Law / United States / 
Montana
Montana Consumer Data Privacy Act, Attorney General enforcement
Mont. Code Ann. §§ 30-14-2817, 30-14-2820
In force since .
An enforcement supervision rule binding private bodies.
- Private right of action
- No
- Audit expectation
- on_request
- Who audits it
- Regulator
- Where the report goes
- Produced on request
What it requires
- Expect MCDPA violations to be enforced exclusively by the Montana Attorney General, never by a private plaintiff.
- Do not assume a notice-and-cure opportunity before an enforcement action. As of , the Attorney General may proceed directly to a civil penalty without a mandatory cure step.
These lines are LexLint's reading of the law's text. Also read by: Montana Department of Justice, Office of Consumer Protection (guidance, recorded ).
Who enforces it
Settledness
- As of
- Guidance link
- https://doj.mt.gov/office-of-consumer-protection/montana-consumer-data-privacy/
- Guidance body
- Montana Department of Justice, Office of Consumer Protection
- Open questions
- What is the "30-day period described in 30-14-2817(3)" that section 30-14-2820(2) makes a condition of civil penalty liability, when section 30-14-2817(3) provides for a civil investigative demand and states no 30-day period?
What it makes you log
Who may demand the log
Regulator
What the log must hold
Decision basis
Logging duty
Section 2817(3)(b) lets the Attorney General, as part of a civil investigative demand, ask a controller to disclose any data protection assessment relevant to an investigation and evaluate it for compliance, which presupposes a documented assessment. The duty to conduct and document the assessment is in section 30-14-2814(1), which this row does not cite and is not borrowed. Section 2820 sets the civil penalty (up to $7,500 per violation) and injunction. The cited sections name no log contents beyond the assessment, no retention period and no public access. They state no territorial test of their own.
- Kind
- Implicit
- As of
- Provision
- 30-14-2817(3)(b) (the Attorney General may request that a controller disclose any data protection assessment relevant to an investigation)
- Trigger
- personal_data_processing
What this law does
The Montana Attorney General has exclusive authority to enforce MCDPA; the chapter creates no private right of action. Civil penalties run up to $7,500 per violation.
As currently codified, section 30-14-2817 (Enforcement) contains no notice-and-cure text in its five subsections following the S.B. 297 amendment, yet section 30-14-2820(2) cross-references a '30-day period described in 30-14-2817 (3)', which as read describes the Attorney General's civil-investigative-demand authority rather than a cure mechanism.
That cross-reference is an open citation-accuracy question rather than a resolved one; the operative, secondary-corroborated finding is that no mandatory pre-action cure right survives as of , so a first violation can lead directly to a penalty.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .