Law / United States / 
Minnesota
Minnesota Consumer Data Privacy Act, sensitive data and biometric consent
Minn. Stat. §§ 325M.11, 325M.16
In force since .
A sensitive categories rule binding private bodies.
- Excludes recording-derived identifiers
- No
- How the hook was established
- express
- What makes it apply
- Data subject residence
- Audit expectation
- none
What it requires
- Obtain a Minnesota consumer's opt-in consent before processing biometric data, or any other sensitive data, when that biometric data is processed for the purpose of uniquely identifying the individual.
- Treat an identifier your product derives from a photograph, video, or audio recording as MCDPA biometric data the moment it is generated to identify a specific individual. Minnesota's biometric definition claws this back rather than excluding it outright.
These lines are LexLint's reading of the law's text. Also read by: Office of the Minnesota Attorney General (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Guidance link
- https://www.ag.state.mn.us/Data-Privacy/Business/Controller/Context-Driven-Obligations.asp
- Guidance body
- Office of the Minnesota Attorney General
- Open questions
- Does 'unless the data is generated to identify a specific individual' in Minn. Stat. 325M.11(d)(3) reach a voiceprint that a product extracts from an audio recording for a purpose other than naming the speaker, such as separating one speaker's words from another's?
What it makes you log
Logging duty
Section 325M.16, subd. 2(c) requires reasonable data security practices including the maintenance of an inventory of the data the controller must manage, which cannot be shown without a kept inventory; the clause names no contents. The consent rules for sensitive data (subd. 2(d)) and the revocation mechanism (subd. 2(e)) require consent but no record of it, and the privacy notice (subd. 1) and the retention limit on personal data (subd. 2(g)) are rules about notices and the data itself, not a log. The appeal records, the assessments and the Attorney General's demand powers sit in 325M.14 and 325M.18, which this row does not cite. Section 325M.11(g) defines a consumer as a Minnesota resident.
- Kind
- Implicit
- As of
- Provision
- Minn. Stat. 325M.16, subd. 2(c) (maintenance of an inventory of the data)
- Trigger
- personal_data_processing
What this law does
MCDPA classifies data revealing racial or ethnic origin, religious beliefs, a mental or physical health condition or diagnosis, sexual orientation, or citizenship or immigration status; the processing of biometric data or genetic information to uniquely identify an individual; a known child's data; and precise geolocation data as sensitive data, processable only with the consumer's opt-in consent, the ordinary multi-state model rather than Maryland's outright sale ban.
"Biometric data" means data generated by automatic measurement of biological characteristics used to identify a specific individual, and it excludes a bare photograph, video, or audio recording, but claws that exclusion back the moment data generated from one is used to identify a specific individual.
When LexLint raises it
When your app profile says your app processes biometric data.
Back to the example · Lint your app
Page updated .