Minnesota passes the nation's first Internet privacy law.

• Author: Blanke, Jordan M.

This Article will examine the new Internet privacy law passed by the Minnesota state legislature. The law restricts an Internet service provider's disclosure of information that identifies a consumer by physical or electronic address or telephone number, by a history of Internet or online sites visited by the consumer, or by information stored on any of the consumer's data storage devices. The law is narrow in scope, but represents an important first step in protecting personal privacy online. In addition, the law anticipates the passage of a federal law, as it specifically expires on the effective date of any federal legislation that preempts state regulation of personally identifiable information. This Article thus will compare the Minnesota law to a proposed Senate bill that is far greater in scope.

1. INTRODUCTION

   In a scene from Steven Spielberg's futuristic film, "Minority Report," the main character walks through a commercially enhanced shopping mall. (1) Holographic billboards greet him every few seconds: "Stressed out John Anderton? Need a vacation? Come to Aruba."; "Challenge yourself, John! Push harder, John!"; and "It's not just a car, Mr. Anderton. It's an environment." (2)

   While the film is set in the year 2054, when sophisticated iris scan technology provides instant recognition of people by machines that scan their eyeballs, (3) we presently have the similar capability to identify and monitor the habits of online users. By tracking personal information like social security numbers, telephone numbers or e-mail addresses, individuals can be immediately identified. Unlimited amounts of information can be tied to those identifiers.

   When someone buys an item in a store and is asked for his or her phone number at the cash register, all the information about that transaction can be permanently associated with that person. When one uses a grocery store's discount card, all of the purchases can be recorded. On the Internet, whenever someone visits a website, requests information, or performs a search, that information can be saved and linked to that person.

   In the brick and mortar world, one can choose not to divulge a phone number to a clerk at the cash register, or refuse to shop at stores that require the use of a special card to receive discounts. On the Internet, however, it is becoming increasingly difficult to retain much anonymity.

   If someone entered a store at a shopping mall and was greeted with a voice saying, "Hello, Mr. Yakamoto! Welcome back. How'd those assorted tank tops work out for you?" he might think twice about returning to that store. While some people might enjoy a personal welcome with ready service, others might prefer to shop more anonymously. In the non-electronic world, one always has the option of leaving the store.

   One of the enticing characteristics of the early days of the Web was its aura of anonymity. Even today, many people who might be hesitant to participate in a live, face-to-face environment might feel more comfortable contributing in an electronic chat room, where they do not have to deal with traditional nuances of social interaction. The pervasive collection, sharing, and selling of personal information on the Internet threatens to undermine this essential feature of the medium.

   The evolution of the Internet has seen the technology of data collection far surpass the ability of the law to protect the information collected. While an individual can refuse to disclose personal information in a store or over the telephone, it is virtually impossible to prevent the compilation of information online that one may not even be aware is being collected.

   While the tragedy of September 11, 2001, temporarily pushed many concerns about privacy to a back burner, efforts are again underway to improve the personal privacy protection of Internet users. Minnesota has taken an important step by passing the nation's first Internet privacy law. (4)

2. MINNESOTA'S INTERNET PRIVACY LAW

   Minnesota's Internet Privacy Law, which took effect March 1, 2003, regulates the disclosure of personally identifiable information ("PII") by Internet service providers ("ISPs"). (5) The law mirrors the federal Video Consumer Privacy Act (6) and the state videotape rental privacy laws of New York (7) and Minnesota. (8) These laws generally prohibit the disclosure of the video rental habits and PII of individuals who rent videotapes. (9) Similarly, Minnesota's new law prohibits the disclosure by ISPs of the browsing habits and PII of individuals who purchase services enabling them to gain access to the Internet. (10)

   Under Minnesota's law, ISPs are prohibited from disclosing PII except when the PII is specifically required to be disclosed (11) or is specifically permitted to be disclosed. (12) An ISP may obtain the authorization of a consumer to permit disclosure using either an opt-in or opt-out scheme. (13) The law expires on the effective date of any federal legislation that preempts state regulation of the release of PII by ISPs. (14)

   1. Definitions

      Section 1 of Minnesota's new law defines an ISP as "a business or person who provides consumers authenticated access to, or presence on, the Internet." (15) Significantly, the scope of the law does not include operators of websites. A consumer is "a person who agrees to pay a fee to an Internet service provider for access to the Internet for personal, family, or household purposes, and who does not resell access." (16) Probably the most important definition is that of PII: "Personally identifiable information" means information that identifies: (1) a consumer by physical or electronic address or telephone number; (2) a consumer as having requested or obtained specific materials or services from an Internet service provider; (3) Internet or online sites visited by a consumer; or (4) any of the contents of a consumer's data-storage devices. (17)

      Importantly, this definition includes not only traditional personal information like name, address, telephone number, and e-mail address, and standard marketing information like product inquiries, but also Internet specific information from things like "clickstream" data (18) and "cookies." (19) The inclusion of items (3) and (4) would prohibit an ISP from disclosing identifying information about a consumer's browsing activities collected from either the server side of an Internet connection or from the consumer's own computer.

      There is a great deal of targeted marketing activity on the Web today related to collecting as much information as possible about the browsing and buying behavior of individual users. A good portion of this collection is done surreptitiously, or, at least, without the knowledge of the vast majority of users. (20) Much of this is accomplished by storing information on the user's own hard drive in the form of cookies. (21) Quite significantly, this law includes such information within the definition of PII. (22)

   2. Required Disclosures

      Section 325M.02 prohibits ISPs from disclosing PII except as provided in Sections 325M.03 and 325M.04. (23) Section 325M.03 requires that PII be disclosed:

      (1) pursuant to a grand jury subpoena; (2) to an investigative or law enforcement officer as defined in section 626A.01, subdivision 7, while acting as authorized by law; (3) pursuant to a court order in a civil proceeding upon a showing of compelling need for the information that cannot be accommodated by other means; (4) to a court in a civil action for conversion commenced by the Internet service provider or in a civil action to enforce collection of unpaid subscription fees or purchase amounts, and then only to the extent necessary to establish the fact of the subscription delinquency or purchase agreement, and with appropriate safeguards against unauthorized disclosure; (5) to the consumer who is the subject of the information, upon written or electronic request and upon payment of a fee not to exceed the actual cost of retrieving the...