Minnesota Consumer Data Privacy Act (HF 1492) Summary

• Establishes consumer rights to confirm data processing, access, correct, delete, and port personal data, plus opt out of targeted advertising and data sales.

• Applies to businesses conducting business in Minnesota that control/process data of 100,000+ consumers annually or derive 25%+ revenue from selling personal data of 25,000+ consumers.

• Requires controllers to provide transparent privacy notices, limit data collection to necessary purposes, maintain data security, obtain consent for sensitive data processing, and conduct data protection assessments for high-risk activities.

• Prohibits discrimination against consumers exercising privacy rights and prohibits processing personal data for unlawful discrimination in housing, employment, credit, or education.

• Provides attorney general enforcement authority with 30-day cure period before civil action; violators subject to injunctions and civil penalties up to $7,500 per violation; effective July 31, 2022 with delayed compliance until July 31, 2026 for certain educational institutions, air carriers, and nonprofits.