The Internet service provider shall take reasonable steps to maintain the security and privacy of a consumer‘s personally identifiable information. The Internet service provider is not liable for actions that would constitute a violation of section 609.88, 609.89, or 609.891, if the Internet service provider does not participate in, authorize, or approve the actions.