language: en · status: in-force · last checked: 2026-10-08

Minnesota — breach of security in government data and civil remedies (Minn. Stat. §13.055; §13.08)

These are two sections of Minnesota's Government Data Practices Act (Minn. Stat. ch. 13), reproduced in full. The earlier-enacted of the two is §13.08, whose History credit begins "1974 c 479 s 5": Laws 1974, chapter 479, section 5 (as section 15.166, "Civil penalties") specified no effective date and was approved on 11 April 1974, so under Minn. Stat. §645.02, as amended by Laws 1971, chapter 196, it took effect on 1 August 1974 (§13.055 dates from 2005 c 163 s 21).

• §13.055 requires a government entity that holds private or confidential data on individuals to disclose a breach of the security of the data in writing to each affected individual. The entity must then prepare an investigation report, notify consumer reporting agencies when more than 1,000 individuals are notified at one time, and carry out an annual security assessment.
• §13.08 makes a responsible authority or government entity that violates the chapter liable for damages, with exemplary damages for a willful violation. It also provides for an injunction and for an action to compel compliance with a civil penalty.

A Minnesota school district is a government entity. A school's technology provider reaches both sections through the companion instrument, Minn. Stat. §13.32 and §13.05, subd. 11.

Applicability to EdTech

• The provider's breach duty is defined by §13.055. A technology provider must disclose to the school "all information necessary to fulfill the requirements of section 13.055" after a breach (§13.32, subd. 13(c)). The school then gives the written notice (§13.055, subd. 2(a)) and prepares the report (subd. 2(b)).
• Contractor-held data counts as the entity's data. "For purposes of this paragraph, data maintained by a government entity includes data maintained by a person under a contract with the government entity" (§13.055, subd. 1(a)). A breach at the vendor is therefore a breach of the district's data.
• Unauthorized acquisition includes mere viewing. It means a person "has obtained, accessed, or viewed government data without the informed consent of the individuals who are the subjects of the data or statutory authority" (§13.055, subd. 1(c)). An "unauthorized person" includes an insider acting outside their work assignment (subd. 1(d)).
• Remedies follow the contract. Under the privatization rule the contractor is subject to the remedies of §13.08 (§13.05, subd. 11(a)). Those are damages plus costs and attorney fees; exemplary damages of $1,000 to $15,000 per willful violation (§13.08, subd. 1); an injunction (subd. 2); and an action to compel compliance with a civil penalty of up to $1,000 (subd. 4(a)).

Contents

Key obligations at a glance

• Written notice of a breach to each affected individual, "in the most expedient time possible and without unreasonable delay" — §13.055, subd. 2(a).
• An investigation report after the investigation and any disciplinary action — §13.055, subd. 2(b).
• Notice to consumer reporting agencies when more than 1,000 individuals are notified at one time — §13.055, subd. 5.
• An annual comprehensive security assessment of personal information — §13.055, subd. 6.

Enforcement

Section 13.08 is the enforcement provision for the whole chapter: damages and exemplary damages (subd. 1), injunction (subd. 2), and the action to compel compliance, in which the court weighs the entity's substantial compliance with general data practices (subd. 4). "The state is deemed to have waived any immunity to a cause of action brought under this chapter" (subd. 1).

Licence

The corpus reproduces §13.055 and §13.08 verbatim from the Office of the Revisor of Statutes' publication of the 2025 Minnesota Statutes (read 2026-10-08). The section pages carry no copyright notice. Statute text enacted by a state legislature is outside copyright under the government edicts doctrine. In Georgia v. Public.Resource.Org, Inc., 590 U.S. 255 (2020) (slip opinion), the Supreme Court held that "officials empowered to speak with the force of law cannot be the authors of—and therefore cannot copyright—the works they create in the course of their official duties". The corpus reproduces the statute text, headnotes and History credits, and none of the revisor's other matter.

Conditions: none. The corpus names the source in Sources and in each subdivision's {.meta} provenance line.

Related

• Minnesota — educational data and technology providers — §13.32, subd. 13(c) points technology providers to §13.055, and §13.05, subd. 11 applies §13.08 to contractors
• FERPA — the federal education-records layer

Sources

• Office of the Revisor of Statutes — Minn. Stat. §13.055
• Office of the Revisor of Statutes — Minn. Stat. §13.08
• Office of the Revisor of Statutes — Laws of Minnesota 1974, chapter 479 — section 5 [15.166] Civil penalties; no effective-date section; "Approved April 11, 1974"
• Office of the Revisor of Statutes — Minn. Stat. §645.02 — "Each act, except one making appropriations, enacted finally at any session of the legislature takes effect on August 1 next following its final enactment, unless a different date is specified in the act"
• Office of the Revisor of Statutes — Laws of Minnesota 1971, chapter 196 — the amendment that put the August 1 rule into §645.02 before 1974 ("takes effect at the beginning of the day on August 1 next following its final enactment, unless a different date is specified in the act")