Law / United States / 
Minnesota
Minnesota Consumer Data Privacy Act (MCDPA), publicly available information exemption and profiling explanation right
Minn. Stat. §§ 325M.10-325M.14 (2024 c 121, art. 5)
In force since .
A personal data rule binding private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Market targeting
- Audit expectation
- periodic
- Who audits it
- Independent third party, Regulator
- Where the report goes
- Produced on request
What it requires
- Personal data that is lawfully made available through a government record or widely distributed media, or that a controller reasonably believes the consumer lawfully made public, falls outside the MCDPA's definition of personal data.
- If you profile a Minnesota consumer's data for a decision with legal or similarly significant effect, be prepared to answer the consumer's questions about why the profiling reached that result and what they could have done differently, not merely to honor an opt-out request.
- There is no private right of action under this Act; only the Minnesota Attorney General enforces it.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MEASURE 2.9The AI model is explained, validated, and documented, and AI system output is interpreted within its context – as identified in the MAP function – to inform responsible use and governance.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
The Attorney General's consumer page on the Act describes itself as a rough guide that simplifies or rewords the Act, and says it is not intended to provide guidance as to how the office would enforce the Act.
- As of
- Open questions
- What facts give a controller "a reasonable basis to believe" that information "has lawfully been made available to the general public" under the definition of personal data in Minn. Stat. section 325M.10?
- Does information a controller collects from an open website count as made available from "widely distributed media" under the definition of personal data in Minn. Stat. section 325M.10?
What it makes you log
Who may demand the log
Regulator
What the log must hold
Affected person reference, Decision basis
Log retention
Section 325M.14, subdivision 5(d): appeal records and the controller's responses are kept for at least 24 months.
- Unit
- Months
- As of
- Basis
- Fixed
- Minimum value
- 24
Logging duty
A controller that decides a consumer appeal against its refusal to act on a rights request must give a written explanation of the reasons and keep records of all appeals and its responses for at least 24 months, and must compile and provide a copy to the attorney general on written request as part of an investigation. Section 325M.13(e) has a processor make available, on the controller's reasonable request, the information needed to demonstrate compliance and allow reasonable assessments, or arrange a qualified independent assessment at least annually whose report goes to the controller on request. Section 325M.14, subdivision 4(k), lets a controller that took data from a source other than the consumer meet a deletion request by retaining a record of it, which is an option and not a duty. The sections the row cites state the express hook in section 325M.12.
- Kind
- Explicit
- As of
- Provision
- Minn. Stat. section 325M.14, subdivision 5(d) (a controller maintains records of all consumer appeals and its responses for at least 24 months and gives the attorney general a copy on written request in an investigation)
- Trigger
- personal_data_processing
What this law does
Personal data excludes deidentified data or publicly available information, defined as information lawfully made available from government records or widely distributed media, or that a controller reasonably believes was lawfully made available to the public.
The Act applies to an entity doing business in Minnesota or targeting Minnesota residents that in a calendar year controls or processes personal data of 100,000 consumers or more, or derives more than 25% of gross revenue from selling personal data and processes or controls data of 25,000 consumers or more.
Section 325M.14(g) grants an unusual right: where personal data is profiled in furtherance of a decision with legal or similarly significant effect, the consumer has the right to question the result of the profiling, to be informed of the reason that the profiling resulted in the decision, and, if feasible, to be informed of what actions the consumer might have taken to secure a different decision.
Section 325M.20(d) expressly states the Act establishes no private right of action for a violation of its provisions or any other law; enforcement is by the Attorney General, with civil penalties up to $7,500 per violation. Effective , except that postsecondary institutions regulated by the Office of Higher Education have until .
When LexLint raises it
When your app profile says your app crawls the web, trains models or processes biometric data.
Back to the example · Lint your app
Page updated .