Office of the Revisor of Statutes
Minnesota Session Laws - 2002, Regular Session
Key: (1) language to be deleted (2) new language
CHAPTER 395-S.F.No. 2908
An act relating to data privacy; regulating electronic
mail solicitations; protecting privacy of Internet
consumers; regulating use of data about Internet
users; providing penalties; amending Minnesota
Statutes 2000, section 626A.28, subdivision 3;
proposing coding for new law in Minnesota Statutes,
chapter 325F; proposing coding for new law as
Minnesota Statutes, chapter 325M.
BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF MINNESOTA:
ARTICLE 1
INTERNET PRIVACY
Section 1. [325M.01] [DEFINITIONS.]
Subdivision 1. [SCOPE.] The terms used in this chapter
have the meanings given them in this section.
Subd. 2. [CONSUMER.] "Consumer" means a person who agrees
to pay a fee to an Internet service provider for access to the
Internet for personal, family, or household purposes, and who
does not resell access.
Subd. 3. [INTERNET SERVICE PROVIDER.] "Internet service
provider" means a business or person who provides consumers
authenticated access to, or presence on, the Internet by means
of a switched or dedicated telecommunications channel upon which
the provider provides transit routing of Internet Protocol (IP)
packets for and on behalf of the consumer. Internet service
provider does not include the offering, on a common carrier
basis, of telecommunications facilities or of telecommunications
by means of these facilities.
Subd. 4. [ORDINARY COURSE OF BUSINESS.] "Ordinary course
of business" means debt-collection activities, order
fulfillment, request processing, or the transfer of ownership.
Subd. 5. [PERSONALLY IDENTIFIABLE
INFORMATION.] "Personally identifiable information" means
information that identifies:
(1) a consumer by physical or electronic address or
telephone number;
(2) a consumer as having requested or obtained specific
materials or services from an Internet service provider;
(3) Internet or online sites visited by a consumer; or
(4) any of the contents of a consumer's data-storage
devices.
Sec. 2. [325M.02] [WHEN DISCLOSURE OF PERSONAL INFORMATION
PROHIBITED.]
Except as provided in sections 325M.03 and 325M.04, an
Internet service provider may not knowingly disclose personally
identifiable information concerning a consumer of the Internet
service provider.
Sec. 3. [325M.03] [WHEN DISCLOSURE OF PERSONAL INFORMATION
REQUIRED.]
An Internet service provider shall disclose personally
identifiable information concerning a consumer:
(1) pursuant to a grand jury subpoena;
(2) to an investigative or law enforcement officer as
defined in section 626A.01, subdivision 7, while acting as
authorized by law;
(3) pursuant to a court order in a civil proceeding upon a
showing of compelling need for the information that cannot be
accommodated by other means;
(4) to a court in a civil action for conversion commenced
by the Internet service provider or in a civil action to enforce
collection of unpaid subscription fees or purchase amounts, and
then only to the extent necessary to establish the fact of the
subscription delinquency or purchase agreement, and with
appropriate safeguards against unauthorized disclosure;
(5) to the consumer who is the subject of the information,
upon written or electronic request and upon payment of a fee not
to exceed the actual cost of retrieving the information;
(6) pursuant to subpoena, including an administrative
subpoena, issued under authority of a law of this state or
another state or the United States; or
(7) pursuant to a warrant or court order.
Sec. 4. [325M.04] [WHEN DISCLOSURE OF PERSONAL INFORMATION
PERMITTED; AUTHORIZATION.]
Subdivision 1. [CONDITIONS OF DISCLOSURE.] An Internet
service provider may disclose personally identifiable
information concerning a consumer to:
(1) any person if the disclosure is incident to the
ordinary course of business of the Internet service provider;
(2) another Internet service provider for purposes of
reporting or preventing violations of the published acceptable
use policy or customer service agreement of the Internet service
provider; except that the recipient may further disclose the
personally identifiable information only as provided by this
chapter;
(3) any person with the authorization of the consumer; or
(4) as provided by section 626A.27.
Subd. 2. [AUTHORIZATION.] The Internet service provider
may obtain the consumer's authorization of the disclosure of
personally identifiable information in writing or by electronic
means. The request for authorization must reasonably describe
the types of persons to whom personally identifiable information
may be disclosed and the anticipated uses of the information.
In order for an authorization to be effective, a contract
between an Internet service provider and the consumer must state
either that the authorization will be obtained by an affirmative
act of the consumer or that failure of the consumer to object
after the request has been made constitutes authorization of
disclosure. The provision in the contract must be conspicuous.
Authorization may be obtained in a manner consistent with
self-regulating guidelines issued by representatives of the
Internet service provider or online industries, or in any other
manner reasonably designed to comply with this subdivision.
Sec. 5. [325M.05] [SECURITY OF INFORMATION.]
The Internet service provider shall take reasonable steps
to maintain the security and privacy of a consumer's personally
identifiable information. The Internet service provider is not
liable for actions that would constitute a violation of section
609.88, 609.89, or 609.891, if the Internet service provider
does not participate in, authorize, or approve the actions.
Sec. 6. [325M.06] [EXCLUSION FROM EVIDENCE.]
Except for purposes of establishing a violation of this
chapter, personally identifiable information obtained in any
manner other than as provided in this chapter may not be
received in evidence in a civil action.
Sec. 7. [325M.07] [ENFORCEMENT; CIVIL LIABILITY; DEFENSE.]
A consumer who prevails or substantially prevails in an
action brought under this chapter is entitled to the greater of
$500 or actual damages. Costs, disbursements, and reasonable
attorney fees may be awarded to a party awarded damages for a
violation of this section. No class action shall be brought
under this chapter.
In an action under this chapter, it is a defense that the
defendant has established and implemented reasonable practices
and procedures to prevent violations of this chapter.
Sec. 8. [325M.08] [OTHER LAW.]
This chapter does not limit any greater protection of the
privacy of information under other law, except that:
(1) nothing in this chapter limits the authority under
other state or federal law of law enforcement or prosecuting
authorities to obtain information; and
(2) if federal law is enacted that regulates the release of
personally identifiable information by Internet service
providers but does not preempt state law on the subject, the
federal law supersedes any conflicting provisions of this
chapter.
Sec. 9. [325M.09] [APPLICATION.]
This chapter applies to Internet service providers in the
provision of services to consumers in this state.
Sec. 10. Minnesota Statutes 2000, section 626A.28,
subdivision 3, is amended to read:
Subd. 3. [RECORDS CONCERNING ELECTRONIC COMMUNICATION
SERVICE OR REMOTE COMPUTING SERVICE.] (a)(1) Except as provided
in clause (2) or chapter 325M, a provider of electronic
communication service or remote computing service may disclose a
record or other information pertaining to a subscriber to or
customer of the service, not including the contents of
communications covered by subdivision 1 or 2, to any person
other than a governmental entity.
(2) A provider of electronic communication service or
remote computing service may disclose a record or other
information pertaining to a subscriber to or customer of the
service, not including the contents of communications covered by
subdivision 1 or 2, to a governmental entity only when the
governmental entity:
(i) uses an administrative subpoena authorized by statute,
or a grand jury subpoena;
(ii) obtains a warrant;
(iii) obtains a court order for such disclosure under
subdivision 4; or
(iv) has the consent of the subscriber or customer to the
disclosure.
(b) A governmental entity receiving records or information
under this subdivision is not required to provide notice to a
subscriber or customer.
Sec. 11. [EFFECTIVE DATE; EXPIRATION.]
Article 1 is effective March 1, 2003.
Article 1 expires on the effective date of federal
legislation that preempts state regulation of the release of
personally identifiable information by Internet service
providers.
ARTICLE 2
COMMERCIAL ELECTRONIC MAIL SOLICITATION
Section 1. [325F.694] [FALSE OR MISLEADING COMMERCIAL
ELECTRONIC MAIL MESSAGES.]
Subdivision 1. [DEFINITIONS.] (a) The terms used in this
section have the meanings given them in this subdivision.
(b) "Commercial electronic mail message" means an
electronic mail message sent through an Internet service
provider's facilities located in this state to a resident of
this state for promoting real property, goods, or services for
sale or lease.
(c) "Electronic mail address" means a destination, commonly
expressed as a string of characters, to which electronic mail
may be sent or delivered.
(d) "Electronic mail service provider" means a business,
nonprofit organization, educational institution, library, or
government entity that provides a set of users the ability to
send or receive electronic mail messages via the Internet.
(e) "Initiate the transmission" refers to the action by the
original sender of an electronic mail message, not to the action
by an intervening Internet service provider or electronic mail
service provider that may handle or retransmit the message.
(f) "Internet service provider" means a business or person
who provides users authenticated access to, or presence on, the
Internet by means of a switched or dedicated telecommunications
channel upon which the provider provides transit routing of
Internet Protocol (IP) packets for and on behalf of the user.
(g) "Internet domain name" refers to a globally unique,
hierarchical reference to an Internet host or service, assigned
through centralized Internet naming authorities, comprising a
series of character strings separated by periods, with the
rightmost string specifying the top of the hierarchy.
Subd. 2. [FALSE OR MISLEADING MESSAGES PROHIBITED.] No
person may initiate the transmission of a commercial electronic
mail message that:
(1) uses a third party's Internet domain name without
permission of the third party, or otherwise misrepresents any
information in identifying the point of origin or the
transmission path of a commercial electronic mail message; or
(2) contains false or misleading information in the subject
line.
Subd. 3. [SUBJECT DISCLOSURE.] The subject line of a
commercial electronic mail message must include "ADV" as the
first characters. If the message contains information that
consists of material of a sexual nature that may only be viewed
by an individual 18 years of age and older, the subject line of
the message must include "ADV-ADULT" as the first characters.
For purposes of this subdivision, "commercial electronic
mail message" does not include a message:
(1) if the recipient has consented to receive or has
solicited electronic mail messages from the initiator;
(2) from an organization using electronic mail to
communicate exclusively with its members;
(3) from an entity which uses electronic mail to
communicate exclusively with its employees or contractors; or
(4) if there is a business or personal relationship between
the initiator and the recipient.
For purposes of this subdivision, "business relationship"
means a prior or existing relationship formed between the
initiator and the recipient, with or without an exchange of
consideration, on the basis of an inquiry, application,
purchase, or use by the recipient of or regarding products,
information, or services offered by the initiator or an
affiliate or agent of the initiator. For purposes of this
paragraph, "affiliate" means a person that directly or
indirectly controls, is controlled by, or is under common
control with a specified person.
Subd. 4. [TOLL-FREE NUMBER.] (a) A sender initiating the
transmission of a commercial electronic mail message must
establish a toll-free telephone number, a valid sender-operated
return electronic mail address, or another easy-to-use
electronic method that the recipient of the commercial
electronic mail message may call or access by electronic mail or
other electronic means to notify the sender not to transmit by
electronic mail any further unsolicited commercial electronic
mail messages. The notification process may include the ability
for the commercial electronic mail messages recipient to direct
the initiator to transmit or not transmit particular commercial
electronic mail messages based upon products, services,
divisions, organizations, companies, or other selections of the
recipient's choice.
(b) A commercial electronic mail message must include a
statement informing the recipient of a toll-free telephone
number that the recipient may call, or a valid return address to
which the recipient may write or access by electronic mail or
another electronic method established by the initiator,
notifying the sender not to transmit to the recipient any
further unsolicited commercial electronic mail messages to the
electronic mail address, or addresses, specified by the
recipient, and explaining the manner in which the recipient may
specify what commercial electronic mail messages the recipient
does and does not wish to receive.
Subd. 5. [BLOCKING RECEIPT OR TRANSMISSION.] No electronic
mail service provider may be held liable in an action by a
recipient for any act voluntarily taken in good faith to block
the receipt or transmission through its service of any
commercial electronic mail message that the electronic mail
service provider reasonably believes is, or will be, sent in
violation of this section.
Subd. 6. [DEFENSES.] (a) A person is not liable for a
commercial electronic mail message sent in violation of this
section if the person can show by a preponderance of the
evidence that the commercial electronic mail message was not
initiated by the person or was initiated in a manner and form
not subject to the control of the person.
(b) In an action under this section it is a defense that
the defendant has established and implemented reasonable
practices and procedures to prevent violations of this section.
Subd. 7. [DAMAGES.] (a) A person injured by a violation of
this section may recover damages caused by the violation as
specified in this subdivision.
(b) An injured person, other than an electronic mail
service provider, may recover:
(1) the lesser of $25 for each commercial electronic mail
message received that violates subdivision 2, or $35,000 per
day; or
(2) the lesser of $10 for each commercial electronic mail
message received that violates subdivision 3, or $25,000 per day.
(c) An injured electronic mail service provider may recover
actual damages or elect, in lieu of actual damages, to recover:
(1) the lesser of $25 for each commercial electronic mail
message received that violates subdivision 2, or $35,000 per
day; or
(2) the lesser of $10 for each commercial electronic mail
message received that violates subdivision 3, or $25,000 per day.
(d) At the request of any party to an action brought under
this section, the court may, at its discretion, conduct all
legal proceedings in such a way as to protect the secrecy and
security of the computer, computer network, computer data,
computer program, and computer software involved in order to
prevent possible recurrence of the same or a similar act by
another person and to protect any trade secrets of any party.
(e) Costs, disbursements, and reasonable attorney fees may
be awarded to a party awarded damages for a violation of this
section. No class action shall be brought under this section.
(f) Except as otherwise provided in this subdivision, the
remedies in this subdivision are in addition to remedies
available under section 8.31, 325F.70, or other law.
Subd. 8. [RELATIONSHIP TO FEDERAL LAW.] If federal law is
enacted that regulates false, misleading, or unsolicited
commercial electronic mail messages but does not preempt state
law on the subject, the federal law supersedes any conflicting
provisions of this section.
Sec. 2. [EFFECTIVE DATE; EXPIRATION.]
Article 2 is effective March 1, 2003.
Article 2 expires on the effective date of federal
legislation that preempts state regulation of false, misleading,
or unsolicited commercial electronic mail messages.
Presented to the governor May 20, 2002
Signed by the governor May 22, 2002, 1:29 p.m.
Official Publication of the State of Minnesota
Revisor of Statutes