1.1 	A bill for an act
1.2 	relating to commerce; modifying fees assessed by the Department of Commerce; 
1.3 	modifying appropriations to the Office of Cannabis Management; modifying 
1.4 	provisions governing cannabis and health responsibilities; modifying insurance 
1.5 	assessments and fees; giving various rights to consumers regarding personal data; 
1.6 	placing obligations on certain businesses regarding consumer data; providing for 
1.7 	enforcement by the attorney general; requiring reports; making technical changes;
1.8 	amending Minnesota Statutes 2022, sections 45.0135, subdivision 7; 62Q.73, 
1.9 	subdivision 3; Minnesota Statutes 2023 Supplement, sections 144.197; 342.15, by 
1.10 	adding a subdivision; 342.72; Laws 2023, chapter 63, article 9, sections 10; 19; 
1.11 	20; proposing coding for new law in Minnesota Statutes, chapter 13; proposing 
1.12 	coding for new law as Minnesota Statutes, chapter 325O.
1.13 	BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF MINNESOTA:

1.14 	ARTICLE 1
1.15 	APPROPRIATIONS

1.16	Section 1. APPROPRIATIONS.
 	
1.17 	The sums shown in the columns marked "Appropriations" are added to or, if shown in 
1.18 	parentheses, subtracted from the appropriations in Laws 2023, chapter 63, article 9, to the 
1.19 	agencies and for the purposes specified in this article. The appropriations are from the 
1.20 	general fund, or another named fund, and are available for the fiscal years indicated for 
1.21 	each purpose. The figures "2024" and "2025" used in this article mean that the addition to 
1.22 	or subtraction from the appropriation listed under them is available for the fiscal year ending 
1.23 	June 30, 2024, or June 30, 2025, respectively. "The first year" is fiscal year 2024. "The 
1.24 	second year" is fiscal year 2025. Supplemental appropriations and reductions to 
1.25 	appropriations for the fiscal year ending June 30, 2024, are effective the day following final 
1.26 	enactment.

2.1				APPROPRIATIONS
	
2.2				Available for the Year
	
2.3				Ending June 30
	
2.4					2024
		2025

2.5
2.6	Sec. 2. OFFICE OF CANNABIS 
MANAGEMENT
 	$
	-0-
	$
	2,727,000
	
2.7 	(a) Enforcement of Temporary Regulations
2.8 	$1,107,000 in fiscal year 2025 is for regulation 
2.9 	of products subject to the requirements of 
2.10 	Minnesota Statutes, section 151.72. This is a 
2.11 	onetime appropriation.
2.12 	(b) Product Testing
2.13 	$771,000 in fiscal year 2025 is for testing 
2.14 	products regulated under Minnesota Statutes, 
2.15 	section 151.72, and chapter 342. The base for 
2.16 	this appropriation is $690,000 in fiscal year 
2.17 	2026 and each year thereafter.
2.18 	(c) Reference Laboratory
2.19 	$849,000 in fiscal year 2025 is to operate a 
2.20 	state reference laboratory. The base for this 
2.21 	appropriation is $632,000 in fiscal year 2026 
2.22 	and $696,000 in fiscal year 2027.

2.23	Sec. 3. DEPARTMENT OF HEALTH
 	$
	-0-
	$
	5,500,000
	
2.24 	$5,500,000 in fiscal year 2025 is for the 
2.25 	purposes outlined in Minnesota Statutes, 
2.26 	section 342.72.

2.27 	Sec. 4. ATTORNEY GENERAL.
 2.28 	The general fund appropriation base for the attorney general is increased by $988,000 
2.29 	in fiscal year 2026 and $748,000 in fiscal year 2027 for staffing and other costs related to 
2.30 	potential violations, compliance monitoring, and enforcement of the Minnesota Consumer 
2.31 	Data Privacy Act.

3.1 	Sec. 5. Laws 2023, chapter 63, article 9, section 10, is amended to read:

3.2	Sec. 10. HEALTH

3.43.3
	Subdivision 1.Total Appropriation
 	$
	3,300,000
	$
	20,252,000
17,525,000
	
3.5 	The base for this appropriation is $19,064,000
3.6 	$17,742,000 in fiscal year 2026 and each fiscal 
3.7 	year thereafter $17,678,000 in fiscal year 
3.8 	2027.
3.9 	The amounts that may be spent for each 
3.10 	purpose are specified in the following 
3.11 	subdivisions.

3.12
3.13	Subd. 2.Youth Prevention and Education
Program
 		-0-
		5,000,000
4,363,000
	
3.14 	For administration and grants under Minnesota 
3.15 	Statutes, section 144.197, subdivision 1. Of 
3.16 	the amount appropriated, $2,863,000 is for 
3.17 	program operations and administration and 
3.18 	$1,500,000 is for grants. The base for this 
3.19 	appropriation is $4,534,000 in fiscal year 2026 
3.20 	and $4,470,000 in fiscal year 2027.

3.21
3.22	Subd. 3.Prevention and Education Grants for 
Pregnant or Breastfeeding Individuals
 		-0-
		2,000,000
1,788,000
	
3.23 	For grants under a coordinated prevention and 
3.24 	education program for pregnant and 
3.25 	breastfeeding individuals under Minnesota 
3.26 	Statutes, section 144.197, subdivision 2. The 
3.27 	base for this appropriation is $1,834,000 
3.28 	beginning in fiscal year 2026.

3.29	Subd. 4.Local and Tribal Health Departments
 		-0-
		10,000,000
	
3.30 	For administration and grants under Minnesota 
3.31 	Statutes, section 144.197, subdivision 4. Of 
3.32 	the amount appropriated, $1,094,000 is for 
3.33 	administration and $8,906,000 is for grants.

4.1
4.2	Subd. 5.Cannabis Data Collection and Biennial 
Reports
 		493,000
		493,000
	
4.3 	For reports under Minnesota Statutes, section 
4.4 	144.196.

4.5
4.6	Subd. 6.Administration for Expungement 
Orders
 		71,000
		71,000
	
4.7 	For administration related to orders issued by 
4.8 	the Cannabis Expungement Board. The base 
4.9 	for this appropriation is $71,000 in fiscal year 
4.10 	2026, $71,000 in fiscal year 2027, $71,000 in 
4.11 	fiscal year 2028, $71,000 in fiscal year 2029, 
4.12 	and $0 in fiscal year 2030.

4.13
4.14	Subd. 7.Grants to the Minnesota Poison Control 
System
 		910,000
		810,000
	
4.15 	For administration and grants under Minnesota 
4.16 	Statutes, section 145.93. Of the amount 
4.17 	appropriated in fiscal year 2025, $15,000 is 
4.18 	for administration and $795,000 is for grants.

4.19
4.20	Subd. 8.Temporary Regulation of Edible 
Products Extracted from Hemp
 		1,107,000
		1,107,000
-0-
	
4.21 	For temporary regulation under the health 
4.22 	enforcement consolidation act of edible 
4.23 	products extracted from hemp. The 
4.24 	commissioner may transfer encumbrances and 
4.25 	unobligated amounts to the Office of Cannabis 
4.26 	Management for this purpose. This is a 
4.27 	onetime appropriation.

4.294.28
	Subd. 9.Testing.
 		719,000
		771,000
-0-
	
4.30 	For testing of edible cannabinoid products. 
4.31 	The base for this appropriation is $690,000 in 
4.32 	fiscal year 2026 and each fiscal year thereafter.
4.33 	The commissioner may transfer encumbrances 
4.34 	and unobligated amounts to the Office of 
4.35 	Cannabis Management for this purpose.

5.1 	Sec. 6. Laws 2023, chapter 63, article 9, section 19, is amended to read:
5.2 	Sec. 19. APPROPRIATION AND BASE REDUCTIONS.
 5.3 	(a) The commissioner of management and budget must reduce general fund appropriations 
5.4 	to the commissioner of corrections by $165,000 in fiscal year 2024 and $368,000 in fiscal 
5.5 	year 2025. The commissioner must reduce the base for general fund appropriations to the 
5.6 	commissioner of corrections by $460,000 in fiscal year 2026 and $503,000 in fiscal year 
5.7 	2027.
5.8 	(b) The commissioner of management and budget must reduce general fund appropriations 
5.9 	to the commissioner of health by $260,000 in fiscal year 2025 for the administration of the 
5.10 	medical cannabis program. The commissioner must reduce the base for general fund 
5.11 	appropriations to the commissioner of health by $781,000 in fiscal year 2026 and each fiscal 
5.12 	year thereafter.
5.13 	(c) The commissioner of management and budget must reduce state government special 
5.14 	revenue fund appropriations to the commissioner of health by $1,141,000 in fiscal year 
5.15 	2025 for the administration of the medical cannabis program. The commissioner must reduce 
5.16 	the base for state government special revenue fund appropriations to the commissioner of 
5.17 	health by $3,424,000 in fiscal year 2026 and each fiscal year thereafter.

5.18 	Sec. 7. Laws 2023, chapter 63, article 9, section 20, is amended to read:
5.19 	Sec. 20. TRANSFERS.
 5.20 	(a) $1,000,000 in fiscal year 2024 and $1,000,000 in fiscal year 2025 are transferred 
5.21 	from the general fund to the dual training account in the special revenue fund under 
5.22 	Minnesota Statutes, section 136A.246, subdivision 10, for grants to employers in the legal 
5.23 	cannabis industry. The base for this transfer is $1,000,000 in fiscal year 2026 and each fiscal 
5.24 	year thereafter. The commissioner may use up to six percent of the amount transferred for 
5.25 	administrative costs. The commissioner shall give priority to applications from employers 
5.26 	who are, or who are training employees who are, eligible to be social equity applicants 
5.27 	under Minnesota Statutes, section 342.17. After June 30, 2025, any unencumbered balance 
5.28 	from this transfer may be used for grants to any eligible employer under Minnesota Statutes, 
5.29 	section 136A.246.
5.30 	(b) $5,500,000 in fiscal year 2024 and $5,500,000 in fiscal year 2025 are transferred 
5.31 	from the general fund to the substance use treatment, recovery, and prevention grant account 
6.1 	established under Minnesota Statutes, section 342.72. The base for this transfer is $5,500,000 
6.2 	in fiscal year 2026 and each fiscal year thereafter.

6.3 	EFFECTIVE DATE. This section is effective the day following final enactment.

6.4 	ARTICLE 2
6.5 	CANNABIS AND HEALTH-RELATED RESPONSIBILITIES

6.6 	Section 1. Minnesota Statutes 2023 Supplement, section 144.197, is amended to read:
6.7 	144.197 CANNABIS AND SUBSTANCE MISUSE PREVENTION AND 
6.8 	EDUCATION PROGRAMS.
6.9 		Subdivision 1.Youth prevention and education program. The commissioner of health, 
6.10 	in consultation with the commissioners of human services and education and in collaboration 
6.11 	with local health departments and Tribal health departments, shall conduct a long-term, 
6.12 	coordinated education program to raise public awareness about and address the top three
6.13 	substance misuse prevention, treatment options, and recovery options. The program must 
6.14 	address adverse health effects, as determined by the commissioner, associated with the use 
6.15 	of cannabis flower, cannabis products, lower-potency hemp edibles, or hemp-derived 
6.16 	consumer products by persons under age 25. In conducting this education program, the 
6.17 	commissioner shall engage and consult with youth around the state on program content and 
6.18 	on methods to effectively disseminate program information to youth around the state.
6.19 		Subd. 2.Prevention and education program for pregnant and breastfeeding 
6.20 	individuals; and individuals who may become pregnant. The commissioner of health, 
6.21 	in consultation with the commissioners of human services and education, shall conduct a 
6.22 	long-term, coordinated prevention program to educate focused on (1) preventing substance 
6.23 	use by pregnant individuals, breastfeeding individuals, and individuals who may become 
6.24 	pregnant, and (2) raising public awareness of the risks of substance use while pregnant or 
6.25 	breastfeeding. The program must include education on the adverse health effects of prenatal 
6.26 	exposure to cannabis flower, cannabis products, lower-potency hemp edibles, or 
6.27 	hemp-derived consumer products and on the adverse health effects experienced by infants 
6.28 	and children who are exposed to cannabis flower, cannabis products, lower-potency hemp 
6.29 	edibles, or hemp-derived consumer products in breast milk, from secondhand smoke, or by 
6.30 	ingesting cannabinoid products. ThisThe prevention and education program must also 
6.31 	educate individuals on what constitutes a substance use disorder, signs of a substance use 
6.32 	disorder, and treatment options for persons with a substance use disorder. The prevention 
6.33 	and education program must also provide resources, including training resources, technical 
7.1 	assistance, or educational materials, to local public health home visiting programs, Tribal 
7.2 	home visiting programs, and child welfare workers.
7.3 		Subd. 3.Home visiting programs. The commissioner of health shall provide training, 
7.4 	technical assistance, and education materials to local public health home visiting programs 
7.5 	and Tribal home visiting programs and child welfare workers regarding the safe and unsafe 
7.6 	use of cannabis flower, cannabis products, lower-potency hemp edibles, or hemp-derived 
7.7 	consumer products in homes with infants and young children. Training, technical assistance, 
7.8 	and education materials shall address substance use, the signs of a substance use disorder, 
7.9 	treatment options for persons with a substance use disorder, the dangers of driving under 
7.10 	the influence of cannabis flower, cannabis products, lower-potency hemp edibles, or 
7.11 	hemp-derived consumer products, how to safely consume cannabis flower, cannabis products, 
7.12 	lower-potency hemp edibles, or hemp-derived consumer products in homes with infants 
7.13 	and young children, and how to prevent infants and young children from being exposed to 
7.14 	cannabis flower, cannabis products, lower-potency hemp edibles, or hemp-derived consumer 
7.15 	products by ingesting cannabinoid products or through secondhand smoke.
7.16 		Subd. 4.Local and Tribal health departments. The commissioner of health shall 
7.17 	distribute grants to local health departments and Tribal health departments for these the
7.18 	departments to create and disseminate educational materials on cannabis flower, cannabis 
7.19 	products, lower-potency hemp edibles, and hemp-derived consumer products and to provide 
7.20 	safe use and prevention training, education, technical assistance, and community engagement 
7.21 	regarding cannabis flower, cannabis products, lower-potency hemp edibles, and hemp-derived 
7.22 	consumer products. prevention, education, and recovery programs focusing on substance 
7.23 	misuse prevention and treatment options. The programs may include specific cannabis-related 
7.24 	initiatives.

7.25 	Sec. 2. Minnesota Statutes 2023 Supplement, section 342.15, is amended by adding a 
7.26 	subdivision to read:
7.27 		Subd. 1a.Transmission of fees. A cannabis business background check account is 
7.28 	established as a separate account in the special revenue fund. All fees received by the office 
7.29 	under subdivision 1 must be deposited in the account and are appropriated to the office to 
7.30 	pay for the criminal records checks conducted by the Bureau of Criminal Apprehension and 
7.31 	Federal Bureau of Investigation.

8.1 	Sec. 3. Minnesota Statutes 2023 Supplement, section 342.72, is amended to read:
8.2 	342.72 SUBSTANCE USE TREATMENT, RECOVERY, AND PREVENTION 
8.3 	GRANTS.
8.4 		Subdivision 1.Account Grant program established; appropriation. A substance use 
8.5 	treatment, recovery, and prevention grant account program is created in the special revenue 
8.6 	fund established and must be administered by the commissioner of health. Money in the 
8.7 	account, including interest earned, is appropriated to the office for the purposes specified 
8.8 	in this section. Of the amount transferred from the general fund to the account, the office 
8.9 	may use up to five percent for administrative expenses.
8.10 		Subd. 2.Acceptance of gifts and grants. Notwithstanding sections 16A.013 to 16A.016, 
8.11 	the office may accept money contributed by individuals and may apply for grants from 
8.12 	charitable foundations to be used for the purposes identified in this section. The money 
8.13 	accepted under this section must be deposited in the substance use treatment, recovery, and 
8.14 	prevention grant account created under subdivision 1.
8.15 		Subd. 3.Disposition of money; grants. (a) Money in the Substance use treatment, 
8.16 	recovery, and prevention grant account grants must be distributed as follows:
8.17 	(1) at least 75 percent of the money is for grants for substance use disorder and mental 
8.18 	health recovery and prevention programs. Funds must be used for recovery and prevention 
8.19 	activities and supplies that assist individuals and families to initiate, stabilize, and maintain 
8.20 	long-term recovery from substance use disorders and co-occurring mental health conditions. 
8.21 	Recovery and prevention activities may include prevention education, school-linked 
8.22 	behavioral health, school-based peer programs, peer supports, self-care and wellness, 
8.23 	culturally specific healing, community public awareness, mutual aid networks, telephone 
8.24 	recovery checkups, mental health warmlines, harm reduction, recovery community 
8.25 	organization development, first episode psychosis programs, and recovery housing; and
8.26 	(2) up to 25 percent of the money is for substance use disorder treatment programs as 
8.27 	defined in chapter 245G and may be used to implement, strengthen, or expand supportive 
8.28 	services and activities that are not covered by medical assistance under chapter 256B, 
8.29 	MinnesotaCare under chapter 256L, or the behavioral health fund under chapter 254B. 
8.30 	Services and activities may include adoption or expansion of evidence-based practices; 
8.31 	competency-based training; continuing education; culturally specific and culturally responsive 
8.32 	services; sober recreational activities; developing referral relationships; family preservation 
8.33 	and healing; and start-up or capacity funding for programs that specialize in adolescent, 
9.1 	culturally specific, culturally responsive, disability-specific, co-occurring disorder, or family 
9.2 	treatment services.
9.3 	(b) The office commissioner of health shall consult with the Governor's Advisory Council 
9.4 	on Opioids, Substance Use, and Addiction; the commissioner of human services; and the 
9.5 	commissioner of health the Office of Cannabis Management to develop an appropriate 
9.6 	application process, establish grant requirements, determine what organizations are eligible 
9.7 	to receive grants, and establish reporting requirements for grant recipients.
9.8 		Subd. 4.Reports to the legislature. By January 15, 2024, and each January 15thereafter
9.9 	year, the office commissioner of health must submit a report to the chairs and ranking 
9.10 	minority members of the committees of the house of representatives and the senate having 
9.11 	jurisdiction over health and human services policy and finance that details grants awarded 
9.12 	from the substance use treatment, recovery, and prevention grant account grants awarded, 
9.13 	including the total amount awarded, total number of recipients, and geographic distribution 
9.14 	of those recipients. Notwithstanding section 144.05, subdivision 7, the reporting requirement 
9.15 	under this subdivision does not expire.

9.16 	Sec. 4. REPORT BY THE COMMISSIONER OF COMMERCE.
 9.17 	By January 30, 2025, the commissioner of commerce must report to the chairs and 
9.18 	ranking minority members of the legislative committees with jurisdiction over commerce, 
9.19 	health, and human services, regarding the balance of the premium security plan account 
9.20 	under Minnesota Statutes, section 62E.25, subdivision 1, the estimated cost to continue the 
9.21 	premium security plan, and the plan's future interactions with public health programs. The 
9.22 	report must include an assessment of potential alternatives that would be available upon 
9.23 	expiration of the current waiver.

9.24 	ARTICLE 3
9.25 	INSURANCE ASSESSMENTS AND FEES

9.26 	Section 1. Minnesota Statutes 2022, section 45.0135, subdivision 7, is amended to read:
9.27 		Subd. 7.Assessment. Each insurer authorized to sell insurance in the state of Minnesota, 
9.28 	including surplus lines carriers, and having Minnesota earned premium the previous calendar 
9.29 	year shall remit an assessment to the commissioner for deposit in the insurance fraud 
9.30 	prevention account on or before June 1 of each year. The amount of the assessment shall 
9.31 	be based on the insurer's total assets and on the insurer's total written Minnesota premium, 
9.32 	for the preceding fiscal year, as reported pursuant to section 60A.13. The assessment is 
10.1 	calculated to be an amount up to the following Beginning with the payment due on or before 
10.2 	June 1, 2024, the assessment amount is:

10.3		Total Assets
	Assessment
	
10.510.4
		Less than $100,000,000
		$
	200
400
	
10.710.6
		$100,000,000 to $1,000,000,000
		$
	750
1,500
	
10.910.8
		Over $1,000,000,000
		$
	2,000
4,000
	
10.10		Minnesota Written Premium
	Assessment
	
10.1210.11
		Less than $10,000,000
		$
	200
400
	
10.1410.13
		$10,000,000 to $100,000,000
		$
	750
1,500
	
10.1610.15
		Over $100,000,000
		$
	2,000
4,000
	
10.17 	For purposes of this subdivision, the following entities are not considered to be insurers 
10.18 	authorized to sell insurance in the state of Minnesota: risk retention groups; or township 
10.19 	mutuals organized under chapter 67A.

10.20 	EFFECTIVE DATE. This section is effective the day following final enactment.

10.21 	Sec. 2. Minnesota Statutes 2022, section 62Q.73, subdivision 3, is amended to read:
10.22 		Subd. 3.Right to external review. (a) Any enrollee or anyone acting on behalf of an 
10.23 	enrollee who has received an adverse determination may submit a written request for an 
10.24 	external review of the adverse determination, if applicable under section 62Q.68, subdivision 
10.25 	1, or 62M.06, to the commissioner of health if the request involves a health plan company 
10.26 	regulated by that commissioner or to the commissioner of commerce if the request involves 
10.27 	a health plan company regulated by that commissioner. Notification of the enrollee's right 
10.28 	to external review must accompany the denial issued by the insurer. The written request 
10.29 	must be accompanied by a filing fee of $25. The fee may be waived by the commissioner 
10.30 	of health or commerce in cases of financial hardship and must be refunded if the adverse 
10.31 	determination is completely reversed. No enrollee may be subject to filing fees totaling 
10.32 	more than $75 during a plan year for group coverage or policy year for individual coverage.
10.33 	(b) Nothing in this section requires the commissioner of health or commerce to 
10.34 	independently investigate an adverse determination referred for independent external review.
11.1 	(c) If an enrollee requests an external review, the health plan company must participate 
11.2 	in the external review. The cost of the external review in excess of the filing fee described 
11.3 	in paragraph (a) shall must be borne by the health plan company.
11.4 	(d) The enrollee must request external review within six months from the date of the 
11.5 	adverse determination.

11.6 	ARTICLE 4
11.7 	CONSUMER DATA PRIVACY

11.8 	Section 1. [13.6505] ATTORNEY GENERAL DATA CODED ELSEWHERE.
11.9 		Subdivision 1.Scope. The section referred to in this section is codified outside this 
11.10 	chapter. Those sections classify attorney general data as other than public, place restrictions 
11.11 	on access to government data, or involve data sharing.
11.12 		Subd. 2.Data privacy and protection assessments. A data privacy and protection 
11.13 	assessment collected or maintained by the attorney general is classified under section 
11.14 	325O.08.

11.15 	Sec. 2. [325O.01] CITATION.
11.16 	This chapter may be cited as the "Minnesota Consumer Data Privacy Act."

11.17 	Sec. 3. [325O.02] DEFINITIONS.
11.18 	(a) For purposes of this chapter, the following terms have the meanings given.
11.19 	(b) "Affiliate" means a legal entity that controls, is controlled by, or is under common 
11.20 	control with another legal entity. For purposes of this paragraph, "control" or "controlled" 
11.21 	means: ownership of or the power to vote more than 50 percent of the outstanding shares 
11.22 	of any class of voting security of a company; control in any manner over the election of a 
11.23 	majority of the directors or of individuals exercising similar functions; or the power to 
11.24 	exercise a controlling influence over the management of a company.
11.25 	(c) "Authenticate" means to use reasonable means to determine that a request to exercise 
11.26 	any of the rights under section 325O.05, subdivision 1, paragraphs (b) to (h), is being made 
11.27 	by or rightfully on behalf of the consumer who is entitled to exercise the rights with respect 
11.28 	to the personal data at issue.
11.29 	(d) "Biometric data" means data generated by automatic measurements of an individual's 
11.30 	biological characteristics, including a fingerprint, a voiceprint, eye retinas, irises, or other 
12.1 	unique biological patterns or characteristics that are used to identify a specific individual. 
12.2 	Biometric data does not include:
12.3 	(1) a digital or physical photograph;
12.4 	(2) an audio or video recording; or
12.5 	(3) any data generated from a digital or physical photograph, or an audio or video 
12.6 	recording, unless the data is generated to identify a specific individual.
12.7 	(e) "Child" has the meaning given in United States Code, title 15, section 6501.
12.8 	(f) "Consent" means any freely given, specific, informed, and unambiguous indication 
12.9 	of the consumer's wishes by which the consumer signifies agreement to the processing of 
12.10 	personal data relating to the consumer. Acceptance of a general or broad terms of use or 
12.11 	similar document that contains descriptions of personal data processing along with other, 
12.12 	unrelated information does not constitute consent. Hovering over, muting, pausing, or closing 
12.13 	a given piece of content does not constitute consent. A consent is not valid when the 
12.14 	consumer's indication has been obtained by a dark pattern. A consumer may revoke consent 
12.15 	previously given, consistent with this chapter.
12.16 	(g) "Consumer" means a natural person who is a Minnesota resident acting only in an 
12.17 	individual or household context. Consumer does not include a natural person acting in a 
12.18 	commercial or employment context.
12.19 	(h) "Controller" means the natural or legal person who, alone or jointly with others, 
12.20 	determines the purposes and means of the processing of personal data.
12.21 	(i) "Decisions that produce legal or similarly significant effects concerning the consumer" 
12.22 	means decisions made by the controller that result in the provision or denial by the controller 
12.23 	of financial or lending services, housing, insurance, education enrollment or opportunity, 
12.24 	criminal justice, employment opportunities, health care services, or access to essential goods 
12.25 	or services.
12.26 	(j) "Dark pattern" means a user interface designed or manipulated with the substantial 
12.27 	effect of subverting or impairing user autonomy, decision making, or choice.
12.28 	(k) "Deidentified data" means data that cannot reasonably be used to infer information 
12.29 	about or otherwise be linked to an identified or identifiable natural person or a device linked 
12.30 	to an identified or identifiable natural person, provided that the controller that possesses the 
12.31 	data:
13.1 	(1) takes reasonable measures to ensure that the data cannot be associated with a natural 
13.2 	person;
13.3 	(2) publicly commits to process the data only in a deidentified fashion and not attempt 
13.4 	to reidentify the data; and
13.5 	(3) contractually obligates any recipients of the information to comply with all provisions 
13.6 	of this paragraph.
13.7 	(l) "Delete" means to remove or destroy information so that it is not maintained in human- 
13.8 	or machine-readable form and cannot be retrieved or utilized in the ordinary course of 
13.9 	business.
13.10 	(m) "Genetic information" has the meaning given in section 13.386, subdivision 1.
13.11 	(n) "Identified or identifiable natural person" means a person who can be readily 
13.12 	identified, directly or indirectly.
13.13 	(o) "Known child" means a person under circumstances where a controller has actual 
13.14 	knowledge of, or willfully disregards, that the person is under 13 years of age.
13.15 	(p) "Personal data" means any information that is linked or reasonably linkable to an 
13.16 	identified or identifiable natural person. Personal data does not include deidentified data or 
13.17 	publicly available information. For purposes of this paragraph, "publicly available 
13.18 	information" means information that (1) is lawfully made available from federal, state, or 
13.19 	local government records or widely distributed media, or (2) a controller has a reasonable 
13.20 	basis to believe has lawfully been made available to the general public.
13.21 	(q) "Process" or "processing" means any operation or set of operations that are performed 
13.22 	on personal data or on sets of personal data, whether or not by automated means, including 
13.23 	but not limited to the collection, use, storage, disclosure, analysis, deletion, or modification 
13.24 	of personal data.
13.25 	(r) "Processor" means a natural or legal person who processes personal data on behalf 
13.26 	of a controller.
13.27 	(s) "Profiling" means any form of automated processing of personal data to evaluate, 
13.28 	analyze, or predict personal aspects related to an identified or identifiable natural person's 
13.29 	economic situation, health, personal preferences, interests, reliability, behavior, location, 
13.30 	or movements.
13.31 	(t) "Pseudonymous data" means personal data that cannot be attributed to a specific 
13.32 	natural person without the use of additional information, provided that the additional 
14.1 	information is kept separately and is subject to appropriate technical and organizational 
14.2 	measures to ensure that the personal data are not attributed to an identified or identifiable 
14.3 	natural person.
14.4 	(u) "Sale," "sell," or "sold" means the exchange of personal data for monetary or other 
14.5 	valuable consideration by the controller to a third party. Sale does not include the following:
14.6 	(1) the disclosure of personal data to a processor who processes the personal data on 
14.7 	behalf of the controller;
14.8 	(2) the disclosure of personal data to a third party  for purposes of providing a product 
14.9 	or service requested by the consumer;
14.10 	(3) the disclosure or transfer of personal data to an affiliate of the controller;
14.11 	(4) the disclosure of information that the consumer intentionally made available to the 
14.12 	general public via a channel of mass media and did not restrict to a specific audience;
14.13 	(5) the disclosure or transfer of personal data to a third party as an asset that is part of a 
14.14 	completed or proposed merger, acquisition, bankruptcy, or other transaction in which the 
14.15 	third party assumes control of all or part of the controller's assets; or
14.16 	(6) the exchange of personal data between the producer of a good or service and 
14.17 	authorized agents of the producer who sell and service the goods and services, to enable 
14.18 	the cooperative provisioning of goods and services by both the producer and the producer's 
14.19 	agents.
14.20 	(v) Sensitive data is a form of personal data. "Sensitive data" means:
14.21 	(1) personal data revealing racial or ethnic origin, religious beliefs, mental or physical 
14.22 	health condition or diagnosis, sexual orientation, or citizenship or immigration status;
14.23 	(2) the processing of biometric data or genetic information for the purpose of uniquely 
14.24 	identifying an individual;
14.25 	(3) the personal data of a known child; or
14.26 	(4) specific geolocation data.
14.27 	(w) "Specific geolocation data" means information derived from technology, including 
14.28 	but not limited to global positioning system level latitude and longitude coordinates or other 
14.29 	mechanisms, that directly identifies the geographic coordinates of a consumer or a device 
14.30 	linked to a consumer with an accuracy of more than three decimal degrees of latitude and 
14.31 	longitude or the equivalent in an alternative geographic coordinate system, or a street address 
14.32 	derived from the coordinates. Specific geolocation data does not include the content of 
15.1 	communications, the contents of databases containing street address information which are 
15.2 	accessible to the public as authorized by law, or any data generated by or connected to 
15.3 	advanced utility metering infrastructure systems or other equipment for use by a public 
15.4 	utility.
15.5 	(x) "Targeted advertising" means displaying advertisements to a consumer where the 
15.6 	advertisement is selected based on personal data obtained or inferred from the consumer's 
15.7 	activities over time and across nonaffiliated websites or online applications to predict the 
15.8 	consumer's preferences or interests. Targeted advertising does not include:
15.9 	(1) advertising based on activities within a controller's own websites or online 
15.10 	applications;
15.11 	(2) advertising based on the context of a consumer's current search query or visit to a 
15.12 	website or online application;
15.13 	(3) advertising to a consumer in response to the consumer's request for information or 
15.14 	feedback; or
15.15 	(4) processing personal data solely for measuring or reporting advertising performance, 
15.16 	reach, or frequency.
15.17 	(y) "Third party" means a natural or legal person, public authority, agency, or body other 
15.18 	than the consumer, controller, processor, or an affiliate of the processor or the controller.
15.19 	(z) "Trade secret" has the meaning given in section 325C.01, subdivision 5.

15.20 	Sec. 4. [325O.03] SCOPE; EXCLUSIONS.
15.21 		Subdivision 1.Scope. (a) This chapter applies to legal entities that conduct business in 
15.22 	Minnesota or produce products or services that are targeted to residents of Minnesota, and 
15.23 	that satisfy one or more of the following thresholds:
15.24 	(1) during a calendar year, controls or processes personal data of 100,000 consumers or 
15.25 	more, excluding personal data controlled or processed solely for the purpose of completing 
15.26 	a payment transaction; or
15.27 	(2) derives over 25 percent of gross revenue from the sale of personal data and processes 
15.28 	or controls personal data of 25,000 consumers or more.
15.29 	(b) A controller or processor acting as a technology provider under section 13.32 shall 
15.30 	comply with this chapter and section 13.32, except that when the provisions of section 13.32 
15.31 	conflict with this chapter, section 13.32 prevails.
16.1 		Subd. 2.Exclusions. (a) This chapter does not apply to the following entities, activities, 
16.2 	or types of information:
16.3 	(1) a government entity, as defined by section 13.02, subdivision 7a;
16.4 	(2) a federally recognized Indian tribe;
16.5 	(3) information that meets the definition of:
16.6 	(i) protected health information, as defined by and for purposes of the Health Insurance 
16.7 	Portability and Accountability Act of 1996, Public Law 104-191, and related regulations;
16.8 	(ii) health records, as defined in section 144.291, subdivision 2;
16.9 	(iii) patient identifying information for purposes of Code of Federal Regulations, title 
16.10 	42, part 2, established pursuant to United States Code, title 42, section 290dd-2;
16.11 	(iv) identifiable private information for purposes of the federal policy for the protection 
16.12 	of human subjects, Code of Federal Regulations, title 45, part 46; identifiable private 
16.13 	information that is otherwise information collected as part of human subjects research 
16.14 	pursuant to the good clinical practice guidelines issued by the International Council for 
16.15 	Harmonisation; the protection of human subjects under Code of Federal Regulations, title 
16.16 	21, parts 50 and 56; or personal data used or shared in research conducted in accordance 
16.17 	with one or more of the requirements set forth in this paragraph;
16.18 	(v) information and documents created for purposes of the federal Health Care Quality 
16.19 	Improvement Act of 1986, Public Law 99-660, and related regulations; or
16.20 	(vi) patient safety work product for purposes of Code of Federal Regulations, title 42, 
16.21 	part 3, established pursuant to United States Code, title 42, sections 299b-21 to 299b-26;
16.22 	(4) information that is derived from any of the health care-related information listed in 
16.23 	clause (3), but that has been deidentified in accordance with the requirements for 
16.24 	deidentification set forth in Code of Federal Regulations, title 45, part 164;
16.25 	(5) information originating from, and intermingled to be indistinguishable with, any of 
16.26 	the health care-related information listed in clause (3) that is maintained by:
16.27 	(i) a covered entity or business associate, as defined by the Health Insurance Portability 
16.28 	and Accountability Act of 1996, Public Law 104-191, and related regulations;
16.29 	(ii) a health care provider, as defined in section 144.291, subdivision 2; or
17.1 	(iii) a program or a qualified service organization, as defined by Code of Federal 
17.2 	Regulations, title 42, part 2, established pursuant to United States Code, title 42, section 
17.3 	290dd-2;
17.4 	(6) information that is:
17.5 	(i) maintained by an entity that meets the definition of health care provider under Code 
17.6 	of Federal Regulations, title 45, section 160.103, to the extent that the entity maintains the 
17.7 	information in the manner required of covered entities with respect to protected health 
17.8 	information for purposes of the Health Insurance Portability and Accountability Act of 
17.9 	1996, Public Law 104-191, and related regulations;
17.10 	(ii) included in a limited data set, as described under Code of Federal Regulations, title 
17.11 	45, part 164.514(e), to the extent that the information is used, disclosed, and maintained in 
17.12 	the manner specified by that part;
17.13 	(iii) maintained by, or maintained to comply with the rules or orders of, a self-regulatory 
17.14 	organization as defined by United States Code, title 15, section 78c(a)(26); or
17.15 	(iv) originated from, or intermingled with, information described in clause (9) and that 
17.16 	a licensed residential mortgage originator, as defined under section 58.02, subdivision 19, 
17.17 	or residential mortgage servicer, as defined under section 58.02, subdivision 20, collects, 
17.18 	processes, uses, or maintains in the same manner as required under the laws and regulations 
17.19 	specified in clause (9);
17.20 	(7) information used only for public health activities and purposes, as described under 
17.21 	Code of Federal Regulations, title 45, part 164.512;
17.22 	(8) an activity involving the collection, maintenance, disclosure, sale, communication, 
17.23 	or use of any personal data bearing on a consumer's credit worthiness, credit standing, credit 
17.24 	capacity, character, general reputation, personal characteristics, or mode of living by a 
17.25 	consumer reporting agency, as defined in United States Code, title 15, section 1681a(f), by 
17.26 	a furnisher of information, as set forth in United States Code, title 15, section 1681s-2, who 
17.27 	provides information for use in a consumer report, as defined in United States Code, title 
17.28 	15, section 1681a(d), and by a user of a consumer report, as set forth in United States Code, 
17.29 	title 15, section 1681b, except that information is only excluded under this paragraph to the 
17.30 	extent that the activity involving the collection, maintenance, disclosure, sale, communication, 
17.31 	or use of the information by the agency, furnisher, or user is subject to regulation under the 
17.32 	federal Fair Credit Reporting Act, United States Code, title 15, sections 1681 to 1681x, and 
17.33 	the information is not collected, maintained, used, communicated, disclosed, or sold except 
17.34 	as authorized by the Fair Credit Reporting Act;
18.1 	(9) personal data collected, processed, sold, or disclosed pursuant to the federal 
18.2 	Gramm-Leach-Bliley Act, Public Law 106-102, and implementing regulations, if the 
18.3 	collection, processing, sale, or disclosure is in compliance with that law;
18.4 	(10) personal data collected, processed, sold, or disclosed pursuant to the federal Driver's 
18.5 	Privacy Protection Act of 1994, United States Code, title 18, sections 2721 to 2725, if the 
18.6 	collection, processing, sale, or disclosure is in compliance with that law;
18.7 	(11) personal data regulated by the federal Family Educational Rights and Privacy Act, 
18.8 	United States Code, title 20, section 1232g, and implementing regulations;
18.9 	(12) personal data collected, processed, sold, or disclosed pursuant to the federal Farm 
18.10 	Credit Act of 1971, as amended, United States Code, title 12, sections 2001 to 2279cc, and 
18.11 	implementing regulations, Code of Federal Regulations, title 12, part 600, if the collection, 
18.12 	processing, sale, or disclosure is in compliance with that law;
18.13 	(13) data collected or maintained:
18.14 	(i) in the course of an individual acting as a job applicant to or an employee, owner, 
18.15 	director, officer, medical staff member, or contractor of a business if the data is collected 
18.16 	and used solely within the context of the role;
18.17 	(ii) as the emergency contact information of an individual under item (i) if used solely 
18.18 	for emergency contact purposes; or
18.19 	(iii) that is necessary for the business to retain to administer benefits for another individual 
18.20 	relating to the individual under item (i) if used solely for the purposes of administering those 
18.21 	benefits;
18.22 	(14) personal data collected, processed, sold, or disclosed pursuant to the Minnesota 
18.23 	Insurance Fair Information Reporting Act in sections 72A.49 to 72A.505;
18.24 	(15) data collected, processed, sold, or disclosed as part of a payment-only credit, check, 
18.25 	or cash transaction where no data about consumers, as defined in section 325O.02, are 
18.26 	retained;
18.27 	(16) a state or federally chartered bank or credit union, or an affiliate or subsidiary that 
18.28 	is principally engaged in financial activities, as described in United States Code, title 12, 
18.29 	section 1843(k);
18.30 	(17) information that originates from, or is intermingled so as to be indistinguishable 
18.31 	from, information described in clause (8) and that a person licensed under chapter 56 collects, 
19.1 	processes, uses, or maintains in the same manner as is required under the laws and regulations 
19.2 	specified in clause (8);
19.3 	(18) an insurance company, as defined in section 60A.02, subdivision 4, an insurance 
19.4 	producer, as defined in section 60K.31, subdivision 6, a third-party administrator of 
19.5 	self-insurance, or an affiliate or subsidiary of any entity identified in this clause that is 
19.6 	principally engaged in financial activities, as described in United States Code, title 12, 
19.7 	section 1843(k), except that this clause does not apply to a person that, alone or in 
19.8 	combination with another person, establishes and maintains a self-insurance program that 
19.9 	does not otherwise engage in the business of entering into policies of insurance;
19.10 	(19) a small business, as defined by the United States Small Business Administration 
19.11 	under Code of Federal Regulations, title 13, part 121, except that a small business identified 
19.12 	in this clause is subject to section 325O.075;
19.13 	(20) a nonprofit organization that is established to detect and prevent fraudulent acts in 
19.14 	connection with insurance; and
19.15 	(21) an air carrier subject to the federal Airline Deregulation Act, Public Law 95-504, 
19.16 	only to the extent that an air carrier collects personal data related to prices, routes, or services 
19.17 	and only to the extent that the provisions of the Airline Deregulation Act preempt the 
19.18 	requirements of this chapter.
19.19 	(b) Controllers that are in compliance with the Children's Online Privacy Protection Act, 
19.20 	United States Code, title 15, sections 6501 to 6506, and implementing regulations, shall be 
19.21 	deemed compliant with any obligation to obtain parental consent under this chapter.

19.22 	Sec. 5. [325O.04] RESPONSIBILITY ACCORDING TO ROLE.
19.23 	(a) Controllers and processors are responsible for meeting the respective obligations 
19.24 	established under this chapter.
19.25 	(b) Processors are responsible under this chapter for adhering to the instructions of the 
19.26 	controller and assisting the controller to meet the controller's obligations under this chapter. 
19.27 	Assistance under this paragraph shall include the following:
19.28 	(1) taking into account the nature of the processing, the processor shall assist the controller 
19.29 	by appropriate technical and organizational measures, insofar as this is possible, for the 
19.30 	fulfillment of the controller's obligation to respond to consumer requests to exercise their 
19.31 	rights pursuant to section 325O.05; and
20.1 	(2) taking into account the nature of processing and the information available to the 
20.2 	processor, the processor shall assist the controller in meeting the controller's obligations in 
20.3 	relation to the security of processing the personal data and in relation to the notification of 
20.4 	a breach of the security of the system pursuant to section 325E.61, and shall provide 
20.5 	information to the controller necessary to enable the controller to conduct and document 
20.6 	any data privacy and protection assessments required by section 325O.08.
20.7 	(c) A contract between a controller and a processor shall govern the processor's data 
20.8 	processing procedures with respect to processing performed on behalf of the controller. The 
20.9 	contract shall be binding and clearly set forth instructions for processing data, the nature 
20.10 	and purpose of processing, the type of data subject to processing, the duration of processing, 
20.11 	and the rights and obligations of both parties. The contract shall also require that the 
20.12 	processor:
20.13 	(1) ensure that each person processing the personal data is subject to a duty of 
20.14 	confidentiality with respect to the data; and
20.15 	(2) engage a subcontractor only (i) after providing the controller with an opportunity to 
20.16 	object, and (ii) pursuant to a written contract in accordance with paragraph (e) that requires 
20.17 	the subcontractor to meet the obligations of the processor with respect to the personal data.
20.18 	(d) Taking into account the context of processing, the controller and the processor shall 
20.19 	implement appropriate technical and organizational measures to ensure a level of security 
20.20 	appropriate to the risk and establish a clear allocation of the responsibilities between the 
20.21 	controller and the processor to implement the technical and organizational measures.
20.22 	(e) Processing by a processor shall be governed by a contract between the controller and 
20.23 	the processor that is binding on both parties and that sets out the processing instructions to 
20.24 	which the processor is bound, including the nature and purpose of the processing, the type 
20.25 	of personal data subject to the processing, the duration of the processing, and the obligations 
20.26 	and rights of both parties. The contract shall include the requirements imposed by this 
20.27 	paragraph, paragraphs (c) and (d), as well as the following requirements:
20.28 	(1) at the choice of the controller, the processor shall delete or return all personal data 
20.29 	to the controller as requested at the end of the provision of services, unless retention of the 
20.30 	personal data is required by law;
20.31 	(2) upon a reasonable request from the controller, the processor shall make available to 
20.32 	the controller all information necessary to demonstrate compliance with the obligations in 
20.33 	this chapter; and
21.1 	(3) the processor shall allow for, and contribute to, reasonable assessments and inspections 
21.2 	by the controller or the controller's designated assessor. Alternatively, the processor may  
21.3 	arrange for a qualified and independent assessor to conduct, at least annually and at the 
21.4 	processor's expense, an assessment of the processor's policies and technical and organizational 
21.5 	measures in support of the obligations under this chapter. The assessor must use an 
21.6 	appropriate and accepted control standard or framework and assessment procedure for 
21.7 	assessments as applicable, and shall provide a report of an assessment to the controller upon 
21.8 	request.
21.9 	(f) In no event shall any contract relieve a controller or a processor from the liabilities 
21.10 	imposed on a controller or processor by virtue of the controller's or processor's roles in the 
21.11 	processing relationship under this chapter.
21.12 	(g) Determining whether a person is acting as a controller or processor with respect to 
21.13 	a specific processing of data is a fact-based determination that depends upon the context in 
21.14 	which personal data are to be processed. A person that is not limited in the person's processing 
21.15 	of personal data pursuant to a controller's instructions, or that fails to adhere to a controller's 
21.16 	instructions, is a controller and not a processor with respect to a specific processing of data. 
21.17 	A processor that continues to adhere to a controller's instructions with respect to a specific 
21.18 	processing of personal data remains a processor. If a processor begins, alone or jointly with 
21.19 	others, determining the purposes and means of the processing of personal data, the processor 
21.20 	is a controller with respect to the processing.

21.21 	Sec. 6. [325O.05] CONSUMER PERSONAL DATA RIGHTS.
21.22 		Subdivision 1.Consumer rights provided. (a) Except as provided in this chapter, a 
21.23 	controller must comply with a request to exercise the consumer rights provided in this 
21.24 	subdivision.
21.25 	(b) A consumer has the right to confirm whether or not a controller is processing personal 
21.26 	data concerning the consumer and access the categories of personal data the controller is 
21.27 	processing.
21.28 	(c) A consumer has the right to correct inaccurate personal data concerning the consumer, 
21.29 	taking into account the nature of the personal data and the purposes of the processing of the 
21.30 	personal data.
21.31 	(d) A consumer has the right to delete personal data concerning the consumer.
21.32 	(e) A consumer has the right to obtain personal data concerning the consumer, which 
21.33 	the consumer previously provided to the controller, in a portable and, to the extent technically 
22.1 	feasible, readily usable format that allows the consumer to transmit the data to another 
22.2 	controller without hindrance, where the processing is carried out by automated means.
22.3 	(f) A consumer has the right to opt out of the processing of personal data concerning 
22.4 	the consumer for purposes of targeted advertising, the sale of personal data, or profiling in 
22.5 	furtherance of automated decisions that produce legal effects concerning a consumer or 
22.6 	similarly significant effects concerning a consumer.
22.7 	(g) If a consumer's personal data is profiled in furtherance of decisions that produce 
22.8 	legal effects concerning a consumer or similarly significant effects concerning a consumer, 
22.9 	the consumer has the right to question the result of the profiling, to be informed of the reason 
22.10 	that the profiling resulted in the decision, and, if feasible, to be informed of what actions 
22.11 	the consumer might have taken to secure a different decision and the actions that the 
22.12 	consumer might take to secure a different decision in the future. The consumer has the right 
22.13 	to review the consumer's personal data used in the profiling. If the decision is determined 
22.14 	to have been based upon inaccurate personal data, taking into account the nature of the 
22.15 	personal data and the purposes of the processing of the personal data, the consumer has the 
22.16 	right to have the data corrected and the profiling decision reevaluated based upon the 
22.17 	corrected data.
22.18 	(h) A consumer has a right to obtain a list of the specific third parties to which the 
22.19 	controller has disclosed the consumer's personal data. If the controller does not maintain 
22.20 	the information in a format specific to the consumer, a list of specific third parties to whom 
22.21 	the controller has disclosed any consumers' personal data may be provided instead.
22.22 		Subd. 2.Exercising consumer rights. (a) A consumer may exercise the rights set forth 
22.23 	in this section by submitting a request, at any time, to a controller specifying which rights 
22.24 	the consumer wishes to exercise.
22.25 	(b) In the case of processing personal data concerning a known child, the parent or legal 
22.26 	guardian of the known child may exercise the rights of this chapter on the child's behalf.
22.27 	(c) In the case of processing personal data concerning a consumer legally subject to 
22.28 	guardianship or conservatorship under sections 524.5-101 to 524.5-502, the guardian or the 
22.29 	conservator of the consumer may exercise the rights of this chapter on the consumer's behalf.
22.30 	(d) A consumer may designate another person as the consumer's authorized agent to 
22.31 	exercise the consumer's right to opt out of the processing of the consumer's personal data 
22.32 	for purposes of targeted advertising and sale under subdivision 1, paragraph (f), on the 
22.33 	consumer's behalf. A consumer may designate an authorized agent by way of, among other 
22.34 	things, a technology, including but not limited to an Internet link or a browser setting, 
23.1 	browser extension, or global device setting, indicating the consumer's intent to opt out of 
23.2 	the processing. A controller shall comply with an opt-out request received from an authorized 
23.3 	agent if the controller is able to verify, with commercially reasonable effort, the identity of 
23.4 	the consumer and the authorized agent's authority to act on the consumer's behalf.
23.5 		Subd. 3.Universal opt-out mechanisms. (a) A controller must allow a consumer to opt 
23.6 	out of any processing of the consumer's personal data for the purposes of targeted advertising, 
23.7 	or any sale of the consumer's personal data through an opt-out preference signal sent, with 
23.8 	the consumer's consent, by a platform, technology, or mechanism to the controller indicating 
23.9 	the consumer's intent to opt out of the processing or sale. The platform, technology, or 
23.10 	mechanism must:
23.11 	(1) not unfairly disadvantage another controller;
23.12 	(2) not make use of a default setting, but require the consumer to make an affirmative, 
23.13 	freely given, and unambiguous choice to opt out of the processing of the consumer's personal 
23.14 	data;
23.15 	(3) be consumer-friendly and easy to use by the average consumer;
23.16 	(4) be as consistent as possible with any other similar platform, technology, or mechanism 
23.17 	required by any federal or state law or regulation; and
23.18 	(5) enable the controller to accurately determine whether the consumer is a Minnesota 
23.19 	resident and whether the consumer has made a legitimate request to opt out of any sale of 
23.20 	the consumer's personal data or targeted advertising. For purposes of this paragraph, the 
23.21 	use of an Internet protocol address to estimate the consumer's location is sufficient to 
23.22 	determine the consumer's residence.
23.23 	(b) If a consumer's opt-out request is exercised through the platform, technology, or 
23.24 	mechanism required under paragraph (a), and the request conflicts with the consumer's 
23.25 	existing controller-specific privacy setting or voluntary participation in a controller's bona 
23.26 	fide loyalty, rewards, premium features, discounts, or club card program, the controller 
23.27 	must comply with the consumer's opt-out preference signal but may also notify the consumer 
23.28 	of the conflict and provide the consumer a choice to confirm the controller-specific privacy 
23.29 	setting or participation in the controller's program.
23.30 	(c) The platform, technology, or mechanism required under paragraph (a) is subject to 
23.31 	the requirements of subdivision 4.
23.32 	(d) A controller that recognizes opt-out preference signals that have been approved by 
23.33 	other state laws or regulations is in compliance with this subdivision.
24.1 		Subd. 4.Controller response to consumer requests. (a) Except as provided in this 
24.2 	chapter, a controller must comply with a request to exercise the rights pursuant to subdivision 
24.3 	1.
24.4 	(b) A controller must provide one or more secure and reliable means for consumers to 
24.5 	submit a request to exercise the consumer's rights under this section. The means made 
24.6 	available must take into account the ways in which consumers interact with the controller 
24.7 	and the need for secure and reliable communication of the requests.
24.8 	(c) A controller may not require a consumer to create a new account in order to exercise 
24.9 	a right, but a controller may require a consumer to use an existing account to exercise the 
24.10 	consumer's rights under this section.
24.11 	(d) A controller must comply with a request to exercise the right in subdivision 1, 
24.12 	paragraph (f), as soon as feasibly possible, but no later than 45 days of receipt of the request.
24.13 	(e) A controller must inform a consumer of any action taken on a request under 
24.14 	subdivision 1 without undue delay and in any event within 45 days of receipt of the request. 
24.15 	That period may be extended once by 45 additional days where reasonably necessary, taking 
24.16 	into account the complexity and number of the requests. The controller must inform the 
24.17 	consumer of any extension within 45 days of receipt of the request, together with the reasons 
24.18 	for the delay.
24.19 	(f) If a controller does not take action on a consumer's request, the controller must inform 
24.20 	the consumer without undue delay and at the latest within 45 days of receipt of the request 
24.21 	of the reasons for not taking action and instructions for how to appeal the decision with the 
24.22 	controller as described in subdivision 5.
24.23 	(g) Information provided under this section must be provided by the controller free of 
24.24 	charge up to twice annually to the consumer. Where requests from a consumer are manifestly 
24.25 	unfounded or excessive, in particular because of the repetitive character of the requests, the 
24.26 	controller may either charge a reasonable fee to cover the administrative costs of complying 
24.27 	with the request, or refuse to act on the request. The controller bears the burden of 
24.28 	demonstrating the manifestly unfounded or excessive character of the request.
24.29 	(h) A controller is not required to comply with a request to exercise any of the rights 
24.30 	under subdivision 1, paragraphs (b) to (h), if the controller is unable to authenticate the 
24.31 	request using commercially reasonable efforts. In such cases, the controller may request 
24.32 	the provision of additional information reasonably necessary to authenticate the request. A 
24.33 	controller is not required to authenticate an opt-out request, but a controller may deny an 
24.34 	opt-out request if the controller has a good faith, reasonable, and documented belief that 
25.1 	the request is fraudulent. If a controller denies an opt-out request because the controller 
25.2 	believes a request is fraudulent, the controller must notify the person who made the request 
25.3 	that the request was denied due to the controller's belief that the request was fraudulent and 
25.4 	state the controller's basis for that belief.
25.5 	(i) In response to a consumer request under subdivision 1, a controller must not disclose 
25.6 	the following information about a consumer, but must instead inform the consumer with 
25.7 	sufficient particularity that the controller has collected that type of information:
25.8 	(1) Social Security number;
25.9 	(2) driver's license number or other government-issued identification number;
25.10 	(3) financial account number;
25.11 	(4) health insurance account number or medical identification number;
25.12 	(5) account password, security questions, or answers; or
25.13 	(6) biometric data.
25.14 	(j) In response to a consumer request under subdivision 1, a controller is not required 
25.15 	to reveal any trade secret.
25.16 	(k) A controller that has obtained personal data about a consumer from a source other 
25.17 	than the consumer may comply with a consumer's request to delete the consumer's personal 
25.18 	data pursuant to subdivision 1, paragraph (d), by either:
25.19 	(1) retaining a record of the deletion request, retaining the minimum data necessary for 
25.20 	the purpose of ensuring the consumer's personal data remains deleted from the business's 
25.21 	records, and not using the retained data for any other purpose pursuant to the provisions of 
25.22 	this chapter; or
25.23 	(2) opting the consumer out of the processing of personal data for any purpose except 
25.24 	for the purposes exempted pursuant to the provisions of this chapter.
25.25 		Subd. 5.Appeal process required. (a) A controller must establish an internal process 
25.26 	whereby a consumer may appeal a refusal to take action on a request to exercise any of the 
25.27 	rights under subdivision 1 within a reasonable period of time after the consumer's receipt 
25.28 	of the notice sent by the controller under subdivision 4, paragraph (f).
25.29 	(b) The appeal process must be conspicuously available. The process must include the 
25.30 	ease of use provisions in subdivision 3 applicable to submitting requests.
26.1 	(c) Within 45 days of receipt of an appeal, a controller must inform the consumer of any 
26.2 	action taken or not taken in response to the appeal, along with a written explanation of the 
26.3 	reasons in support thereof. That period may be extended by 60 additional days where 
26.4 	reasonably necessary, taking into account the complexity and number of the requests serving 
26.5 	as the basis for the appeal. The controller must inform the consumer of any extension within 
26.6 	45 days of receipt of the appeal, together with the reasons for the delay.
26.7 	(d) When informing a consumer of any action taken or not taken in response to an appeal 
26.8 	pursuant to paragraph (c), the controller must provide a written explanation of the reasons 
26.9 	for the controller's decision and clearly and prominently provide the consumer with 
26.10 	information about how to file a complaint with the Office of the Attorney General. The 
26.11 	controller must maintain records of all appeals and the controller's responses for at least 24 
26.12 	months and shall, upon written request by the attorney general as part of an investigation, 
26.13 	compile and provide a copy of the records to the attorney general.

26.14 	Sec. 7. [325O.06] PROCESSING DEIDENTIFIED DATA OR PSEUDONYMOUS 
26.15 	DATA.
26.16 	(a) This chapter does not require a controller or processor to do any of the following 
26.17 	solely for purposes of complying with this chapter:
26.18 	(1) reidentify deidentified data;
26.19 	(2) maintain data in identifiable form, or collect, obtain, retain, or access any data or 
26.20 	technology, in order to be capable of associating an authenticated consumer request with 
26.21 	personal data; or
26.22 	(3) comply with an authenticated consumer request to access, correct, delete, or port 
26.23 	personal data pursuant to section 325O.05, subdivision 1, if all of the following are true:
26.24 	(i) the controller is not reasonably capable of associating the request with the personal 
26.25 	data, or it would be unreasonably burdensome for the controller to associate the request 
26.26 	with the personal data;
26.27 	(ii) the controller does not use the personal data to recognize or respond to the specific 
26.28 	consumer who is the subject of the personal data, or associate the personal data with other 
26.29 	personal data about the same specific consumer; and
26.30 	(iii) the controller does not sell the personal data to any third party or otherwise 
26.31 	voluntarily disclose the personal data to any third party other than a processor, except as 
26.32 	otherwise permitted in this section.
27.1 	(b) The rights contained in section 325O.05, subdivision 1, paragraphs (b) to (h), do not 
27.2 	apply to pseudonymous data in cases where the controller is able to demonstrate any 
27.3 	information necessary to identify the consumer is kept separately and is subject to effective 
27.4 	technical and organizational controls that prevent the controller from accessing the 
27.5 	information.
27.6 	(c) A controller that uses pseudonymous data or deidentified data must exercise reasonable 
27.7 	oversight to monitor compliance with any contractual commitments to which the 
27.8 	pseudonymous data or deidentified data are subject, and must take appropriate steps to 
27.9 	address any breaches of contractual commitments.
27.10 	(d) A processor or third party must not attempt to identify the subjects of deidentified 
27.11 	or pseudonymous data without the express authority of the controller that caused the data 
27.12 	to be deidentified or pseudonymized.
27.13 	(e) A controller, processor, or third party must not attempt to identify the subjects of 
27.14 	data that has been collected with only pseudonymous identifiers.

27.15 	Sec. 8. [325O.07] RESPONSIBILITIES OF CONTROLLERS.
27.16 		Subdivision 1.Transparency obligations. (a) Controllers must provide consumers with 
27.17 	a reasonably accessible, clear, and meaningful privacy notice that includes:
27.18 	(1) the categories of personal data processed by the controller;
27.19 	(2) the purposes for which the categories of personal data are processed;
27.20 	(3) an explanation of the rights contained in section 325O.05 and how and where 
27.21 	consumers may exercise those rights, including how a consumer may appeal a controller's 
27.22 	action with regard to the consumer's request;
27.23 	(4) the categories of personal data that the controller sells to or shares with third parties, 
27.24 	if any;
27.25 	(5) the categories of third parties, if any, with whom the controller sells or shares personal 
27.26 	data;
27.27 	(6) the controller's contact information, including an active email address or other online 
27.28 	mechanism that the consumer may use to contact the controller;
27.29 	(7) a description of the controller's retention policies for personal data; and
27.30 	(8) the date the privacy notice was last updated.
28.1 	(b) If a controller sells personal data to third parties, processes personal data for targeted 
28.2 	advertising, or engages in profiling in furtherance of decisions that produce legal effects 
28.3 	concerning a consumer or similarly significant effects concerning a consumer, the controller 
28.4 	must disclose the processing in the privacy notice and provide access to a clear and 
28.5 	conspicuous method outside the privacy notice for a consumer to opt out of the sale, 
28.6 	processing, or profiling in furtherance of decisions that produce legal effects concerning a 
28.7 	consumer or similarly significant effects concerning a consumer. This method may include 
28.8 	but is not limited to an Internet hyperlink clearly labeled "Your Opt-Out Rights" or "Your 
28.9 	Privacy Rights" that directly effectuates the opt-out request or takes consumers to a web 
28.10 	page where the consumer can make the opt-out request.
28.11 	(c) The privacy notice must be made available to the public in each language in which 
28.12 	the controller provides a product or service that is subject to the privacy notice or carries 
28.13 	out activities related to the product or service.
28.14 	(d) The controller must provide the privacy notice in a manner that is reasonably 
28.15 	accessible to and usable by individuals with disabilities.
28.16 	(e) Whenever a controller makes a material change to the controller's privacy notice or 
28.17 	practices, the controller must notify consumers affected by the material change with respect 
28.18 	to any prospectively collected personal data and provide a reasonable opportunity for 
28.19 	consumers to withdraw consent to any further materially different collection, processing, 
28.20 	or transfer of previously collected personal data under the changed policy. The controller 
28.21 	shall take all reasonable electronic measures to provide notification regarding material 
28.22 	changes to affected consumers, taking into account available technology and the nature of 
28.23 	the relationship.
28.24 	(f) A controller is not required to provide a separate Minnesota-specific privacy notice 
28.25 	or section of a privacy notice if the controller's general privacy notice contains all the 
28.26 	information required by this section.
28.27 	(g) The privacy notice must be posted online through a conspicuous hyperlink using the 
28.28 	word "privacy" on the controller's website home page or on a mobile application's app store 
28.29 	page or download page. A controller that maintains an application on a mobile or other 
28.30 	device shall also include a hyperlink to the privacy notice in the application's settings menu 
28.31 	or in a similarly conspicuous and accessible location. A controller that does not operate a 
28.32 	website shall make the privacy notice conspicuously available to consumers through a 
28.33 	medium regularly used by the controller to interact with consumers, including but not limited 
28.34 	to mail.
29.1 		Subd. 2.Use of data. (a) A controller must limit the collection of personal data to what 
29.2 	is adequate, relevant, and reasonably necessary in relation to the purposes for which the 
29.3 	data are processed, which must be disclosed to the consumer.
29.4 	(b) Except as provided in this chapter, a controller may not process personal data for 
29.5 	purposes that are not reasonably necessary to, or compatible with, the purposes for which 
29.6 	the personal data are processed, as disclosed to the consumer, unless the controller obtains 
29.7 	the consumer's consent.
29.8 	(c) A controller shall establish, implement, and maintain reasonable administrative, 
29.9 	technical, and physical data security practices to protect the confidentiality, integrity, and 
29.10 	accessibility of personal data, including the maintenance of an inventory of the data that 
29.11 	must be managed to exercise these responsibilities. The data security practices shall be 
29.12 	appropriate to the volume and nature of the personal data at issue.
29.13 	(d) Except as otherwise provided in this act, a controller may not process sensitive data 
29.14 	concerning a consumer without obtaining the consumer's consent, or, in the case of the 
29.15 	processing of personal data concerning a known child, without obtaining consent from the 
29.16 	child's parent or lawful guardian, in accordance with the requirement of the Children's 
29.17 	Online Privacy Protection Act, United States Code, title 15, sections 6501 to 6506, and its 
29.18 	implementing regulations, rules, and exemptions.
29.19 	(e) A controller shall provide an effective mechanism for a consumer, or, in the case of 
29.20 	the processing of personal data concerning a known child, the child's parent or lawful 
29.21 	guardian, to revoke previously given consent under this subdivision. The mechanism provided 
29.22 	shall be at least as easy as the mechanism by which the consent was previously given. Upon 
29.23 	revocation of consent, a controller shall cease to process the applicable data as soon as 
29.24 	practicable, but not later than 15 days after the receipt of such request.
29.25 	(f) A controller may not process the personal data of a consumer for purposes of targeted 
29.26 	advertising, or sell the consumer's personal data, without the consumer's consent, under 
29.27 	circumstances where the controller knows that the consumer is between the ages of 13 and 
29.28 	16.
29.29 	(g) A controller may not retain personal data that is no longer relevant and reasonably 
29.30 	necessary in relation to the purposes for which the data were collected and processed, unless 
29.31 	retention of the data is otherwise required by law or permitted under section 325O.09.
29.32 		Subd. 3.Nondiscrimination. (a) A controller shall not process personal data on the 
29.33 	basis of a consumer's or a class of consumers' actual or perceived race, color, ethnicity, 
29.34 	religion, national origin, sex, gender, gender identity, sexual orientation, familial status, 
30.1 	lawful source of income, or disability in a manner that unlawfully discriminates against the 
30.2 	consumer or class of consumers with respect to the offering or provision of: housing, 
30.3 	employment, credit, or education; or the goods, services, facilities, privileges, advantages, 
30.4 	or accommodations of any place of public accommodation.
30.5 	(b) A controller may not discriminate against a consumer for exercising any of the rights 
30.6 	contained in this chapter, including denying goods or services to the consumer, charging 
30.7 	different prices or rates for goods or services, and providing a different level of quality of 
30.8 	goods and services to the consumer. This subdivision does not: (1) require a controller to 
30.9 	provide a good or service that requires the consumer's personal data that the controller does 
30.10 	not collect or maintain; or (2) prohibit a controller from offering a different price, rate, level, 
30.11 	quality, or selection of goods or services to a consumer, including offering goods or services 
30.12 	for no fee, if the offering is in connection with a consumer's voluntary participation in a 
30.13 	bona fide loyalty, rewards, premium features, discounts, or club card program.
30.14 	(c) A controller may not sell personal data to a third-party controller as part of a bona 
30.15 	fide loyalty, rewards, premium features, discounts, or club card program under paragraph 
30.16 	(b) unless:
30.17 	(1) the sale is reasonably necessary to enable the third party to provide a benefit to which 
30.18 	the consumer is entitled;
30.19 	(2) the sale of personal data to third parties is clearly disclosed in the terms of the 
30.20 	program; and
30.21 	(3) the third party uses the personal data only for purposes of facilitating a benefit to 
30.22 	which the consumer is entitled and does not retain or otherwise use or disclose the personal 
30.23 	data for any other purpose.
30.24 		Subd. 4.Waiver of rights unenforceable. Any provision of a contract or agreement of 
30.25 	any kind that purports to waive or limit in any way a consumer's rights under this chapter 
30.26 	is contrary to public policy and is void and unenforceable.

30.27 	Sec. 9. [325O.075] REQUIREMENTS FOR SMALL BUSINESSES.
30.28 	(a) A small business, as defined by the United States Small Business Administration 
30.29 	under Code of Federal Regulations, title 13, part 121, that conducts business in Minnesota 
30.30 	or produces products or services that are targeted to residents of Minnesota, must not sell 
30.31 	a consumer's sensitive data without the consumer's prior consent.
30.32 	(b) Penalties and attorney general enforcement procedures under section 325O.10 apply 
30.33 	to a small business that violates this section.

31.1 	Sec. 10. [325O.08] DATA PRIVACY POLICIES AND DATA PRIVACY AND 
31.2 	PROTECTION ASSESSMENTS.
31.3 	(a) A controller must document and maintain a description of the policies and procedures 
31.4 	the controller has adopted to comply with this chapter. The description must include, where 
31.5 	applicable:
31.6 	(1) the name and contact information for the controller's chief privacy officer or other 
31.7 	individual with primary responsibility for directing the policies and procedures implemented 
31.8 	to comply with the provisions of this chapter; and
31.9 	(2) a description of the controller's data privacy policies and procedures which reflect 
31.10 	the requirements in section 325O.07, and any policies and procedures designed to:
31.11 	(i) reflect the requirements of this chapter in the design of the controller's systems;
31.12 	(ii) identify and provide personal data to a consumer as required by this chapter;
31.13 	(iii) establish, implement, and maintain reasonable administrative, technical, and physical 
31.14 	data security practices to protect the confidentiality, integrity, and accessibility of personal 
31.15 	data, including the maintenance of an inventory of the data that must be managed to exercise 
31.16 	the responsibilities under this item;
31.17 	(iv) limit the collection of personal data to what is adequate, relevant, and reasonably 
31.18 	necessary in relation to the purposes for which the data are processed;
31.19 	(v) prevent the retention of personal data that is no longer relevant and reasonably 
31.20 	necessary in relation to the purposes for which the data were collected and processed, unless 
31.21 	retention of the data is otherwise required by law or permitted under section 325O.09; and
31.22 	(vi) identify and remediate violations of this chapter.
31.23 	(b) A controller must conduct and document a data privacy and protection assessment 
31.24 	for each of the following processing activities involving personal data:
31.25 	(1) the processing of personal data for purposes of targeted advertising;
31.26 	(2) the sale of personal data;
31.27 	(3) the processing of sensitive data;
31.28 	(4) any processing activities involving personal data that present a heightened risk of 
31.29 	harm to consumers; and
31.30 	(5) the processing of personal data for purposes of profiling, where the profiling presents 
31.31 	a reasonably foreseeable risk of:
32.1 	(i) unfair or deceptive treatment of, or disparate impact on, consumers;
32.2 	(ii) financial, physical, or reputational injury to consumers;
32.3 	(iii) a physical or other intrusion upon the solitude or seclusion, or the private affairs or 
32.4 	concerns, of consumers, where the intrusion would be offensive to a reasonable person; or
32.5 	(iv) other substantial injury to consumers.
32.6 	(c) A data privacy and protection assessment must take into account the type of personal 
32.7 	data to be processed by the controller, including the extent to which the personal data are 
32.8 	sensitive data, and the context in which the personal data are to be processed.
32.9 	(d) A data privacy and protection assessment must identify and weigh the benefits that 
32.10 	may flow directly and indirectly from the processing to the controller, consumer, other 
32.11 	stakeholders, and the public against the potential risks to the rights of the consumer associated 
32.12 	with the processing, as mitigated by safeguards that can be employed by the controller to 
32.13 	reduce the potential risks. The use of deidentified data and the reasonable expectations of 
32.14 	consumers, as well as the context of the processing and the relationship between the controller 
32.15 	and the consumer whose personal data will be processed, must be factored into this 
32.16 	assessment by the controller.
32.17 	(e) A data privacy and protection assessment must include the description of policies 
32.18 	and procedures required by paragraph (a).
32.19 	(f) As part of a civil investigative demand, the attorney general may request, in writing, 
32.20 	that a controller disclose any data privacy and protection assessment that is relevant to an 
32.21 	investigation conducted by the attorney general. The controller must make a data privacy 
32.22 	and protection assessment available to the attorney general upon a request made under this 
32.23 	paragraph. The attorney general may evaluate the data privacy and protection assessments 
32.24 	for compliance with this chapter. Data privacy and protection assessments are classified as 
32.25 	nonpublic data, as defined by section 13.02, subdivision 9. The disclosure of a data privacy 
32.26 	and protection assessment pursuant to a request from the attorney general under this 
32.27 	paragraph does not constitute a waiver of the attorney-client privilege or work product 
32.28 	protection with respect to the assessment and any information contained in the assessment.
32.29 	(g) Data privacy and protection assessments or risk assessments conducted by a controller 
32.30 	for the purpose of compliance with other laws or regulations may qualify under this section 
32.31 	if the assessments have a similar scope and effect.
32.32 	(h) A single data protection assessment may address multiple sets of comparable 
32.33 	processing operations that include similar activities.

33.1 	Sec. 11. [325O.09] LIMITATIONS AND APPLICABILITY.
33.2 	(a) The obligations imposed on controllers or processors under this chapter do not restrict 
33.3 	a controller's or a processor's ability to:
33.4 	(1) comply with federal, state, or local laws, rules, or regulations, including but not 
33.5 	limited to data retention requirements in state or federal law notwithstanding a consumer's 
33.6 	request to delete personal data;
33.7 	(2) comply with a civil, criminal, or regulatory inquiry, investigation, subpoena, or 
33.8 	summons by federal, state, local, or other governmental authorities;
33.9 	(3) cooperate with law enforcement agencies concerning conduct or activity that the 
33.10 	controller or processor reasonably and in good faith believes may violate federal, state, or 
33.11 	local laws, rules, or regulations;
33.12 	(4) investigate, establish, exercise, prepare for, or defend legal claims;
33.13 	(5) provide a product or service specifically requested by a consumer; perform a contract 
33.14 	to which the consumer is a party, including fulfilling the terms of a written warranty; or 
33.15 	take steps at the request of the consumer prior to entering into a contract;
33.16 	(6) take immediate steps to protect an interest that is essential for the life or physical 
33.17 	safety of the consumer or of another natural person, and where the processing cannot be 
33.18 	manifestly based on another legal basis;
33.19 	(7) prevent, detect, protect against, or respond to security incidents, identity theft, fraud, 
33.20 	harassment, malicious or deceptive activities, or any illegal activity; preserve the integrity 
33.21 	or security of systems; or investigate, report, or prosecute those responsible for any such 
33.22 	action;
33.23 	(8) assist another controller, processor, or third party with any of the obligations under 
33.24 	this paragraph;
33.25 	(9) engage in public or peer-reviewed scientific, historical, or statistical research in the 
33.26 	public interest that adheres to all other applicable ethics and privacy laws and is approved, 
33.27 	monitored, and governed by an institutional review board, human subjects research ethics 
33.28 	review board, or a similar independent oversight entity that has determined:
33.29 	(i) the research is likely to provide substantial benefits that do not exclusively accrue to 
33.30 	the controller;
33.31 	(ii) the expected benefits of the research outweigh the privacy risks; and
34.1 	(iii) the controller has implemented reasonable safeguards to mitigate privacy risks 
34.2 	associated with research, including any risks associated with reidentification; or
34.3 	(10) process personal data for the benefit of the public in the areas of public health, 
34.4 	community health, or population health, but only to the extent that the processing is:
34.5 	(i) subject to suitable and specific measures to safeguard the rights of the consumer 
34.6 	whose personal data is being processed; and
34.7 	(ii) under the responsibility of a professional individual who is subject to confidentiality 
34.8 	obligations under federal, state, or local law.
34.9 	(b) The obligations imposed on controllers or processors under this chapter do not restrict 
34.10 	a controller's or processor's ability to collect, use, or retain data to:
34.11 	(1) effectuate a product recall or identify and repair technical errors that impair existing 
34.12 	or intended functionality;
34.13 	(2) perform internal operations that are reasonably aligned with the expectations of the 
34.14 	consumer based on the consumer's existing relationship with the controller, or are otherwise 
34.15 	compatible with processing in furtherance of the provision of a product or service specifically 
34.16 	requested by a consumer or the performance of a contract to which the consumer is a party; 
34.17 	or
34.18 	(3) conduct internal research to develop, improve, or repair products, services, or 
34.19 	technology.
34.20 	(c) The obligations imposed on controllers or processors under this chapter do not apply 
34.21 	where compliance by the controller or processor with this chapter would violate an 
34.22 	evidentiary privilege under Minnesota law and do not prevent a controller or processor from 
34.23 	providing personal data concerning a consumer to a person covered by an evidentiary 
34.24 	privilege under Minnesota law as part of a privileged communication.
34.25 	(d) A controller or processor that discloses personal data to a third-party controller or 
34.26 	processor in compliance with the requirements of this chapter is not in violation of this 
34.27 	chapter if the recipient processes the personal data in violation of this chapter, provided that 
34.28 	at the time of disclosing the personal data, the disclosing controller or processor did not 
34.29 	have actual knowledge that the recipient intended to commit a violation. A third-party 
34.30 	controller or processor receiving personal data from a controller or processor in compliance 
34.31 	with the requirements of this chapter is not in violation of this chapter for the obligations 
34.32 	of the controller or processor from which the third-party controller or processor receives 
34.33 	the personal data.
35.1 	(e) Obligations imposed on controllers and processors under this chapter shall not:
35.2 	(1) adversely affect the rights or freedoms of any persons, including exercising the right 
35.3 	of free speech pursuant to the First Amendment of the United States Constitution; or
35.4 	(2) apply to the processing of personal data by a natural person in the course of a purely 
35.5 	personal or household activity.
35.6 	(f) Personal data that are processed by a controller pursuant to this section may be 
35.7 	processed solely to the extent that the processing is:
35.8 	(1) necessary, reasonable, and proportionate to the purposes listed in this section;
35.9 	(2) adequate, relevant, and limited to what is necessary in relation to the specific purpose 
35.10 	or purposes listed in this section; and
35.11 	(3) insofar as possible, taking into account the nature and purpose of processing the 
35.12 	personal data, subjected to reasonable administrative, technical, and physical measures to 
35.13 	protect the confidentiality, integrity, and accessibility of the personal data, and to reduce 
35.14 	reasonably foreseeable risks of harm to consumers.
35.15 	(g) If a controller processes personal data pursuant to an exemption in this section, the 
35.16 	controller bears the burden of demonstrating that the processing qualifies for the exemption 
35.17 	and complies with the requirements in paragraph (f).
35.18 	(h) Processing personal data solely for the purposes expressly identified in paragraph 
35.19 	(a), clauses (1) to (7), does not, by itself, make an entity a controller with respect to the 
35.20 	processing.

35.21 	Sec. 12. [325O.10] ATTORNEY GENERAL ENFORCEMENT.
35.22 	(a) In the event that a controller or processor violates this chapter, the attorney general, 
35.23 	prior to filing an enforcement action under paragraph (b), must provide the controller or 
35.24 	processor with a warning letter identifying the specific provisions of this chapter the attorney 
35.25 	general alleges have been or are being violated. If, after 30 days of issuance of the warning 
35.26 	letter, the attorney general believes the controller or processor has failed to cure any alleged 
35.27 	violation, the attorney general may bring an enforcement action under paragraph (b). This 
35.28 	paragraph expires January 31, 2026.
35.29 	(b) The attorney general may bring a civil action against a controller or processor to 
35.30 	enforce a provision of this chapter in accordance with section 8.31. If the state prevails in 
35.31 	an action to enforce this chapter, the state may, in addition to penalties provided by paragraph 
36.1 	(c) or other remedies provided by law, be allowed an amount determined by the court to be 
36.2 	the reasonable value of all or part of the state's litigation expenses incurred.
36.3 	(c) Any controller or processor that violates this chapter is subject to an injunction and 
36.4 	liable for a civil penalty of not more than $7,500 for each violation.
36.5 	(d) Nothing in this chapter establishes a private right of action, including under section 
36.6 	8.31, subdivision 3a, for a violation of this chapter or any other law.

36.7 	Sec. 13. [325O.11] PREEMPTION OF LOCAL LAW; SEVERABILITY.
36.8 	(a) This chapter supersedes and preempts laws, ordinances, regulations, or the equivalent 
36.9 	adopted by any local government regarding the processing of personal data by controllers 
36.10 	or processors.
36.11 	(b) If any provision of this chapter or the chapter's application to any person or 
36.12 	circumstance is held invalid, the remainder of the chapter or the application of the provision 
36.13 	to other persons or circumstances is not affected.

36.14 	Sec. 14. EFFECTIVE DATE.
 36.15 	This article is effective July 31, 2025, except that postsecondary institutions regulated 
36.16 	by the Office of Higher Education are not required to comply with this article until July 31, 
36.17 	2029.