Data Privacy Interactive Map - Minnesota

Highlights

Covered Entities: Any person or business that conducts business in Minnesota, and that owns or licenses data that includes personal information.

Consumer Notification: When there has been a breach of the security of the system containing personal information following discovery or notification of the breach in the security of the data when the unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person.

Regulatory Notification: No.

Notification Timeline: In the most expedient time possible and without unreasonable delay, consistent with any measures necessary to determine the scope of the breach, identify the individuals affected, and restore the reasonable integrity of the data system.

Data Format: Electronic.

Citations: Minn. Stat. § 325E.61

More Details

Definitions:

• Breach: A breach of the security of the system means unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of personal information maintained by the person or business.
• Personal Information (PI):
  • Personal information means an individual’s first name or first initial and last name in combination with any one or more of the following data elements:
    • Social Security number;
    • Driver’s license number or Minnesota identification card number; or
    • Account number or credit card number, in combination with any required security code, access code, or password that would permit access to an individual’s financial account.
• Medical Information: N/A
• Health Insurance Information: N/A

Safe Harbors:

• Encryption: Does not apply when the data is secured by encryption or another method of technology that makes electronic data unreadable or unusable, only if the encryption key, password, or other means necessary for reading or using the data is not also acquired.
• Good Faith: Good faith acquisition of personal information by an employee or agent of the person or business for the purposes of the person or business is not a breach of the security system, provided that personal information is not used or subject to further unauthorized disclosure.
• Risk of Harm: N/A
• Law Enforcement Delay: Notification may be delayed to a date certain if a law enforcement agency affirmatively determines that the notification will impede a criminal investigation.

Direct Notice:

• Timing: Most expedient time possible and without unreasonable delay, consistent with any measures necessary to determine the scope of the breach, identify the individual affected, and restore the reasonable integrity of the data system.
• Format: N/A
• Content: N/A
• Method: Written notice to the most recent available address the person or business has in its records. Electronic notice, if the person’s primarily method of communication with the individual is by electronic means, or if the notice is consistent with the provisions regarding electronic records and signatures in E-SIGN.

Substitute Notice:

If the person or business demonstrates that the cost of providing notice would exceed $250,000, or that the affected class of subject persons to be notified exceeds 500,000, or the person or business does not have sufficient contact information. Substitute notice must consist of all of the following: (i) email notice when the person or business has an email address for the subject persons; (ii) conspicuous posting of the notice on the website page of the person or business, if the person or business maintains one; and (iii) notification to major statewide media.

Remediation Services:

N/A

Regulatory Notice:

N/A

Credit Reporting Agencies Notice:

If a person discovers circumstances requiring notification of more than 500 persons at one time, the person shall also notify, within 48 hours, all consumer reporting agencies that compile and maintain files on consumers on a nationwide basis of the timing, distribution, and content of the notices.

Third-Party Notice:

Any person or business that maintains data that includes personal information that the person or business does not own shall notify the owner or licensee of the information of any breach of the security of the data immediately following discovery, if the personal information was, or is reasonably believed to have been, acquired by an unauthorized person.

HIPAA:

N/A

Private Action:

N/A

Associated Regulations:

• Access Devices; Breach of Security (Minn. Stat. Ann. § 325E.64)
• Insurance Data Security (Minn. Stat. Ann. §§ 60A.985 - 60A.9858)
• Information Security Standard (Minn. Stat. Ann. §§ 325M.01 – 325M.09)
• Breach Disclosure for Minnesota Government Agencies (Minn. Stat. Ann. § 13.055)

Highlights

Covered Entities: Referred to as a “licensee”. A licensee is any person licensed, authorized to operate, or registered (or required to be licensed, authorized, or registered) by the Department of Commerce or the Department of Health under chapters 59A to 62M, 62Q to 62V, and 64B to 79A.

Security Standard: Commensurate with the size and complexity of the licensee, the nature and scope of the licensee's activities, including its use of third-party service providers, and the sensitivity of the nonpublic information used by the licensee or in the licensee's possession, custody, or control, each licensee shall develop, implement, and maintain a comprehensive written information security program based on the licensee’s risk assessment. The program must contain administrative, technical, and physical safeguards for the protection of nonpublic information and the licensee’s information system.

Consumer Notification: If a licensee is required to submit a report to the relevant Minnesota Commissioner, the licensee shall notify any consumer residing in Minnesota if, as a result of the cybersecurity event reported to the Commissioner, the consumer’s nonpublic information was or is reasonably believed to have been acquired by an unauthorized person, and there is a reasonable likelihood of material harm to the consumer as a result of the cybersecurity event. The notification must be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement or with any measures necessary to determine the scope of the breach, identify the individuals affected, and restore the reasonable integrity of the data system. The licensee shall provide a copy of the notice to the commissioner.

Notice can be made in one of the following methods:

• Written notice to the consumer's most recent address in the licensee's records;

• Electronic notice, if the licensee's primary method of communication with the consumer is by electronic means or if the notice provided is consistent with the provisions regarding electronic records and signatures in United States Code, title 15, section 7001; or

• If the cost of providing notice exceeds $250,000, the affected class of consumers to be notified exceeds 500,000, or the licensee does not have sufficient contact information for the subject consumers, notice as follows:

  • Email notice when the licensee has an email address for the subject consumers;

  • Conspicuous posting of the notice on the website page of the licensee; and

  • Notification to major statewide media.

  • Notwithstanding the notification requirements outlined above, a licensee that maintains its own notification procedure as part of its information security program that is consistent with the timing requirements of this subdivision is deemed to comply with the notification requirements if the licensee notifies subject consumers in accordance with its program.

Regulatory Notification: A licensee shall notify the Minnesota Commissioner of Commerce or the Commissioner of Health, whichever commissioner otherwise regulates the licensee, without unreasonable delay but in no event later than five business days from a determination that a cybersecurity event has occurred, when either of the criteria referenced below has been met.

Notification Timeline: The licensee must notify the applicable Minnesota Commissioner without unreasonable delay but in no event later than five business days from a determination that a cybersecurity event has occurred. As it pertains to consumer notification, notice must be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement or with any measures necessary to determine the scope of the breach, identify the individuals affected, and restore the reasonable integrity of the data system.

Citations: Minn. Stat. Ann. § 60A.985 et seq.

More Details

Definitions:

• Consumer: An individual, including but not limited to an applicant, policyholder, insured, beneficiary, claimant, and certificate holder who is a resident of Minnesota and whose nonpublic information is in a licensee’s possession, custody, or control.
• Cybersecurity Event: An event resulting in unauthorized access to, or disruption or misuse of, an information system or nonpublic information stored on an information system unless the licensee has determined that: (i) the unauthorized acquisition involved encrypted nonpublic information and the encryption key was not acquired, released, or used without authorization or (ii) the nonpublic information accessed by an unauthorized person has not been used or released and has been returned or destroyed.
• Licensee: Any person licensed, authorized to operate, or registered, or required to be licensed, authorized, or registered by the Department of Commerce or the Department of Health under chapters 59A to 62M, 62Q to 62V, and 64B to 79A. A licensee is not subject to sections 60A.985 to 60.9857 if it is: 
  • A licensee with fewer than 25 employees is exempt from sections 60A.9851 and 60A.9852;
  • A licensee subject to and in compliance with the Health Insurance Portability and Accountability Act, Public Law 104-191, 110 Stat. 1936 (HIPAA), is considered to comply with sections 60A.9851, 60A.9852, and 60A.9853, subdivisions 3 to 5, provided the licensee submits a written statement certifying its compliance with HIPAA;
  • A licensee affiliated with a depository institution that maintains an information security program in compliance with the interagency guidelines establishing standards for safeguarding customer information as set forth pursuant to United States Code, title 15, sections 6801 and 6805, shall be considered to meet the requirements of section 60A.9851 provided that the licensee produce, upon request, documentation satisfactory to the commission that independently validates the affiliated depository institution's adoption of an information security program that satisfies the interagency guidelines;
  • An employee, agent, representative, or designee of a licensee, who is also a licensee, is exempt from sections 60A.9851 and 60A.9852 and need not develop its own information security program to the extent that the employee, agent, representative, or designee is covered by the information security program of the other licensee; and

In the event that a licensee ceases to qualify for an exception, such licensee shall have 180 days to comply with sections 60A.985 to 60A.9858.

• Nonpublic Information: Electronic information that is not publicly available information and is:
  
  • Any information concerning a consumer which because of name, number, personal mark, or other identifier can be used to identify the consumer, in combination with any one (1) or more of the following data elements:
    
    • Social Security number;
    • Driver’s license number or nondriver identification card number;
    • Financial account number, credit card number, or debit card number;
    • Any security code, access code, or password that would permit access to a consumer’s financial account; or
    • Biometric records.
  • Any information or data, except age or gender, in any form or medium created by or derived from a health care provider or a consumer that can be used to identify a particular consumer and that relates to:
    
    • The past, present, or future physical, mental, or behavioral health or condition of any consumer or a member of the consumer’s family;
    • The provision of health care to any consumer; or
    • Payment for the provision of health care to any consumer.

Please note, the definition of nonpublic information and “personal information” as defined by Minnesota’s data breach statute differ. See Minn. Stat. Ann. § 325E.61 subd.1 (e).

Regulatory Notice:

A licensee shall notify the Minnesota Commissioner of Commerce or the Commissioner of Health, whichever commissioner otherwise regulates the licensee, without unreasonable delay but in no event later than five business days from a determination that a cybersecurity event has occurred when either of the following criteria has been met:

• Minnesota is the licensee’s state of domicile, in the case of an insurer, or Minnesota is the licensee’s home state, in the case of a producer, as those terms are defined in chapter 60K and the cybersecurity event has a reasonable likelihood of materially harming a consumer residing Minnesota or any material part of the licensee’s operations; or:
• The licensee reasonably believes that the nonpublic information involved is of 250 or more consumers residing in Minnesota and that is either of the following:
  
  • A cybersecurity event impacting the licensee of which notice is required to be provided to any government body, self-regulatory agency, or any other supervisory body pursuant to any state or federal law; or
  • A cybersecurity event that has a reasonable likelihood of materially harming either a consumer residing in Minnesota or a material part of the licensee’s operations.

Content Requirements:

When notifying the relevant Minnesota Commissioner of a cybersecurity event, a licensee shall provide as much of the following information as possible:

• The date of the cybersecurity event.
• A description of how the information was exposed, lost, stolen, or breached, including the specific roles and responsibilities of third-party service providers, if any.
• How the cybersecurity event was discovered.
• Whether any lost, stolen, or breached information has been recovered and if so, how this was done.
• The identity of the source of the cybersecurity event.
• Whether the licensee has filed a police report or has notified any regulatory, government, or law enforcement agencies and, if so, when such notification was provided.
• A description of the specific types of information acquired without authorization. Specific types of information means particular data elements including, for example, types of medical information, types of financial information, or types of information allowing identification of the consumer.
• The period during which the information system was compromised by the cybersecurity event.
• The number of total consumers in this state affected by the cybersecurity event. The licensee shall provide the best estimate in the initial report to the commissioner and update this estimate with each subsequent report to the commissioner pursuant to this section.
• The results of any internal review identifying a lapse in either automated controls or internal procedures, or confirming that all automated controls or internal procedures were followed.
• A description of efforts being undertaken to remediate the situation which permitted the cybersecurity event to occur.
• A copy of the licensee’s privacy policy and a statement outlining the steps the licensee will take to investigate and notify consumers affected by the cybersecurity event.
• The name of a contact person who is familiar with the cybersecurity event and authorized to act for the licensee.

Third-Party Notice Requirements:

If a licensee discovers that a cybersecurity incident occurred in a system maintained by a third-party service provider, the licensee shall treat the event in the same manner for purposes of notification to the applicable Minnesota Commissioner unless the third-party service provider provides the notice to the Commissioner. The computation of a licensee's deadlines shall begin on the day after the third-party service provider notifies the licensee of the cybersecurity event or the licensee otherwise has actual knowledge of the cybersecurity event, whichever is sooner.

Penalties:

In the case of violation under this statute, a licensee may be penalized in accordance with Minn. Stat. Ann. §60A.052. Penalties include the following: (1) revocation or suspension of any or all certificates of authority granted to the foreign or domestic insurance company or its agent; (2) censuring of the insurance company; (3) cancellation of all or some of the company's insurance contracts then in force in this state; (4) the imposition of a civil penalty; or (5) under a written agreement with the insurance company based upon the company's financial condition, imposition of conditions or restrictions on the insurance company's authority to transact business in Minnesota.

Associated Regulations:

N/A

Highlights

Covered Entities: Internet Service Providers.

First Party Security Standard: The Internet service provider shall take reasonable steps to maintain the security and privacy of a consumer’s personally identifiable information.

Third Party Security Standard: N/A

Disposal/Destruction Standard: N/A

Data Format: Electronic and Paper.

Citations: Minn. Stat. §§ 325M.01 – 325M.09.

More Details

Definitions:

• Consumer: A person who agrees to pay a fee to an Internet service provider for access to the Internet for personal, family, or household purposes, and who does not resell access.
• Internet Service Provider: A business or person who provides consumer authenticated access to, or presence on, the Internet by means of a switched or dedicated telecommunications channel upon which the provider provides transit routing of Internet Protocol (IP) packets for and on behalf of the consumer. Internet service provider does not include the offering, on a common carrier basis, of telecommunications facilities or of telecommunications by means of these facilities.
• Personal Information (PI): Personally identifiable information means information that identifies:
  
  • A consumer by physical or electronic address or telephone number;
  • A consumer as having requested or obtained specific materials or services from an Internet service provider;
  • Internet or online sites visited by a consumer, or
  • Any of the contents of a consumer’s data-storage devices.

Methods of Compliance:

The statute does not define what constitutes “reasonable steps” or other means of compliance are not defined by the statute.

Exclusions:

• Health Care: N/A
• Financial: N/A
• Other: An Internet service provider may disclose personally identifiable information concerning a consumer to:
  
  • Any person if the disclosure is incident to the ordinary course of business of the Internet service provider;
  • Another Internet service provider for purposes of reporting or preventing violations of the published acceptable use policy or customer service agreement of the Internet service provider; except that the recipient may further disclose the personally identifiable information only as provided by this chapter;
  • Any person with the authorization of the consumer; or
  • As provided in 626A.27.

Enforcement/Penalties:

A consumer who prevails or substantially prevails in an action brought under this chapter is entitled to the greater of $500 or actual damages. Costs, disbursements, and reasonable attorney fees may be awarded to a party awarded damages for a violation of this section. No class action shall be brought under this chapter.

In an action under this chapter, it is a defense that the defendant has established and implemented reasonable practices and procedures to prevent violations of this chapter.

Associated Regulations:

N/A

Minn. Stat § 325M.10 to 325M.21

Highlights

Applicability:

A legal entity that conducts business in Minnesota or produces products or services targeted to residents of Minnesota and satisfies one or more of the following thresholds:

• (1) during a calendar year, controls or Processes Personal Data of 100,000 Consumers or
  more, excluding Personal Data controlled or Processed solely for the purpose of completing payment transaction; or
• (2) derives over 25 percent of gross revenue from the Sale of Personal Data and Processes
  or controls Personal Data of 25,000 Consumers or more.

Among other exclusions, the Minnesota Act does not apply to the following entities: government entities; Indian tribes; chartered banks or credit unions; insurance companies; nonprofit organizations (established for the prevention of insurance fraud); small businesses (as defined by the U.S. Small Business Administration and that do not sell sensitive data without Consumer prior consent); and entities in compliance with the Children’s Online Privacy Protection Act.

In addition, the Minnesota Act does not apply to the following types of information: protected health information (as defined by the Health Insurance Portability and Accountability Act); information related to consumer credit worthiness (as defined by the Fair Credit Reporting Act); financial data regulated by the Gramm-Leach-Bliley Act; employment-related information; and information covered by the Drivers' Privacy Protection Act, the Family Educational Rights and Privacy Act, and the Farm Credit Act.  

The Act also excludes Personal Data Processed by a natural person in the course of a purely personal or household activity. Controllers and Processors that comply with COPPA’s verifiable parental consent requirements are considered compliant with the Minnesota Act’s parental-consent requirements for data collected online. Note: Effective Date July 31, 2025 applies, except that postsecondary institutions regulated by the Minnesota Office of Higher Education are not required to comply until July 31, 2029.

Controller Obligations:

Among other obligations, the Minnesota Act requires Controllers to:

• Implement appropriate administrative, technical, and physical measures to ensure appropriate security regarding the confidentiality, integrity, and accessibility of Personal Data, including the maintenance of an inventory of the data that must be managed to exercise these responsibilities.
• Limit the collection of Personal Data to that adequate, relevant, and reasonably necessary in relation to purposes with which the data is Processed and disclosed and inform the same to the relevant Consumer.
• Provide an online privacy notice, via hyperlink posted on the Controller’s homepage, including the following: categories of Personal Data Processed; purpose(s) for Processing the data; an explanation of a Consumer's rights and how rights may be exercised; categories of third parties to whom Personal Data is disclosed and which categories of data may be disclosed; a description of data retention policies; and an active email address or other online mechanism for a Consumer to directly contact the Controller. Controllers must electronically notify Consumers of any material changes to the privacy notice and provide a reasonable opportunity for Consumers to thereafter withdraw consent.

The privacy notice must also include the date it was last updated, must be available in each language in which the Controller provides a product or service subject to the notice, and must be reasonably accessible to and usable by individuals with disabilities.

Note: The Minnesota Act does not require Controllers to provide a separate privacy notice specific to Minnesota residents, where a Controller's general privacy notice satisfies requirements under the Act.

• Provide notice within the privacy policy, along with a method for Consumers to opt-out of Sale or Processing, if Personal Data is Processed and/or sold for Targeted Advertising or Profiling in furtherance of decisions that produce legal or similarly significant effects concerning a Consumer.
• Not Process Sensitive Data, without the Consumer's consent, or in the case of a known child, in accordance with the Children's Online Privacy Protection Act (COPPA).
• Provide a mechanism for the Consumer (or a child’s parent or legal guardian) to revoke consent that is as easy as the mechanism provided for consent. Upon revocation, the Controller must cease Processing the applicable data as soon as practicable, but not later than 15 days after receiving the request.
  • Not Process Personal Data for purposes of Targeted Advertising or sell the Consumer’s Personal Data without consent when the Controller knows that the Consumer is between the ages of 13 and 16.
  • Not retain Personal Data that is no longer relevant and reasonably necessary in relation to the purposes for which the data was collected and Processed, unless retention is otherwise required by law or permitted under the Minnesota Act.
• Not Process data in violation of state and federal laws prohibiting discrimination, including by Processing Personal Data based on a Consumer’s or class of Consumers’ actual or perceived race, color, ethnicity, religion, national origin, sex, gender, gender identity, sexual orientation, familial status, lawful source of income, or disability in a manner that unlawfully discriminates in housing, employment, credit, education, or places of public accommodation.
• Not discriminate against Consumers based on the exercise of any rights under the Minnesota Act.
• Respond to Consumers without undue delay, but not later than 45 days after receiving a Consumer’s request. The 45 days may be extended by an additional 45 days when reasonably necessary, considering the complexity and number of the Consumer’s requests, provided that the Controller informs the Consumer of the extension within the initial 45-day period and provides the reason for the extension.
• Where a Controller declines to act regarding a Consumer’s request, notify the Consumer without undue delay, but not later than 45 days after receiving the request, of the justification for declining to act and providing instructions for how to appeal the decision.
• Conduct and document a Data Protection Assessment (DPA) for each of the Controller’s Processing activities that include the following:
  • Targeted Advertising;
  • Processing Sensitive Data;
  • Selling Personal Data;
  • Processing activities involving Personal Data with a heightened risk of Consumer harm; and
  • Processing data for Profiling, if the Profiling presents a reasonably foreseeable risk of unfair or deceptive treatment, unlawful disparate impact on Consumers; financial, physical, or reputational injury to Consumers; intrusion upon a Consumer's private affairs; or other substantial injury to Consumers.
• Maintain a data inventory as part of the Controller’s security obligations and data governance responsibilities.
• Comply with a Consumer’s request to exercise rights and establish secure and reliable means for Consumers to submit requests, taking into account how Consumers normally interact with the Controller, the need for secure and reliable communication, and the Controller’s ability to authenticate the Consumer.
• Not require a Consumer to create a new account to exercise Consumer rights, but the Controller may require the Consumer to use an existing account.
• Provide an internal appeal process for Consumers to appeal a refusal to take action on a Consumer rights request. The appeal process must be conspicuously available and similar to the process for submitting rights requests.
• Treat any contract or agreement that purports to waive or limit Consumer rights under the Minnesota Act as void and unenforceable.

Additional Notes:

• As part of DPA requirements, controllers must provide the name and contact information for the controller's chief privacy officer or other individual with primary responsibility for directing the policies and procedures implemented to comply with the Act’s provisions—i.e., this creates an implied requirement to appoint a CPO or equivalent.
• Data protection assessments must also include, among other things, a summary of the processing activity; the categories of personal data processed; the purpose of processing; any external parties that receive the data; the risks to consumers; safeguards to mitigate those risks; and the controller’s policies and procedures for compliance.
• A Controller is not required to disclose, in response to a Consumer request, details regarding the collection of sensitive information but may inform the Consumer whether such information was collected.  
• A Controller is not required to comply with a Consumer opt-out request, in the event the Controller is unable to authenticate the request or believes such request is fraudulent, in which case the Controller must notify the person who submitted the request that the request was denied due to the Controller’s review and determination.

Processor Obligations:

Among other obligations, the Minnesota Act requires Processors to:

• Adhere to the instructions of the Controller and assist the Controller in complying with the Minnesota Act, including obligations regarding Consumer rights requests, security of data Processing and breach notifications, and providing necessary information to enable the Controller to conduct and document data protection assessments.
• Enter into a binding contract with the Controller that clearly sets forth the instructions for Processing data, nature and purpose of Processing, type of data subject to Processing, duration of Processing, confidentiality regarding Processed data, deletion or return of data to the Controller, opportunity for the Controller to reject any subcontractor, and rights and obligations of both Controller and Processor.
• Ensure that each person Processing Personal Data is subject to a duty of confidentiality with respect to that Personal Data.
• At the Controller’s direction, delete or return all Personal Data to the Controller at the end of the provision of services, unless retention of the Personal Data is required by law.
• Make available to the Controller all information necessary to demonstrate the Processor’s compliance with its obligations, on the Controller’s reasonable request.
• Allow and cooperate with reasonable assessments by the Controller or the Controller’s designated assessor, or arrange for a qualified and independent assessor to assess the Processor’s policies and technical and organizational measures using an appropriate and accepted control standard or framework.
• Engage subcontractors only after providing the Controller with an opportunity to object and entering into a written contract requiring the subcontractor to meet the Processor’s obligations with respect to Personal Data.

Consumer Rights:

Consumers under the Minnesota Act have the right to the following:

• Confirm whether the Controller is Processing the Personal Data;
• Access the Personal Data;
• Correct inaccurate Personal Data concerning the Consumer, taking into account the nature of the Personal Data and the purposes of Processing;
• Delete the Personal Data concerning the Consumer;
• Obtain Personal Data concerning the Consumer in a portable and, to the extent technically feasible, readily usable format that allows the Consumer to transmit the data to another entity without hindrance; and
• Obtain a list of the specific third parties to which the Controller has disclosed the Consumer’s Personal Data, or, if the Controller does not maintain this information in a format specific to the Consumer, a list of specific third parties to which the Controller has disclosed any Consumers’ Personal Data.
• Obtain information about the reasoning behind a Profiling decision, including the actions the Consumer might have taken to secure a different decision and the actions the Consumer might take to secure a different decision in the future.
• Right to opt out of Personal Data Sales, Targeted Advertising, and Profiling in furtherance of automated decisions producing legal or similarly significant effects concerning the customer (e.g. decisions made by the Controller that result in the provision or denial by the Controller of financial or lending services, housing, insurance, education enrollment or opportunity, criminal justice, employment opportunities, health care services, or access to necessities such as food and water).
• If Profiling results in a decision producing legal or similarly significant effects concerning the Consumer, question the result, be informed of the reason the Profiling resulted in the decision, review the Consumer’s Personal Data used in the Profiling, and, if the decision was based on inaccurate Personal Data, correct the data and request reevaluation.

Note: The Minnesota Act requires Controllers to allow Consumers to opt out of Processing Personal Data by using universal opt-out mechanisms ("UOOMs").

More Details

Definitions:

• Biometric data: Data generated by automatic measurements of an individual's​ biological characteristics, including a fingerprint, voiceprint, eye retinas, irises, or other​ unique biological patterns or characteristics used to identify a specific individual.​ “Biometric data” does not include:​ (1) a digital or physical photograph;​ (2) an audio or video recording; or (3) any data generated from a digital or physical photograph, or an audio or video​ recording, unless the data is generated to identify a specific individual.
• Consumer: A natural person who is a Minnesota resident acting only in an​ individual or household context. Consumer does not include a natural person acting in a​ commercial or employment context.​
• Controller: A natural or legal person who, alone or jointly with others,​ determines the purposes and means of the Processing of Personal Data.​
• Consent: Any freely given, specific, informed, and unambiguous indication of the Consumer’s wishes by which the Consumer signifies agreement to the Processing of Personal Data relating to the Consumer. Consent does not include acceptance of general or broad terms of use, hovering over, muting, pausing, or closing content, or consent obtained through a dark pattern. A Consumer may revoke consent previously given.
• Decision that Produces Legal or Similarly Significant Effects Concerning the Consumer: A decision made by the Controller that results in the provision or denial by the Controller of financial or lending services, housing, insurance, education enrollment or opportunity, criminal justice, employment opportunities, health care services, or access to essential goods or services.
• Known Child: A person under circumstances where a Controller has actual
  knowledge of, or willfully disregards, that the person is under 13 years of age.
• Personal Data: Any information that is linked or reasonably linkable to an​ identified or identifiable natural person. Personal Data does not include deidentified data or​ publicly available information (defined as information that is lawfully made available from federal, state, or​ local government records or widely distributed media, or where a Controller has a reasonable​ basis to believe has lawfully been made available to the general public by the Consumer or by a person to whom the Consumer disclosed the information, unless the Consumer restricted the information to a specific audience).
• Process or Processing: Any operation or set of operations performed​ on Personal Data or sets of Personal Data, whether or not by automated means, including​ but not limited to the collection, use, storage, disclosure, analysis, deletion, or modification​ of Personal Data.​
• Processor: A natural or legal person who Processes Personal Data on behalf​ of a Controller.
• Profiling: Any form of automated Processing of Personal Data to evaluate,​ analyze, or predict personal aspects related to an identified or identifiable natural person's​ economic situation, health, personal preferences, interests, reliability, behavior, location,​ or movements.​
• Sale, sell, or sold: The exchange of Personal Data for monetary or other​ valuable consideration by the Controller to a third party. Sale does not include the following disclosures:​ Personal Data to a Processor, on the Controller’s​ behalf;​ Personal Data to a third party for purposes of providing a product​ or service requested by the Consumer;​ Personal Data to an affiliate of the Controller; information the Consumer intentionally made available to the​ general public via a channel of mass media and did not restrict to a specific audience;​ Personal Data to a third party as an asset included in a merger, acquisition, bankruptcy, or other transaction; or​ exchange of Personal Data between a producer of a good or service and​/or authorized agents.
• Sensitive data:​ Personal Data revealing racial or ethnic origin, religious beliefs, mental or physical​ health condition or diagnosis, sexual orientation, or citizenship or immigration status;​ Processing of biometric data or genetic information for the purpose of uniquely​ identifying an individual;​ Personal Data of a known child; or​ specific geolocation data.
• Specific Geolocation Data: Information derived from technology, including but not limited to global positioning system level latitude and longitude coordinates or other mechanisms, that directly identifies the geographic coordinates of a Consumer or a device linked to a Consumer with an accuracy of more than three decimal degrees of latitude and longitude, or the equivalent in an alternative geographic coordinate system, or a street address derived from the coordinates. Specific geolocation data does not include the content of communications or any data generated by or connected to advanced utility metering infrastructure systems or equipment for use by a utility.Targeted Advertising: Displaying advertisements to a Consumer where the advertisement is selected based on Personal Data obtained or inferred from the Consumer’s activities over time and across nonaffiliated websites or online applications to predict the Consumer’s preferences or interests. Targeted Advertising does not include advertisements based on activities within a Controller’s own websites or online applications, the context of a Consumer’s current search query or website visit, the Consumer’s request for information or feedback, or Processing Personal Data solely to measure or report advertising performance, reach, or frequency.]
• Third Party: A natural or legal person, public authority, agency, or body other than the Consumer, Controller, Processor, or affiliate of the Controller or Processor.

Penalties:

The Minnesota Attorney General may bring a civil action against a Controller or Processor to enforce provisions of the Minnesota Act. Violations may result in one or more of the following: an injunction; civil penalties of not more than $7,500 for each violation; payment for the reasonable value of the State’s litigation expenses; and/or any other remedies provided by law.

Private Action:

No

Enforcement Action:

No

Associated Regulations & Rulemakings:

H.F. 4757

Minn. Stat § 325E.61

Notes on AI Related Regulations:

The Minnesota Act is not a standalone AI law, but it regulates AI-adjacent processing through consumer opt-out rights for Profiling in furtherance of decisions producing legal or similarly significant effects, data protection assessments for high-risk Profiling, and consumer rights to obtain information about the reasoning behind certain Profiling decisions and to question, review, correct, and request reevaluation of certain Profiling decisions.

Effective Date: 

July 31, 2025, except that postsecondary institutions regulated by the Minnesota Office of Higher Education are not required to comply until July 31, 2029.