1.1 	A bill for an act
1.2 	relating to data practices; classifying data; regulating data use; requiring a 
1.3 	report to the legislature; providing civil remedies; providing criminal penalties;
1.4 	amending Minnesota Statutes 2005 Supplement, sections 168.346, subdivision 
1.5 	1; 171.12, subdivision 7; 325E.59, subdivisions 1, 3, by adding a subdivision; 
1.6 	proposing coding for new law in Minnesota Statutes, chapters 168; 171; 325F; 
1.7 	repealing Minnesota Statutes 2005 Supplement, section 325E.59, subdivision 2.
1.8 	BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF MINNESOTA:

1.9 	Section 1. Minnesota Statutes 2005 Supplement, section 168.346, subdivision 1, 
1.10 	is amended to read:
1.11 		Subdivision 1.Vehicle registration data; federal compliance. (a) Data on an 
1.12 	individual Personal information and highly restrictive personal information, as defined 
1.13 	in United States Code, title 18, section 2725, clauses (3) and (4),  provided to register a 
1.14 	vehicle is private data on individuals and shall be treated as provided by United States 
1.15 	Code, title 18, section 2721, as in effect on May 23, 2005 March 9, 2006, and shall be 
1.16 	disclosed as required by paragraph (b) of United States Code, title 18, section 2721 or as 
1.17 	permitted by paragraph (b), clauses (1), (2) to (7), (9), and (14) of that section.
1.18 	(b) The registered owner of a vehicle who is an individual may consent in writing to 
1.19 	the commissioner to disclose the individual's personal information exempted by United 
1.20 	States Code, title 18, section 2721, to any person who makes a written request for the 
1.21 	personal information. If the registered owner is an individual and so authorizes disclosure, 
1.22 	the commissioner shall implement the request.
1.23 	(c) If authorized by the registered owner as indicated in paragraph (b), the registered 
1.24 	owner's personal information may be used, rented, or sold solely for bulk distribution 
1.25 	by organizations for business purposes including surveys, marketing, or solicitation. A 
2.1 	recipient of data from the commissioner under this subdivision may use the data only for 
2.2 	the purpose for which it was obtained and the recipient must not resell or redisclose the 
2.3 	data. Resale or redisclosure of data pursuant to a contract that was the purpose of a request 
2.4 	for data under this subdivision is not prohibited by this paragraph. 
2.5 	(d) A person who requests disclosure of data under paragraph (a) must identify the 
2.6 	data elements requested and the reason each element is needed and may receive only those 
2.7 	data elements needed to accomplish the purpose of the request. A person requesting data 
2.8 	on 500 or more individuals must document compliance with data security measures as 
2.9 	required by the commissioner. The commissioner shall implement a system for tracking 
2.10 	the sale or disclosure of personal information described in paragraph (a) by those who 
2.11 	receive personal information from the commissioner. The commissioner shall audit 
2.12 	activities of recipients of personal information under paragraph (a) with regard to that 
2.13 	information. Persons who receive personal information from the commissioner must 
2.14 	cooperate with all compliance activities. 
2.15 	(e) An individual who registers a vehicle may request that the individual's residence 
2.16 	address not appear on the registration and that a substitute address be used. The 
2.17 	commissioner shall grant the substitution on receipt of a signed statement by the individual 
2.18 	that the substitute address is required for the safety of the individual or the individual's 
2.19 	family, if the statement also provides a valid, existing, substitute address where the 
2.20 	individual consents to receive service of process. The commissioner shall use the 
2.21 	substitute address in place of the residence address in all documents and notices pertaining 
2.22 	to the registration. Any information provided in the substitution request are private data 
2.23 	on individuals and may be provided to requesting law enforcement agencies, probation 
2.24 	and parole agencies, and public authorities, as defined in section 518.54, subdivision 9. 

2.25 	Sec. 2. [168.348] PENALTIES.
2.26 		Subdivision 1.Receipt. A person who knowingly receives personal information in 
2.27 	violation of section 168.346, subdivision 1, is guilty of a misdemeanor.
2.28 		Subd. 2. Resale or redisclosure. A person who knowingly resells or rediscloses 
2.29 	personal information in violation of section 168.346, subdivision 1, is guilty of a 
2.30 	misdemeanor. 
2.31 		Subd. 3. Multiple violations.  A person who knowingly violates the provisions of 
2.32 	section 168.346, subdivision 1, two or more times is guilty of a gross misdemeanor.
2.33 		Subd. 4. Civil penalty.  A person who knowingly violates the provisions of section 
2.34 	168.346, subdivision 1, is subject to a civil penalty of $5,000 per violation. 

3.1 	Sec. 3. Minnesota Statutes 2005 Supplement, section 171.12, subdivision 7, is 
3.2 	amended to read:
3.3 		Subd. 7.Privacy of data. (a) Data on individuals  Personal information and highly 
3.4 	restrictive personal information, as defined in United States Code, title 18, section 2725, 
3.5 	clauses (3) and (4), provided to obtain a driver's license, instruction permit,  or Minnesota 
3.6 	identification card is private data on individuals and shall be treated as provided by United 
3.7 	States Code, title 18, section 2721, as in effect on May 23, 2005 March 9, 2006, and shall 
3.8 	be disclosed as required by paragraph (b) of United States code, title 18, section 2721 or 
3.9 	as permitted by paragraph (b), clauses (1), (2) to (7), (9), and (14) of that section.
3.10 	(b) The commissioner may disclose an applicant's personal information to a 
3.11 	federally certified or designated nonprofit organ procurement organization for use in 
3.12 	connection with the organization's authorized activities.
3.13 	(c) An applicant for a driver's license or a Minnesota identification card may 
3.14 	consent, in writing, to the commissioner to disclose the applicant's personal information 
3.15 	exempted by United States Code, title 18, section 2721, to any person who makes a request 
3.16 	for the personal information. If the applicant so authorizes disclosures, the commissioner 
3.17 	shall implement the request and the information may be used.
3.18 	(c) If authorized by an applicant for a driver's license or a Minnesota identification 
3.19 	card, as indicated in paragraph (b), the applicant's personal information may be used, 
3.20 	rented, or sold solely for bulk distribution by organizations for business purposes, 
3.21 	including surveys, marketing, or solicitation.
3.22 	(d) An applicant for a driver's license, instruction permit, or Minnesota identification 
3.23 	card may request that the applicant's residence address be classified as "private data on 
3.24 	individuals," as defined in section 13.02, subdivision 12 not appear in the driver's license, 
3.25 	instruction permit, or Minnesota identification card and that a substitute address be used. 
3.26 	The commissioner shall grant the classification request for a substitute address  on receipt 
3.27 	of a signed statement by the individual applicant  that the classification substitute address 
3.28 	 is required for the safety of the applicant or the applicant's family, if the statement also 
3.29 	provides a valid, existing substitute address where the applicant consents to receive service 
3.30 	of process. The commissioner shall use the service for process mailing  substitute address 
3.31 	in place of the residence address in all documents and notices pertaining to the driver's 
3.32 	license, instruction permit, or Minnesota identification card. The residence address and 
3.33 	any information provided in the classification substitute address  request, other than the 
3.34 	mailing address, are private data on individuals and may be provided to requesting law 
3.35 	enforcement agencies, probation and parole agencies, and public authorities, as defined 
3.36 	in section 518.54, subdivision 9.
4.1 	(e) A recipient of data from the commissioner under this subdivision may use the 
4.2 	data only for the purpose for which it was obtained and the recipient must not resell or 
4.3 	redisclose the data. Resale or redisclosure of data pursuant to a contract that was the 
4.4 	purpose of a request for data under this subdivision is not prohibited by this paragraph. 
4.5 	(f) A person who requests disclosure of data under paragraph (a) must identify the 
4.6 	data elements requested and the reason each element is needed and may receive only those 
4.7 	data elements needed to accomplish the purpose of the request. A person requesting data 
4.8 	on 500 or more individuals must document compliance with data security measures as 
4.9 	required by the commissioner. The commissioner may implement a system for tracking 
4.10 	the sale or disclosure of personal information described in paragraph (a) both from the 
4.11 	commissioner and by those who receive personal information from the commissioner. The 
4.12 	commissioner may audit activities of recipients of personal information under paragraph 
4.13 	(a) with regard to that information. Persons who receive personal information from the 
4.14 	commissioner must cooperate with all compliance activities. 

4.15 	Sec. 4. [171.125] PENALTIES.
4.16 		Subdivision 1.Receipt.  A person who receives personal information in violation of 
4.17 	section 171.12, subdivision 7, is guilty of a misdemeanor. 
4.18 		Subd. 2. Resale or redisclosure.  A person who knowingly resells or rediscloses 
4.19 	personal information in violation of section 171.12, subdivision 7, is guilty of a 
4.20 	misdemeanor. 
4.21 		Subd. 3. Multiple violations.   A person who knowingly violates the provisions of 
4.22 	section 171.12, subdivision 7, two or more times is guilty of a gross misdemeanor. 
4.23 		Subd. 4. Additional penalty.  A person who knowingly violates the provisions of 
4.24 	section 171.12, subdivision 7, is subject to a civil penalty of $5,000 per violation.

4.25 	Sec. 5. Minnesota Statutes 2005 Supplement, section 325E.59, subdivision 1, is 
4.26 	amended to read:
4.27 		Subdivision 1.Generally. (a) A person or entity, not including a government entity, 
4.28 	may not do any of the following:
4.29 	(1) publicly post or publicly display in any manner an individual's Social Security 
4.30 	number. "Publicly post" or "publicly display" means to intentionally communicate or 
4.31 	otherwise make available to the general public;
4.32 	(2) print an individual's Social Security number on any card required for the 
4.33 	individual to access products or services provided by the person or entity;
5.1 	(3) require an individual to transmit the individual's Social Security number over the 
5.2 	Internet, unless the connection is secure or the Social Security number is encrypted;
5.3 	(4) require an individual to use the individual's Social Security number to access an 
5.4 	Internet Web site, unless a password or unique personal identification number or other 
5.5 	authentication device is also required to access the Internet Web site; or
5.6 	(5) print a number that the person or entity knows to be an individual's Social 
5.7 	Security number on any materials that are mailed to the individual, unless state or federal 
5.8 	law requires the Social Security number to be on the document to be mailed. If, in 
5.9 	connection with a transaction involving or otherwise relating to an individual, a person 
5.10 	or entity receives a number from a third party, that person or entity is under no duty to 
5.11 	inquire or otherwise determine whether the number is or includes that individual's Social 
5.12 	Security number and may print that number on materials mailed to the individual, unless 
5.13 	the person or entity receiving the number has actual knowledge that the number is or 
5.14 	includes the individual's Social Security number.; 
5.15 	(6) assign or use a number as an account identifier that is identical to or incorporates 
5.16 	an individual's complete Social Security number; or 
5.17 	(7) sell Social Security numbers obtained from individuals in the course of business.
5.18 	Notwithstanding clauses (1) to (5), Social Security numbers may be included in 
5.19 	applications and forms sent by mail, including documents sent as part of an application or 
5.20 	enrollment process, or to establish, amend, or terminate an account, contract, or policy, 
5.21 	or to confirm the accuracy of the Social Security number. Nothing in this paragraph 
5.22 	authorizes inclusion of a Social Security number on the outside of a mailing.
5.23 	(b) A person or entity, not including a government entity, must restrict access to 
5.24 	individual Social Security numbers it holds so that only employees who require the 
5.25 	numbers in order to perform their job duties have access to the numbers. 
5.26 	Except as provided in subdivision 2,(c) This section applies only to the use of Social 
5.27 	Security numbers on or after July 1, 2007.

5.28 	Sec. 6. Minnesota Statutes 2005 Supplement, section 325E.59, subdivision 3, is 
5.29 	amended to read:
5.30 		Subd. 3.Coordination with other law. This section does not prevent: 
5.31 	(1) the collection, use, or release of a Social Security number as required by state or 
5.32 	federal law or; 
5.33 	(2)  the use of a Social Security number for internal verification or administrative 
5.34 	purposes.; 
6.1 	(3) the use of a Social Security number to access a credit report for purposes allowed 
6.2 	by the federal Fair Credit Reporting Act, United States Code, title 15, section 1681a, if a 
6.3 	Social Security number is required in order to access the credit report; or 
6.4 	(4) the use of a Social Security number to access or report information to a person 
6.5 	who maintains a database of information used in connection with the prevention or 
6.6 	detection of fraud. 

6.7 	Sec. 7. Minnesota Statutes 2005 Supplement, section 325E.59, is amended by adding a 
6.8 	subdivision to read:
6.9 		Subd. 6. Penalties.  (a) A violation of this section is a gross misdemeanor punishable 
6.10 	by a sentence of up to one year, a fine of $3,000, or both. 
6.11 	(b) Each subsequent violation is a felony punishable by a sentence of up to five 
6.12 	years, a fine of $5,000, or both. 
6.13 	(c) A violation of this section is subject to a $5,000 civil penalty. 
6.14 	(d) A violation of this section is a deceptive trade practice under section 325D.44. 
6.15 	(e) An individual aggrieved by a violation of this section may bring a civil action 
6.16 	to recover damages, costs, and reasonable attorney fees. 

6.17 	Sec. 8. [325F.696] CUSTOMER SALES OR SERVICE CALL CENTER 
6.18 	REQUIREMENTS.
6.19 		Subdivision 1.Definitions. For purposes of this section, the following terms have 
6.20 	the meanings given them:
6.21 	(1) "customer sales and service call center" means an entity whose primary purpose 
6.22 	includes the initiating or receiving of telephonic communications on behalf of any person 
6.23 	for the purpose of initiating telephone solicitations as defined in section 325E.311, 
6.24 	subdivision 6; 
6.25 	(2) "customer service call center" means an entity whose primary purpose includes 
6.26 	the initiating or receiving of telephonic communications on behalf of any person for the 
6.27 	purposes of providing or receiving services or information necessary in connection with 
6.28 	the providing of services or other benefits; and 
6.29 	(3) "customer service employee" means a person employed by or working on behalf 
6.30 	of a customer sales call center or a customer service call center. 
6.31 		Subd. 2.Customer's right to customer sales or customer service call center 
6.32 	information. (a) Any person who receives a telephone call from, or places a telephone 
6.33 	call to, a customer sales call center or a customer service call center, upon request, has 
7.1 	the right to know the identification of the state or country where the customer service 
7.2 	employee is located.
7.3 	(b) A person who receives a telephone solicitation from, or places a telephone call to, 
7.4 	a customer sales call center or a customer service call center located in a foreign country, 
7.5 	which requests the person's financial, credit, or identifying information, shall have the 
7.6 	right to request an alternative option to contact a customer sales and service center located 
7.7 	in the United States before the information is given if the alternative option is available. 
7.8 		Subd. 3.Violation. It is fraud under section 325F.69 for a person to willfully 
7.9 	violate this section.
7.10 		Subd. 4.Application to other remedies. Nothing in this section changes the 
7.11 	remedies currently available under state or federal law or creates additional or new 
7.12 	remedies.

7.13 	EFFECTIVE DATE. This section is effective August 1, 2006.

7.14 	Sec. 9. REPORT TO LEGISLATURE.
 7.15 	The commissioner of administration must conduct a comprehensive review of 
7.16 	chapter 13.  The commissioner must evaluate the current law in terms of its three competing 
7.17 	purposes:  (a) to protect the privacy of individuals; (b) permit government to function; 
7.18 	and (c) promote transparency in government; and make recommendations whether the 
7.19 	current balance in these purposes should be changed.  In addition, the report must identify 
7.20 	any changes to chapter 13 that are needed to respond to emerging technologies, including 
7.21 	new methodologies for data storage, retention, and dissemination and whether any of the 
7.22 	recommendations in the 1999 report of the Information Policy Task Force that have not 
7.23 	been adopted should be considered.  The report must be submitted to the chair of the House 
7.24 	Civil Law and Elections Committee and the chair of the Senate Judiciary Committee and 
7.25 	the ranking minority members of those committees.  The report is due by January 15, 2007.

7.26 	Sec. 10.  REPEALER.
 7.27 	Minnesota Statutes 2005 Supplement, section 325E.59, subdivision 2, is repealed.