May 22, 2024 - The Minnesota state legislature has given the green light to the Minnesota Consumer Data Privacy Act, representing a significant stride in safeguarding individuals' digital information. Spearheaded by Representative Steve Elkins, the bill introduces a host of innovative measures aimed at bolstering privacy rights for state residents.

Central to the Act is the concept of a "controller," referring to entities that oversee the processing of personal data. This includes businesses or organizations that manage or manipulate consumer information. The Act imposes stringent obligations on these controllers, mandating them to maintain meticulous data inventories and document comprehensive privacy protocols.

One of the Act's standout features is the introduction of a unique provision granting consumers the right to question profiling decisions which are made by computer through data analysis. This empowers individuals to challenge the outcome of any profile derived in this manner.

The Act also introduces enhanced privacy policy requirements, emphasizing the importance of clarity and accessibility in data management practices. Controllers are now obligated to provide conspicuous opt-out mechanisms and ensure that privacy notices are readily accessible to consumers, both online and through mobile applications.

A notable aspect of the Act is its stringent stance against discrimination. The inclusion of a nondiscrimination clause prohibits controllers from processing personal data in a manner that discriminates against individuals based on various protected characteristics, such as race, gender, or disability. This has significant implications for corporate marketing programs, as it prohibits the use of consumer data for discriminatory targeting or profiling. While the intent of this is good it could prove to be problematic for companies that are actually targeting, rather than attempting to exclude, advertising to people falling into these specific groups.

Enforcement of the Act falls under the purview of the Attorney General's office, with no provision for private legal action. However, controllers are granted a thirty-day window to rectify any compliance shortcomings, underscoring the importance of proactive adherence to the legislation's mandates.

If the governor signs the bill, it will go into effect on July 31, 2025.

Note: When posting a comment, please sign-in first if you want a response. If you are not registered, click here. Registration is easy and free.

Follow ACCESS