The Minnesota Consumer Data Privacy Act Is the Next Evolution in Consumer Privacy Rights

Key Takeaways:

• The Minnesota Consumer Data Privacy Act (the “Act”) follows established trends regarding transparency, data minimization, and required assessments, but represents the next evolution in consumer rights under U.S. state-by-state privacy legislation.
• The Act provides consumers with special rights related to profiling, that is, automated processing of personal data to evaluate, analyze, or predict personal aspects of an individual, including through AI, not found in other state laws.
• The Act requires covered organizations to adapt and expand their existing compliance programs in order to respond to these new consumer rights.

Summary:

Starting July 31, Minnesota will join the growing list of U.S. states with its own comprehensive consumer data privacy law, but with a key difference. Signed into law in 2024, the Minnesota Consumer Data Privacy Act follows the broader national trend toward stronger data protection and use standards. Like other U.S. state privacy laws, the Act requires covered organizations to:

• publish a clear, accessible privacy notice that lists the categories of data collected, the purposes of data processing, the categories of data sold or disclosed, contact information for the controller, and a description of consumer rights and how to exercise them;
• recognize universal opt-out mechanisms, such as browser privacy settings, that signal a consumer’s choice to opt out of online browsing data sales or targeted advertising;
• perform data privacy and protection assessments for high-risk data processing activities; and
• provide consumers with the right to access, correct, delete, and port their data, and to opt out of certain uses of their data, like selling, profiling, and use of targeted advertising.

What sets Minnesota apart is its focus on consumer profiling. Profiling is the use of personal data to evaluate or predict aspects of an individual’s life, such as their behavior, preferences, or economic status. Under the Act, not only will consumers have the right to opt out of this type of data processing when it is used to reach significant decisions, but also request detailed explanations regarding the profiling’s outcome.

Profiling and Automated Decision-Making:

Formally, the Act defines “profiling” as any form of automated processing of personal data to evaluate, analyze, or predict personal aspects of an individual, for example, an individual’s economic situation, health, preferences, behavior, location, or movements. Note that the term “artificial intelligence” does not appear anywhere in the Act, but the application of AI would fall squarely under the definition of “profiling.”

“Profiling” is a data processing activity that must be disclosed to consumers and must be subject to data privacy and protection assessments if there is some foreseeable harm that may arise to the consumer due to its application. However, Minnesota gives consumers special rights related to profiling in cases where it feeds into automated decisions that produce legal or similarly significant effects (e.g., financial or lending services, housing, insurance, education enrollment or opportunity, criminal justice, employment opportunities, health care services, or access to essential goods or services). Namely:

• To opt out of the processing of their data for profiling purposes;
• To question the result of the profiling, i.e., the right to be told why the profile led to a particular decision and, if feasible, what actions the consumer might take to achieve a different outcome; and
• To review the personal data used in the profiling, and if the decision is based on inaccurate data, the organization must correct the data and reassess the profiling decision.

These consumer rights exist even if a human is a part of the decision-making process or is the final decision maker. This is because the opt-out right extends to profiling “in furtherance of decisions” that produce legal or similarly significant effects. There is no prerequisite that the decision itself be automated. This is a key distinction between the Act and other U.S. comprehensive privacy laws, like Delaware’s, which limits the opt-out right to profiling “in furtherance of solely automated decisions,” or Iowa’s and Utah’s privacy laws that don’t provide a profiling opt-out right at all.