What does Minnesota's data breach law ask a business to do?

Who does this law apply to?

A person or business that conducts business in Minnesota and owns or licenses data with personal information must disclose a breach to each Minnesota resident whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person.

Any person or business that conducts business in this state, and that owns or licenses data that includes personal information, shall disclose any breach of the security of the system following discovery or notification of the breach in the security of the data to any resident of this state whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person.

What counts as personal information?

Personal information is a person's name together with a Social Security number, a driver's licence or Minnesota ID card number, or an account or card number with any code or password that would open the financial account.

(1) Social Security number; (2) driver's license number or Minnesota identification card number; or (3) account number or credit or debit card number, in combination with any required security code, access code, or password that would permit access to an individual's financial account.

How fast must people be told?

The law says the disclosure must be made in the most expedient time possible and without unreasonable delay.

Room is left for the needs of law enforcement and for the steps needed to find the scope of the breach, identify the people affected and restore the system.

The disclosure must be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement, as provided in paragraph (c), or with any measures necessary to determine the scope of the breach, identify the individuals affected, and restore the reasonable integrity of the data system.

Who else must be told?

When more than 500 people are notified at one time, the person must also tell the nationwide consumer reporting agencies within 48 hours about the timing, distribution and content of the notices.

If a person discovers circumstances requiring notification under this section and section 13.055, subdivision 6, of more than 500 persons at one time, the person shall also notify, within 48 hours, all consumer reporting agencies that compile and maintain files on consumers on a nationwide basis, as defined by United States Code, title 15, section 1681a, of the timing, distribution, and content of the notices.

Is encrypted information treated differently?

Data secured by encryption, or by another method that makes it unreadable or unusable, is outside the definition. It comes back in when the encryption key, password or other means of reading it was also acquired.

"personal information" means an individual's first name or first initial and last name in combination with any one or more of the following data elements, when the data element is not secured by encryption or another method of technology that makes electronic data unreadable or unusable, or was secured and the encryption key, password, or other means necessary for reading or using the data was also acquired:

What if a vendor holds the data?

A person or business that keeps personal information it does not own must tell the owner or licensee immediately after discovering a breach.

Any person or business that maintains data that includes personal information that the person or business does not own shall notify the owner or licensee of the information of any breach of the security of the data immediately following discovery, if the personal information was, or is reasonably believed to have been, acquired by an unauthorized person.

What can an outside reading show for this rule?

This law is about what a business does after a breach: who it tells, and how fast. An outside reading cannot tell whether a breach has happened inside your systems, what personal information you hold, whether it is encrypted where you keep it, or whether anyone has been told.

What it can show, read from outside the way anyone could, is evidence about ways someone could get in: whether your domain publishes a rule telling mail servers to refuse email forged in your name, whether remote access or file sharing services answer from the internet, and whether addresses at your domain are listed in monitored breach databases.

The text names none of these. They are evidence about how a breach could start, never proof that a firm meets the law.

Is this legal advice?

No. This summarises the public text; it is not legal advice.

The text itself is the authority. Read it at the source below.