Minnesota Internet Privacy Act, Internet service provider duty to maintain the security of consumer information

An Internet service provider must take reasonable steps to maintain the security and privacy of a consumer's personally identifiable information. An Internet service provider is a business or person who provides consumers authenticated access to, or presence on, the Internet by means of a switched or dedicated telecommunications channel on which the provider provides transit routing of Internet Protocol packets for and on behalf of the consumer.

The definition does not include the offering, on a common carrier basis, of telecommunications facilities or of telecommunications by means of these facilities. A consumer is a person who agrees to pay a fee to an Internet service provider for access to the Internet for personal, family, or household purposes and who does not resell access.

The provider is not liable for actions that would violate section 609.88, 609.89, or 609.891 if it does not participate in, authorize, or approve the actions. A consumer who prevails or substantially prevails in an action brought under sections 325M.01 to 325M.09 is entitled to the greater of $500 or actual damages. No class action may be brought under sections 325M.01 to 325M.09.

It is a defense that the defendant has established and implemented reasonable practices and procedures to prevent violations of sections 325M.01 to 325M.09. Sections 325M.01 to 325M.09 apply to Internet service providers in the provision of services to consumers in Minnesota. Article 1 of chapter 395 took effect March 1, 2003 and expires on the effective date of federal legislation that preempts state regulation of the release of personally identifiable information by Internet service providers.