Law / United States / 
Minnesota
Minnesota Consumer Data Privacy Act, consumer rights and profiling
In force since .
A data subject rights rule binding private bodies.
- Audit expectation
- on_request
- Who audits it
- Regulator
- Where the report goes
- Produced on request
What it requires
- Give a Minnesota consumer a means to confirm processing, access, correct, delete, and port their personal data.NIST Privacy FrameworkCT.PO-P3
- Provide a Minnesota consumer, on request, a list of the specific third parties you disclosed their personal data to, not merely categories of third parties.NIST Privacy FrameworkCM.AW-P4
- Offer a Minnesota consumer the right to opt out of automated profiling in furtherance of decisions with legal or similarly significant effects, question the result, receive an explanation, and have the decision reevaluated if based on inaccurate data.NIST Privacy FrameworkCT.PO-P3NIST Privacy FrameworkCM.AW-P3
These lines are LexLint's reading of the law's text. Also read by: Office of the Minnesota Attorney General (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
- CM.AW-P3System/product/service design enables data processing visibility.
- CM.AW-P4Records of data disclosures and sharing are maintained and can be accessed for review or transmission/disclosure.
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Guidance link
- https://www.ag.state.mn.us/Data-Privacy/Consumer/
- Guidance body
- Office of the Minnesota Attorney General
- Open questions
- Does the fallback list under Minn. Stat. 325M.14, subdivision 1(h) cover the third parties to which the controller has disclosed any consumers' personal data, as the subdivision provides, or only the third parties to which any consumers' personal data has been sold, as the Attorney General's consumer page describes it?
What it makes you log
Who may demand the log
Regulator
What the log must hold
Decision basis
Log retention
Applies to the records of consumer appeals and the controller responses (subd. 5(d)).
- Unit
- Months
- As of
- Basis
- Fixed
- Minimum value
- 24
Logging duty
A controller must maintain records of all consumer appeals and its responses for at least 24 months and, on the Attorney General's written request in an investigation, compile and provide a copy (subd. 5(d)). An appeal answer carries a written explanation of the reasons (subd. 5(d)), and a controller that denies an opt-out request as fraudulent must rest on a documented belief and tell the requester its basis (subd. 4(h)); both are records of the grounds of a decision. Retaining a record of a deletion request is one of two routes in subd. 4(k) and is not a duty. The right to a list of the specific third parties that received the consumer's data (subd. 1(h)) is a right of access to the data, so it sets no access value. The section has no scope clause of its own: the reach test is in 325M.12 and 325M.11(g), which this row does not cite, so the hook is left empty.
- Kind
- Explicit
- As of
- Provision
- Minn. Stat. 325M.14, subd. 5(d) (records of appeals), with subd. 4(h) (documented belief behind denying an opt-out request)
- Trigger
- personal_data_processing
- consent_or_optout
What this law does
MCDPA grants a Minnesota consumer the rights to confirm processing, access, correct, delete, port their personal data, and opt out of targeted advertising, sale, and certain profiling, with an appeal right for denials.
A consumer may also demand a list of the specific third parties a controller disclosed their personal data to, going further than the multi-state model's usual categories-only disclosure, and may opt out of automated profiling for decisions with legal or similarly significant effects, question such a decision, receive an explanation, and have it reevaluated if based on inaccurate data.
A controller must respond within 45 days of receipt, extendable once by 45 additional days, and must respond to an appeal within 45 days, extendable by 60 additional days.
When LexLint raises it
When your app profile says your app makes high-risk automated decisions or processes personal data.
Back to the example · Lint your app
Page updated .