Law note · Minnesota
Minnesota Consumer Data Privacy Act, sensitive data and biometric consent
MCDPA classifies data revealing racial or ethnic origin, religious beliefs, a mental or physical health condition or diagnosis, sexual orientation, or citizenship or immigration status; the processing of biometric data or genetic information to uniquely identify an individual; a known child's data; and precise geolocation data as sensitive data, processable only with the consumer's opt-in consent, the ordinary multi-state model rather than Maryland's outright sale ban.
"Biometric data" means data generated by automatic measurement of biological characteristics used to identify a specific individual, and it excludes a bare photograph, video, or audio recording, but claws that exclusion back the moment data generated from one is used to identify a specific individual.
What it asks of an app
- Obtain a Minnesota consumer's opt-in consent before processing biometric data, or any other sensitive data, when that biometric data is processed for the purpose of uniquely identifying the individual.
- Treat an identifier your product derives from a photograph, video, or audio recording as MCDPA biometric data the moment it is generated to identify a specific individual. Minnesota's biometric definition claws this back rather than excluding it outright.
When LexLint raises it
Declared activities: processes_biometrics, processes_voice, crawls_web, trains_models
Primary source: official Minnesota statute text, Minn. Stat. Chapter 325M, Office of the Revisor of Statutes