Subdivision 1. Generally. (a) A person or entity, not including a government entity, may not do any of the following:

(1) publicly post or publicly display in any manner an individual's Social Security number. "Publicly post" or "publicly display" means to intentionally communicate or otherwise make available to the general public;

(2) print an individual's Social Security number on any card required for the individual to access products or services provided by the person or entity;

(3) require an individual to transmit the individual's Social Security number over the Internet, unless the connection is secure or the Social Security number is encrypted, except as required by titles XVIII and XIX of the Social Security Act and by Code of Federal Regulations, title 42, section 483.20;

(4) require an individual to use the individual's Social Security number to access an Internet website, unless a password or unique personal identification number or other authentication device is also required to access the Internet website;

(5) print a number that the person or entity knows to be an individual's Social Security number on any materials that are mailed to the individual, unless state or federal law requires the Social Security number to be on the document to be mailed. If, in connection with a transaction involving or otherwise relating to an individual, a person or entity receives a number from a third party, that person or entity is under no duty to inquire or otherwise determine whether the number is or includes that individual's Social Security number and may print that number on materials mailed to the individual, unless the person or entity receiving the number has actual knowledge that the number is or includes the individual's Social Security number;

(6) assign or use a number as the primary account identifier that is identical to or incorporates an individual's complete Social Security number, except in conjunction with an employee or member retirement or benefit plan or human resource or payroll administration; or

(7) sell Social Security numbers obtained from individuals in the course of business.

(b) For purposes of paragraph (a), clause (7), "sell" does not include the release of an individual's Social Security number if the release of the Social Security number is incidental to a larger transaction and is necessary to identify the individual in order to accomplish a legitimate business purpose. The release of a Social Security number for the purpose of marketing is not a legitimate business purpose under this paragraph.

(c) Notwithstanding paragraph (a), clauses (1) to (5), Social Security numbers may be included in applications and forms sent by mail, including documents sent as part of an application or enrollment process, or to establish, amend, or terminate an account, contract, or policy, or to confirm the accuracy of the Social Security number. Nothing in this paragraph authorizes inclusion of a Social Security number on the outside of a mailing or in the bulk mailing of a credit card solicitation offer.

(d) A person or entity, not including a government entity, must restrict access to individual Social Security numbers it holds so that only its employees, agents, or contractors who require access to records containing the numbers in order to perform their job duties have access to the numbers, except as required by titles XVIII and XIX of the Social Security Act and by Code of Federal Regulations, title 42, section 483.20.

(e) This section applies only to the use of Social Security numbers on or after July 1, 2008.

Subd. 2. [Repealed, 2007 c 129 s 58]

Subd. 3. Coordination with other law. This section does not prevent:

(1) the collection, use, or release of a Social Security number as required by state or federal law;

(2) the collection, use, or release of a Social Security number for a purpose specifically authorized or specifically allowed by a state or federal law that includes restrictions on the use and release of information on individuals that would apply to Social Security numbers; or

(3) the use of a Social Security number for internal verification or administrative purposes.

Subd. 4. Public records. This section does not apply to documents that are recorded or required to be open to the public under chapter 13 or by other law.

Subd. 5. Definitions. For purposes of this section, "government entity" has the meaning given in section 13.02, subdivision 7a, but does not include the Minnesota State Colleges and Universities or the University of Minnesota.

History: 2005 c 163 s 85; 2006 c 253 s 19; 2007 c 129 s 55,57; 2008 c 333 s 1,2