2007 Minnesota Statutes

CHAPTER 325M. INTERNET PRIVACY

325M.01 DEFINITIONS.
    Subdivision 1. Scope. The terms used in this chapter have the meanings given them in
this section.
    Subd. 2. Consumer. "Consumer" means a person who agrees to pay a fee to an Internet
service provider for access to the Internet for personal, family, or household purposes, and who
does not resell access.
    Subd. 3. Internet service provider. "Internet service provider" means a business or person
who provides consumers authenticated access to, or presence on, the Internet by means of a
switched or dedicated telecommunications channel upon which the provider provides transit
routing of Internet Protocol (IP) packets for and on behalf of the consumer. Internet service
provider does not include the offering, on a common carrier basis, of telecommunications
facilities or of telecommunications by means of these facilities.
    Subd. 4. Ordinary course of business. "Ordinary course of business" means debt-collection
activities, order fulfillment, request processing, or the transfer of ownership.
    Subd. 5. Personally identifiable information. "Personally identifiable information" means
information that identifies:
(1) a consumer by physical or electronic address or telephone number;
(2) a consumer as having requested or obtained specific materials or services from an
Internet service provider;
(3) Internet or online sites visited by a consumer; or
(4) any of the contents of a consumer's data-storage devices.
History: 2002 c 395 art 1 s 1

NOTE: This section, as added by Laws 2002, chapter 395, article 1, section 1, is effective
March 1, 2003, and expires on the effective date of federal legislation that preempts state
regulation of the release of personally identifiable information by Internet service providers.
Laws 2002, chapter 395, article 1, section 11.

325M.02 WHEN DISCLOSURE OF PERSONAL INFORMATION PROHIBITED.
Except as provided in sections 325M.03 and 325M.04, an Internet service provider may not
knowingly disclose personally identifiable information concerning a consumer of the Internet
service provider.
History: 2002 c 395 art 1 s 2

NOTE: This section, as added by Laws 2002, chapter 395, article 1, section 2, is effective
March 1, 2003, and expires on the effective date of federal legislation that preempts state
regulation of the release of personally identifiable information by Internet service providers.
Laws 2002, chapter 395, article 1, section 11.

325M.03 WHEN DISCLOSURE OF PERSONAL INFORMATION REQUIRED.
An Internet service provider shall disclose personally identifiable information concerning a
consumer:
(1) pursuant to a grand jury subpoena;
(2) to an investigative or law enforcement officer as defined in section 626A.01, subdivision
7 , while acting as authorized by law;
(3) pursuant to a court order in a civil proceeding upon a showing of compelling need for
the information that cannot be accommodated by other means;
(4) to a court in a civil action for conversion commenced by the Internet service provider
or in a civil action to enforce collection of unpaid subscription fees or purchase amounts, and
then only to the extent necessary to establish the fact of the subscription delinquency or purchase
agreement, and with appropriate safeguards against unauthorized disclosure;
(5) to the consumer who is the subject of the information, upon written or electronic request
and upon payment of a fee not to exceed the actual cost of retrieving the information;
(6) pursuant to subpoena, including an administrative subpoena, issued under authority of a
law of this state or another state or the United States; or
(7) pursuant to a warrant or court order.
History: 2002 c 395 art 1 s 3

NOTE: This section, as added by Laws 2002, chapter 395, article 1, section 3, is effective
March 1, 2003, and expires on the effective date of federal legislation that preempts state
regulation of the release of personally identifiable information by Internet service providers.
Laws 2002, chapter 395, article 1, section 11.

325M.04 WHEN DISCLOSURE OF PERSONAL INFORMATION PERMITTED;
AUTHORIZATION.
    Subdivision 1. Conditions of disclosure. An Internet service provider may disclose
personally identifiable information concerning a consumer to:
(1) any person if the disclosure is incident to the ordinary course of business of the Internet
service provider;
(2) another Internet service provider for purposes of reporting or preventing violations of the
published acceptable use policy or customer service agreement of the Internet service provider;
except that the recipient may further disclose the personally identifiable information only as
provided by this chapter;
(3) any person with the authorization of the consumer; or
(4) as provided by section 626A.27.
    Subd. 2. Authorization. The Internet service provider may obtain the consumer's
authorization of the disclosure of personally identifiable information in writing or by electronic
means. The request for authorization must reasonably describe the types of persons to whom
personally identifiable information may be disclosed and the anticipated uses of the information.
In order for an authorization to be effective, a contract between an Internet service provider and
the consumer must state either that the authorization will be obtained by an affirmative act of the
consumer or that failure of the consumer to object after the request has been made constitutes
authorization of disclosure. The provision in the contract must be conspicuous. Authorization
may be obtained in a manner consistent with self-regulating guidelines issued by representatives
of the Internet service provider or online industries, or in any other manner reasonably designed
to comply with this subdivision.
History: 2002 c 395 art 1 s 4

NOTE: This section, as added by Laws 2002, chapter 395, article 1, section 4, is effective
March 1, 2003, and expires on the effective date of federal legislation that preempts state
regulation of the release of personally identifiable information by Internet service providers.
Laws 2002, chapter 395, article 1, section 11.

325M.05 SECURITY OF INFORMATION.
The Internet service provider shall take reasonable steps to maintain the security and privacy
of a consumer's personally identifiable information. The Internet service provider is not liable
for actions that would constitute a violation of section 609.88, 609.89, or 609.891, if the Internet
service provider does not participate in, authorize, or approve the actions.
History: 2002 c 395 art 1 s 5

NOTE: This section, as added by Laws 2002, chapter 395, article 1, section 5, is effective
March 1, 2003, and expires on the effective date of federal legislation that preempts state
regulation of the release of personally identifiable information by Internet service providers.
Laws 2002, chapter 395, article 1, section 11.

325M.06 EXCLUSION FROM EVIDENCE.
Except for purposes of establishing a violation of this chapter, personally identifiable
information obtained in any manner other than as provided in this chapter may not be received in
evidence in a civil action.
History: 2002 c 395 art 1 s 6

NOTE: This section, as added by Laws 2002, chapter 395, article 1, section 6, is effective
March 1, 2003, and expires on the effective date of federal legislation that preempts state
regulation of the release of personally identifiable information by Internet service providers.
Laws 2002, chapter 395, article 1, section 11.

325M.07 ENFORCEMENT; CIVIL LIABILITY; DEFENSE.
A consumer who prevails or substantially prevails in an action brought under this chapter is
entitled to the greater of $500 or actual damages. Costs, disbursements, and reasonable attorney
fees may be awarded to a party awarded damages for a violation of this section. No class action
shall be brought under this chapter.
In an action under this chapter, it is a defense that the defendant has established and
implemented reasonable practices and procedures to prevent violations of this chapter.
History: 2002 c 395 art 1 s 7

NOTE: This section, as added by Laws 2002, chapter 395, article 1, section 7, is effective
March 1, 2003, and expires on the effective date of federal legislation that preempts state
regulation of the release of personally identifiable information by Internet service providers.
Laws 2002, chapter 395, article 1, section 11.

325M.08 OTHER LAW.
This chapter does not limit any greater protection of the privacy of information under other
law, except that:
(1) nothing in this chapter limits the authority under other state or federal law of law
enforcement or prosecuting authorities to obtain information; and
(2) if federal law is enacted that regulates the release of personally identifiable information
by Internet service providers but does not preempt state law on the subject, the federal law
supersedes any conflicting provisions of this chapter.
History: 2002 c 395 art 1 s 8

NOTE: This section, as added by Laws 2002, chapter 395, article 1, section 8, is effective
March 1, 2003, and expires on the effective date of federal legislation that preempts state
regulation of the release of personally identifiable information by Internet service providers.
Laws 2002, chapter 395, article 1, section 11.

325M.09 APPLICATION.
This chapter applies to Internet service providers in the provision of services to consumers in
this state.
History: 2002 c 395 art 1 s 9

NOTE: This section, as added by Laws 2002, chapter 395, article 1, section 9, is effective
March 1, 2003, and expires on the effective date of federal legislation that preempts state
regulation of the release of personally identifiable information by Internet service providers.
Laws 2002, chapter 395, article 1, section 11.