1.1 	A bill for an act
1.2 	relating to consumer data privacy; giving various rights to consumers regarding 
1.3 	personal data; placing data transparency obligations on businesses; creating a 
1.4 	private right of action; providing for enforcement by the attorney general;proposing 
1.5 	coding for new law as Minnesota Statutes, chapter 325O.
1.6 	BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF MINNESOTA:

1.7 	Section 1. [325O.01] DEFINITIONS.
1.8 		Subdivision 1.Scope. As used in this chapter, the terms defined in this section have the 
1.9 	meanings given.
1.10 		Subd. 2.Business. "Business" means an individual, corporation, business trust, estate, 
1.11 	trust, partnership, limited liability company, association, joint venture, or any other legal 
1.12 	or commercial entity that is organized or operated for the profit or financial benefit of the 
1.13 	business's shareholders or other owners.
1.14 		Subd. 3.Business purpose. "Business purpose" means the use of personal information 
1.15 	for a business's or a service provider's operational purposes, or other notified purposes, 
1.16 	provided that the use of personal information must be reasonably necessary and proportionate 
1.17 	to achieve the operational purpose for which the personal information was collected or 
1.18 	processed or for another operational purpose that is compatible with the context in which 
1.19 	the personal information was collected. Business purposes include but are not limited to:
1.20 	(1) auditing related to a current interaction with the consumer and concurrent transactions, 
1.21 	including but not limited to counting ad impressions to unique visitors, verifying positioning 
1.22 	and quality of ad impressions, and auditing compliance with this specification and other 
1.23 	standards;
2.1 	(2) detecting security incidents; protecting against malicious, deceptive, fraudulent, or 
2.2 	illegal activity; and prosecuting those responsible for that activity;
2.3 	(3) debugging to identify and repair errors that impair existing intended functionality;
2.4 	(4) short-term, transient use, provided the personal information is not disclosed to another 
2.5 	third party and is not used to build a profile about a consumer or otherwise alter an individual 
2.6 	consumer's experience outside the current interaction, including but not limited to the 
2.7 	contextual customization of ads shown as part of the same interaction;
2.8 	(5) performing services on behalf of the business or service provider, including 
2.9 	maintaining or servicing accounts, providing customer service, processing or fulfilling 
2.10 	orders and transactions, verifying customer information, processing payments, providing 
2.11 	financing, providing advertising or marketing services, providing analytic services, or 
2.12 	providing similar services on behalf of the business or service provider;
2.13 	(6) undertaking internal research for technological development and demonstration; and
2.14 	(7) undertaking activities to verify or maintain the quality or safety of a service or device 
2.15 	that is owned by, manufactured by, manufactured for, or controlled by the business.
2.16 		Subd. 4.Collect. "Collect" means buying, renting, gathering, obtaining, receiving, or 
2.17 	accessing any personal information pertaining to a consumer by any means. This includes 
2.18 	receiving information from the consumer, either actively or passively, or by observing the 
2.19 	consumer's behavior.
2.20 		Subd. 5.Commercial purpose.  "Commercial purpose" means to advance a person's 
2.21 	commercial or economic interests, such as by inducing another person to buy, rent, lease, 
2.22 	join, subscribe to, provide, or exchange products, goods, property, information, or services 
2.23 	or enabling or effecting, directly or indirectly, a commercial transaction. Commercial purpose 
2.24 	does not include for the purpose of engaging in speech that state or federal courts have 
2.25 	recognized as noncommercial speech, including political speech and journalism.
2.26 		Subd. 6.Consumer. "Consumer" means a natural person who is a Minnesota resident.
2.27 		Subd. 7.Disclose. "Disclose" means releasing, disseminating, making available, 
2.28 	transferring, or otherwise communicating orally, in writing, or by electronic or other means, 
2.29 	a consumer's personal information by the business to a service provider for a business 
2.30 	purpose. Disclose does not include sell.
2.31 		Subd. 8.Personal Information. "Personal information" means information that identifies, 
2.32 	relates to, describes, is capable of being associated with, or could reasonably be linked, 
3.1 	directly or indirectly, with a particular consumer. Personal information includes but is not 
3.2 	limited to:
3.3 	(1) identifiers such as a real name, alias, postal address, telephone number, unique 
3.4 	personal identifier, online identifier, Internet Protocol address, e-mail address, account 
3.5 	name, Social Security number, driver's license or state identification card number, passport 
3.6 	number, signature, or other similar identifiers;
3.7 	(2) financial information such as a bank account number, loan or mortgage information, 
3.8 	income, an insurance policy, credit card number, or debit card number;
3.9 	(3) physical characteristics or descriptions;
3.10 	(4) education, professional, or employment-related information;
3.11 	(5) sleep, health, exercise, fitness, medical, or health insurance information;
3.12 	(6) characteristics of protected classifications under chapter 363A or federal law;
3.13 	(7) commercial information, including records of personal property; products or services 
3.14 	purchased, obtained, or considered; or other purchasing or consuming histories or tendencies;
3.15 	(8) biometric information such as genetic information as defined by section 13.386; 
3.16 	information derived from the iris, retina, fingerprint, face, other parts or features of the 
3.17 	body, voice recordings, keystroke patterns or rhythms, or gait patterns or rhythms;
3.18 	(9) internet or other electronic network activity information, including but not limited 
3.19 	to browsing history, search history, and information regarding a consumer's interaction with 
3.20 	an Internet website, application, or advertisement; and
3.21 	(10) inferences drawn from any of the information identified in this subdivision to create 
3.22 	a profile about a consumer reflecting the consumer's preferences, characteristics, traits, 
3.23 	predispositions, behavior, attitudes, abilities, and aptitudes.
3.24 		Subd. 9.Sell. "Sell" means selling, renting, releasing, disseminating, making available, 
3.25 	transferring, or otherwise communicating orally, in writing, or by electronic or other means, 
3.26 	a consumer's personal information by the business to a third party for a commercial purpose 
3.27 	or for any monetary or other valuable consideration. Sell does not include disclose.
3.28 		Subd. 10.Service provider. "Service provider" means a business to which another 
3.29 	business discloses a consumer's personal information.
3.30 		Subd. 11.Third party. "Third party" means a business to which another business sells 
3.31 	a consumer's personal information.

4.1 	Sec. 2. [325O.03] SCOPE; EXCLUSIONS.
4.2 		Subdivision 1.Scope. (a) A business is subject to this chapter if the business:
4.3 	(1) has annual gross revenues in excess of $25,000,000;
4.4 	(2) annually buys or sells the personal information of 50,000 or more individuals, 
4.5 	households, or devices; or
4.6 	(3) derives 50 percent or more of the business's annual revenues from selling personal 
4.7 	information.
4.8 	(b) A business is also subject to this chapter if the business:
4.9 	(1) controls or is controlled by a separate business that meets any of the criteria under 
4.10 	paragraph (a); and
4.11 	(2) shares common branding with that separate business.
4.12 	(c) For purposes of paragraph (b):
4.13 	(1) "controls" or "controlled" means:
4.14 	(i) ownership of, or the power to vote, more than 50 percent of the outstanding shares 
4.15 	of any class of voting security of a business;
4.16 	(ii) control in any manner over the election of a majority of the directors or of individuals 
4.17 	exercising similar functions; or
4.18 	(iii) the power to exercise a controlling influence over the management of a company; 
4.19 	and
4.20 	(2) "common branding" means a shared name, service mark, or trademark.
4.21 		Subd. 2.Exclusions. For purposes of this chapter, the following actions do not constitute 
4.22 	the sale of personal information by a business.
4.23 	(1) A consumer intentionally directs the business to disclose the consumer's personal 
4.24 	information or uses the business to intentionally interact with a third party, provided the 
4.25 	third party does not also sell the personal information. Intentional action by a consumer 
4.26 	must be active and deliberate. Hovering over, muting, pausing, or closing a given piece of 
4.27 	content does not constitute intentional action.
4.28 	(2) The business uses or shares an identifier for a consumer who has opted out of the 
4.29 	sale of the consumer's personal information for the purpose of alerting a third party or a 
4.30 	service provider that the consumer has opted out of the sale of the consumer's personal 
4.31 	information.
5.1 	(3) The business discloses with a service provider personal information of a consumer 
5.2 	that is necessary to perform a business purpose and the following conditions are met:
5.3 	(i) the business has provided notice pursuant to section 325O.04 that the information 
5.4 	may be disclosed;
5.5 	(ii) the service provider does not further collect, sell, disclose, or use the personal 
5.6 	information of the consumer except as necessary to perform the business purpose; and
5.7 	(iii) the contract between the business and the service provider prohibits the service 
5.8 	provider from retaining, using, or disclosing the personal information for any purpose other 
5.9 	than the specific purpose of performing the services specified in the contract for the business, 
5.10 	or as otherwise permitted by this chapter, including retaining, using, or disclosing the 
5.11 	personal information for a commercial purpose other than providing the service specified 
5.12 	in the contract with the businesses.
5.13 	(4) The business transfers to a third party the personal information of a consumer as an 
5.14 	asset in the context of a merger, acquisition, bankruptcy, or other transaction in which the 
5.15 	third party assumes control of all or part of the business. If the third party materially alters 
5.16 	how it uses or shares the personal information of a consumer in a manner that is materially 
5.17 	inconsistent with the terms and conditions agreed upon by the consumer at the time of 
5.18 	collection, the third party must provide the consumer prior notice of the new or changed 
5.19 	practice. The notice must be sufficiently prominent and robust to ensure that existing 
5.20 	consumers can easily exercise rights under this chapter. This paragraph does not authorize 
5.21 	a business to make material, retroactive privacy policy changes or make other changes in 
5.22 	the business's privacy policy in a manner that would constitute a deceptive trade practice.

5.23 	Sec. 3. [325O.04] BUSINESS TRANSPARENCY OBLIGATIONS.
5.24 		Subdivision 1.Business obligations regarding collection and disclosure of personal 
5.25 	information to service providers. (a) A business that collects personal information about 
5.26 	a consumer must, at or before the point of collection, notify the consumer of:
5.27 	(1) the categories of personal information the business collects about the consumer;
5.28 	(2) the categories of sources from which the business collects the personal information;
5.29 	(3) for each category of personal information, the business or commercial purpose for 
5.30 	collecting the personal information;
5.31 	(4) for each category of personal information, the categories of service providers to 
5.32 	which the personal information may be disclosed and the business purpose for the disclosure;
6.1 	(5) the consumer's right to access personal information under section 325O.045; and
6.2 	(6) the consumer's right to deletion of personal information under section 325O.052.
6.3 	(b) A business must not collect additional categories of personal information, use personal 
6.4 	information collected for additional purposes, or disclose additional personal information 
6.5 	without providing the consumer with notice consistent with paragraph (a).
6.6 	(c) A business must make available to consumers two or more designated methods for 
6.7 	submitting a request to either access personal information pursuant to section 325O.045 or 
6.8 	to delete personal information pursuant to section 325O.052. Such methods must include 
6.9 	a toll-free telephone number and, if the business maintains a website, a clear and conspicuous 
6.10 	link on the business's home page that enables a consumer to make a request pursuant to 
6.11 	section 325O.045 or 325O.052.
6.12 		Subd. 2.Business obligations regarding sale of personal information to third 
6.13 	parties. (a) A business that sells a consumer's personal information to a third party must, 
6.14 	at or before the point of sale:
6.15 	(1) notify the consumer which categories of personal information may be sold;
6.16 	(2) for each category of personal information the may be sold, notify the consumer of 
6.17 	the categories of third parties to which the personal information may be sold and the 
6.18 	commercial purpose for the sale; and
6.19 	(3) inform the consumer of the consumer's right to opt out of the sale under section 
6.20 	325O.05.
6.21 	(b) A business must not sell additional categories of personal information without 
6.22 	providing the consumer with notice consistent with paragraph (a).
6.23 	(c) A business that sells a consumer's personal information must make available to 
6.24 	consumers two or more designated methods for submitting a request to opt out of the 
6.25 	information sale pursuant to section 325O.05. Such methods must include a toll-free 
6.26 	telephone number and, if the business maintains a website, a clear and conspicuous link on 
6.27 	the business's home page titled "Do Not Sell My Personal Information" that enables a 
6.28 	consumer to opt out of the sale of the consumer's personal information.

6.29 	Sec. 4. [325O.042] THIRD PARTY AND SERVICE PROVIDER OBLIGATIONS.
6.30 	(a) A third party must not sell personal information about a consumer that has been sold 
6.31 	to the third party by a business unless the consumer has received explicit notice and is 
6.32 	provided an opportunity to exercise the right to opt-out pursuant to section 325O.05.
7.1 	(b) A service provider to which a business discloses personal information of a consumer 
7.2 	for a business purpose must not further retain, sell, disclose, or use the personal information 
7.3 	except as necessary to perform the business purpose specified in the service provider's 
7.4 	contract with the business or as otherwise permitted by law.

7.5 	Sec. 5. [325O.045] RIGHT TO ACCESS PERSONAL INFORMATION.
7.6 	(a) A consumer may at any time request that a business that collects a consumer's personal 
7.7 	information give the consumer access to the consumer's personal information collected by 
7.8 	the business, including:
7.9 	(1) the categories of personal information the business has collected about that consumer;
7.10 	(2) the categories of sources from which the business collects the personal information;
7.11 	(3) the specific pieces of personal information the business has collected about that 
7.12 	consumer;
7.13 	(4) for each category of personal information, the business or commercial purpose for 
7.14 	collecting the personal information;
7.15 	(5) for each category of personal information, the categories of service providers, if any, 
7.16 	to which the business discloses the personal information along with the business purpose 
7.17 	for the disclosure; and
7.18 	(6) for each category of personal information, the categories of third parties, if any, to 
7.19 	which the business sells the personal information along with the commercial purpose for 
7.20 	the sale.
7.21 	(b) A business must not require a consumer to create an account in order to make a 
7.22 	request under this section, but a business may require authentication of the consumer's 
7.23 	identity and the request. A business may require that the consumer make the request to 
7.24 	access the consumer's personal information through a designated method required by section 
7.25 	325O.04, subdivision 1, paragraph (c).
7.26 	(c) A business that receives a request from a consumer to access personal information 
7.27 	shall promptly take steps to disclose and deliver, free of charge to the consumer, the personal 
7.28 	information required by paragraph (a) within 45 days of receiving the consumer request. 
7.29 	The time period to provide the required information may be extended once by an additional 
7.30 	45 days when reasonably necessary, provided the consumer is notified of the extension 
7.31 	within the first 45-day period. The information may be delivered by mail or electronically, 
7.32 	and, if provided electronically, the information shall be in a portable and, to the extent 
8.1 	technically feasible, readily useable format that allows the consumer to transmit this 
8.2 	information to another entity without hindrance. A business shall not be required to provide 
8.3 	personal information to a consumer more than twice in a 12-month period.
8.4 	(d) This section shall not require a business to:
8.5 	(1) retain any personal information collected for a single, one-time transaction, if such 
8.6 	information is not sold or retained by the business; or
8.7 	(2) reidentify or otherwise link information that is not maintained in a manner that would 
8.8 	be considered personal information.

8.9 	Sec. 6. [325O.05] RIGHT TO OPT OUT OF INFORMATION SALE.
8.10 	(a) A consumer may, at any time, direct a business that sells personal information about 
8.11 	the consumer to a third party not to sell the consumer's personal information. This may be 
8.12 	referred to as the right to opt out. A business must not require a consumer to create an 
8.13 	account in order to make a request under this section, but a business may require 
8.14 	authentication of the consumer's identity and the request. A business may require that the 
8.15 	consumer make the request through a designated method required by section 325O.04, 
8.16 	subdivision 2, paragraph (c).
8.17 	(b) Notwithstanding paragraph (a), a business must not sell the personal information of 
8.18 	a consumer if the business has actual knowledge that the consumer is less than 16 years of 
8.19 	age, unless the consumer, in the case of a consumer between 13 and 16 years of age, or the 
8.20 	consumer's parent or guardian, in the case of consumers who are less than 13 years of age, 
8.21 	has affirmatively authorized the sale of the consumer's personal information. A business 
8.22 	that willfully disregards the consumer's age shall be deemed to have had actual knowledge 
8.23 	of the consumer's age. This may be referred to as the minor's right to opt in.
8.24 	(c) A business that receives a request from a consumer not to sell a consumer's personal 
8.25 	information pursuant to paragraph (a), or that has not received an authorization for a 
8.26 	consumer pursuant to paragraph (b), must not sell that consumer's personal information.

8.27 	Sec. 7. [325O.052] RIGHT TO DELETION OF PERSONAL INFORMATION.
8.28 		Subdivision 1.Right granted. (a) A consumer may request that a business delete any 
8.29 	personal information about the consumer which the business has collected from the consumer. 
8.30 	A business must not require a consumer to create an account in order to make a request 
8.31 	under this section, but a business may require authentication of the consumer's identity and 
9.1 	the request. A business may require that the consumer make the request through a designated 
9.2 	method required by section 325O.04, subdivision 1, paragraph (c).
9.3 	(b) A business that receives a request from a consumer to delete the consumer's personal 
9.4 	information pursuant to paragraph (a) shall delete the consumer's personal information from 
9.5 	the business's records and direct any service provider to delete the consumer's personal 
9.6 	information from the service provider's records.
9.7 		Subd. 2.Exceptions provided. A business or a service provider shall not be required 
9.8 	to comply with a consumer's request to delete the consumer's personal information if it is 
9.9 	necessary for the business or service provider to maintain the consumer's personal information 
9.10 	in order to:
9.11 	(1) complete the transaction for which the personal information was collected, fulfill 
9.12 	the terms of a written warranty or product recall conducted in accordance with federal law, 
9.13 	provide a good or service requested by the consumer or reasonably anticipated within the 
9.14 	context of a business's ongoing business relationship with the consumer, or otherwise 
9.15 	perform a contract between the business and the consumer;
9.16 	(2) detect security incidents; protect against malicious, deceptive, fraudulent, or illegal 
9.17 	activity; or prosecute those responsible for that activity;
9.18 	(3) debug to identify and repair errors that impair existing intended functionality;
9.19 	(4) exercise free speech, ensure the right of another consumer to exercise that consumer's 
9.20 	right of free speech, or exercise another right provided for by law;
9.21 	(5) engage in public or peer-reviewed scientific, historical, or statistical research in the 
9.22 	public interest that adheres to all other applicable ethics and privacy laws, when the business's 
9.23 	deletion of the information is likely to render impossible or seriously impair the achievement 
9.24 	of such research, if the consumer has provided informed consent;
9.25 	(6) to enable solely internal uses that are reasonably aligned with the expectations of 
9.26 	the consumer based on the consumer's relationship with the business;
9.27 	(7) comply with a legal obligation; or
9.28 	(8) otherwise use the consumer's personal information, internally, in a lawful manner 
9.29 	that is compatible with the context in which the consumer provided the information.

10.1 	Sec. 8. [325O.07] DISCRIMINATION PROHIBITED.
10.2 	(a) A business must not discriminate against a consumer because the consumer exercised 
10.3 	any of the consumer's rights under this chapter. Discrimination prohibited by this section 
10.4 	includes but is not limited to:
10.5 	(1) denying goods or services to the consumer;
10.6 	(2) charging a different price or rate for goods or services, including imposing penalties 
10.7 	or through the use of discounts, financial incentives, or other benefits;
10.8 	(3) providing a different level or quality of goods or services to the consumer; or
10.9 	(4) the suggestion that a consumer will be subject to such discrimination if the consumer 
10.10 	exercises any of the consumer's rights under this chapter.
10.11 	(b) Nothing in this section prohibits a business from charging a consumer a different 
10.12 	price or rate for goods or services, or providing a different level or quality of goods or 
10.13 	services to a consumer, if the difference is reasonably related to the value provided to the 
10.14 	business by sale of the consumer's data.

10.15 	Sec. 9. [325O.09] ENFORCEMENT; LIABILITY.
10.16 		Subdivision 1.Enforcement. (a) The attorney general may bring an action to enforce 
10.17 	a provision of this chapter in accordance with section 8.31. If the state prevails in an action 
10.18 	to enforce this chapter, the state, in addition to penalties provided by paragraph (b) or other 
10.19 	remedies provided by law, may be allowed an amount determined by the court to be the 
10.20 	reasonable value of all or part of the state's litigation expenses incurred.
10.21 	(b) In addition to other remedies provided by law, any person injured by a violation of 
10.22 	this chapter may bring a civil action to receive or recover:
10.23 	(1) damages not less than $100 and not more than $750 per consumer, per violation, or 
10.24 	the consumer's actual damages, whichever is greater;
10.25 	(2) the costs of investigation and reasonable attorney fees;
10.26 	(3) other equitable relief as determined by the court; and
10.27 	(4) in the case of a willful and malicious violation, exemplary damages in an amount 
10.28 	not exceeding three times other damages awarded.
10.29 	(c) In assessing the amount of damages under paragraph (b), clause (1), the court shall 
10.30 	consider any one the relevant circumstances presented by any of the parties to the case, 
10.31 	including but not limited to:
11.1 	(1) the nature and seriousness of the misconduct;
11.2 	(2) the number of violations;
11.3 	(3) the persistence of the misconduct;
11.4 	(4) the length of time over which the misconduct occurred;
11.5 	(5) the willfulness of the defendant's misconduct; and
11.6 	(6) the defendant's assets, liabilities, and net worth.
11.7 	(e) Any provision of a contract or agreement of any kind that purports to waive or limit 
11.8 	a business's compliance or a consumer's rights under this chapter is contrary to public policy 
11.9 	and is void and unenforceable.
11.10 		Subd. 2.Liability. (a) A business, service provider, or third party that violates this 
11.11 	chapter shall be liable for the violation.
11.12 	(b) A businesses that discloses a consumer's personal information to a service provider 
11.13 	or third party without violating this chapter shall not be liable for any subsequent violation 
11.14 	by the service provider or third party, provided that, at the time of disclosing the personal 
11.15 	information, the business did not have actual knowledge, or reason to believe, that the 
11.16 	service provider or third party intended to commit the violation.

11.17 	Sec. 10. EFFECTIVE DATE.
 11.18 	Sections 1 to 9 are effective June 30, 2024.