Privacy & Information Security Law Blog

On May 24, 2024, Governor Tim Walz signed H.F. 4757 into law, enacting the Minnesota Consumer Data Privacy Act (“MNCDPA” or “Act”). The MNCDPA will take effect on July 31, 2025. 

Applicability

The MNCDPA applies to:

• Legal entities that conduct business in Minnesota or produce products or services that are targeted to residents of Minnesota, and that satisfy one or more of the following thresholds: (1) during a calendar year, controls or processes personal data of 100,000 consumers or more, excluding personal data controlled or processed solely for the purpose of completing a payment transaction; or (2) derives over 25 percent of gross revenue from the sale of personal data and processes or controls personal data of 25,000 consumers or more.
• A controller or processor acting as a “technology provider” under Minnesota law (e., certain persons who contract with a public educational agency or institution).

The MNCDPA applies to Minnesota consumers (i.e., Minnesota residents who act only in an individual or household context and not in a commercial or employment context). The MNCDPA contains numerous exemptions, including exemptions for state or federally chartered banks or credit unions and certain affiliates or subsidiaries, certain insurance companies, nonprofit organizations established to detect and prevent insurance fraud, data subject to the Gramm-Leach-Bliley Act; PHI under HIPAA, and certain air carriers. Small businesses as defined by the U.S. Small Business Administration are exempt except from the Act’s sale of sensitive data requirements.

Controller Obligations

With some notable differences, the MNCDPA contains obligations for controllers that largely follow provisions in other comprehensive state privacy laws, such as obligations relating to data minimization, data protection impact assessments (called “data privacy and protection assessments”), obtaining consent to process sensitive data and providing a privacy notice with certain specified content (including a description of the controller’s data retention policies).

Notably, the MNCDPA requires that a controller:

• maintain a data inventory as part of the required reasonable security practices;
• notify consumers of material changes with respect to the controller’s privacy notice or practices, and take “all reasonable electronic measures to provide notification” to affected consumers, “taking into account available technology and the nature of the relationship”; and
• document and maintain a description of the policies and procedures the controller has adopted to comply with MNCDPA.

The MNCDPA includes requirements for placement of the privacy notice, which must be posted online through a conspicuous hyperlink using the word “privacy” on the controller’s website home page or, in the case of a mobile application, the app store page or download page and in the application’s settings menu or in a similarly conspicuous and accessible location.

Consumer Rights

The MNCDPA generally follows the model set by other state comprehensive privacy laws in terms of the rights it provides to consumers (for example, the NJDPA).

Notably, the MNCDPA has specific provisions regarding profiling. If a consumer’s personal data is subject to certain profiling, the consumer has the rights to: (1) question the result of the profiling, (2) be informed of the reason that the profiling resulted in the decision, and, if feasible, to be informed of what actions the consumer might have taken to secure a different decision and the actions that the consumer might take to secure a different decision in the future, (4) review the consumer’s personal data used in the profiling, and (5) if the decision is determined to have been based upon inaccurate personal data, have the data corrected and the profiling decision reevaluated.

As with several recent laws, a consumer also has a right to obtain a list of third parties to which the controller has disclosed the consumer’s personal data. Controllers have 45 days to respond to consumer rights requests, with a potential 45-day extension when reasonably necessary.

Enforcement

The MNCDPA does not contain a private right of action and will be enforced exclusively by the Minnesota Attorney General. The MNCDPA provides a 30-day cure period. The cure provision expires January 31, 2026. Violations are subject to civil penalties up to $7,500 per violation.

Effective Date

The MNCDPA will take effect on July 31, 2025.