1.1 	A bill for an act
1.2 	relating to data privacy; requiring controllers to provide, correct, or restrict 
1.3 	processing of personal data upon a consumer's request; requiring controllers to 
1.4 	provide a privacy notice and document risk assessment; providing for liability and 
1.5 	civil penalties; providing the attorney general with enforcement authority;proposing 
1.6 	coding for new law in Minnesota Statutes, chapter 325E.
1.7 	BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF MINNESOTA:

1.8 	Section 1. [325E.75] CONSUMER RIGHTS TO PERSONAL DATA PROCESSING.
1.9 		Subdivision 1.Definitions. (a) The terms used in this section have the meanings given 
1.10 	them.
1.11 	(b) "Affiliate" means a legal entity that controls, is controlled by, or is under common 
1.12 	control with another legal entity.
1.13 	(c) "Business purpose" means the processing of personal data for the controller's or its 
1.14 	processor's operational purposes or other notified purposes, provided the processing of 
1.15 	personal data is reasonably necessary and proportionate (i) to achieve the operational 
1.16 	purposes for which the personal data was collected or processed, or (ii) for another 
1.17 	operational purpose that is compatible with the context in which the personal data was 
1.18 	collected. Business purpose includes:
1.19 	(1) auditing related to a current interaction with the consumer and concurrent transactions, 
1.20 	including but not limited to counting ad impressions, verifying positioning and quality of 
1.21 	ad impressions, and auditing compliance with this specification and other standards;
1.22 	(2) detecting security incidents; protecting against malicious, deceptive, fraudulent, or 
1.23 	illegal activity; and prosecuting those responsible for the activity;
2.1 	(3) identifying and repairing errors that impair existing or intended functionality;
2.2 	(4) short-term, transient use, provided the personal data is not disclosed to another third 
2.3 	party and is not used to build a profile about a consumer or otherwise alter an individual 
2.4 	consumer's experience outside the current interaction, including but not limited to the 
2.5 	contextual customization of ads shown as part of the same interaction;
2.6 	(5) maintaining or servicing accounts, providing customer service, processing or fulfilling 
2.7 	orders and transactions, verifying customer information, processing payments, or providing 
2.8 	financing;
2.9 	(6) undertaking internal research for technological development; or
2.10 	(7) authenticating a consumer's identity.
2.11 	(d) "Consent" means a clear, affirmative act, including a written statement, that establishes 
2.12 	a specific, informed, and unambiguous indication the consumer agrees to personal data 
2.13 	processing relating to the consumer.
2.14 	(e) "Consumer" means a natural person who is a Minnesota resident. Consumer does 
2.15 	not include a business's employee or contractor that is acting in the role of an employee or 
2.16 	contractor.
2.17 	(f) "Controller" means the natural or legal person that alone or jointly with others 
2.18 	determines the purposes and means to process personal data.
2.19 	(g) "Data broker" means a business or unit of business that knowingly collects and sells 
2.20 	or licenses to third parties the brokered personal information of a consumer the business 
2.21 	does not have a direct relationship with.
2.22 	(h) "Deidentified data" means:
2.23 	(1) data that cannot be linked to a known natural person without additional information 
2.24 	kept separately; or
2.25 	(2) data that:
2.26 	(i) is modified to a degree that the risk of reidentification is small;
2.27 	(ii) is subject to a controller's public commitment to not attempt to reidentify the data; 
2.28 	and
2.29 	(iii) one or more enforceable controls to prevent reidentification, including legal, 
2.30 	administrative, technical, or contractual controls, have been applied to.
3.1 	(i) "Developer" means a person who creates or modifies the instructions or programs 
3.2 	that instruct a computer or device to perform tasks.
3.3 	(j) "Identified person" or "identifiable person" means a natural person who can be directly 
3.4 	or indirectly identified by reference to an identifier.
3.5 	(k) "Personal data" means any information relating to an identified or identifiable person. 
3.6 	Personal data does not include deidentified data.
3.7 	(l) "Process" or "processing" means any operation or set of operations performed on 
3.8 	personal data or on sets of personal data, whether or not by automated means. Process 
3.9 	includes collecting, recording, organizing, structuring, storing, adapting or altering, retrieving, 
3.10 	consulting, using, disclosing by transmission, disseminating or otherwise making available, 
3.11 	aligning or combining, restricting, deleting, or destructing personal data or sets of personal 
3.12 	data.
3.13 	(m) "Processor" means a natural or legal person who processes personal data on behalf 
3.14 	of the controller.
3.15 	(n) "Profiling" means any automated processing of personal data that consists of using 
3.16 	personal data to evaluate certain personal aspects relating to a natural person, including 
3.17 	analyzing or predicting aspects concerning the natural person's economic situation, health, 
3.18 	personal preferences, interests, reliability, behavior, location, or movements.
3.19 	(o) "Restriction of processing" means marking stored personal data to limit the processing 
3.20 	of the personal data in the future.
3.21 	(p) "Sale" means the exchange of personal data for monetary consideration by the 
3.22 	controller to a third party to license or sell personal data at the third party's discretion to 
3.23 	additional third parties. Sale does not include the following:
3.24 	(1) the disclosure of personal data to a processor who processes the personal data on 
3.25 	behalf of the controller; or
3.26 	(2) the disclosure of personal data to a third party with whom the consumer has a direct 
3.27 	relationship to provide a product or service requested by the consumer or otherwise in a 
3.28 	manner that is consistent with a consumer's reasonable expectations considering the context 
3.29 	in which the consumer provided the personal data to the controller.
3.30 	(q) "Sensitive data" means personal data revealing racial or ethnic origin, religious or 
3.31 	philosophical beliefs, genetic data, biometric data to uniquely identify a natural person, data 
3.32 	concerning a minor, data concerning health, or data concerning a natural person's sex life 
3.33 	or sexual orientation.
4.1 	(r) "Targeted advertising" means displaying advertisements to a consumer where the 
4.2 	advertisement is selected based on personal data obtained or inferred over time from a 
4.3 	consumer's:
4.4 	(1) activities across nonaffiliate websites, applications, or online services to predict user 
4.5 	preferences or interests; or
4.6 	(2) visits to a website, application, or online service that a reasonable consumer would 
4.7 	not expect to be associated with the publisher, based on lack of common branding, 
4.8 	trademarks, or other indicators of common ownership.
4.9 	Targeted advertising does not include advertising to a consumer in response to the consumer's 
4.10 	request for information or feedback.
4.11 	(s) "Third party" means a natural or legal person, public authority, agency, or body other 
4.12 	than a consumer, controller, or an affiliate of the processor or the controller.
4.13 		Subd. 2.Application. (a) This section applies to legal entities that conduct business in 
4.14 	Minnesota or produce products or services that are intentionally targeted to residents of 
4.15 	Minnesota, provided the legal entity:
4.16 	(1) controls or processes data of 100,000 consumers or more; or
4.17 	(2) derives over 50 percent of gross revenue from the sale of personal information, and 
4.18 	processes or controls the personal information of 25,000 consumers or more.
4.19 	(b) This section does not apply to:
4.20 	(1) government entities, as defined in section 13.02, subdivision 7a;
4.21 	(2) personal data sets to the extent regulated by sections 144.291 to 144.34, the federal 
4.22 	Health Insurance Portability and Accountability Act of 1996, the federal Health Information 
4.23 	Technology for Economic and Clinical Health Act of 2009, or the Gramm-Leach-Bliley 
4.24 	Act of 1999; or
4.25 	(3) data sets maintained solely for employment record purposes.
4.26 		Subd. 3.Responsibility. (a) Controllers must meet the obligations under this section.
4.27 	(b) Processors must adhere to the instructions of the controller and assist the controller 
4.28 	to meet its obligations under this section.
4.29 	(c) Processing by a processor must be governed by a contract between the controller 
4.30 	and the processor that is binding on the processor and that establishes the processing 
4.31 	instructions the processor is bound to.
5.1 		Subd. 4.Consumer rights generally. (a) Upon a consumer's request, a controller must:
5.2 	(1) confirm whether personal data concerning the consumer is being processed by the 
5.3 	controller;
5.4 	(2) confirm whether the personal data is sold to data brokers;
5.5 	(3) provide information regarding where personal data concerning the consumer is being 
5.6 	processed by the controller;
5.7 	(4) provide access to personal data concerning the consumer that the controller maintains 
5.8 	in identifiable form;
5.9 	(5) provide a copy of the personal data that the controller maintains in identifiable form 
5.10 	undergoing processing; and
5.11 	(6) correct inaccurate personal data concerning the consumer that the controller maintains 
5.12 	in identifiable form within a reasonable period.
5.13 	(b) If a consumer requests more than one copy of personal data, the controller may 
5.14 	charge a reasonable fee. The fee must be based on administrative costs. If the consumer 
5.15 	makes the request by electronic means, and unless otherwise requested by the consumer, 
5.16 	the information must be provided in a commonly used electronic form.
5.17 	(c) A consumer must not be subject to a decision based solely on profiling which produces 
5.18 	legal effects concerning such consumer or similarly significantly affects the consumer. 
5.19 	Legal or similarly significant effects include but are not limited to denial of consequential 
5.20 	services or support for financial and lending services, housing, insurance, education 
5.21 	enrollment, criminal justice, employment opportunities, and health care services.
5.22 	(d) Paragraph (c) does not apply if the decision is:
5.23 	(1) necessary to enter into or perform a contract between the consumer and a controller;
5.24 	(2) authorized by federal or state law the controller is subject to and that incorporates 
5.25 	suitable measures to safeguard the consumer's rights and legitimate interests, as indicated 
5.26 	by the risk assessments required under subdivision 12; or
5.27 	(3) based on the consumer's consent.
5.28 	(e) Notwithstanding paragraph (d), the controller must implement suitable measures, 
5.29 	including providing human review of the decision, to safeguard the consumer's rights and 
5.30 	legitimate interests with respect to decisions based solely on profiling, to express the 
5.31 	consumer's point of view with respect to the decision, and to contest the decision.
6.1 		Subd. 5.Request for data deletion. (a) Upon a consumer's request, the controller must 
6.2 	delete the consumer's personal data without undue delay if:
6.3 	(1) the personal data is no longer necessary to the purposes the personal data was collected 
6.4 	or otherwise processed for;
6.5 	(2) the consumer withdraws consent to processing that requires consent under subdivision 
6.6 	12, and there are no other legitimate grounds for the processing;
6.7 	(3) the consumer objects to the processing under subdivision 8 and (i) no overriding 
6.8 	legitimate grounds for the processing exist, or (ii) the processing is for direct marketing 
6.9 	purposes;
6.10 	(4) the personal data has been unlawfully processed; or
6.11 	(5) the personal data must be deleted to comply with a legal obligation under federal, 
6.12 	state, or local law the controller is subject to.
6.13 	(b) If the controller is required under this section to delete personal data that has been 
6.14 	disclosed to third parties by the controller, including data brokers that received the data 
6.15 	through a sale, the controller must take reasonable steps, which may include technical 
6.16 	measures, to inform other controllers processing the personal data that the consumer has 
6.17 	requested the deletion by the other controllers of any links to, or copy or replication of, the 
6.18 	personal data. Compliance with this obligation must consider available technology and the 
6.19 	cost of implementation.
6.20 	(c) This subdivision does not apply to the extent processing is necessary to:
6.21 	(1) exercise the right to free speech;
6.22 	(2) comply with a legal obligation that requires processing by federal, state, or local law 
6.23 	the controller is subject to, or perform a task carried out in the public interest or in the 
6.24 	exercise of official authority vested in the controller;
6.25 	(3) support the public interest in the area of public health, provided the processing is (i) 
6.26 	subject to suitable and specific measures that safeguard the rights of the consumer, and (ii) 
6.27 	processed by or under the responsibility of a professional subject to confidentiality obligations 
6.28 	under federal, state, or local law;
6.29 	(4) archive for purposes in the public interest, scientific or historical research purposes, 
6.30 	or statistical purposes, if the deletion of the personal data is likely to render impossible or 
6.31 	seriously impair achievement of the processing's objectives; or
6.32 	(5) establish, exercise, or defend a legal claim.
7.1 		Subd. 6.Request to restrict processing. (a) Upon a consumer's request, the controller 
7.2 	must restrict processing if:
7.3 	(1) the consumer contests the accuracy of the personal data. The controller may restrict 
7.4 	processing for the period of time needed for the controller to verify the accuracy of the 
7.5 	personal data;
7.6 	(2) the processing is unlawful, and the consumer opposes the deletion of the personal 
7.7 	data and requests that processing is restricted instead;
7.8 	(3) the controller no longer needs the personal data for processing, but the personal data 
7.9 	is required by the consumer to establish, exercise, or defend a legal claim; or
7.10 	(4) the consumer objects to processing under subdivision 8, pending verification of 
7.11 	whether the legitimate grounds of the controller override the consumer's objection.
7.12 	(b) If personal data is subject to a processing restriction under this subdivision, the 
7.13 	personal data must, with the exception of storage, be processed only:
7.14 	(1) with the consumer's consent;
7.15 	(2) to establish, exercise, or defend a legal claim;
7.16 	(3) to protect the rights of another natural or legal person; or
7.17 	(4) for reasons of important public interest under federal, state, or local law.
7.18 	(c) If a consumer obtains a processing restriction under this subdivision, the controller 
7.19 	must inform the consumer before lifting the processing restriction.
7.20 		Subd. 7.Request for personal data. (a) Upon a consumer's request, the controller must 
7.21 	provide the consumer in a structured, commonly used, and machine-readable format any 
7.22 	personal data concerning the consumer that the controller maintains and that the consumer 
7.23 	has provided to the controller if:
7.24 	(1) processing the personal data requires consent under subdivision 12, processing the 
7.25 	personal data is necessary for the performance of a contract the consumer is a party to, or 
7.26 	at the request of the consumer prior to entering into a contract; and
7.27 	(2) the processing is carried out by automated means.
7.28 	(b) Controllers must transmit the personal data requested under this subdivision (1) 
7.29 	directly from one controller to another where technically feasible, and (2) to another controller 
7.30 	without hindrance from the controller the personal data was provided to.
8.1 	(c) Requests for personal data under this subdivision must be without prejudice to 
8.2 	subdivision 5.
8.3 	(d) The rights provided under this subdivision do not apply to processing necessary to 
8.4 	perform a task carried out in the public interest or in the exercise of official authority vested 
8.5 	in the controller, and must not adversely affect the rights of others.
8.6 		Subd. 8.Objection to processing. A consumer may object at any time, on grounds 
8.7 	relating to the consumer's particular situation, to processing personal data concerning the 
8.8 	consumer. When a consumer objects to targeted advertising, which includes the sale of 
8.9 	personal data concerning the consumer to third parties for direct targeted advertising, the 
8.10 	controller is prohibited from processing the personal data subject to the objection for direct 
8.11 	targeted advertising and must communicate the consumer's objection regarding any further 
8.12 	processing of the consumer's personal data to any third parties to whom the controller sold 
8.13 	the consumer's personal data for direct targeted advertising unless communication proves 
8.14 	impossible or involves disproportionate effort. Third parties must honor objection requests 
8.15 	under this subdivision received from third-party controllers. If a consumer objects to 
8.16 	processing for any purpose other than targeted advertising, the controller may continue 
8.17 	processing the personal data subject to the objection if the controller demonstrates a 
8.18 	compelling legitimate ground to process the personal data.
8.19 		Subd. 9.Third parties. A controller must communicate any correction, deletion, or 
8.20 	restriction of processing carried out under this section to each third-party recipient, including 
8.21 	third parties that received the data through a sale, the personal data has been disclosed to 
8.22 	unless communication proves impossible or involves disproportionate effort. The controller 
8.23 	must inform the consumer about third-party recipients, if any, that have received the 
8.24 	consumer's personal data if the consumer requests the information.
8.25 		Subd. 10.Timely action. (a) A controller must provide information on action taken in 
8.26 	response to a consumer request under this section within 30 days of the date the request is 
8.27 	received. That period may be extended for 60 additional days if necessary due to the 
8.28 	complexity and number of the requests. The controller must inform the consumer of the 
8.29 	extension and the reasons for the delay within 30 days of the date the request is received. 
8.30 	If the consumer makes the request by electronic means, the information must be provided 
8.31 	by electronic means if possible or unless otherwise requested by the consumer.
8.32 	(b) If a controller does not take action on a consumer's request, the controller must inform 
8.33 	the consumer within 30 days of the date the request is received of the reasons for not taking 
8.34 	action and any possibility for internal review of the controller's decision.
9.1 	(c) Information provided under this section must be provided by the controller free of 
9.2 	charge to the consumer. If a request from a consumer is manifestly unfounded, excessive, 
9.3 	or repetitive, the controller may:
9.4 	(1) charge a reasonable fee based on the administrative costs to provide the information 
9.5 	or communication or take the action requested; or
9.6 	(2) refuse to act on the request.
9.7 	The controller bears the burden of demonstrating that the request is manifestly unfounded 
9.8 	or excessive.
9.9 	(d) If the controller has reasonable doubts concerning the identity of the consumer making 
9.10 	a request under this section, the controller may request that the consumer provide additional 
9.11 	information necessary to confirm the consumer's identity.
9.12 		Subd. 11.Notice. (a) Controllers must make available, in a form that is reasonably 
9.13 	accessible to consumers, a clear privacy notice that includes:
9.14 	(1) the categories of personal data the controller collects;
9.15 	(2) the purposes the categories of personal data are used and disclosed to third parties 
9.16 	for, if any;
9.17 	(3) the rights consumers may exercise under this section;
9.18 	(4) the categories of personal data the controller shares with third parties, if any; and
9.19 	(5) the categories of third parties, if any, the controller shares personal data with.
9.20 	(b) Controllers that engage in profiling must disclose the profiling to the consumer at 
9.21 	or before the time personal data is obtained. The disclosure must include information 
9.22 	regarding the logic involved, and the significance and potential consequences of the profiling.
9.23 	(c) If a controller sells personal data to data brokers or processes personal data for targeted 
9.24 	advertising, it must disclose in a clear and prominent manner the processing and the manner 
9.25 	in which a consumer may exercise the right to object to the processing.
9.26 		Subd. 12.Risk assessment. (a) Controllers must conduct risk assessments of each 
9.27 	processing activity the controller engages in that involves personal data, and must conduct 
9.28 	an additional risk assessment any time a change in processing occurs that materially increases 
9.29 	the risk to consumers. Risk assessments must consider the type of personal data processed 
9.30 	by the controller, including the extent to which the personal data is sensitive data or otherwise 
9.31 	sensitive in nature, and the context in which the personal data is processed.
10.1 	(b) Risk assessments must identify and weigh the benefits that may flow directly and 
10.2 	indirectly to the controller, consumer, other stakeholders, and the public from the processing 
10.3 	against the potential risks, as mitigated by safeguards that can be employed by the controller 
10.4 	to reduce the risks, to the rights of the consumer associated with the processing. The use of 
10.5 	deidentified data and the reasonable expectations of consumers must be included in the 
10.6 	controller's assessment.
10.7 	(c) If the risk assessment determines that the potential risks to the rights of the consumer 
10.8 	in processing the personal data of the consumer outweigh the interests of the controller, 
10.9 	consumer, other stakeholders, and the public, the controller may engage in processing only 
10.10 	if the consumer provides consent. Consent must be as easy to withdraw as it is to provide.
10.11 	(d) Processing for a business purpose is presumed permissible unless:
10.12 	(1) it involves processing sensitive data; and
10.13 	(2) the risk of processing cannot be reduced through the use of appropriate administrative 
10.14 	and technical safeguards.
10.15 	(e) The controller must make the risk assessment available to the attorney general upon 
10.16 	request. Risk assessments are nonpublic data, as defined in section 13.02, subdivision 9.
10.17 		Subd. 13.Deidentified data. A controller or processor that uses deidentified data must 
10.18 	exercise reasonable oversight to monitor compliance with any contractual commitments 
10.19 	the deidentified data is subject to, and must take appropriate steps to address any breach of 
10.20 	a contractual commitment.
10.21 		Subd. 14.Exemptions. (a) The obligations imposed on controllers or processors under 
10.22 	this section do not restrict a controller's or processor's ability to:
10.23 	(1) comply with federal, state, or local laws;
10.24 	(2) comply with a civil, criminal, or regulatory inquiry, investigation, subpoena, or 
10.25 	summons by federal, state, local, or other governmental authorities;
10.26 	(3) cooperate with law enforcement agencies concerning conduct or activity that the 
10.27 	controller or processor reasonably and in good faith believes may violate federal, state, or 
10.28 	local law;
10.29 	(4) investigate, exercise, or defend legal claims; or
10.30 	(5) prevent or detect identity theft, fraud, or other criminal activity.
10.31 	(b) A controller or processor that discloses personal data to a third-party controller or 
10.32 	processor in compliance with this section does not violate this section if the third-party 
11.1 	recipient processes the personal data in violation of this section, provided that, at the time 
11.2 	the personal data was disclosed, the disclosing controller or processor did not have actual 
11.3 	knowledge that the third-party recipient intended to commit a violation. A third-party 
11.4 	recipient that receives personal data from a controller or processor is not liable under this 
11.5 	section for the obligations of a controller or processor it provides services to.
11.6 	(c) This section does not require a controller or processor to:
11.7 	(1) reidentify deidentified data;
11.8 	(2) retain personal data concerning a consumer that it would not otherwise retain in the 
11.9 	ordinary course of business; or
11.10 	(3) comply with a request to exercise under this section if the controller is unable to 
11.11 	verify, using commercially reasonable efforts, the identity of the consumer making the 
11.12 	request.
11.13 	(d) Obligations imposed on controllers and processors under this section do not:
11.14 	(1) adversely affect the rights of any person;
11.15 	(2) apply to processing personal data by a natural person in the course of a personal or 
11.16 	household activity;
11.17 	(3) apply if compliance by the controller or processor would violate an evidentiary 
11.18 	privilege; or
11.19 	(4) prevent a controller or processor from providing personal data concerning a consumer 
11.20 	to a person covered by an evidentiary privilege as part of a privileged communication.
11.21 		Subd. 15.Liability. (a) If more than one controller or processor, or both a controller 
11.22 	and a processor, involved in the same processing violates this section, liability must be 
11.23 	allocated among the parties on a comparative fault basis unless the liability is otherwise 
11.24 	allocated in a contract between the parties.
11.25 	(b) A controller or processor violates this section if the controller or processor fails to 
11.26 	cure any alleged breach of this section within 30 days of the date notice of alleged 
11.27 	noncompliance is received. A controller or processor that violates this section is subject to 
11.28 	a civil penalty of not more than $2,500 for each violation or $7,500 for each intentional 
11.29 	violation.
11.30 		Subd. 16.Enforcement. The attorney general may enforce this section under section 
11.31 	8.31. The attorney general may recover costs and disbursements, including costs of 
12.1 	investigation and reasonable attorney fees. Nothing in this section serves as the basis for a 
12.2 	private right of action.

12.3 	EFFECTIVE DATE. This section is effective December 31, 2020.