Law / United States / 
Montana
Montana Consumer Data Privacy Act, consumer rights
In force since .
A data subject rights rule binding private bodies.
- How the hook was established
- express
- What makes it apply
- Data subject residence
- Audit expectation
- none
What it requires
- Give a Montana consumer a means to confirm whether you process their personal data, access it, correct it, delete it, and receive a portable copy.NIST Privacy FrameworkCT.PO-P3
- Respond to a consumer rights request without undue delay and within 45 days of receipt, with one 45-day extension available, and decide an appeal of a refusal within 60 days.NIST Privacy FrameworkCT.PO-P3NIST Privacy FrameworkGV.MT-P7
These lines are LexLint's reading of the law's text. Also read by: Montana Department of Justice, Office of Consumer Protection (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- GV.MT-P7Policies, processes, and procedures for receiving, tracking, and responding to complaints, concerns, and questions from individuals about organizational privacy practices are established and in place.
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Guidance link
- https://doj.mt.gov/office-of-consumer-protection/montana-consumer-data-privacy/
- Guidance body
- Montana Department of Justice, Office of Consumer Protection
- Open questions
- How much detail is "sufficient particularity" under section 30-14-2808(6) when a controller tells a consumer that it has collected biometric data or another listed identifier that it may not disclose?
What it makes you log
What the log must hold
Decision basis
Logging duty
Section 2808(4)(d) lets a controller deny an opt-out request only on a good faith, reasonable and documented belief that the request is fraudulent, which is a written record of the decision's grounds. The rest of the section is rights and deadlines (45 days, one 45-day extension, a 60-day appeal with a written explanation to the consumer), which are notices to the consumer and not a record. Subsection (4)(e)(i) lets a controller keep a record of a deletion request as one of two ways to be deemed compliant, an option and not a duty, and subsection (4)(c) puts the burden of demonstrating that a request is unfounded or excessive on the controller, a rule about those requests alone. The section sets no retention period and no regulator access. A consumer is defined in section 2802 as a resident of the state.
- Kind
- Implicit
- As of
- Provision
- 30-14-2808(4)(d) (a controller may deny an opt-out request only on a documented belief that it is fraudulent)
- Trigger
- consent_or_optout
What this law does
MCDPA gives a Montana consumer the right to confirm processing, access, correct, delete, obtain a portable copy, and opt out of targeted advertising, sale, and qualifying profiling. A controller must respond without undue delay and no later than 45 days after receipt, with one 45-day extension available, and must decide an appeal of a refusal within 60 days.
When LexLint raises it
When your app profile says your app makes high-risk automated decisions or processes personal data.
Back to the example · Lint your app
Page updated .