Minnesota Tells Businesses What They May Not Do With a Social Security Number. It Never Says What Happens If They Do It.

Minnesota has a statute that tells private businesses, in seven numbered clauses, what they may not do with a Social Security number. It bars printing the number on a membership card. It bars using it as a customer account number. It bars selling it. It bars mailing it. It requires the business to lock down internal access to the numbers it holds.

Then it stops.

Minn. Stat. § 325E.59 has five subdivisions — subdivision 2 was repealed in 2007 — and not one of them creates a penalty, a damages remedy, an injunction, or an assignment of enforcement authority to anyone. There’s no “Remedies” subdivision. There’s no “Enforcement” subdivision. There’s no civil penalty figure, no criminal grade, and no sentence naming the attorney general.

That’s unusual, and you can’t chalk it up to old drafting. The section right next door in the same chapter, Minnesota’s breach-notification statute, closes with exactly the sentence § 325E.59 is missing. So the interesting question about this statute isn’t what it prohibits. It’s what happens when somebody violates it. The real answer, the one I give clients, takes reading three other provisions.

Here’s what the section actually says.

What are the seven things a Minnesota business may not do with a Social Security number?

Subdivision 1(a) opens with a scope line and then lists seven prohibitions. The scope line is short: “A person or entity, not including a government entity, may not do any of the following:”. The seven:

1. Publicly post or publicly display it. The statute defines its own terms in the clause: “publicly post or publicly display in any manner an individual’s Social Security number. ‘Publicly post’ or ‘publicly display’ means to intentionally communicate or otherwise make available to the general public”.
2. Print it on an access card. No printing an individual’s Social Security number “on any card required for the individual to access products or services provided by the person or entity.”
3. Require unsecured internet transmission. No requiring an individual to transmit the number over the internet “unless the connection is secure or the Social Security number is encrypted,” with an exception for what is required by titles XVIII and XIX of the Social Security Act and 42 C.F.R. § 483.20.
4. Require it as a website credential, standing alone. No requiring an individual to use the number to access a website “unless a password or unique personal identification number or other authentication device is also required to access the Internet website.” Note the shape of this one: it does not ban Social Security numbers as login identifiers. It bans them as the only factor.
5. Print it on mailed materials. No printing a number the business knows to be an individual’s Social Security number on materials mailed to that individual, “unless state or federal law requires the Social Security number to be on the document to be mailed.” Clause (5) then supplies a safe harbor for numbers received from third parties: a business that receives a number from a third party in connection with a transaction “is under no duty to inquire or otherwise determine whether the number is or includes that individual’s Social Security number,” and may print it, unless it has actual knowledge that the number is or includes the Social Security number.
6. Use it as the primary account identifier. No “assign[ing] or us[ing] a number as the primary account identifier that is identical to or incorporates an individual’s complete Social Security number, except in conjunction with an employee or member retirement or benefit plan or human resource or payroll administration”. The carve-out is narrow and functional — payroll and benefits administration, not customer accounts.
7. Sell it. No selling “Social Security numbers obtained from individuals in the course of business.”

Paragraph (b) then narrows the seventh prohibition: “sell” doesn’t include a release that “is incidental to a larger transaction and is necessary to identify the individual in order to accomplish a legitimate business purpose.” And it shuts the obvious workaround: “The release of a Social Security number for the purpose of marketing is not a legitimate business purpose under this paragraph.”

Does the statute also impose an affirmative duty?

Yes, and it’s the sleeper. It’s the one I point to when a business tells me its data practices are fine. Subdivision 1(d) doesn’t prohibit anything. It orders the business to secure what it has:

A person or entity, not including a government entity, must restrict access to individual Social Security numbers it holds so that only its employees, agents, or contractors who require access to records containing the numbers in order to perform their job duties have access to the numbers, except as required by titles XVIII and XIX of the Social Security Act and by Code of Federal Regulations, title 42, section 483.20.

That’s a need-to-know access rule written into Minnesota consumer law, and it applies to any private person or entity holding Social Security numbers. No revenue threshold, no minimum number of records, no industry limit. A small employer with a shared drive every employee can open falls short of what subdivision 1(d) requires.

It also pairs naturally with the breach-notification statute. If a business can’t say who had access to a set of Social Security numbers, it’s going to have a hard time working through the notice question under Minn. Stat. § 325E.61 after an incident.

When may a business still put a Social Security number in the mail?

Applications, enrollment documents, and account paperwork, but never on the outside of the envelope. Paragraph (c) is the exception to the mailing prohibitions, and it’s broader than most of the compliance policies I review assume:

Notwithstanding paragraph (a), clauses (1) to (5), Social Security numbers may be included in applications and forms sent by mail, including documents sent as part of an application or enrollment process, or to establish, amend, or terminate an account, contract, or policy, or to confirm the accuracy of the Social Security number. Nothing in this paragraph authorizes inclusion of a Social Security number on the outside of a mailing or in the bulk mailing of a credit card solicitation offer.

That second sentence draws two hard lines, and neither one bends: nothing on the outside of a mailing, and nothing in a bulk-mailed credit card solicitation.

Why are the University of Minnesota and MnSCU treated as private businesses here?

Because subdivision 5 says so. Every prohibition in subdivision 1 applies to “a person or entity, not including a government entity.” Subdivision 5 then defines that exclusion:

For purposes of this section, “government entity” has the meaning given in section 13.02, subdivision 7a, but does not include the Minnesota State Colleges and Universities or the University of Minnesota.

Section 13.02, subd. 7a, defines “government entity” as “a state agency, statewide system, or political subdivision.” Subdivision 5 then pulls two institutions back out of that definition. So they’re not excluded from § 325E.59, and the seven prohibitions and the access duty apply to them the same way they apply to a bank.

Public bodies that are government entities aren’t off the hook. They’re just regulated somewhere else. Minn. Stat. § 13.355, subd. 1, classifies Social Security numbers collected or maintained by a government entity as private data on individuals “except to the extent that access to the Social Security number is specifically authorized by law,” and subdivision 3 bars a government entity from mailing or delivering an item that displays a Social Security number on the outside, or where it’s visible without opening the item, and from requiring or requesting anyone else to do so. Subdivision 2 carves out numbers appearing in documents filed or recorded with the county recorder or registrar of titles, other than documents filed under § 600.23.

What does § 325E.59 not reach?

Three carve-outs, and the third is a hard date. Subdivision 3 provides that the section does not prevent (1) collection, use, or release of a Social Security number as required by state or federal law; (2) collection, use, or release for a purpose specifically authorized or specifically allowed by a state or federal law that itself includes restrictions on the use and release of information on individuals that would apply to Social Security numbers; or (3) “the use of a Social Security number for internal verification or administrative purposes.”

Subdivision 4 adds: “This section does not apply to documents that are recorded or required to be open to the public under chapter 13 or by other law.”

And subdivision 1(e) is a one-sentence time limit: “This section applies only to the use of Social Security numbers on or after July 1, 2008.”

Clause (3) of subdivision 3 (internal verification and administrative purposes) carries a lot of weight. Put it next to the payroll-and-benefits carve-out in subdivision 1(a)(6) and you can see what the statute is after: external exposure of the number. It isn’t aimed at the fact that a business holds the number and uses it to run itself.

Can a Minnesota consumer sue a business for violating § 325E.59?

The statute doesn’t say, and that silence is the whole issue. Be suspicious of anyone who gives you a confident answer in either direction.

Here’s everything the text gives you.

§ 325E.59 itself supplies nothing. Its five subdivisions are: subdivision 1 (the prohibitions and the access-control duty), subdivision 2 (repealed by Laws 2007, ch. 129, § 58), subdivision 3 (coordination with other law), subdivision 4 (public records), and subdivision 5 (definitions). Read it end to end. None of them mentions damages, penalties, injunctions, the attorney general, a county attorney, or a private action.

The section next door shows what an express grant looks like. Minn. Stat. § 325E.61, subd. 6, is a single sentence: “The attorney general shall enforce this section and section 13.055, subdivision 6, under section 8.31.” By its terms that sentence reaches § 325E.61 and § 13.055, subd. 6. It doesn’t reach § 325E.59.

The legislature also knows how to close the door. In the Minnesota Consumer Data Privacy Act, Minn. Stat. § 325M.20(b) routes enforcement to the attorney general “in accordance with section 8.31,” and paragraph (d) then says: “Nothing in sections 325M.10 to 325M.21 establishes a private right of action, including under section 8.31, subdivision 3a, for a violation of sections 325M.10 to 325M.21 or any other law.” Section 325E.59 has nothing like either sentence.

§ 8.31 itself isn’t a closed list. Subdivision 1 begins by directing that “[t]he attorney general shall investigate violations of the law of this state respecting unfair, discriminatory, and other unlawful practices in business, commerce, or trade, and specifically, but not exclusively,” a set of named statutes. The only chapter 325E provision named in that list is § 325E.39, the telephone-advertising-services act. Section 325E.59 isn’t on it. But “but not exclusively” means the list, on its own, doesn’t settle the question, and the Minnesota Supreme Court has said so. In Findling v. Group Health Plan, Inc., 998 N.W.2d 1 (Minn. 2023), it said that “[t]he list of 10 specific laws following the broad grant of authority is not exclusive”, and that “the set of laws for which an individual can bring a private action under subdivision 3a aligns with the set of laws that the Attorney General is empowered to investigate and enforce under section 8.31.” That case was about the Health Records Act, which isn’t on the list either.

That matters because the private remedy in Minn. Stat. § 8.31, subd. 3a, is keyed to the same set:

In addition to the remedies otherwise provided by law, any person injured by a violation of any of the laws referred to in subdivision 1 may bring a civil action and recover damages, together with costs and disbursements, including costs of investigation and reasonable attorney’s fees, and receive other equitable relief as determined by the court.

So a private § 8.31, subd. 3a, claim built on a § 325E.59 violation depends on § 325E.59 being one of “the laws referred to in subdivision 1” through the general clause rather than the named list — after Findling, a law “respecting unfair, discriminatory, and other unlawful practices in business, commerce, or trade”. No court I’ve found has decided whether § 325E.59 is one, and this article doesn’t decide it either. The closest decision cuts the other way for the statute next door. In the Target breach litigation, the federal court in Minnesota rejected a private claim under § 325E.61 through subd. 3a, reasoning that the argument “stretches the language of the statute beyond the breaking point” because § 325E.61 says the attorney general “shall” enforce it. That’s one federal district court decision, it came nine years before Findling, and it doesn’t bind a Minnesota state court. Its reasoning also rests on an enforcement sentence § 325E.59 doesn’t have. If you plan to plead it, expect to fight about that threshold question before you ever get to the merits.

And even if that door is open, there’s another filter. In Ly v. Nystrom, 615 N.W.2d 302 (Minn. 2000), the Minnesota Supreme Court held “that the Private AG Statute applies only to those claimants who demonstrate that their cause of action benefits the public,” and overruled its earlier Church of Nativity decision to the extent that decision could be construed to permit recovery without proof of public benefit. Two justices wrote separately, taking the position that the statute’s plain language contains no such requirement. We cover the public benefit filter at length in our guide to Minnesota’s private attorney general statute. A standardized business practice that hits a whole customer base (printing Social Security numbers on every mailed statement, say) sits very differently under Ly than a single misdirected envelope.

What actually happens after a Social Security number is exposed?

In my practice, the claim usually travels under something other than § 325E.59. The statute is most useful as a compliance standard and as evidence of Minnesota public policy. It’s not much use as a stand-alone cause of action, because it doesn’t describe one.

The laws that do carry stated consequences, and that commonly overlap the same facts, are the breach-notification statute at § 325E.61, which the attorney general enforces under § 8.31 by its own terms; the federal Fair Credit Reporting Act, where the exposure produces a fraudulent tradeline; and Minnesota’s criminal identity theft statute at § 609.527, which is what makes the police report described in our identity theft response guide obtainable. Where a business made affirmative representations about how it protects the number, the Consumer Fraud Act analysis in our consumer protection statutes guide is often the more direct route. And for how § 325E.59 fits with Minnesota’s other data statutes, see Minnesota’s three privacy regimes.

For a business, it runs the other way, and it’s simpler. Subdivision 1 is a checklist, short enough that I can audit a client against it in an afternoon: no Social Security number on a member card, no Social Security number as a customer account number, no unencrypted transmission required, no single-factor Social Security number login, nothing on the outside of an envelope, no bulk credit card solicitation carrying the number, no sale, and access limited to the people whose jobs require it. Every item on that list is in the statute. Writing down who has access isn’t one of them, but it’s how you’ll show you complied. What isn’t in the statute is a number telling you what breaking it costs. That’s a reason to comply, not a reason to relax.

Madgett Law, LLC works on Minnesota consumer privacy and credit reporting matters, including exposure of Social Security numbers, disputes with credit reporting agencies and furnishers, and identity theft recovery, and advises Minnesota businesses on their data-handling obligations under state law. If your Social Security number got exposed, or your business needs its handling practices checked against § 325E.59, send us a message or call 612-470-6529.

Sources: Minn. Stat. § 325E.59 (2025 Minnesota Statutes, Minnesota Office of the Revisor of Statutes, revisor.mn.gov/statutes/cite/325E.59): subd. 1(a) opening scope line and clauses (1)–(7) (public posting or display and its definition; access-card printing; unsecured internet transmission; single-factor website access; printing on mailed materials, including the third-party actual-knowledge safe harbor; primary account identifier and the retirement, benefit, human resource, and payroll carve-out; and sale); subd. 1(b) (definition of “sell,” the incidental-and-necessary-for-a-legitimate-business-purpose exclusion, and the marketing sentence); subd. 1(c) (applications and forms sent by mail; the bar on the outside of a mailing and on bulk credit card solicitation offers); subd. 1(d) (mandatory restriction of internal access to employees, agents, or contractors who require access to perform their job duties); subd. 1(e) (applies only to use on or after July 1, 2008); subd. 2 (repealed, Laws 2007, ch. 129, § 58, per the Revisor’s codified note); subd. 3, clauses (1)–(3) (coordination with other law; internal verification or administrative purposes); subd. 4 (documents recorded or required to be open to the public under chapter 13 or other law); subd. 5 (definition of “government entity,” excluding the Minnesota State Colleges and Universities and the University of Minnesota from that definition). Minn. Stat. § 13.02, subd. 7a (2025) (“Government entity” means a state agency, statewide system, or political subdivision). Minn. Stat. § 13.355 (2025): subd. 1 (government-held Social Security numbers are private data unless access is specifically authorized by law); subd. 2 (county recorder and registrar of titles exception, other than documents filed under § 600.23); subd. 3(1)–(2) (no display on the outside of a mailed item; no requiring or requesting another to do so). Minn. Stat. § 325E.61, subd. 6 (2025) (“The attorney general shall enforce this section and section 13.055, subdivision 6, under section 8.31.”). Minn. Stat. § 325M.20 (2025), paragraphs (b) and (d) (attorney general enforcement in accordance with § 8.31; express statement that nothing in §§ 325M.10 to 325M.21 establishes a private right of action, including under § 8.31, subd. 3a). Minn. Stat. § 8.31 (2025): subd. 1 (duty to investigate violations of laws respecting unfair, discriminatory, and other unlawful practices in business, commerce, or trade, “specifically, but not exclusively,” the enumerated acts, of which § 325E.39 is the only chapter 325E section named); subd. 3a (private civil action for damages, costs and disbursements, costs of investigation, reasonable attorney’s fees, and equitable relief, for “any person injured by a violation of any of the laws referred to in subdivision 1”). Minn. Stat. § 609.527 is named only as Minnesota’s criminal identity theft statute; no subdivision of it is relied on in this article. Case law: Hoang Minh Ly v. Nystrom, 615 N.W.2d 302 (Minn. 2000) (No. C6-99-565, decided August 3, 2000), for the holding that the private attorney general statute applies only to claimants who demonstrate that their cause of action benefits the public, the overruling of Church of Nativity to the extent it permitted recovery without proof of public benefit, and the existence of separate opinions disagreeing on that point — Caselaw Access Project, static.case.law/nw2d/615/cases/0302-01.json. Findling v. Group Health Plan, Inc., 998 N.W.2d 1 (Minn. 2023) (Nos. A21-1518, A21-1527, A21-1528, A21-1530, decided December 6, 2023), slip op. at 7 (the list of 10 specific laws in § 8.31, subd. 1 is not exclusive) and slip op. at 8 (the laws for which an individual can bring a private action under subd. 3a align with those the Attorney General may investigate and enforce under § 8.31) (CourtListener). In re Target Corp. Customer Data Security Breach Litigation, 66 F. Supp. 3d 1154, 1168 (D. Minn. 2014) (rejecting a private claim under § 325E.61 through § 8.31, subd. 3a, on the ground that § 325E.61’s “attorney general shall” language is unambiguous) (Caselaw Access Project, static.case.law/f-supp-3d/66/cases/1154-01.json).

Currency note: none of §§ 325E.59, 8.31, 13.02, 13.355, 325E.61, and 325M.20 was amended in the 2026 Regular Session. This article does not assert that a private right of action exists under § 325E.59, and it does not assert that none exists; the statutory text does not resolve the question, and no decision indexed on CourtListener addresses a private claim under § 325E.59. The two decisions discussed on the adjacent § 8.31, subd. 3a question, Findling and In re Target, are identified in the Sources.

This article is general legal information about Minnesota law, not legal advice, and reading it does not create an attorney–client relationship. Whether particular conduct violates § 325E.59, and what remedy if any is available for a violation, depends on facts this article does not know. No outcome is promised or implied.