Law / United States / 
Minnesota
Minnesota Consumer Data Privacy Act, deidentified and pseudonymous data
In force since .
A de-identification rule binding private bodies.
- Obligation class
- Prohibition
- Audit expectation
- none
What it requires
- Do not attempt to identify the subjects of deidentified or pseudonymous data held for a Minnesota controller unless that controller, which caused the data to be deidentified or pseudonymized, expressly authorizes it (Minn. Stat. 325M.15(d)).
- Do not attempt to identify the subjects of data collected with only pseudonymous identifiers (Minn. Stat. 325M.15(e)).
- If you use pseudonymous or deidentified data as a controller, monitor compliance with the contractual commitments the data is subject to and take appropriate steps to address any breach of them (Minn. Stat. 325M.15(c)).
These lines are LexLint's reading of the law's text.
What it makes you log
Logging duty
Section 325M.15 states the oversight duty and the bans on identifying data subjects. It states no log or record duty.
- Kind
- None
- As of
What this law does
Section 325M.15(d) bars a processor or third party from attempting to identify the subjects of deidentified or pseudonymous data without the express authority of the controller that caused the data to be deidentified or pseudonymized, and section 325M.15(e) bars a controller, processor or third party from attempting to identify the subjects of data collected with only pseudonymous identifiers.
Under section 325M.15(c), a controller that uses pseudonymous or deidentified data must exercise reasonable oversight to monitor compliance with the contractual commitments the data is subject to, and must take appropriate steps to address any breach of them.
When LexLint raises it
When your app profile says your app processes personal data or processes de-identified data.
Back to the example · Lint your app
Page updated .