Duty LXD-1831
Makes high-risk automated decisions, in Montana
Impediment of Identity Theft, record destruction dutysince 2 lines
Mont. Code Ann. § 30-14-1703 · Read the law's page
- This binds any business holding a customer's records containing personal information within its custody or control, a business being any sole proprietorship, partnership, corporation, association, or other group, whether or not organized to operate at a profit, including an entity that destroys records, but not an industry regulated under Title 33 of the Montana Code.
- Take all reasonable steps to destroy, or arrange for the destruction of, a customer's records containing personal information once they are no longer necessary to be retained, by shredding, erasing, or otherwise modifying the personal information in those records to make it unreadable or undecipherable.
Montana Consumer Data Privacy Act, consumer rightssince 2 lines
Mont. Code Ann. § 30-14-2808 · Read the law's page
- Give a Montana consumer a means to confirm whether you process their personal data, access it, correct it, delete it, and receive a portable copy.
- Respond to a consumer rights request without undue delay and within 45 days of receipt, with one 45-day extension available, and decide an appeal of a refusal within 60 days.
Montana Consumer Data Privacy Act (MCDPA), data protection assessmentssince 4 lines
Mont. Code Ann. § 30-14-2814 · Read the law's page
- Conduct and document a data protection assessment for each processing activity that presents a heightened risk of harm to a consumer, which includes targeted advertising, the sale of personal data, profiling that presents a reasonably foreseeable risk of unfair or deceptive treatment, injury, an offensive intrusion or other substantial injury to consumers, and the processing of sensitive data.
- Make each assessment weigh the benefits of the processing to you, the consumer, other stakeholders and the public against the risks to the consumer's rights as mitigated by safeguards, and factor in de-identified data, consumers' reasonable expectations, the context of the processing and your relationship with the consumer.
- Make an assessment available to the attorney general when the attorney general requires disclosure of one that is relevant to an investigation.
- Apply the assessment duty to processing activities created or generated after , and not to earlier ones.
Right to Compute Act (SB 212, 2025), critical AI infrastructure risk management dutysince 3 lines
Mont. Code Ann. 2-10-205 · Read the law's page
- If a deployer of a critical artificial intelligence system controls, in whole or in part, a critical infrastructure facility, develop a risk management policy after deploying the system
- The policy must be reasonable and consider a nationally or internationally recognized AI risk management framework, such as the NIST AI risk management framework
- A risk management plan already prepared to satisfy a federal requirement counts as compliance