Minnesota

A 2025 amendment expanded Minnesota's definition of child sexual abuse material at section 617.246 to reach a visual depiction that has been created, adapted, or modified to appear that an identifiable minor is engaging in sexual conduct, including one created by generative artificial intelligence or other computer technology processing data-input prompts, where the depicted individual is indistinguishable from an actual minor and the material is obscene.

Because section 617.247's dissemination and possession offenses incorporate section 617.246's definition, this AI-generated category carries the same felony exposure as other child sexual abuse material: up to seven years and a $10,000 fine for dissemination (up to 15 years and $20,000 with an aggravating factor), and up to five years and a $5,000 fine for possession (up to ten years and $10,000 with an aggravating factor).

A companion immunity provision, section 617.2471, bars civil or criminal liability under sections 617.246 or 617.247 for material that qualifies as child sexual abuse material solely because it is an AI-generated depiction, from being imposed on an interactive computer service, an information or telecommunications service provider, or their employees, for actions taken to detect, report, or respond to such material, or for content provided by another person.

It is a crime to knowingly or recklessly disseminate a deep fake, or to enter a contract to disseminate one, without the depicted individual's consent, with intent to injure a candidate or influence an election result, within 90 days before a party nominating convention or after the start of absentee voting before a primary or general election. There is no disclosure safe harbor; the offense turns on lack of consent and electoral intent, not on whether the item is labeled synthetic.

A 2024 amendment added that a convicted candidate forfeits the nomination or office and is disqualified from appointment to another office, and armed the attorney general, a county or city attorney, the depicted individual, or an injured candidate with a civil action for injunctive or equitable relief.

It is a crime under section 617.262 to intentionally disseminate a deep fake that realistically depicts a person's intimate parts, artificially generated intimate parts presented as the depicted individual's, or the depicted individual engaging in a sexual act, knowing or with reason to know the depicted individual did not consent, where the individual is identifiable.

The base offense is a gross misdemeanor; it becomes a felony punishable by up to three years and a $5,000 fine where an aggravating factor applies, including that the actor profited, ran a website for the purpose of disseminating the material, obtained it by hacking, or has a prior conviction under the chapter.

A parallel civil cause of action at section 604.32, enacted the same day, lets the depicted individual sue for general and special damages, disgorgement of the disseminator's profit, a civil penalty of up to $100,000, and injunctive relief, with a civil fine of up to $1,000 per day for violating an order under the section.

Both sections exempt dissemination for law-enforcement, medical-treatment, newsworthy, scientific, or legal-proceeding purposes, and section 617.262 immunizes interactive computer services and telecommunications providers for content provided by another person.

A person who owns or controls a website, application, software, program, or other service must not allow a user to access, download, or use it to nudify an image or video of an identifiable individual, or nudify one on the user's behalf, and must not advertise or promote a service that does either.

Nudifying means altering or generating an image or video so that it depicts an identifiable individual's intimate part or so realistically appears to that a reasonable person would believe it belongs to that individual. An exemption applies where the service requires the user's own substantial technical or artistic skill to produce the result.

The attorney general may enforce the section and a person who violates it is subject to a civil penalty of up to $500,000 for each unlawful access, download, or use; an individual may also bring a civil action against the violator for compensatory damages of up to three times the actual damages sustained, punitive damages, injunctive relief, and attorney fees.

House File 1606 was enrolled as 2026 Minnesota Session Law chapter 72, presented to the governor May 6, 2026 and approved by the governor May 7, 2026.

A 2026 amendment to the utilization review act adds paragraph (f) to section 62M.09, subdivision 3, barring a utilization review organization from using any form of automated processing alone, without a clinician review by an appropriate health professional as the rest of the subdivision already requires, when making an adverse determination on a health care service, admission, or extension of stay.

A utilization review organization under this chapter is a private entity, such as an insurance company, prepaid limited health service organization, or health plan company, rather than a state agency. The amendment reached enactment as section 6 of House File 4188, an omnibus commerce policy bill, after a conference committee substituted new language for the entire bill (a delete-everything amendment).

House File 2500, a stand-alone bill on the same subject, was introduced in 2025 and never advanced past its initial committee referral. Its companion, Senate File 1856, was amended in committee in 2026 but received no recommendation and no floor vote in either chamber. The House repassed the conference report 121-13 on May 16, 2026, and the Senate 49-15 on May 17, 2026; the governor approved the act, filed as 2026 Minnesota Session Law chapter 124, on May 27, 2026.

The amendment's own effective-date clause makes it effective January 1, 2027, applying to health plans offered, sold, issued, or renewed on or after that date.

Section 60A.9853 requires each licensee to notify the commissioner of commerce or commissioner of health, whichever otherwise regulates the licensee, without unreasonable delay and no later than five business days from a determination that a cybersecurity event has occurred when the section's criteria are met.

One of the criteria is that the licensee reasonably believes the nonpublic information involved is of 250 or more consumers residing in Minnesota and that the event is one of which notice must be given to a government or supervisory body, or has a reasonable likelihood of materially harming a consumer or normal operations.

A licensee required to report to the commissioner must notify any consumer residing in Minnesota whose nonpublic information was or is reasonably believed to have been acquired by an unauthorized person where there is a reasonable likelihood of material harm, in the most expedient time possible and without unreasonable delay.

A licensee must treat a cybersecurity event in a system maintained by a third-party service provider, of which it has become aware, as it would under subdivision 1 unless the third-party service provider provides the notice. An assuming insurer must notify its affected ceding insurers and the commissioner of its state of domicile within three business days of making the determination that a cybersecurity event involving nonpublic information has occurred.

A licensee is a person licensed, authorized to operate or registered, or required to be, by the Department of Commerce or the Department of Health under the chapters the section lists. A licensee subject to and in compliance with Health Insurance Portability and Accountability Act (HIPAA) is considered to comply with section 60A.9853, subdivisions 3 to 5 if it submits a written statement certifying its compliance with HIPAA. A licensee that violates sections 60A.985 to 60A.9856 may be penalized in accordance with section 60A.052.

Section 60A.052 lets the commissioner impose a civil penalty as provided for in section 45.027, subdivision 6. Section 45.027, subdivision 6 lets the commissioner impose a civil penalty not to exceed $10,000 per violation upon a person who violates any law, rule or order related to the commissioner's duties unless a different penalty is specified. The session law that enacted the section makes it effective August 1, 2021.

Under section 60A.9852, subdivision 4, a licensee must maintain records concerning all cybersecurity events for a period of at least five years from the date of the cybersecurity event and must produce those records upon demand of the commissioner. A licensee is any person licensed, authorized to operate, or registered, or required to be licensed, authorized, or registered by the Department of Commerce or the Department of Health under the chapters section 60A.985 lists.

A licensee that violates sections 60A.985 to 60A.9856 may be penalized in accordance with section 60A.052. Section 60A.052 lets the commissioner impose a civil penalty as provided for in section 45.027, subdivision 6. Section 45.027, subdivision 6 lets the commissioner impose a civil penalty not to exceed $10,000 per violation upon a person who violates any law, rule or order related to the commissioner's duties unless a different penalty is specified. The session law that enacted the section makes it effective August 1, 2021.

Under section 60A.9855, subdivision 4, any document, material, or information disclosed to the commissioner under that section about a cybersecurity event must be retained and preserved by the licensee for five years. Subdivision 1 classifies the documents, materials and information a licensee furnishes under the listed sections as confidential, protected nonpublic, or both, and not subject to subpoena.

A licensee is any person licensed, authorized to operate, or registered, or required to be licensed, authorized, or registered by the Department of Commerce or the Department of Health under the chapters section 60A.985 lists. A licensee that violates sections 60A.985 to 60A.9856 may be penalized in accordance with section 60A.052. Section 60A.052 lets the commissioner impose a civil penalty as provided for in section 45.027, subdivision 6.

Section 45.027, subdivision 6 lets the commissioner impose a civil penalty not to exceed $10,000 per violation upon a person who violates any law, rule or order related to the commissioner's duties unless a different penalty is specified. The session law that enacted the section makes it effective August 1, 2021.

Minnesota's breach notification duty, a separate and pre-existing chapter from MCDPA, was originally enacted by 2005 Minn. Laws ch. 167, section 1, and has since been amended by 2006 Minn. Laws ch. 212, article 1, sections 17 and 24, and ch. 233, sections 7 and 8. Section 1 of the 2005 act, which enacted the section, is effective January 1, 2006, and the section is currently in force.

A person or business must disclose a breach of the security of the system, following discovery or notification of the breach, to any Minnesota resident whose unencrypted personal information was or is reasonably believed to have been acquired by an unauthorized person, made in the most expedient time possible and without unreasonable delay.

Unlike Maryland's or Tennessee's fixed-day deadlines, Minnesota uses a reasonableness standard with no numeric cap; a data maintainer that does not own the information must notify the owner immediately upon discovery.

MCDPA governs private-sector processing of Minnesota residents' personal data, enacted as Laws of Minnesota 2024, chapter 121, article 5. A controller must limit collection to what is adequate, relevant, and reasonably necessary for the disclosed processing purpose, and must obtain consent before processing for an undisclosed, incompatible secondary purpose.

The general effective date, July 31, 2025, binds every controller except postsecondary institutions regulated by the Office of Higher Education, which are not required to comply until July 31, 2029, per the statute's own history note.

Sections 325M.01 to 325M.09 apply to Internet service providers in the provision of services to consumers in this state. An Internet service provider is a business or person who provides consumers authenticated access to, or presence on, the Internet by means of a switched or dedicated telecommunications channel on which the provider provides transit routing of Internet Protocol packets for and on behalf of the consumer.

An Internet service provider does not include the offering, on a common carrier basis, of telecommunications facilities or of telecommunications by means of these facilities. Except as sections 325M.03 and 325M.04 provide, an Internet service provider may not knowingly disclose personally identifiable information concerning a consumer of the provider.

An Internet service provider shall disclose personally identifiable information concerning a consumer to the consumer who is the subject of the information, upon written or electronic request and upon payment of a fee not to exceed the actual cost of retrieving the information.

Personally identifiable information is information that identifies a consumer by physical or electronic address or telephone number, as having requested or obtained specific materials or services from the provider, by the sites visited, or by the contents of the consumer's data-storage devices.

An Internet service provider may disclose personally identifiable information concerning a consumer to any person with the authorization of the consumer, or to any person if the disclosure is incident to the ordinary course of business of the provider. The Internet service provider must take reasonable steps to maintain the security and privacy of a consumer's personally identifiable information.

A consumer who prevails or substantially prevails in an action under sections 325M.01 to 325M.09 is entitled to the greater of $500 or actual damages. No class action may be brought under sections 325M.01 to 325M.09. The session law that enacted the sections makes article 1 effective March 1, 2003.

The session law provides that article 1 expires on the effective date of federal legislation that preempts state regulation of the release of personally identifiable information by Internet service providers.

MCDPA grants a Minnesota consumer the rights to confirm processing, access, correct, delete, port their personal data, and opt out of targeted advertising, sale, and certain profiling, with an appeal right for denials.

A consumer may also demand a list of the specific third parties a controller disclosed their personal data to, going further than the multi-state model's usual categories-only disclosure, and may opt out of automated profiling for decisions with legal or similarly significant effects, question such a decision, receive an explanation, and have it reevaluated if based on inaccurate data.

A controller must respond within 45 days of receipt, extendable once by 45 additional days, and must respond to an appeal within 45 days, extendable by 60 additional days.

The Minnesota Insurance Fair Information Reporting Act is the short title of sections 72A.49 to 72A.505 of the Minnesota Statutes. The Act applies to an insurer, insurance agent or insurance-support organization that collects, receives or maintains information in connection with insurance transactions that pertains to Minnesota residents, or that engages in insurance transactions with applicants, individuals or policyholders who are Minnesota residents.

For the Act, an insurer includes a joint self-insurance plan or multiple employer trust regulated under chapter 60F, 62H, or section 471.617, subdivision 2. Section 471.617, subdivision 2 lets two or more statutory or home rule charter cities, counties, towns, school districts, watershed districts, watershed management organizations, or instrumentalities of them that together have more than 100 employees jointly self-insure for employee health benefits.

The Act does not apply to insurance transactions involving property and casualty insurance primarily for business or professional needs. Section 72A.494 requires each insurer or insurance agent to provide a notice relating to information practices to each applicant or policyholder.

Section 72A.494 exempts from the notice a group policy that is not individually underwritten and a renewal, reinstatement or change in benefits where no personal information is to be collected other than from the applicant, policyholder or public records.

On a written request after proper identification, an insurer, insurance agent or insurance-support organization must within 30 business days tell the individual the nature and substance of the personal information it holds, permit the individual to see and copy it, and disclose to whom it was disclosed within the previous two years.

Within 30 business days of a written request to correct, amend or delete personal information, the holder must correct, amend or delete the disputed portion or notify the individual of its refusal, the reasons and the right to appeal to the commissioner. After an adverse underwriting decision, the insurer or insurance agent responsible must provide in writing the specific reasons for the decision and a summary of the person's rights of access and correction.

An insurer, insurance agent or insurance-support organization may not disclose personal or privileged information about a person collected or received in connection with an insurance transaction without the person's authorization except as section 72A.502 allows.

An insurer, insurance agent or insurance-support organization that discloses personal or privileged information requiring the person's written authorization must notify the person in writing within ten days of the date the information was disclosed.

An insurer, insurance agent or insurance-support organization may not obtain information in connection with an insurance transaction by pretending to be someone else, pretending to represent a person, misrepresenting the true purpose of the interview or refusing to provide identification on request.

An insurer, insurance agent or insurance-support organization that violates the Act is liable to the aggrieved person to the same extent as civil remedies are allowed in section 13.08, subdivision 1 for violations of chapter 13 by a government body. Section 13.08, subdivision 1 makes a government entity liable, in the case of a willful violation, for exemplary damages of not less than $1,000 and not more than $15,000 for each violation.

Any person who knowingly and willfully obtains information about a person in violation of section 72A.493 is subject to a fine not to exceed $3,000 or imprisonment not to exceed 364 days, or both. The session law that enacted the Act makes sections 1 to 5 and 7 to 17 effective August 1, 1989. The session law that enacted the Act makes the notice section effective January 1, 1990.

The Minnesota Attorney General may bring a civil action to enforce MCDPA under the general false-advertising and consumer-protection statute, Minn. Stat. § 8.31, with a civil penalty of up to $7,500 per violation plus litigation costs and injunctive relief. MCDPA expressly bars any private right of action, including one brought under § 8.31's own private-attorney-general provision.

A discretionary warning-letter and 30-day cure opportunity existed but has already sunset, expiring January 31, 2026; the Attorney General may now sue directly without first offering a cure window.

A technology provider is a person who contracts with a public educational agency or institution to provide a school-issued device for student use and who creates, receives or maintains educational data pursuant or incidental to the contract. A technology provider is subject to the provisions of section 13.05, subdivision 11.

Section 13.05, subdivision 11 makes data a private person collects under a government contract subject to chapter 13, and requires the private person to comply as if it were a government entity. A technology provider must not sell, share or disseminate educational data, except as the section provides or as part of a valid delegation or assignment of its contract with a public educational agency or institution.

A technology provider must not use educational data for any commercial purpose, including marketing or advertising to a student or parent. Within 90 days of the expiration of the contract, a technology provider must destroy or return to the public educational agency or institution all educational data created, received or maintained under the contract, unless renewal is reasonably anticipated.

A technology provider whose educational data are subject to a breach of the security of the data must disclose to the public educational agency or institution all information necessary to fulfill the requirements of section 13.055. A government entity or technology provider must not electronically access or monitor a school-issued device's location-tracking feature, its audio or visual features, or student interactions with it, except in the circumstances the subdivision lists.

A postsecondary institution is exempt from subdivisions 13 and 14, and the exemption extends to a technology provider for purposes of a contract with a postsecondary institution. Section 13.09 makes a person who willfully violates the provisions of chapter 13 guilty of a misdemeanor. The section of the session law that added the technology provider definition makes that section effective for the 2022-2023 school year and later.

Section 2 of that session law, which added subdivision 13 of section 13.32, makes that section effective for the 2022-2023 school year and later. Section 3 of that session law, which added subdivision 14 of section 13.32, makes that section effective for the 2022-2023 school year and later. Section 4 of that session law, which added subdivision 15 of section 13.32, makes that section effective for the 2022-2023 school year and later.

Section 72A.139 may be cited as the Genetic Discrimination Act. A health plan company may not require or request that an individual or a blood relative take a genetic test, inquire whether one was taken or refused or what the results were, or take into consideration the fact or the results of a genetic test, in connection with the offer, sale or renewal of a health plan.

A life insurance company or fraternal benefit society that requires a genetic test to determine insurability must obtain the individual's written informed consent for the test. A life insurance company or fraternal benefit society must notify an individual of a genetic test result by notifying the individual or the individual's designated physician.

A life insurance company or fraternal benefit society may not require an individual to submit to a genetic test unless the insurer pays the cost of the test. A violation of section 72A.139 is subject to the investigative and enforcement authority of the commissioner, who must enforce the section. The session law that enacted the section makes it effective January 1, 1996, and applicable to applications for coverage made on or after that date.

Section 325F.995 is titled the Genetic Information Privacy Act. A direct-to-consumer genetic testing company is an entity that offers consumer genetic testing products or services directly to consumers, or that collects, uses or analyzes genetic data collected through such a product or service and provided to it by a consumer.

The section does not apply to protected health information collected by a covered entity or business associate, to a public or private institution of higher education, or to an entity owned or operated by one. A company must obtain a consumer's express consent to collect, use and disclose the consumer's genetic data, including separate express consent naming the recipient for each transfer to a person other than its vendors and service providers.

A company may not disclose genetic data to law enforcement or any other governmental agency without the consumer's express written consent unless the disclosure is made under a valid search warrant or court order. A company may not disclose a consumer's genetic data without the consumer's written consent to an entity offering health insurance, life insurance, disability insurance or long-term care insurance, or to the consumer's employer.

A company must develop, implement and maintain a comprehensive security program and measures to protect a consumer's genetic data against unauthorized access, use or disclosure. A company must provide a process for a consumer to access the consumer's genetic data, delete the consumer's account and genetic data, and request and obtain destruction of the consumer's biological sample.

A company must honor a consumer's revocation of consent as soon as practicable, but not later than 30 days after the consumer revokes it, and must destroy a biological sample within 30 days of receipt of revocation of consent to store the sample.

A contract between a company and a service provider must prohibit the service provider from retaining, using or disclosing any biological sample, extracted genetic material, genetic data or consumer identity information for any purpose other than the specific services in the contract. The commissioner of commerce may enforce the section under section 45.027.

Section 45.027, subdivision 6 lets the commissioner impose a civil penalty not to exceed $10,000 per violation upon a person who violates any law, rule or order related to the commissioner's duties unless a different penalty is specified.

Section 13.386 addresses the treatment of genetic information held by government entities and other persons. Genetic information is information about an identifiable individual derived from the presence, absence, alteration or mutation of a gene, or the presence or absence of a specific DNA or RNA marker, obtained from analysis of the individual's or a relative's biological information or specimen.

Genetic information also means medical or biological information collected from an individual about a particular genetic condition that is or might be used to provide medical care to the individual or the individual's family members. Unless a law expressly provides otherwise, genetic information about an individual may be collected by a government entity or any other person only with the written informed consent of the individual.

Genetic information may be used only for purposes to which the individual has given written informed consent, stored only for the period of time to which the individual has given written informed consent, and disseminated only with the individual's written informed consent or if necessary to accomplish the consented purposes.

A consent to disseminate genetic information must be signed and dated and, unless otherwise provided by law, is valid for one year or for a lesser period specified in the consent. Newborn screening activities conducted under sections 144.125 to 144.128 are subject to the consent rules of paragraph (a) of section 13.386, subdivision 3, and other programs and activities governed under section 144.192 are not.

The history of section 13.386 records that subdivision 3 was amended by chapter 82, section 3 of the 2013 session laws. The 2013 amendment of section 13.386, subdivision 3 took effect on July 1, 2013. The 2013 amendment designated the existing text of section 13.386, subdivision 3 as paragraph (a). Section 13.09 makes a person who willfully violates the provisions of chapter 13 guilty of a misdemeanor.

The session law that added the section makes it effective August 1, 2006, and applicable to genetic information collected on or after that date.

Section 181.974 governs genetic testing in employment. An employer is any person having one or more employees in Minnesota, and includes the state and its political subdivisions. Protected genetic information is information about a person's genetic test or about a genetic test of a blood relative of the person.

No employer or employment agency may directly or indirectly administer a genetic test or request, require or collect protected genetic information regarding a person as a condition of employment. No employer or employment agency may affect the terms or conditions of employment or terminate the employment of any person based on protected genetic information. No person may provide or interpret for any employer or employment agency protected genetic information on a current or prospective employee.

A person aggrieved by a violation may bring a civil action in which the court may award up to three times the actual damages, punitive damages, reasonable costs and attorney fees, and injunctive or other equitable relief. The history note of section 181.974 records its enactment by section 1 of chapter 154, Laws of 2001, and an amendment by article 13, section 20 of chapter 9, First Special Session 2001. The act that enacted section 181.974 was signed by the governor on May 21, 2001.

Section 181.974 defines a genetic test as the analysis of human DNA, RNA, chromosomes, proteins, or certain metabolites in order to detect disease-related genotypes or mutations.

MCDPA classifies data revealing racial or ethnic origin, religious beliefs, a mental or physical health condition or diagnosis, sexual orientation, or citizenship or immigration status; the processing of biometric data or genetic information to uniquely identify an individual; a known child's data; and precise geolocation data as sensitive data, processable only with the consumer's opt-in consent, the ordinary multi-state model rather than Maryland's outright sale ban.

"Biometric data" means data generated by automatic measurement of biological characteristics used to identify a specific individual, and it excludes a bare photograph, video, or audio recording, but claws that exclusion back the moment data generated from one is used to identify a specific individual.

Sections 144.291 to 144.298 may be cited as the Minnesota Health Records Act. A provider is a person who furnishes health care services and is regulated under the chapters the section lists, a licensed home care provider, a health care facility licensed under chapter 144 or 144A, or a licensed assisted living facility.

A provider, or a person who receives health records from a provider, may not release a patient's health records without a signed and dated consent, specific authorization in Minnesota law, or a representation from a provider that holds a signed and dated consent. A consent to release health records is valid for one year or for a period specified in the consent or for a different period provided by Minnesota law, except as the section otherwise provides.

Upon request, a provider must supply a patient within 30 calendar days of a written request complete and current information concerning any diagnosis, treatment and prognosis of the patient. A provider must furnish copies of the patient's health record, at a reasonable cost to the patient, within 30 calendar days of receiving a written request.

A provider must give patients, in a clear and conspicuous manner, a written notice concerning practices and rights with respect to access to health records. Health records may be released to an external researcher solely for purposes of medical or scientific research only as section 144.295 provides. A health information exchange maintaining a record locator or patient information service must maintain an audit log of providers accessing information in the service.

A person who negligently or intentionally requests or releases a health record in violation of sections 144.291 to 144.297 is liable to the patient for compensatory damages caused by an unauthorized release, plus costs and reasonable attorney fees. A violation of sections 144.291 to 144.298 may be grounds for disciplinary action against a provider by the appropriate licensing board or agency. Section 144.335 was repealed by chapter 147, article 10, section 16 of the Laws of 2007.

Section 144.293, subdivision 7 was amended by chapter 127, article 1, section 29 of the Laws of 2026. The 2026 amendment of section 144.293, subdivision 7 removes the words "or the Health Data Institute under chapter 62J" from the exception to consent for release to the commissioner of health. Section 144.294, subdivision 2 was amended by chapter 121, article 8, section 2 of the Laws of 2026.

The amendment of section 144.294, subdivision 2 will replace the cross-reference to section 256B.0624, subdivision 2, paragraph (j) with section 245I.24, subdivision 2, paragraph (g) in the definition of a mental health crisis. The 2026 amendment of section 144.294, subdivision 2 takes effect January 1, 2028, the effective date of the article that carries it.

Section 325E.59 bars a person or entity, not including a government entity, from publicly posting or publicly displaying an individual's Social Security number in any manner. A person or entity may not print an individual's Social Security number on any card required for the individual to access products or services provided by the person or entity.

A person or entity may not require an individual to transmit the individual's Social Security number over the Internet unless the connection is secure or the number is encrypted. A person or entity may not require an individual to use the individual's Social Security number to access an Internet website unless a password or unique personal identification number or other authentication device is also required.

A person or entity may not print a number that it knows to be an individual's Social Security number on materials mailed to the individual, unless state or federal law requires the number to be on the document.

A person or entity may not assign or use a number as the primary account identifier that is identical to or incorporates an individual's complete Social Security number, except in conjunction with an employee or member retirement or benefit plan or human resource or payroll administration. A person or entity may not sell Social Security numbers obtained from individuals in the course of business.

A person or entity must restrict access to the individual Social Security numbers it holds so that only its employees, agents or contractors who require access in order to perform their job duties have access to the numbers.

Social Security numbers may be included in applications and forms sent by mail, including documents sent as part of an application or enrollment process, or to establish, amend, or terminate an account, contract, or policy, or to confirm the accuracy of the number, notwithstanding paragraph (a), clauses (1) to (5).

Section 325E.59 does not prevent the collection, use, or release of a Social Security number as required by state or federal law, for a purpose specifically authorized by a law that restricts use and release of information on individuals, or the use of a number for internal verification or administrative purposes. The section does not apply to documents that are recorded or required to be open to the public under chapter 13 or by other law.

For the section, a government entity has the meaning given in section 13.02, subdivision 7a, but does not include the Minnesota State Colleges and Universities or the University of Minnesota. The section applies only to the use of Social Security numbers on or after July 1, 2008.

A videotape service provider is a person engaged in the business of rental of prerecorded videocassette tapes or similar audiovisual materials, or a person to whom a disclosure is made by a videotape service provider under section 325I.02, but only with respect to the information contained in the disclosure.

Personally identifiable information is information that identifies a person as having requested or obtained specific video materials or services from a videotape service provider or videotape seller. Except as subdivisions 2 and 3 provide, a videotape service provider or videotape seller who knowingly discloses personally identifiable information concerning any consumer to any person is liable to the consumer for the relief provided in section 325I.03.

To obtain a consumer's written informed consent to a disclosure, a videotape service provider or videotape seller must obtain a signed statement conforming to the notice contained in section 325I.02, subdivision 4.

A person subject to section 325I.02 shall destroy personally identifiable information as soon as practicable, but no later than one year from the date the information is no longer necessary for the purpose for which it was collected and there are no pending requests or orders for access to the information. A videotape service provider or videotape seller may not require a consumer to execute a consent as a condition of providing videotape goods or services to the consumer.

The public and private remedies in section 8.31 apply to violations of section 325I.02. Section 8.31, subdivision 3 entitles the attorney general, on behalf of the state, to sue for injunctive relief against a violation and to sue to recover a civil penalty in an amount determined by the court, not in excess of $25,000.

Section 8.31, subdivision 3a lets any person injured by a violation of the laws referred to in subdivision 1 bring a civil action and recover damages, together with costs and disbursements, including costs of investigation and reasonable attorney's fees. A consumer who prevails or substantially prevails in an action under section 325I.03 is entitled to a minimum of $500 in damages, regardless of the amount of actual damage proved, plus costs, disbursements and reasonable attorney fees.

Subdivision 1 provides that a person is guilty of unauthorized computer access if the person intentionally and without authorization attempts to or does penetrate a computer security system or electronic terminal, so the offense reaches an attempt as well as a completed penetration, and subdivision 4 makes a violation a misdemeanor.

This ties the offense to penetrating a computer security system rather than to access without permission as such, so a plain crawl of a public page behind no security system would not, on this section's own terms, appear to fall within it.

The grade rises to a gross misdemeanor where a violation creates a risk to public health and safety, compromises the security of data that are not public data, or gains access to personal data, and to a felony where it creates a grave risk of causing the death of a person. Further tiers apply to opening a panel or access door of an electronic terminal, including to place a device that captures access device information.

Section 609.89, subdivision 1, makes it computer or electronic data theft to intentionally and without authorization or claim of right access, or cause to be accessed, any computer, computer system, computer network or part of one for the purpose of obtaining services or property. The same subdivision reaches intentionally and without authorization or claim of right accessing or copying computer software or electronic data and then using, altering, transferring, retaining or publishing it.

It also reaches intentionally retaining copies of computer software or electronic data beyond the individual's authority. Section 609.89 has no computer-security-system element; subdivision 1 turns on access without authorization or claim of right. Section 609.87, subdivision 6, defines property to include electronically processed or produced data and information contained in a computer or computer software in either machine or human readable form.

Subdivision 7 of the same section defines services to include computer time, data processing and storage functions. Section 609.87, subdivision 2a, defines authorization to include access with the permission of the owner of the computer, computer system, computer network, computer software or other property.

The owner may limit authorization by giving the user actual notice orally or in writing, by posting a written notice in a prominent location adjacent to the computer being used, or by using a notice displayed on or announced by the computer being used.

The penalty depends on the loss to the owner, the owner's agent or lessee: up to ten years in prison or a fine of up to $50,000, or both, for a loss over $2,500, up to five years or a fine of up to $10,000, or both, for a loss of more than $500 but not more than $2,500, and up to 90 days or a fine of up to $1,000, or both, in all other cases.

Personal data excludes deidentified data or publicly available information, defined as information lawfully made available from government records or widely distributed media, or that a controller reasonably believes was lawfully made available to the public.

The Act applies to an entity doing business in Minnesota or targeting Minnesota residents that in a calendar year controls or processes personal data of 100,000 consumers or more, or derives more than 25% of gross revenue from selling personal data and processes or controls data of 25,000 consumers or more.

Section 325M.14(g) grants an unusual right: where personal data is profiled in furtherance of a decision with legal or similarly significant effect, the consumer has the right to question the result of the profiling, to be informed of the reason that the profiling resulted in the decision, and, if feasible, to be informed of what actions the consumer might have taken to secure a different decision.

Section 325M.20(d) expressly states the Act establishes no private right of action for a violation of its provisions or any other law; enforcement is by the Attorney General, with civil penalties up to $7,500 per violation. Effective July 31, 2025, except that postsecondary institutions regulated by the Office of Higher Education have until July 31, 2029.

Each licensee must develop, implement, and maintain a comprehensive written information security program based on its risk assessment, with administrative, technical, and physical safeguards for nonpublic information and its information system.

A licensee is a person licensed, authorized to operate, or registered, or required to be licensed, authorized, or registered, by the Department of Commerce or the Department of Health under chapters 59A to 62M, 62Q to 62V, and 64B to 79A. Each licensee must establish a written incident response plan designed to promptly respond to and recover from a cybersecurity event that compromises nonpublic information, its information systems, or the continuing functionality of its business or operations.

A licensee must require a third-party service provider to implement appropriate administrative, technical, and physical measures to protect the information systems and nonpublic information that the provider can access or holds. By April 15 of each year, an insurer domiciled in Minnesota must certify in writing to the commissioner that it complies with section 60A.9851. If a licensee learns that a cybersecurity event has or may have occurred, it must conduct a prompt investigation.

A licensee must maintain records concerning all cybersecurity events for at least five years from the date of the event and produce them on the commissioner's demand. A licensee with fewer than 25 employees is exempt from sections 60A.9851 and 60A.9852. A licensee subject to and in compliance with Health Insurance Portability and Accountability Act (HIPAA) is considered to comply with sections 60A.9851 and 60A.9852 if it submits a written statement certifying its compliance with HIPAA.

Licensees had one year from August 1, 2021 to implement section 60A.9851, subdivisions 1 to 5 and 7 to 9, and two years to implement subdivision 6. A violation of sections 60A.985 to 60A.9856 may be penalized in accordance with section 60A.052.

An Internet service provider must take reasonable steps to maintain the security and privacy of a consumer's personally identifiable information. An Internet service provider is a business or person who provides consumers authenticated access to, or presence on, the Internet by means of a switched or dedicated telecommunications channel on which the provider provides transit routing of Internet Protocol packets for and on behalf of the consumer.

The definition does not include the offering, on a common carrier basis, of telecommunications facilities or of telecommunications by means of these facilities. A consumer is a person who agrees to pay a fee to an Internet service provider for access to the Internet for personal, family, or household purposes and who does not resell access.

The provider is not liable for actions that would violate section 609.88, 609.89, or 609.891 if it does not participate in, authorize, or approve the actions. A consumer who prevails or substantially prevails in an action brought under sections 325M.01 to 325M.09 is entitled to the greater of $500 or actual damages. No class action may be brought under sections 325M.01 to 325M.09.

It is a defense that the defendant has established and implemented reasonable practices and procedures to prevent violations of sections 325M.01 to 325M.09. Sections 325M.01 to 325M.09 apply to Internet service providers in the provision of services to consumers in Minnesota. Article 1 of chapter 395 took effect March 1, 2003 and expires on the effective date of federal legislation that preempts state regulation of the release of personally identifiable information by Internet service providers.

A licensee must notify the commissioner of commerce or commissioner of health, whichever regulates it, without unreasonable delay and no later than five business days from a determination that a cybersecurity event has occurred when either of two criteria is met.

The first criterion is that Minnesota is the licensee's state of domicile, for an insurer, or home state, for a producer, and the event has a reasonable likelihood of materially harming a consumer residing in Minnesota or any part of the licensee's normal operations.

The second criterion is that the licensee reasonably believes the nonpublic information of 250 or more consumers residing in Minnesota is involved and either notice is owed to a government or supervisory body or the event has a reasonable likelihood of materially harming a Minnesota consumer or part of the licensee's normal operations.

A licensee has a continuing obligation to update and supplement its notifications to the commissioner concerning material changes to previously provided information. An assuming insurer must notify its affected ceding insurers and the commissioner of its state of domicile within three business days of making the determination that a cybersecurity event has occurred.

A licensee required to report to the commissioner must also notify a Minnesota consumer whose nonpublic information was or is reasonably believed to have been acquired by an unauthorized person where there is a reasonable likelihood of material harm.

Beginning December 1, 2024, the head of or the decision-making body for a public agency must report a cybersecurity incident that impacts the public agency to the commissioner. A government contractor or vendor that provides goods or services to a public agency must report a cybersecurity incident to the public agency if the incident impacts the public agency.

The report must be made within 72 hours of when the public agency or government contractor reasonably identifies or believes that a cybersecurity incident has occurred. The section defines a public agency to include school districts, charter schools, intermediate districts, cooperative units under section 123A.24, subdivision 2, and public postsecondary education institutions.

The commissioner must coordinate with the superintendent of the Bureau of Criminal Apprehension to promptly share reported cybersecurity incidents. The cyber incident reporting system must securely accept a cybersecurity incident notification from any individual or private entity, whether or not the entity is a public agency or government contractor.

Requires a covered social media platform, as the Act defines that term in subdivision 1, to estimate a new account holder's age after 25 hours of use within six months, treating the user as a child (age 15 or younger) unless it can conclude with 80 percent confidence the user is 16 or older, rising to a 90 percent confidence threshold at 50 hours of use.

Child accounts require verifiable parental consent, must default to the most private settings, and may not display addictive interface features such as infinite scroll, autoplay, push notifications, or targeted advertising.