Minnesota Introduces State Privacy Law Modeled on the CCPA

Last month, Minnesota House of Representatives introduced a draft privacy legislation (HB 36) modeled on the California Consumer Privacy Act.

Similarly to the CCPA, the Minnesota bill would provide consumers with the rights to access and delete their personal information, to opt out of the sale of personal information, and not to be discriminated for exercising their privacy rights under the law. If the requested personal information is delivered electronically, consumers would have a right to receive it in a portable and, to the extent technically feasible, readily useable format that allows consumers to transmit the information to another entity.

Under the Minnesota law, businesses would be required to provide various disclosures to consumers at or before the point of collection of their personal information, as well as designated methods for submitting data subject requests. Further, the law would prohibit businesses from collecting additional information, using collected information for additional purposes, or disclosing additional information without providing a notice to consumers.

Similarly to the CCPA, businesses would be prohibited from selling personal information of minor consumers unless minors (or their parents/guardians if the consumers are younger than 13 years old) affirmatively opt in to the sale of their information.

Unlike the CCPA, however, the Minnesota bill does not exempt various categories of information from its scope, including information covered by HIPAA and GLBA. The bill also does not exempt personal information collected in the context of employment and business-to-business communications.

The Minnesota bill also provides for a broader private right of action than the CCPA. Whereas the CCPA limits a private right to cases of certain data breaches, the Minnesota bill would extend it to all violations of the law. It also provides for treble damages in cases of willful and malicious violations.

If enacted, the Minnesota law would become effective on June 30, 2022.

Improve customer trust with Clarip’s privacy governance platform.  Schedule a demo of the Clarip data mapping software for Privacy Compliance by calling 1-888-252-5653.