1.1 	A bill for an act
1.2 	relating to consumer protection; regulating security freezes on consumer reports; 
1.3 	providing for payment of fees;amending Minnesota Statutes 2016, section 13C.016, 
1.4 	subdivisions 1, 8; proposing coding for new law in Minnesota Statutes, chapter 
1.5 	13C.
1.6 	BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF MINNESOTA:

1.7 	Section 1. Minnesota Statutes 2016, section 13C.016, subdivision 1, is amended to read:
1.8 		Subdivision 1.Definitions. (a) For purposes of this section and sections 13C.017 to 
1.9 	13C.019, the terms defined in this section have the meanings given.
1.10 	(b) "Security freeze" means a notice placed in a consumer's consumer report, at the 
1.11 	request of the consumer and subject to certain exceptions, that prohibits the consumer 
1.12 	reporting agency from releasing the consumer report or any information from it, in connection 
1.13 	with the extension of credit or the opening of a new account, without the express authorization 
1.14 	of the consumer. If a security freeze is in place, information from a consumer's consumer 
1.15 	report may not be released to a third party, in connection with the extension of credit or the 
1.16 	opening of an account, without prior express authorization from the consumer. This paragraph 
1.17 	does not prevent a consumer reporting agency from advising a third party that a security 
1.18 	freeze is in effect with respect to the consumer report.
1.19 	(c) "Victim of a data breach" means a consumer who has a notice that there has been a 
1.20 	breach of the security system involving the consumer's personal information, as provided 
1.21 	in section 325E.61.
2.1 	(c)(d) "Victim of identity theft" means a consumer who has a copy of a valid police 
2.2 	report evidencing that the consumer has alleged to be a victim of identity theft as defined 
2.3 	in section 609.527.

2.4 	Sec. 2. Minnesota Statutes 2016, section 13C.016, subdivision 8, is amended to read:
2.5 		Subd. 8.Fees. (a) A consumer reporting agency may charge a fee of $5 for placing, 
2.6 	temporarily lifting, or removing a security freeze unless:
2.7 	(1) the consumer is a victim of identity theft as defined in subdivision 1, paragraph (c);
2.8 	(d), and
2.9 	(2) the consumer provides the consumer reporting agency with a valid copy of a police 
2.10 	report or a police case number documenting the identity theft.; or
2.11 	(2) the consumer is a victim of a data breach as defined in subdivision 1, paragraph (c), 
2.12 	and the consumer provides the consumer reporting agency with a copy of a notice that there 
2.13 	has been a breach of the security system.
2.14 	(b) In addition to the charge, if any, permitted under paragraph (a), a consumer may be 
2.15 	charged no more than $5 if the consumer fails to retain the original personal identification 
2.16 	number given to the consumer by the agency, but the consumer may not be charged for a 
2.17 	onetime reissue of the same or a new personal identification number. The consumer may 
2.18 	be charged no more than $5 for subsequent instances of loss of the personal identification 
2.19 	number.
2.20 	(c) A consumer who makes a written request by mail may pay any fee charged pursuant 
2.21 	to this subdivision by check, money order, or credit card. A consumer who makes a request 
2.22 	by telephone or other electronic media may pay any fee charged pursuant to this subdivision 
2.23 	by credit card.

2.24 	Sec. 3. [13C.05] CONTRACT CLAUSES.
2.25 	If a consumer reporting agency reports that there has been a breach of the security system 
2.26 	involving consumers' personal information, as provided in section 325E.61, and the consumer 
2.27 	reporting agency offers additional or reduced cost security services, including but not limited 
2.28 	to credit monitoring services, security freezes, or security locks, then the consumer reporting 
2.29 	agency may not include in a contract with the consumer a clause requiring mediation, 
2.30 	arbitration, or any other form of alternative dispute resolution, or limiting the liability of 
2.31 	the consumer reporting agency in any way. Such a clause is void and unenforceable.

3.1 	Sec. 4. EFFECTIVE DATE.
 3.2 	Sections 1 to 3 are effective retroactively for data breaches that occurred on or after July 
3.3 	1, 2017.