Duty LXD-1433
Processes biometric data, in Montana
Impediment of Identity Theft, record destruction dutysince 2 lines
Mont. Code Ann. § 30-14-1703 · Read the law's page
- This binds any business holding a customer's records containing personal information within its custody or control, a business being any sole proprietorship, partnership, corporation, association, or other group, whether or not organized to operate at a profit, including an entity that destroys records, but not an industry regulated under Title 33 of the Montana Code.
- Take all reasonable steps to destroy, or arrange for the destruction of, a customer's records containing personal information once they are no longer necessary to be retained, by shredding, erasing, or otherwise modifying the personal information in those records to make it unreadable or undecipherable.
Montana Consumer Data Privacy Act (MCDPA), publicly available information exemptionsince 3 lines
Mont. Code Ann. § 30-14-2802(26) · Read the law's page
- Personal data that is lawfully made available through a government record or widely distributed media, or that a controller reasonably believes a consumer lawfully made public, falls outside the MCDPA's definition of personal data.
- Check the Act's current, lower thresholds (25,000 consumers, or 15,000 with more than 25% of revenue from data sales) as amended by SB 297 in 2025; the original 2023 thresholds were roughly double these and no longer apply.
- Cite this Act's origin as Senate Bill 384 (2023), Chapter 681, never House Bill 351, which is an unrelated, unenacted marijuana bill.
Montana Consumer Data Privacy Act, sensitive data and biometric data definitionssince 2 lines
Mont. Code Ann. § 30-14-2802(4), (28) · Read the law's page
- Obtain opt-in consent before processing a Montana consumer's genetic or biometric data collected to uniquely identify them.
- Treat a voiceprint or other biometric identifier generated from a recording, for the purpose of identifying a specific individual, as covered biometric data. Montana's exclusion does not reach data generated for that purpose.
Genetic Information Privacy Act: direct-to-consumer genetic and neurotechnology datain force8 lines
Mont. Code Ann. §§ 30-23-101 to 30-23-106 · Read the law's page
- If you are an entity that offers consumer genetic testing products or services directly to a consumer, or that collects, uses or analyzes genetic data, make available a high-level privacy policy overview and a prominent, publicly available privacy notice covering your collection, consent, use, access, disclosure, transfer, security, retention and deletion practices for genetic or neurotechnology data.
- Obtain initial express consent from a consumer, parent, guardian or power of attorney for the collection, use or disclosure of the consumer's genetic or neurotechnology data, describing your uses of the data, the categories of individuals within the entity with access to test results, and how you may share the data.
- Obtain separate express consent, naming the third party, for each transfer or disclosure to a third party other than your processors; separate express consent for each use beyond the primary purpose and for retaining a biological sample after the initial testing; informed express consent for transfer to third parties for research; and express consent for marketing based on the data and for sale or other valuable consideration of the data.
- Comply with section 44-6-104, which requires a valid legal process for disclosing genetic or neurotechnology data to law enforcement or any other government agency without the consumer's express consent.
- Develop, implement and maintain a comprehensive security program to protect a consumer's genetic or neurotechnology data against unauthorized access, use or disclosure.
- Provide a process for a consumer to access and delete the consumer's genetic or neurotechnology data, revoke any consent, and request and obtain destruction of the consumer's biological sample, subject to the clinical research and laboratory waivers in section 30-23-104(7) and (8).
- Do not disclose a consumer's genetic or neurotechnology data to any entity offering health insurance, life insurance or long-term care insurance, or to any employer of the consumer, without the consumer's express consent.
- Do not store genetic or neurotechnology data or biometric samples of Montana residents collected in the state within a country sanctioned by the United States Office of Foreign Assets Control or designated a foreign adversary, and transfer or store such data outside the United States only with the resident's consent.