language: en · last checked: 2026-10-08

Minnesota — breach of security in government data and civil remedies (Minn. Stat. §13.055; §13.08)

Two sections of Minnesota's Government Data Practices Act in full: the government entity's duty to notify individuals of a breach of the security of the data, to investigate and report on it, and to keep security procedures, with the definitions and the role of a person acting on the entity's behalf (§13.055); and the civil remedies — liability for damages, injunction, the action to compel compliance and the immunity provisions (§13.08).

§13.055, Subdivision 1. Definitions.

Verbatim from Minn. Stat. §13.055, subd. 1 (2025 Minnesota Statutes), Office of the Revisor of Statutes; see Meta.

For purposes of this section, the following terms have the meanings given to them.

(a) "Breach of the security of the data" means unauthorized acquisition of data maintained by a government entity that compromises the security and classification of the data. Good faith acquisition of or access to government data by an employee, contractor, or agent of a government entity for the purposes of the entity is not a breach of the security of the data, if the government data is not provided to or viewable by an unauthorized person, or accessed for a purpose not described in the procedures required by section 13.05, subdivision 5. For purposes of this paragraph, data maintained by a government entity includes data maintained by a person under a contract with the government entity that provides for the acquisition of or access to the data by an employee, contractor, or agent of the government entity.

(b) "Contact information" means either name and mailing address or name and email address for each individual who is the subject of data maintained by the government entity.

(c) "Unauthorized acquisition" means that a person has obtained, accessed, or viewed government data without the informed consent of the individuals who are the subjects of the data or statutory authority and with the intent to use the data for nongovernmental purposes.

(d) "Unauthorized person" means any person who accesses government data without a work assignment that reasonably requires access, or regardless of the person's work assignment, for a purpose not described in the procedures required by section 13.05, subdivision 5.

§13.055, Subd. 2. Notice to individuals; investigation report.

Verbatim from Minn. Stat. §13.055, subd. 2 (2025 Minnesota Statutes), Office of the Revisor of Statutes; see Meta.

(a) A government entity that collects, creates, receives, maintains, or disseminates private or confidential data on individuals must disclose any breach of the security of the data following discovery or notification of the breach. Written notification must be made to any individual who is the subject of the data and whose private or confidential data was, or is reasonably believed to have been, acquired by an unauthorized person and must inform the individual that a report will be prepared under paragraph (b), how the individual may obtain access to the report, and that the individual may request delivery of the report by mail or email. The disclosure must be made in the most expedient time possible and without unreasonable delay, consistent with (1) the legitimate needs of a law enforcement agency as provided in subdivision 3; or (2) any measures necessary to determine the scope of the breach and restore the reasonable security of the data.

(b) Notwithstanding section 13.15 or 13.37, upon completion of an investigation into any breach in the security of data and final disposition of any disciplinary action for purposes of section 13.43, including exhaustion of all rights of appeal under any applicable collective bargaining agreement, the responsible authority shall prepare a report on the facts and results of the investigation. If the breach involves unauthorized access to or acquisition of data by an employee, contractor, or agent of the government entity, the report must at a minimum include:

(1) a description of the type of data that were accessed or acquired;
(2) the number of individuals whose data was improperly accessed or acquired;
(3) if there has been final disposition of disciplinary action for purposes of section 13.43, the name of each employee determined to be responsible for the unauthorized access or acquisition, unless the employee was performing duties under chapter 5B; and
(4) the final disposition of any disciplinary action taken against each employee in response.

§13.055, Subd. 3. Delayed notice.

Verbatim from Minn. Stat. §13.055, subd. 3 (2025 Minnesota Statutes), Office of the Revisor of Statutes; see Meta.

The notification required by this section may be delayed if a law enforcement agency determines that the notification will impede an active criminal investigation. The notification required by this section must be made after the law enforcement agency determines that it will not compromise the investigation.

§13.055, Subd. 4. Method of notice.

Verbatim from Minn. Stat. §13.055, subd. 4 (2025 Minnesota Statutes), Office of the Revisor of Statutes; see Meta.

Notice under this section may be provided by one of the following methods:

(a) written notice by first class mail to each affected individual;

(b) electronic notice to each affected individual, if the notice provided is consistent with the provisions regarding electronic records and signatures as set forth in United States Code, title 15, section 7001; or

(c) substitute notice, if the government entity demonstrates that the cost of providing the written notice required by paragraph (a) would exceed $250,000, or that the affected class of individuals to be notified exceeds 500,000, or the government entity does not have sufficient contact information. Substitute notice consists of all of the following:

(i) email notice if the government entity has an email address for the affected individuals;
(ii) conspicuous posting of the notice on the website page of the government entity, if the government entity maintains a website; and
(iii) notification to major media outlets that reach the general public within the government entity's jurisdiction.

§13.055, Subd. 5. Coordination with consumer reporting agencies.

Verbatim from Minn. Stat. §13.055, subd. 5 (2025 Minnesota Statutes), Office of the Revisor of Statutes; see Meta.

If the government entity discovers circumstances requiring notification under this section of more than 1,000 individuals at one time, the government entity must also notify, without unreasonable delay, all consumer reporting agencies that compile and maintain files on consumers on a nationwide basis, as defined in United States Code, title 15, section 1681a, of the timing, distribution, and content of the notices.

§13.055, Subd. 6. Security assessments.

Verbatim from Minn. Stat. §13.055, subd. 6 (2025 Minnesota Statutes), Office of the Revisor of Statutes; see Meta.

At least annually, each government entity shall conduct a comprehensive security assessment of any personal information maintained by the government entity. For the purposes of this subdivision, personal information is defined under section 325E.61, subdivision 1, paragraphs (e) and (f).

§13.055, Subd. 7. Access to data for audit purposes.

Verbatim from Minn. Stat. §13.055, subd. 7 (2025 Minnesota Statutes), Office of the Revisor of Statutes; see Meta.

Nothing in this section or section 13.05, subdivision 5, restricts access to not public data by the legislative auditor or state auditor in the performance of official duties.

History: 2005 c 163 s 21; 2005 c 167 s 1; 2006 c 212 art 1 s 17,24; 2006 c 233 s 7,8; 2014 c 284 s 2

§13.08, Subdivision 1. Action for damages.

Verbatim from Minn. Stat. §13.08, subd. 1 (2025 Minnesota Statutes), Office of the Revisor of Statutes; see Meta.

Notwithstanding section 466.03, a responsible authority or government entity which violates any provision of this chapter is liable to a person or representative of a decedent who suffers any damage as a result of the violation, and the person damaged or a representative in the case of private data on decedents or confidential data on decedents may bring an action against the responsible authority or government entity to cover any damages sustained, plus costs and reasonable attorney fees. In the case of a willful violation, the government entity shall, in addition, be liable to exemplary damages of not less than $1,000, nor more than $15,000 for each violation. The state is deemed to have waived any immunity to a cause of action brought under this chapter.

§13.08, Subd. 2. Injunction.

Verbatim from Minn. Stat. §13.08, subd. 2 (2025 Minnesota Statutes), Office of the Revisor of Statutes; see Meta.

A responsible authority or government entity which violates or proposes to violate this chapter may be enjoined by the district court. The court may make any order or judgment as may be necessary to prevent the use or employment by any person of any practices which violate this chapter.

§13.08, Subd. 3. Venue.

Verbatim from Minn. Stat. §13.08, subd. 3 (2025 Minnesota Statutes), Office of the Revisor of Statutes; see Meta.

An action filed pursuant to this section may be commenced in the county in which the individual alleging damage or seeking relief resides, or in the county wherein the political subdivision exists, or, in the case of the state, any county.

§13.08, Subd. 4. Action to compel compliance.

Verbatim from Minn. Stat. §13.08, subd. 4 (2025 Minnesota Statutes), Office of the Revisor of Statutes; see Meta.

(a) Actions to compel compliance may be brought either under this subdivision or section 13.085. For actions under this subdivision, in addition to the remedies provided in subdivisions 1 to 3 or any other law, any aggrieved person seeking to enforce the person's rights under this chapter or obtain access to data may bring an action in district court to compel compliance with this chapter and may recover costs and disbursements, including reasonable attorney's fees, as determined by the court. If the court determines that an action brought under this subdivision is frivolous and without merit and a basis in fact, it may award reasonable costs and attorney fees to the responsible authority. If the court issues an order to compel compliance under this subdivision, the court may impose a civil penalty of up to $1,000 against the government entity. This penalty is payable to the state general fund and is in addition to damages under subdivision 1. The matter shall be heard as soon as possible. In an action involving a request for government data under section 13.03 or 13.04, the court may inspect in camera the government data in dispute, but shall conduct its hearing in public and in a manner that protects the security of data classified as not public. If the court issues an order to compel compliance under this subdivision, the court shall forward a copy of the order to the commissioner of administration.

(b) In determining whether to assess a civil penalty under this subdivision, the court or other tribunal shall consider whether the government entity has substantially complied with general data practices under this chapter, including but not limited to, whether the government entity has:

(1) designated a responsible authority under section 13.02, subdivision 16;
(2) designated a data practices compliance official under section 13.05, subdivision 13;
(3) prepared the data inventory that names the responsible authority and describes the records and data on individuals that are maintained by the government entity under section 13.025, subdivision 1;
(4) developed public access procedures under section 13.03, subdivision 2; procedures to guarantee the rights of data subjects under section 13.025, subdivision 3; and procedures to ensure that data on individuals are accurate and complete and to safeguard the data's security under section 13.05, subdivision 5;
(5) acted in conformity with an opinion issued under section 13.072 that was sought by a government entity or another person; or
(6) provided ongoing training to government entity personnel who respond to requests under this chapter.

(c) The court shall award reasonable attorney fees to a prevailing plaintiff who has brought an action under this subdivision if the government entity that is the defendant in the action was also the subject of a written opinion issued under section 13.072 and the court finds that the opinion is directly related to the cause of action being litigated and that the government entity did not act in conformity with the opinion.

§13.08, Subd. 5. Immunity from liability.

Verbatim from Minn. Stat. §13.08, subd. 5 (2025 Minnesota Statutes), Office of the Revisor of Statutes; see Meta.

A government entity or person that releases not public data pursuant to an order under section 13.03, subdivision 6, is immune from civil and criminal liability.

§13.08, Subd. 6. Immunity from liability; personnel settlement.

Verbatim from Minn. Stat. §13.08, subd. 6 (2025 Minnesota Statutes), Office of the Revisor of Statutes; see Meta.

No cause of action may arise as a result of the release of data contained in a termination or personnel settlement agreement if the data were not public data as defined in section 13.02, at the time the agreement was executed but become public data under a law enacted after execution.

History: 1974 c 479 s 5; 1975 c 401 s 5; 1976 c 239 s 4,5; 1979 c 328 s 14; 1980 c 603 s 13; 1981 c 311 s 39; 1Sp1981 c 4 art 1 s 8-10; 1982 c 545 s 24; 1985 c 298 s 5,6; 1986 c 444; 1991 c 319 s 30; 1999 c 227 s 22; 2000 c 468 s 8; 2001 c 202 s 3; 1Sp2003 c 8 art 2 s 3; 2005 c 163 s 29-31; 2007 c 129 s 8; 2008 c 315 s 3,4; 2010 c 297 s 2; 2013 c 125 art 1 s 1; 2016 c 158 art 1 s 6

Sources

Office of the Revisor of Statutes — Minn. Stat. §13.055 (13.055 DISCLOSURE OF BREACH IN SECURITY; NOTIFICATION AND INVESTIGATION REPORT REQUIRED.)
Office of the Revisor of Statutes — Minn. Stat. §13.08 (13.08 CIVIL REMEDIES.)
Edition: 2025 Minnesota Statutes. Extracted-text SHA-256: 5062c6a2ed679c064b11cf4cb670364aa2d2e536a850b2216b557dc8ba4ccdc2