Law note · Minnesota
Minnesota Consumer Data Privacy Act, consumer rights and profiling
MCDPA grants a Minnesota consumer the rights to confirm processing, access, correct, delete, port their personal data, and opt out of targeted advertising, sale, and certain profiling, with an appeal right for denials.
A consumer may also demand a list of the specific third parties a controller disclosed their personal data to, going further than the multi-state model's usual categories-only disclosure, and may opt out of automated profiling for decisions with legal or similarly significant effects, question such a decision, receive an explanation, and have it reevaluated if based on inaccurate data.
A controller must respond within 45 days of receipt, extendable once by 45 additional days, and must respond to an appeal within 45 days, extendable by 60 additional days.
What it asks of an app
- Give a Minnesota consumer a means to confirm processing, access, correct, delete, and port their personal data.
- Provide a Minnesota consumer, on request, a list of the specific third parties you disclosed their personal data to, not merely categories of third parties.
- Offer a Minnesota consumer the right to opt out of automated profiling in furtherance of decisions with legal or similarly significant effects, question the result, receive an explanation, and have the decision reevaluated if based on inaccurate data.
When LexLint raises it
Declared activities: crawls_web, trains_models, deploys_chatbot, automated_outreach, high_risk_decisions
Primary source: official Minnesota statute text, Minn. Stat. Chapter 325M, Office of the Revisor of Statutes