HF2700

Purpose of the Bill

This legislative bill aims to amend the Minnesota Consumer Data Privacy Act by adding new protections for consumer health data and classifying it as sensitive data. It gives consumers more control over how their sensitive data is used, sold, or processed.

Main Provisions

• Sensitive Data Definition: The bill expands the definition of sensitive data to include consumer health data, biometric data, and genetic information.
• Consent Requirements: Organizations must obtain explicit consent from consumers to process or share sensitive data. Consent for selling sensitive data must be separate and include specific disclosures.
• Data Privacy Policies: Controllers must document data privacy policies, conduct privacy and protection assessments, and ensure security practices are in place.
• Geofencing Restrictions: Prohibits the use of geofences to track, collect data from, or send ads to consumers at in-person health care locations.

Significant Changes to Existing Law

• Introduces new legal requirements for businesses that handle sensitive data, including obtaining explicit consent before selling or processing such data.
• Establishes rules that prevent the use of geofencing technology to collect information from or target individuals seeking health care services.

Enforcement

• The Minnesota Attorney General is authorized to enforce these requirements and can issue warning letters for violations before pursuing legal action. The bill includes penalties of up to $7,500 per violation, but it does not create a private right of action (i.e., individuals cannot personally sue for violations).

Relevant Terms

• Consumer Data Privacy
• Sensitive Data
• Health Data
• Consent
• Biometric Data
• Geofencing
• Privacy Policy