325E.61 Data warehouses; notice required for certain 
  disclosures. 

    Subdivision 1.    Disclosure of personal information; 
 notice required.  (a) Any person or business that conducts 
 business in this state, and that owns or licenses data that 
 includes personal information, shall disclose any breach of the 
 security of the system following discovery or notification of 
 the breach in the security of the data to any resident of this 
 state whose unencrypted personal information was, or is 
 reasonably believed to have been, acquired by an unauthorized 
 person.  The disclosure must be made in the most expedient time 
 possible and without unreasonable delay, consistent with the 
 legitimate needs of law enforcement, as provided in paragraph 
 (c), or with any measures necessary to determine the scope of 
 the breach, identify the individuals affected, and restore the 
 reasonable integrity of the data system. 

    (b) Any person or business that maintains data that 
 includes personal information that the person or business does 
 not own shall notify the owner or licensee of the information of 
 any breach of the security of the data immediately following 
 discovery, if the personal information was, or is reasonably 
 believed to have been, acquired by an unauthorized person. 

    (c) The notification required by this section may be 
 delayed to a date certain if a law enforcement agency 
 affirmatively determines that the notification will impede a 
 criminal investigation. 

    (d) For purposes of this section, "breach of the security 
 of the system" means unauthorized acquisition of computerized 
 data that compromises the security, confidentiality, or 
 integrity of personal information maintained by the person or 
 business.  Good faith acquisition of personal information by an 
 employee or agent of the person or business for the purposes of 
 the person or business is not a breach of the security system, 
 provided that the personal information is not used or subject to 
 further unauthorized disclosure. 

    (e) For purposes of this section, "personal information" 
 means an individual's first name or first initial and last name 
 in combination with any one or more of the following data 
 elements, when either the name or the data elements is not 
 encrypted: 

    (1) Social Security number; 

    (2) driver's license number or Minnesota identification 
 card number; or 

    (3) account number or credit or debit card number, in 
 combination with any required security code, access code, or 
 password that would permit access to an individual's financial 
 account. 

    (f) For purposes of this section, "personal information" 
 does not include publicly available information that is lawfully 
 made available to the general public from federal, state, or 
 local government records. 

    (g) For purposes of this section, "notice" may be provided 
 by one of the following methods: 

    (1) written notice to the most recent available address the 
 person or business has in its records; 

    (2) electronic notice, if the notice provided is consistent 
 with the provisions regarding electronic records and signatures 
 in United States Code, title 15, section 7001; or 

    (3) substitute notice, if the person or business 
 demonstrates that the cost of providing notice would exceed 
 $250,000, or that the affected class of subject persons to be 
 notified exceeds 500,000, or the person or business does not 
 have sufficient contact information.  Substitute notice must 
 consist of all of the following: 

    (i) e-mail notice when the person or business has an e-mail 
 address for the subject persons; 

    (ii) conspicuous posting of the notice on the Web site page 
 of the person or business, if the person or business maintains 
 one; and 

    (iii) notification to major statewide media. 

    (h) Notwithstanding paragraph (g), a person or business 
 that maintains its own notification procedures as part of an 
 information security policy for the treatment of personal 
 information and is otherwise consistent with the timing 
 requirements of this section, shall be deemed to be in 
 compliance with the notification requirements of this section if 
 the person or business notifies subject persons in accordance 
 with its policies in the event of a breach of security of the 
 system. 

    Subd. 2.    Coordination with consumer reporting agencies. 
  If a person discovers circumstances requiring notification 
 under this section of more than 500 persons at one time, the 
 person shall also notify, within 48 hours, all consumer 
 reporting agencies that compile and maintain files on consumers 
 on a nationwide basis, as defined by United States Code, title 
 15, section 1681a, of the timing, distribution, and content of 
 the notices. 

    Subd. 3.    Waiver prohibited.  Any waiver of the 
 provisions of this section is contrary to public policy and is 
 void and unenforceable. 

    Subd. 4.    Exemption.  This section does not apply to 
 any "financial institution" as defined by United States Code, 
 title 15, section 6809(3), and to entities subject to the 
 federal privacy and security regulations adopted under the 
 federal Health Insurance Portability and Accountability Act of 
 1996, Public Law 104-191. 

    Subd. 5.    Security assessments.  Each government 
 entity shall conduct a comprehensive security assessment of any 
 personal information maintained by the government entity. 

    Subd. 6.    Remedies and enforcement.  The attorney 
 general shall enforce this section under section 8.31. 

    HIST: 2005 c 167 s 1