Stephen L. Love, Appellant,

This opinion is nonprecedential except as provided by
Minn. R. Civ. App. P. 136.01, subd. 1(c).

STATE OF MINNESOTA
IN COURT OF APPEALS
A24-0347

Stephen L. Love,
Appellant,

Lincoln Brown,
Appellant,

Christopher J. Marquedant,
Appellant,

Milton Thomas,
Appellant,

Joshua G. Berg, et al.,
Plaintiffs,

vs.

Department of Human Services, et al.,
Respondents,

Melissa Bjergo,
Defendant.

Filed March 3, 2025
Affirmed in part, reversed in part, and remanded
Bratvold, Judge

Ramsey County District Court
File No. 62-CV-22-4902

Stephen L. Love, Moose Lake, Minnesota (pro se appellant)

Lincoln Brown, Moose Lake, Minnesota (pro se appellant)

Christopher J. Marquedant, Moose Lake, Minnesota (pro se appellant)

2
Milton Thomas, Moose Lake, Minnesota (pro se appellant)

Keith Ellison, Attorney General, Brian M. Card, Assistant Attorney General, St. Paul,
Minnesota (for respondents Minnesota Department of Human Services and Jodi Harpstead)

Eric A. Johnson, Samuel T. Westby, T.W. Vending, Inc., River Falls, Wisconsin (for
respondent T.W. Vending, Inc.)

Considered and decided by Larson, Presiding Judge; Reyes, Judge; and Bratvold,
Judge.
NONPRECEDENTIAL OPINION
BRATVOLD, Judge
Appellants Stephen L. Love, Lincoln Brown, Christopher J. Marquedant, and
Milton Thomas reside at the Minnesota Sex Offender Program (MSOP) in Moose Lake
and are civilly committed to the care and custody of respondent Minnesota Department of
Human Services (DHS) and its commissioner. Respondent Jodi Harpstead was the
commissioner of DHS at the time the complaint was served, and this opinion refers to DHS
and Harpstead collectively as state respondents. Respondent T.W. Vending Inc. is a private
company that contracted with DHS to provide canteen services at MSOP’s Moose Lake
facility.
Appellants seek review of a district court order granting the dismissal of their
amended complaint for failure to state a claim upon which relief can be granted. See Minn.
R. Civ. P. 12.02(e). Appellants argue that the amended complaint sufficiently alleges that
state respondents disclosed appellants’ private data to T.W. Vending, that respondents
allowed other MSOP residents to view the private data, and that respondents failed to notify
appellants in violation of the Minnesota Government Data Practices Act (MGDPA), Minn.
3
Stat. §§ 13.01-.991 (2024). We conclude that the amended complaint allege s sufficient
facts to maintain data-practices claims against DHS but fails to state a claim for relief
against T.W. Vending. Therefore, we affirm in part, reverse in part, and remand for further
proceedings.
FACTS
In September 2022, Love, Brown, and Marquedant served a complaint on state
respondents and T.W. Vending, among others, for violations of the MGDPA, seeking
damages and costs. Thomas then served an identical complaint, and the district court
consolidated the cases. As explained below, appellants later served an amended complaint.
The following summarizes the facts alleged in the amended complaint and construes
reasonable inferences in favor of appellants as the nonmoving party.
In 2018, MSOP searched for a new canteen vendor to sell personal- care and food
items to residents. 1 On October 15, 2018, MSOP informed appellants that canteen kiosks
would be installed that week, the kiosks would use a “separate” system for payment, and
training would be provided after installation and testing.
On October 25, 2018, MSOP notified appellants that T.W. Vending was the new
canteen vendor and that the new kiosks would allow residents to deposit “ money on a
separate account identified only by” the resident’s name.2

1 The amended complaint refers to MSOP broadly, but we understand the amended
complaint’s allegations to relate to MSOP’s Moose Lake facility.

2 The amended complaint refers to appellants as clients and patients; this opinion refers to
appellants and, when appropriate, to residents of MSOP’s Moose Lake facility.
4
On October 28, 2018, a newly installed kiosk displayed the following information
on a screen: Resident “accounts have been imported and you may log onto the kiosk by
typing your MREC number for an account code. Upon doing so, you will be prompted to
choose your own password.” Each appellant received a medical-record number (MREC
number) when they were placed in MSOP’s Moose Lake facility. According to the
amended complaint, MREC numbers are “private, nonpublic, and confidential medical
record[s] uniquely identifying health records and billing information.”3
As each appellant logged into the kiosk, their MREC number appeared on the kiosk
screen “in big bold numbers while other third-party clients [were] within viewing
distance.” The amended complaint added: “This is not to be interpreted to claim third-party
clients used this information.”
On November 2, 2018, DHS executed a contract for vending services w ith
T.W. Vending (the contract); the effective date was October 29, 2018. According to the
amended complaint, T.W. Vending received appellants’ MREC numbers and “financial
banking information” from state respondents “before the contract was executed.”
The amended complaint has two counts and alleges that state respondents and
T.W. Vending violated the M GDPA in four ways: (1) state respondents disclosed
appellants’ MREC numbers to T.W. Vending before the contract was executed and without
authorization from appellants; ( 2) state respondents and T.W. Vending did not install
adequate safeguards to protect appellants’ MREC numbers from other residents before the

3 In their brief to this court, state respondents add that MSOP residents use MREC numbers
“to purchase items and send money out of the facility.”
5
contract was executed; (3) appellants’ MREC numbers are being “continuously
disseminated”; and (4) state respondents and T.W. Vending failed to notify appellants of a
security breach related to the disclosure of appellants’ MREC numbers.
In March 2023, T.W. Vending moved to dismiss appellants’ complaint for failure
to state a claim upon which relief can be granted under Minn. R. Civ. P. 12.02(e). In
May 2023, state respondents also moved under rule 12.02(e) to dismiss the complaint in
part. Appellants opposed both motions to dismiss.
In June 2023, after a hearing, the district court granted the motions to dismiss in part
(June order).4 The June order reflects three rulings relevant to this appeal. First, the district
court dismissed without prejudice all claims against state respondents for alleged violations
of the MGDPA that occurred after the effective date of the contract with T.W. Vending.5
Second, the district court dismissed “with prejudice” all claims against T.W. Vending for
alleged violations of the MGDPA that occurred before the effective date of the contract.
Third, the district court also dismissed “without prejudice” all claims against T.W. Vending
for alleged violations of the MGDPA that occurred after the effective date of the contract.
The district court gave appellants 30 days’ leave to file an amended complaint.

4 The June order notes that the district court’s rationale for its decision was stated on the
record during the motion hearing on May 31, 2023. The record on appeal, however, does
not include a hearing transcript dated May 31, 2023.

5 The June order does not state whether the first ruling was a dismissal with or without
prejudice. Thus, the dismissal was without prejudice. See Minn. R. Civ. P. 41.01(b)
(“Unless otherwise specified in the order, a dismissal herein is without prejudice.”).
6
In July 2023, appellants served an amended complaint that included the factual
allegations and claims outlined above . In lieu of an answer, state respondents and
T.W. Vending filed separate motions under rule 12.02(e) to dismiss the amended complaint
for failure to state a claim upon which relief can be granted. A ppellants opposed the
motions.
At an October 2023 hearing on the motions to dismiss, appellants asked the district
court to allow them to voluntarily dismiss their amended complaint without prejudice,
which state respondents and T.W. Vending opposed. The district court took appellants’
request under advisement along with the pending motions to dismiss.
In December 2023, the district court granted the motions to dismiss all claims
against state respondents and T.W. Vending and directed entry of judgment (December
order). First, the district court addressed the claims against state respondents and
determined that “DHS is statutorily authorized to share” appellants’ MREC numbers “with
entities under contract,” including T.W. Vending, without appellants’ signed authorization.
Second, the district court determined that DHS was not required to notify appellants of any
breach of the MGDPA that occurred before the contract because T.W. Vending’s access to
appellants’ MREC numbers was “related to a governmental purpose—namely providing
canteen services to MSOP clients.”
Third, the district court determined that Harpstead was not liable for any MGDPA
violations because she “was not the DHS Commissioner [in 2018] at the time the alleged
disclosure occurred” and the “plain language of the MGDPA limits liability to a responsible
authority if he or she commits a violation of the statute.” Fourth, the district court reasoned
7
in the alternative that the claims in the amended complaint “are the same claims and legal
theories as were previously dismissed with prejudice in the original complaint.” Because
appellants were parties to the prior adjudication and were given an opportunity to be heard
on their claims, the district court concluded that collateral estoppel precluded appellants
from reasserting the same claims in their amended complaint.
The district court then addressed the claims against T.W. Vending. First, the district
court acknowledged that the amended complaint alleges that appellants’ MREC numbers
“briefly appeared” on the kiosk screen and “that the numbers could have been seen by
others,” but the district court determined that this did not allege a MGDPA violation
because appellants “explicitly [pleaded] that this was not to be interpreted as a claim that
the numbers were used by any third parties.” The amended complaint therefore failed to
state a claim that T.W. Vending caused “an unauthorized person [to view] the data with the
intent to use the data for a nongovernmental purpose,” as prohibited by the MGDPA. See
Minn. Stat. § 13.055, subd. 1(c).
Second, the district court concluded that the amended complaint (a) included “no
allegation that T.W. Vending failed to have appropriate safeguards protecting the
[appellants’] data after the effective date of the contract” and (b) failed to state a claim for
relief related to the alleged unauthorized viewing of appellants’ data that occurred before
the effective date of the contract because the MGDPA did not apply to T.W. Vending
before it executed the contract. Third, and in the alternative, the district court determined
that appellants were collaterally estopped from alleging th at T.W. Vending violated the
8
MGDPA before the effective date of the contract because those claims were previously
dismissed with prejudice.
Love, Brown, Marquedant, and Thomas appeal.6
DECISION
The MGDPA “regulates the collection, creation, storage, maintenance,
dissemination, and access to government data in government entities.” Minn. Stat. § 13.01,
subd. 3. The MGDPA seeks “to reconcile the rights of data subjects to protect personal
information from indiscriminate disclosure with the right of the public to know what the
government is doing.” KSTP-TV v. Ramsey C ounty, 806 N.W.2d 785, 788 (Minn. 2011)
(quotation omitted). The MGDPA “attempts to balance these competing rights within a
context of effective government operation.” Id. (quotation omitted).
The MGDPA imposes three duties relevant for understanding appellants’ amended
complaint. First, a government entity cannot disseminate an individual’s “[p]rivate or
confidential data . . . for any purposes other than those stated to the individual at the time
of collection” without the individual’s informed consent or separate authorization under
the statute. Minn. Stat. § 13.05, subd. 4. Based on the amended complaint, we take as true

6 In the months leading up to this appeal, appellants, who are self-represented, experienced
difficulty ordering a transcript of the October 2023 hearing and filed a declaration with this
court stating that they did not receive a copy of the transcript before they prepared their
brief. The record on appeal includes the October 2023 hearing transcript.

9
the allegation that MREC numbers are private or confidential data and that appellants did
not consent to disclosure of their MREC numbers.7
Second, a “responsible authority” must “establish appropriate security safeguards”
for an individual’s data, including “procedures for ensuring that data that are not public are
only accessible to persons whose work assignment reasonably requires access to the data,
and is only being accessed by those persons for purposes described in the procedure.” Id.,
subd. 5(a)(2). A responsible authority in a state agency is “the state official designated by
law or by the commissioner as the individual responsible for the collection, use and
dissemination of any set of data on individuals, government data, or summary data.” Minn.
Stat. § 13.02, subd. 16(a).
Third, if a “breach of the security of the data” occurs, the responsible government
entity must disclose the breach to the subject of the data. Minn. Stat. § 13.055, subd. 2(a).
“‘Breach of the security of the data’ means unauthorized acquisition of data maintained by
a government entity that compromises the security and classification of the data.” Id.,
subd. 1(a). “‘Unauthorized acquisition’ means that a person has obtained, accessed, or
viewed government data without the informed consent of the individuals who are the
subjects of the data or statutory authority and with the intent to use the data for
nongovernmental purposes.” Id., subd. 1(c).

7 Appellants’ brief to this court contends that the district court erred in its analysis of
“private data on individuals” as stated in the MGDPA and therefore erroneously treated
appellants’ MREC numbers as “public data.” We disagree. The district court expressly
accepted appellants’ allegation that MREC numbers are “private, nonpublic, and
confidential” data subject to the MGDPA.
10
Relatedly, when a government entity executes a contract with a private entity, the
private entity is bound by the MGDPA. Minn. Stat. § 13.05, subd. 6. Specifically, if a
contract “requires that data on individuals be made available to the contracting parties by
the government entity,” then the contracting parties “shall maintain the data on individuals
which [they] received according to the statutory provisions applicable to the data.” Id.
Violations of the MGDPA may be remedied by a civil action. Minn. Stat. § 13.08,
subds. 1-2. If a “responsible authority or government entity” violates the MGDPA, the
person affected by the violation may “bring an action against the responsible authority or
government entity to cover any damages sustained, plus costs and reasonable attorney
fees.” Id., subd. 1. The district court may also grant injunctive relief to prevent violations
of the MGDPA. Id., subd. 2.
Appellants ask this court to reverse the district court’s order granting respondents’
motions under Minn. R. Civ. P. 12.02(e) to dismiss the amended complaint for failure to
state a claim upon which relief can be granted. When deciding a rule 12.02(e) motion to
dismiss, the district court must “accept the facts alleged in the complaint as true and
construe all reasonable inferences in favor of the nonmoving party.” Halva v. Minn. State
Colls. & Univs. , 953 N.W.2d 496, 500 (Minn. 2021) (quotation omitted). Because
Minnesota is a notice -pleading state, plaintiffs “may plead their case by way of a broad
general statement which may express conclusions rather than . . . by a statement of facts
sufficient to constitute a cause of action.” Id. (quotation omitted). A claim survives a rule
12.02(e) motion “if it is possible, on any evidence that might be produced, to grant the
relief demanded.” Id. at 501 (quotation omitted). The claim must, however, give “fair
11
notice to the adverse party of the incident giving rise to the suit with sufficient clarity to
disclose the pleader’s theory upon which his claim for relief is based.” Id. at 503 (quotation
omitted). Appellate courts “review the allegations of a complaint subject to dismissal under
rule 12.02 de novo.” Id. at 500.
While a court generally considers only the facts alleged in the complaint when
deciding a motion to dismiss, a court “may consider [an] entire written contract when the
complaint refers to the contract and the contract is central to the claims alleged.” In re
Hennepin Cnty. 1986 Recycling Bond Litig., 540 N.W.2d 494, 497 (Minn. 1995). Here, as
the district court did, we consider the contract between DHS and T.W. Vending when
reviewing the motions to dismiss because the contract is central to the claims alleged in the
amended complaint. See id. (concluding that district court’s consideration of a contract
central to the claims alleged in the complaint did not convert a motion to dismiss into a
summary-judgment motion).
I. The amended complaint alleges sufficient facts to maintain two data-practices
claims against DHS.

A. The amended complaint alleges that DHS disclosed appellants’ MREC
numbers to T.W. Vending before the effective date of the contract.

On appeal, a ppellants maintain that the amended complaint alleges that DHS
disclosed appellants’ MREC numbers to T.W. Vending before the effective date of the
contract.
8 The state respondents argue that the amended complaint “does not allege that

8 Appellants appear to concede that the amended complaint does not assert a
postcontract-disclosure claim against DHS. In their brief to this court, appellants note that
“private contractors and their employees are specifically authorized to receive private
welfare data from DHS without the consent of the individual subject of the data” when “the
12
state respondents disclosed appellants’ information to T.W. Vending before the contract
was executed.” While the December order stated that “the alleged unauthorized viewing of
the data occurred prior to the effective [date] of the contract,” it did not consider whether
the amended complaint stated a precontract-disclosure claim against DHS.9
In considering the factual allegations in the amended complaint, we look at the
entire amended complaint to determine whether it adequately identified “facts that could
support a finding of a Data Practices Act violation.” Halva, 953 N.W.2d at 503. The
amended complaint alleges that, in October 2018, MSOP notified appellants that a new
canteen vendor, T.W. Vending, would install kiosks at the Moose Lake facility and that
appellants would receive training on how to use the kiosks. On October 28, 2018, the newly
installed kiosks displayed the following message: “Client accounts have been imported and
you may log onto the kiosk by typing your MREC number for an account code.” When
appellants logged into the kiosks, “their MREC numbers appeared in the upper part of the
kiosk screen in big bold numbers.”

disclosure is within the scope of the contract.” In the interest of being thorough, we briefly
consider whether the amended complaint states a postcontract-disclosure claim against
state respondents. The contract authorized DHS to “share information” with T.W. Vending
to provide canteen services to MSOP residents at the Moose Lake facility. This included
providing information “to properly identify clients and to properly set up such client
accounts.” Because the amended complaint alleges that DHS provided T.W. Vending with
appellants’ MREC numbers to provide canteen services at MSOP , we conclude that this
disclosure fell “within the scope of the contract.” Therefore, the amended complaint fails
to state a postcontract-disclosure claim against DHS.

9 To be clear and as discussed below, the district court concluded that the amended
complaint failed to state a claim for relief based on a precontract-disclosure claim against
T.W. Vending.
13
The amended complaint also alleges, and the contract confirms, th at DHS and
T.W. Vending signed a contract on November 2, 2018, with an effective date of
October 29, 2018. The amended complaint alleges that “T.W. Vending received
[appellants’] private data including their MREC number and financial banking information
from [DHS] before the contract was executed.” (Emphasis added.) It also alleges that DHS
“failed to obtain a signed and dated authorization for release of information prior
to . . . signing a contract” with T.W. Vending.
Accepting the alleged facts as true and construing all reasonable inferences in favor
of appellants, we conclude that the amended complaint alleges facts sufficient to state a
claim against DHS for precontract disclosure of appellants’ MREC numbers in violation
of Minn. Stat. § 13.05, subd. 4. Therefore, we reverse the district court’s dismissal of the
precontract-disclosure claim against DHS.
B. The amended complaint alleges that DHS did not establish appropriate
safeguards to protect appellants’ MREC numbers before the effective
date of the contract.

Appellants argue that the amended complaint alleges DHS “failed to institute
appropriate safeguards leading to the unauthorized access of Appellants’ private data.” In
their brief to this court, state respondents do not address appellants’ appropriate-safeguard
claim. The December order also did not address an appropriate-safeguard claim related to
DHS, other than to briefly state that the “alleged unauthorized viewing of the data occurred
prior to the effective [date] of the contract.”
The amended complaint alleges that DHS “failed to install proper safeguards” in
two respects: (1) “ensuring unauthorized access or acquisition to private information could
14
not be obtainable/viewable by other patients in violation of clearly established rights under
the MGDPA” and (2) “upon the protected information shared with third-party clients, per
the contract, including mitigating harmful effects, investigations, corrective actions and
notifications to parties of said breaches.” We understand these allegations to assert that
DHS failed to implement appropriate safeguards to protect the confidentiality of MREC
numbers, as required by Minn. Stat. § 13.05, subd. 5(a)(2), before the effective date of the
contract.
Accepting the alleged facts as true and construing all reasonable inferences in favor
of appellants, we conclude that the amended complaint sufficiently identifies facts to
maintain appellants’ appropriate-safeguard claim against DHS for the period before the
effective date of the contract. Therefore, we reverse the district court’s dismissal of the
appropriate-safeguard claim against DHS.
C. The amended complaint fails to allege facts sufficient to state an
unauthorized-acquisition claim against state respondents and therefore
fails to state a breach of the duty to notify appellants of a security breach.

Appellants argue that the amended complaint alleges DHS was “required to notify”
appellants that “a breach had occurred” but failed to do so.
10 State respondents counter that

10 “Breach of the security of the data” does not include “good faith acquisition of or access
to government data by . . . [a] contractor . . . for the purposes of the entity . . . if the
government data is not provided to or viewable by an unauthorized person, or accessed for
a purpose not described” in Minn. Stat. § 13.05, subd. 5. Minn. Stat. § 13.055, subd. 1(a).
Appellants argue that DHS’s disclosure of their private data to T.W. Vending “was not in
good faith.” State respondents argue that any disclosure to T.W. Vending “was in good
faith and does not constitute a breach.” Because we affirm the district court’s decision
dismissing the unauthorized-acquisition claim on other grounds, we need not reach the
good-faith exception.
15
the amended complaint fails to allege that T.W. Vending or another third party “obtained,
accessed, or viewed” appellants’ data “with the intent to use the data for nongovernmental
purposes” and that, under the relevant statute, “unauthorized acquisition” must include
“intent to use the data for nongovernmental purposes.” Minn. Stat. § 13.055, subd. 1(c).
The state respondents also contend that the amended complaint alleges that T.W. Vending
received appellants’ MREC numbers for a governmental purpose—to provide canteen
services at MSOP’s Moose Lake facility—and that, therefore, no unauthorized acquisition
occurred and no notice is required. The district court dismissed appellants’
unauthorized-acquisition claim against DHS because the “access alleged in the [amended]
complaint was [T.W.] Vending’s access related to a governmental purpose—namely
providing canteen services to MSOP clients.”
The amended complaint does not allege that DHS allowed an “unauthorized
acquisition” of appellants’ MREC numbers, as that term is defined by statute. See id. The
amended complaint alleges that other MSOP residents were “within viewing distance” of
the kiosks that displayed appellants’ MREC numbers but asserts that “[t]his is not to be
interpreted to claim third-party clients used this information.” The amended complaint does
not allege that T.W. Vending intended to use appellants’ MREC numbers “for
nongovernmental purposes” and, in fact, alleges that T.W. Vending purported to use the
MREC numbers for canteen vending. Id. In their reply brief to this court, appellants appear
to concede that the amended complaint “never alleged their data was used for
nongovernmental purposes.”
16
We conclude that the amended complaint does not allege an
unauthorized-acquisition claim against DHS related to appellants’ MREC numbers;
therefore, it fails to state a claim for “breach of the security of the data” triggering a duty
to notify appellants as provided in Minn. Stat. § 13.055, subd. 2(a). Thus, we affirm the
district court’s dismissal of the unauthorized-acquisition claim against DHS.
D. Even if we assume that the district court erred by dismissing appellants’
claims against Harpstead in her official capacity, any error would be
harmless.

As discussed, a “responsible authority” shall “establish appropriate security
safeguards” to protect individuals’ private data. Minn. Stat. § 13.05, subd. 5(a)(2). For state
departments, the commissioner of the department is the responsible authority. Minn. R.
1205.0200, subp. 13 (2023).
It is undisputed that Harpstead was the commissioner of DHS at the time the
amended complaint was served but not at the time of the MGDPA violations alleged in the
amended complaint. Appellants argue that Harpstead is DHS’s “responsible authority” and
can be held liable in her official capacity for MGDPA claims that occurred before she
became commissioner. In their brief to this court, state respondents acknowledge that
“Commissioner Harpstead is DHS’s ‘responsible authority.’” S tate respondents argue,
however, that the claims against Harpstead were correctly dismissed because she was not
the commissioner in 2018 when the alleged violations occurred. State respondents argue
that, even if Harpstead was commissioner at the time, “dismissal was still appropriate
because Appellants do not allege Commissioner Harpstead personally violated the
17
MGDPA.” The district court dismissed appellants’ claims against Harpstead based on state
respondents’ arguments.11
Even if we assume that the district court erred in dismissing appellants’ claims
against Harpstead, we conclude that appellants failed to show prejudice. If, on appeal, an
appellant shows that the district court committed an error, the existence of that error cannot
support relief without a showing that the error prejudiced that appellant. See Minn. R. Civ.
P. 61 (“The court at every stage of the proceeding must disregard any error or defect in the
proceeding which does not affect the substantial rights of the parties.”); Goldman v.
Greenwood, 748 N.W.2d 279, 285 (Minn. 2008) (citing this aspect of Minn. R. Civ. P. 61).
“Official-capacity suits generally represent another way of pleading an action
against an entity of which an officer is an agent . . . . [O]fficial capacity suits are, in all
respects other than the name, to be treated as a suit against the entity.” Khalifa v. State,
397 N.W.2d 383, 389- 90 (Minn. App. 1986).12 Because the amended complaint names

11 State respondents and the district court rely on a nonprecedential opinion, Wills v. Jesson,
which states that the “plain language of the MGDPA limits liability to a responsible
authority if he or she commits a violation of the statute.” No. A18-0948, 2019 WL 418542,
at *3 (Minn. App. Feb. 4, 2019). This court concluded that the statute “does not extend
liability to a responsible authority for the actions of his or her employees, agents, or
representatives” and that a complaint must allege that the responsible authority individually
violated the MGDPA. Id. Wills is not binding precedent but may be persuasive. See Minn.
R. Civ. App. P. 136.01, subd. 1(c) (stating that nonprecedential opinions “are not binding
authority” but “may be cited as persuasive authority”). For the reasons stated, we need not
consider whether Wills supports dismissal of appellants’ claims against Harpstead.

12 Official-capacity suits are often brought against new commissioners, and party
substitution is contemplated by the Minnes ota Rules of Civil Procedure. Minn. R. Civ.
P. 25.04 (“When any public officer is a party to an action and during its pendency dies,
resigns, or otherwise ceases to hold office, the action may be continued and maintained by
18
Harpstead in her official capacity as the commissioner of DHS, we treat the claims against
Harpstead as being against DHS.
As discussed above, the amended complaint sufficiently alleges two data-practices
claims against DHS itself. Appellants do not explain how the claims against DHS and
against Harpstead in her official capacity are different in any respect. Thus, even if the
district court erred by dismissing the claims against Harpstead, any error would be
harmless. Therefore, we affirm the district court’s dismissal of the claims against
Harpstead.
E. Collateral estoppel does not apply to appellants’ claims against DHS for
the period before DHS’s contract with T.W. Vending.

In the alternative, the district court dismissed the claims against DHS based on
collateral estoppel. Appellants argue that the district court erred in applying collateral
estoppel to preclude their claims. State respondents argue that the amended complaint
repeated claims that were identical to those previously adjudicated and dismissed in the
district court’s June order and that, therefore, collateral estoppel applies.
“Collateral estoppel bars the relitigation of issues that are both identical to those
issues already litigated by the parties in a prior action and necessary and essential to the
resulting judgment.” State Farm Mut. Auto. Ins. Co. v. Lennartson, 872 N.W.2d 524, 534

or against the officer’s successor.”). In other words, a government entity does not avoid an
official-capacity suit because its commissioner changes.
19
(Minn. 2015) (emphasis omitted) (quotation omitted). Collateral estoppel applies if all of
these elements are met:
(1) the issue must be identical to one in a prior adjudication;
(2) there was a final judgment on the merits; (3) the estopped
party was a party . . . to the prior adjudication; and (4) the
estopped party was given a full and fair opportunity to be heard
on the adjudicated issue.

Hauschildt v. Beckingham, 686 N.W.2d 829, 837 (Minn. 2004). “Whether collateral
estoppel precludes litigation of an issue is a mixed question of law and fact” that appellate
courts review de novo. Id.
We conclude that collateral estoppel did not preclude appellants from asserting their
claims for MGDPA violations that predate DHS’s contract with T.W. Vending in their
amended complaint. First, in the June order that dismissed some of appellants’ claims
against DHS, the district court gave leave for appellants to file an amended complaint. See
Minn. R. Civ. P. 15.01 (stating that a party may amend their pleading “by leave of court”).
Second, while the June order dismissed some claims against DHS, it did so without
prejudice. See Minn. R. Civ. P. 41.01(b) (“Unless otherwise specified in the order, a
dismissal herein is without prejudice.”). Third, the June order did not result in a final
judgment on the merits for DHS and was thus “subject to revision.” See Minn. R. Civ.
P. 54.02 (stating that a district court’s order “is subject to revision at any time” before final
judgment).
As explained above, the amended complaint asserts claims against DHS for
MGDPA violations that occurred before DHS’s contract with T.W. Vending. These claims
were not “necessarily determined in a previous judgment,” given that appellants were
20
granted leave to amend, and as the supreme court has cautioned, appellate courts “do not
apply collateral estoppel rigidly, but focus on whether an injustice would be worked upon
the party against whom the estoppel is urged.” Mach v. Wells Concrete Prods. Co.,
866 N.W.2d 921, 927 (Minn. 2015) (quotation omitted).
To be clear, we read the December order to apply collateral estoppel to the amended
complaint’s claims against DHS for alleged MGDPA violations that occurred after DHS’s
contract with T.W. Vending. In their briefs to this court, appellants do not challenge this
ruling, appear to have abandoned all postcontract claims against DHS, and instead pursue
those claims exclusively against T.W. Vending. Thus, we need not consider appellants’
postcontract claims against DHS.
II. The amended complaint fails to state a data-practices claim against
T.W. Vending.

Appellants argue that the amended complaint states a claim for MGDPA violations
against T.W. Vending because it was not authorized to receive appellants’ MREC numbers
before the effective date of the contract. T.W. Vending argues that it was not subject to the
MGDPA before the effective date of the contract and therefore could not be held liable for
any precontract data-practices claim. The district court considered and rejected appellants’
claim that T.W. Vending was liable under the MGDPA before the effective date of its
contract with DHS.
A private company is subject to the MGDPA under certain conditions. If the
government entity executes a contract with a private company “to perform any of its
functions,” all data obtained and used by the private company “in performing those
21
functions is subject to ” the MGDPA and the private company must comply with the
MGDPA “as if it were a government entity.” Minn. Stat. § 13.05, subds. 11(a), 6.
We conclude that the amended complaint fails to state a claim for relief against
T.W. Vending for alleged violations of the MGDPA that occurred before the effective date
of its contract with DHS. Appellants’ brief to this court asserts that the amended complaint
alleges data-practices violations that occurred before the contract was executed. Thus,
T.W. Vending was not under contract with DHS at the time of the MGDPA violations
alleged in the amended complaint.
In their briefs to this court, appellants do not argue that the amended complaint
alleged a postcontract-disclosure or appropriate-safeguard claim against T.W. Vending. 13
On the other hand, appellants argue, without specifying when, that T.W. Vending was
“required to notify” appellants that “a breach had occurred” as provided in Minn. Stat.
§ 13.055, subd. 2(a), but failed to do so. T.W. Vending maintains that it used appellants’
private data for governmental purposes, “namely, providing canteen services to MSOP
clients.” T.W. Vending also argues that the amended complaint does not allege that a third
party “obtained, accessed, or viewed” appellants’ MREC numbers “with the intent to use
the data for nongovernmental purposes,” so no breach occurred and no duty to provide
notice was triggered. See Minn. Stat. § 13.055, subd. 1(c).

13 In the alternative, the district court dismissed the precontract claims against
T.W. Vending based on collateral estoppel. In their brief to this court, appellants do not
specifically challenge the district court’s application of collateral estoppel to those claims.
We need not address the collateral-estoppel issue, however, because we affirm the district
court’s decision to dismiss appellants’ claims against T.W. Vending on other grounds.
22
We conclude, for the same reasons discussed above as to the amended complaint’s
unauthorized-acquisition claim against DHS, that the amended complaint fails to allege a
claim for relief against T.W. Vending related to an “unauthorized acquisition” of
appellants’ MREC numbers for nongovernmental purposes. Minn. Stat. § 13.055,
subd. 1(c). We therefore affirm the district court’s dismissal of the
unauthorized-acquisition claim against T.W. Vending. We also conclude that the amended
complaint fails to allege a data-practices claim against T.W. Vending. Therefore, we affirm
the district court’s dismissal of the amended complaint’s claims against T.W. Vending.
Affirmed in part, reversed in part, and remanded.