1.1 	A bill for an act
1.2 	relating to data privacy; requiring consent before providers share audio or video 
1.3 	data with third parties;proposing coding for new law in Minnesota Statutes, chapter 
1.4 	325E.
1.5 	BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF MINNESOTA:

1.6 	Section 1. [325E.80] AUDIO AND VIDEO DATA SHARING.
1.7 		Subdivision 1.Definitions. (a) "Affiliate" means a legal entity that controls, is controlled 
1.8 	by, or is under common control with another legal entity.
1.9 	(b) "Consent" means a clear, affirmative act, including a written statement, that establishes 
1.10 	a specific, informed, and unambiguous indication that the consumer agrees to share audio 
1.11 	or video data.
1.12 	(c) "Consumer" means a natural person who is a Minnesota resident. Consumer does 
1.13 	not include a business's employee or contractor that is acting in the role of an employee or 
1.14 	contractor.
1.15 	(d) "Provider" means the natural or legal person that stores private audio or video data 
1.16 	for the consumer.
1.17 	(e) "Third party" means a natural or legal person, public authority, agency, or body other 
1.18 	than a consumer, provider, or an affiliate of the provider.
1.19 		Subd. 2.Contract prohibitions. (a) A provider is prohibited from sharing a consumer's 
1.20 	private audio or video data with a third party without the express consent of the consumer.
2.1 	(b) A provider is prohibited from refusing to provide its services to a consumer on the 
2.2 	grounds that the consumer has not approved the sharing of audio or video data with third 
2.3 	parties.
2.4 		Subd. 3.Consent notice. Providers must make available, in a form that is reasonably 
2.5 	accessible to consumers, a clear consent notice that includes:
2.6 	(1) the name of the third party that is seeking the audio or video data;
2.7 	(2) the time frame of the audio or video data the provider is seeking to release to a third 
2.8 	party;
2.9 	(3) the third party's stated purposes for obtaining the audio or video data; and
2.10 	(4) the rights consumers may exercise under this section.
2.11 		Subd. 4.Exemptions. (a) The obligations imposed on providers under this section do 
2.12 	not restrict a provider's ability to:
2.13 	(1) comply with federal, state, or local laws;
2.14 	(2) comply with a civil, criminal, or regulatory inquiry; investigation; subpoena; or 
2.15 	summons by federal, state, local, or other governmental authorities; or
2.16 	(3) investigate, exercise, or defend legal claims.
2.17 	(b) This section does not require a provider to:
2.18 	(1) reidentify deidentified data; or
2.19 	(2) retain audio or video data concerning a consumer that it would not otherwise retain 
2.20 	in the ordinary course of business.
2.21 	(c) Obligations imposed on providers under this section do not:
2.22 	(1) adversely affect the rights of any person;
2.23 	(2) apply if compliance by the provider would violate an evidentiary privilege; or
2.24 	(3) prevent a provider from providing audio or video data concerning a consumer to a 
2.25 	person covered by an evidentiary privilege as part of a privileged communication.
2.26 		Subd. 5.Liability and enforcement. (a) A provider violates this section if the provider 
2.27 	fails to cure any alleged breach of this section within 30 days of the date notice of alleged 
2.28 	noncompliance is received. A provider that violates this section is subject to a civil penalty 
2.29 	of not more than $2,500 for each unintentional violation or $7,500 for each intentional 
2.30 	violation.
3.1 	(b) The attorney general may enforce this section under section 8.31. The attorney general 
3.2 	may recover costs and disbursements, including costs of investigation and reasonable attorney 
3.3 	fees. Nothing in this section serves as the basis for a private right of action.

3.4 	EFFECTIVE DATE. This section is effective December 31, 2021.