New Minnesota Data Retention Law Creates Potential Liability For Merchants

Beginning August 1, 2007, merchants with customers in Minnesota may not retain credit or debit card security data after a transaction is completed. Merchants violating the law face strict liability to financial institutions for the costs associated with a card security breach.

The new law also imposes liability on merchants for the data retention practices of their service providers. Any merchant that accepts credit or debit card payments from Minnesota residents may be exposed to liability under this first-of-a-kind law, which codifies into law one of the Payment Card Industry Data Security Standard (PCI DSS) requirements.¹

Minnesota is not alone in its efforts; a number of other states have similar legislation pending. Merchants should consider taking proactive steps to avoid future liability. In particular, merchants with customers in Minnesota should audit and bolster their security plans and procedures related to credit and debit card security data, as well as review their