (b) The information service shall provide the consumer or 
  4.25  subscriber with a secured, verifiable account.  The information 
  4.26  service shall be responsible for maintaining the security and 
  4.27  privacy of a consumer's personally identifiable information 
  4.28  concerning this account. 
  4.29     Subd. 5.  [EXCLUSION FROM EVIDENCE.] Personally 
  4.30  identifiable information obtained in any manner other than as 
  4.31  provided in this section may not be received in evidence in any 
  4.32  trial, hearing, arbitration, or other proceeding before any 
  4.33  court, grand jury, officer, agency, regulatory body, legislative 
  4.34  committee, or other authority of the state or any political 
  4.35  subdivision. 
  4.36     Subd. 6.  [DESTRUCTION OF INFORMATION.] A person subject to 
  5.1   this section shall destroy personally identifiable information 
  5.2   relating to the product, services, or information obtained or 
  5.3   requested by a consumer, internet sites visited by the consumer, 
  5.4   and the contents of the consumer's computer's electronic storage 
  5.5   devices as soon as practicable, but no later than six months 
  5.6   from the date the information is no longer necessary for the 
  5.7   purpose for which it was collected, except that requests or 
  5.8   orders for access to the information under this section pending 
  5.9   at that time shall be completed before the information is 
  5.10  destroyed.  Destruction of personally identifiable information 
  5.11  includes electronic erasing or expungement. 
  5.12     Sec. 4.  [13D.04] [ENFORCEMENT; CIVIL LIABILITY.] 
  5.13     A consumer who prevails or substantially prevails in an 
  5.14  action brought under sections 13D.01 to 13D.04 is entitled to a 
  5.15  minimum of $500 in damages, regardless of the amount of actual 
  5.16  damage provided, plus costs, disbursements, and reasonable 
  5.17  attorney fees. 
  5.18     Sec. 5.  [13D.05] [OTHER LAW.] 
  5.19     This chapter does not limit any greater protection of the 
  5.20  privacy of individual medical records or financial records 
  5.21  provided by any other state or federal law. 
  5.22     Sec. 6.  [13D.06] [APPLICATION.] 
  5.23     This chapter applies to information services in the 
  5.24  provision of services to customers in this state.