Law / United States / 
Minnesota
Internet service provider customer information: limits on disclosure of personally identifiable information
Minn. Stat. §§ 325M.01 to 325M.09
In force since .
A data subject rights rule binding private bodies.
- Enforcement body
- A consumer who prevails or substantially prevails sues under section 325M.07.
- Obligation class
- Consent, Security, Prohibition
As of .
What it requires
- If you are an Internet service provider, do not knowingly disclose personally identifiable information concerning a consumer, that is, information identifying the consumer by physical or electronic address or telephone number, as having requested or obtained specific materials or services, the sites visited, or the contents of the consumer's data-storage devices, except as section 325M.03 requires or section 325M.04 permits.
- Disclose a consumer's personally identifiable information only to a person with the consumer's authorization, obtained in writing or by electronic means with a conspicuous contract provision stating whether the authorization is given by an affirmative act or by failing to object, or in the ordinary course of business, which is debt collection, order fulfillment, request processing or a transfer of ownership.
- Take reasonable steps to maintain the security and privacy of a consumer's personally identifiable information.
- On a consumer's written or electronic request, disclose to the consumer the personally identifiable information you hold about the consumer, and charge no more than the actual cost of retrieving it.
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Private right of actionYes
Statutory damages
Section 325M.07 entitles a prevailing consumer to the greater of $500 or actual damages, with costs, disbursements and reasonable attorney fees that may be awarded; no class action may be brought under the sections, and it is a defense that the defendant established and implemented reasonable practices and procedures to prevent violations.
- As of
- Currency
- USD
- Per person minimum
- 500
What this law does
Sections 325M.01 to 325M.09 apply to Internet service providers in the provision of services to consumers in this state. An Internet service provider is a business or person who provides consumers authenticated access to, or presence on, the Internet by means of a switched or dedicated telecommunications channel on which the provider provides transit routing of Internet Protocol packets for and on behalf of the consumer.
An Internet service provider does not include the offering, on a common carrier basis, of telecommunications facilities or of telecommunications by means of these facilities. Except as sections 325M.03 and 325M.04 provide, an Internet service provider may not knowingly disclose personally identifiable information concerning a consumer of the provider.
An Internet service provider shall disclose personally identifiable information concerning a consumer to the consumer who is the subject of the information, upon written or electronic request and upon payment of a fee not to exceed the actual cost of retrieving the information.
Personally identifiable information is information that identifies a consumer by physical or electronic address or telephone number, as having requested or obtained specific materials or services from the provider, by the sites visited, or by the contents of the consumer's data-storage devices.
An Internet service provider may disclose personally identifiable information concerning a consumer to any person with the authorization of the consumer, or to any person if the disclosure is incident to the ordinary course of business of the provider. The Internet service provider must take reasonable steps to maintain the security and privacy of a consumer's personally identifiable information.
A consumer who prevails or substantially prevails in an action under sections 325M.01 to 325M.09 is entitled to the greater of $500 or actual damages. No class action may be brought under sections 325M.01 to 325M.09. The session law that enacted the sections makes article 1 effective .
The session law provides that article 1 expires on the effective date of federal legislation that preempts state regulation of the release of personally identifiable information by Internet service providers.
When LexLint raises it
When your app profile says your app provides telecom services.