Law / United States / 
Montana
Montana Consumer Data Privacy Act (MCDPA), de-identified data
In force since .
A de-identification rule binding private bodies.
- Enforcement body
- The Montana Attorney General, who has exclusive authority to enforce the part.
- Obligation class
- Disclosure, Prohibition
- Audit expectation
- none
What it requires
- To hold data as de-identified under the MCDPA, take reasonable measures to ensure that the data cannot be associated with an individual (Mont. Code Ann. section 30-14-2815(1)(a)).
- Publicly commit to maintaining and using de-identified data without attempting to re-identify it (Mont. Code Ann. section 30-14-2815(1)(b)).
- Contractually obligate every recipient of de-identified data to comply with all provisions of the MCDPA (Mont. Code Ann. section 30-14-2815(1)(c)).
- When you disclose pseudonymous data or de-identified data, exercise reasonable oversight to monitor compliance with the contractual commitments that bind it and take appropriate steps to address any breach of those commitments (Mont. Code Ann. section 30-14-2815(5)).
These lines are LexLint's reading of the law's text.
If you get it wrong
Private right of actionNo
Penalty structure
Section 30-14-2820(2) makes a person who violates the part liable for a civil penalty of up to $7,500 for each violation, recovered in an action by the attorney general under section 30-14-2820(3). The section's cross-reference to a 30-day period described in section 30-14-2817(3) is an open drafting question recorded on the enforcement row of the same act.
- Rule
- Per violation only
- As of
- Currency
- USD
- Per violation unit
- Violation
- Per violation amount
- 7,500
What it makes you log
Logging duty
Section 30-14-2815 sets the conditions for holding data as de-identified, the oversight a controller exercises over commitments attached to disclosed data, and two limits on the part's reach. It states no log or record duty.
- Kind
- None
- As of
What this law does
Section 30-14-2802(12) defines de-identified data as data that cannot be used to reasonably infer information about or otherwise be linked to an identified or identifiable individual or a device linked to the individual, if the controller that possesses the data takes reasonable measures to ensure that the data cannot be associated with an individual, publicly commits to process the data in a de-identified fashion only and to not attempt to re-identify it, and contractually obligates any recipients to satisfy those criteria.
Section 30-14-2815(1) requires a controller in possession of de-identified data to take reasonable measures to ensure that the data cannot be associated with an individual, to publicly commit to maintaining and using it without attempting to re-identify it, and to contractually obligate any recipients of it to comply with all provisions of the part. Under section 30-14-2815(2)(a), nothing in the part requires a controller or processor to re-identify de-identified data or pseudonymous data.
Under section 30-14-2815(4), the rights afforded under section 30-14-2808(1)(a) through (1)(d) do not apply to pseudonymous data where the controller is able to demonstrate that any information necessary to identify the consumer is kept separately and is subject to effective technical and organizational controls that prevent the controller from accessing the information.
Section 30-14-2815(5) requires a controller that discloses pseudonymous data or de-identified data to exercise reasonable oversight to monitor compliance with any contractual commitments to which that data is subject and to take appropriate steps to address any breaches of those commitments.
When LexLint raises it
When your app profile says your app processes personal data or processes de-identified data.
Back to the example · Lint your app
Page updated .