Processes personal data, in Minnesota

Minn. Stat. § 72A.502, subd. 7 · Read the law's page

• If you are an insurer, insurance agent or insurance-support organization and you disclose personal or privileged information without a written authorization to conduct actuarial or research studies, make sure that no individual may be identified in the actuarial or research report (Minn. Stat. 72A.502, subd. 7(1)).
• Make sure that materials allowing an individual to be identified are returned or destroyed as soon as they are no longer needed (Minn. Stat. 72A.502, subd. 7(2)).
• Make sure that the actuarial or research organization agrees not to disclose the information unless Minn. Stat. 72A.502 would otherwise permit the disclosure if you made it (Minn. Stat. 72A.502, subd. 7(3)).

Minn. Stat. § 72A.139 · Read the law's page

• If you are a health plan company, do not require or request that an individual or a blood relative take a genetic test, do not inquire whether one has taken or refused a test or what the results were, and do not take into consideration the fact or the results of a genetic test, in determining eligibility, establishing premiums, limiting or renewing coverage or any other underwriting decision in connection with a health plan.
• If you are a life insurance company or fraternal benefit society that requires a genetic test to determine insurability, obtain the individual's written informed consent for the test, using a disclosure form the commissioner has approved, and state in it whether you will pay for a genetic counselor.
• If you are a life insurance company or fraternal benefit society that requires a genetic test, notify the individual of the result by notifying the individual or the individual's designated physician, and urge the individual to contact a genetic counselor or other health care professional where no physician has been authorized to receive the result.
• If you are a life insurance company or fraternal benefit society, do not require an individual to submit to a genetic test unless you pay its cost.

Minn. Stat. § 325E.61 · Read the law's page

• Disclose a breach of the security of the system to an affected Minnesota resident in the most expedient time possible and without unreasonable delay. Minnesota sets no fixed numeric-day cap on notice to residents, unlike several peer states.
• If you discover circumstances requiring notification of more than 500 persons at one time, also notify, within 48 hours, every nationwide consumer reporting agency of the timing, distribution, and content of the notices (Minn. Stat. 325E.61, subd. 2).
• Notify the data owner immediately upon discovering a breach if you maintain, but do not own, the affected data.

Minn. Stat. § 13.386 · Read the law's page

• Do not collect genetic information about an individual, whether you are a government entity or any other person, without the individual's written informed consent, unless a law expressly provides otherwise.
• Use genetic information only for purposes to which the individual has given written informed consent, and store it only for the period to which the individual has given written informed consent.
• Disseminate genetic information only with the individual's written informed consent, or if necessary to accomplish the purposes the individual consented to; a consent to disseminate must be signed and dated and, unless the law provides otherwise, is valid for one year or a lesser period the consent specifies.

Minn. Stat. § 325E.59 · Read the law's page

• If you are a person or entity other than a government entity, do not publicly post or publicly display an individual's Social Security number in any manner.
• Do not print an individual's Social Security number on any card the individual must use to access products or services you provide.
• Do not require an individual to transmit the individual's Social Security number over the Internet unless the connection is secure or the number is encrypted, and do not require an individual to use the number to access an Internet website unless a password, unique personal identification number or other authentication device is also required.
• Do not print a number you know to be an individual's Social Security number on materials mailed to the individual unless state or federal law requires it, although applications and forms sent by mail may include it, and never on the outside of a mailing.
• Do not assign or use a number as the primary account identifier that is identical to or incorporates an individual's complete Social Security number, except in conjunction with an employee or member retirement or benefit plan or human resource or payroll administration.
• Do not sell Social Security numbers obtained from individuals in the course of business; a release incidental to a larger transaction that is necessary to identify the individual for a legitimate business purpose is not a sale, and a release for marketing is not a legitimate business purpose.
• Restrict access to the Social Security numbers you hold so that only employees, agents or contractors who need access to perform their job duties have it.

Minn. Stat. § 62U.04, subd. 4(a)(1) · Read the law's page

• If you are a health plan company, dental organization or third-party administrator, submit encounter data on a monthly basis to the private entity the commissioner of health designates, in the form and manner the commissioner specifies, and submit it only as de-identified data as described under 45 CFR 164.514 (Minn. Stat. 62U.04, subd. 4(a)(1)).

Minn. Stat. § 325M.14 · Read the law's page

• Give a Minnesota consumer a means to confirm processing, access, correct, delete, and port their personal data.
• Provide a Minnesota consumer, on request, a list of the specific third parties you disclosed their personal data to, not merely categories of third parties.
• Offer a Minnesota consumer the right to opt out of automated profiling in furtherance of decisions with legal or similarly significant effects, question the result, receive an explanation, and have the decision reevaluated if based on inaccurate data.

Minn. Stat. § 325M.15 · Read the law's page

• Do not attempt to identify the subjects of deidentified or pseudonymous data held for a Minnesota controller unless that controller, which caused the data to be deidentified or pseudonymized, expressly authorizes it (Minn. Stat. 325M.15(d)).
• Do not attempt to identify the subjects of data collected with only pseudonymous identifiers (Minn. Stat. 325M.15(e)).
• If you use pseudonymous or deidentified data as a controller, monitor compliance with the contractual commitments the data is subject to and take appropriate steps to address any breach of them (Minn. Stat. 325M.15(c)).

Minn. Stat. § 325M.20 · Read the law's page

• Expect MCDPA violations to be enforced exclusively by the Minnesota Attorney General, never by a private plaintiff, including under § 8.31's general private-attorney-general mechanism.
• Do not rely on a warning letter or cure opportunity before an enforcement action. Minnesota's discretionary 30-day cure mechanism expired January 31, 2026.

Minn. Stat. §§ 325M.10 to 325M.21 · Read the law's page

• Limit your collection of a Minnesota resident's personal data to what is adequate, relevant, and reasonably necessary for the purpose you disclosed to them, and obtain consent before processing it for an undisclosed, incompatible secondary purpose.
• Confirm whether you are a postsecondary institution regulated by the Minnesota Office of Higher Education before assuming MCDPA already binds you; that sector's compliance date is July 31, 2029, not the general July 31, 2025 date.

Minn. Stat. § 325F.995 · Read the law's page

• If you are a direct-to-consumer genetic testing company, make available in plain language a high-level privacy policy overview, a prominent public privacy notice covering your collection, consent, use, access, disclosure, maintenance, transfer, security, retention and deletion practices for genetic data, and information on how to file a complaint under section 45.027.
• Obtain a consumer's express consent to collect, use and disclose genetic data: initial consent describing the uses and who has access, separate consent naming the recipient for each transfer to a person other than your vendors and service providers, separate consent for each use beyond the primary purpose, separate consent to retain a biological sample after testing, informed consent under the federal human-subjects rules to transfer data for research, and express consent for marketing based on genetic data.
• Do not disclose genetic data to law enforcement or any other governmental agency without the consumer's express written consent unless the disclosure is made under a valid search warrant or court order.
• Do not disclose a consumer's genetic data without the consumer's written consent, clearly identifying the recipient, to any entity offering health insurance, life insurance, disability insurance or long-term care insurance, or to the consumer's employer.
• Develop, implement and maintain a comprehensive security program and measures to protect a consumer's genetic data against unauthorized access, use or disclosure.
• Provide a process for a consumer to access the consumer's genetic data, delete the consumer's account and genetic data, and request and obtain destruction of the consumer's biological sample.
• Provide effective mechanisms for a consumer to revoke any consent, honor a revocation as soon as practicable and not later than 30 days after it, and destroy a biological sample within 30 days of receipt of revocation of consent to store it.
• Give a consumer clear and complete notice that deidentified data may be shared with or disclosed to third parties for research purposes.
• Bind each service provider by contract not to retain, use or disclose a biological sample, extracted genetic material, genetic data or identity information for any purpose other than the contracted services, and not to associate or combine it with information from another source.