1.1 	A bill for an act
1.2 	relating to consumer protection; creating standards for disposal of personal 
1.3 	information to limit the potential for identity theft;proposing coding for new law 
1.4 	in Minnesota Statutes, chapter 325E.
1.5 	BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF MINNESOTA:

1.6 	Section 1. [325E.62] PERSONAL RECORDS DESTRUCTION.
1.7 		Subdivision 1.Definitions. (a) For the purposes of this section, the terms in 
1.8 	paragraphs (b) to (f) have the meanings given them.
1.9 	(b) "Firm" means sole proprietorship, partnership, corporation, association, or other 
1.10 	group however organized and whether or not organized to operate at a profit.
1.11 	(c) "Destruction" includes:
1.12 	(1) the discarding or abandonment of records containing personal information; and
1.13 	(2) the sale, donation, discarding, or transfer of any medium, including computer 
1.14 	equipment or computer media, containing records of personal information, or other 
1.15 	nonpaper media upon which records of personal information is stored, or other equipment 
1.16 	for nonpaper storage of information.
1.17 	(d) "Personal information" means any information that identifies, relates to, 
1.18 	describes, or is capable of being associated with a particular individual, including, but 
1.19 	not limited to, a name, signature, Social Security number, fingerprint and other biometric 
1.20 	information, photograph or computerized image, physical characteristic or description, 
1.21 	address, telephone number, passport number, driver's license or state identification card 
1.22 	number, date of birth, medical information, bank account number, credit card number, 
1.23 	debit card number, or any other financial information.
2.1 	(e) "Records" means any material on which written, drawn, spoken, visual, or 
2.2 	electromagnetic information is recorded or preserved, regardless of physical form or 
2.3 	characteristics. "Records" does not include publicly available directories containing 
2.4 	information an individual has voluntarily consented to have publicly disseminated or 
2.5 	listed, such as name, address, or telephone number.
2.6 	(f) "Record destruction firm" means a business whose primary purpose is disposal or 
2.7 	destruction of records with personal information.
2.8 		Subd. 2.Disposal of records containing personal information. Any firm 
2.9 	that conducts business in this state and maintains or otherwise possesses personal 
2.10 	information of residents of Minnesota shall take all reasonable measures to protect against 
2.11 	unauthorized access to or use of the information in connection with or after its destruction. 
2.12 	Reasonable measures include, but are not limited to:
2.13 	(1) implementing and monitoring compliance with policies and procedures that 
2.14 	require burning, pulverizing, or shredding of papers containing personal information so 
2.15 	that the information cannot be read or reconstructed;
2.16 	(2) implementing and monitoring compliance with policies and procedures that 
2.17 	require the destruction or erasure of electronic media and other nonpaper media containing 
2.18 	personal information so that the information cannot be read or reconstructed; and
2.19 	(3) after due diligence, entering into and monitoring compliance with a contract with 
2.20 	a record destruction firm to destroy personal information in a manner consistent with this 
2.21 	section, including protection against unauthorized access to or use of personal information 
2.22 	during or after the collection, transportation, and destruction of the information.
2.23 	For purposes of this clause, "due diligence" means taking appropriate measures to 
2.24 	determine the competency and integrity of the record destruction firm, including at least 
2.25 	one of the following:
2.26 	(i) reviewing an independent audit of the operations of the record destruction firm 
2.27 	and/or its compliance with this section;
2.28 	(ii) obtaining information about the record destruction firm from several references 
2.29 	or other reliable sources and requiring that the record destruction firm be certified by a 
2.30 	recognized trade association or similar third party with a reputation for high standards of 
2.31 	quality review; or
2.32 	(iii) reviewing and evaluating the information security policies or procedures of the 
2.33 	record destruction firm.
2.34 		Subd. 3.Record destruction policy. The record destruction firm shall adopt as 
2.35 	official policy, and provide to new employees, a comprehensive description of procedures 
2.36 	relating to the adequate destruction or proper disposal of personal records.
3.1 		Subd. 4.Penalties and remedies. A person violating this section is subject to 
3.2 	the penalties and remedies in section 8.31.