Minnesota Enacts Security Breach Law

Minnesota has enacted a Security Breach law.

On June 2, the Governor signed H.F. 2121, a security breach notification law.

The law requires that:

“Any person or business that conducts business in [Minnesota] and that owns or licenses data that includes personal information, shall disclose any breach of the security of the system following discovery or notification of the breach in the security of the data to any resident of this state whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. The disclosure must be made in the most expedient time possible and without unreasonable delay . . . .”

The law defines “breach of the security of the system" as:

“Unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of personal information maintained by the person or business.”

The law also states that:

“Good faith acquisition of personal information by an employee or agent of the person or business for the purposes of the person or business is not a breach of the security system, provided that the personal information is not used or subject to further unauthorized disclosure.”

The law defines “personal information” as:

“an individual's first name or first initial and last name in combination with any one or more of the following data elements, when either the name or the data elements is not encrypted:

(1) Social Security number;
(2) driver's license number or Minnesota identification card number; or
(3) account number or credit or debit card number, in combination with any required security code, access code, or password that would permit access to an individual's financial account.”


The law is effective January 1, 2006.