HF4456

Purpose and Intent

• This bill would create a data broker registry to strengthen consumer protection by requiring data brokers to register with the Minnesota Attorney General, establish an enforcement framework with civil penalties, and provide funding to administer the program.

Main Provisions

• Definitions

  • Data broker: a person who knowingly sells a consumer’s personal data to a third party, even if they have a direct relationship with the consumer, or if they sell data they didn’t directly collect from the consumer.
  • Direct relationship: when a consumer intentionally interacts with a person to obtain information about access, purchase, use, or to request that person’s products or services within the last three years. It does not include actions taken to exercise rights under section 325M.14 or to verify a consumer’s identity.
  • Exclusions: certain entities may be exempt if they meet other statutory exclusions.

• Registration required

  • Data brokers cannot collect or sell a consumer’s personal data unless they have a current registration approved by the Attorney General.
  • Registration must include: name, street address and telephone number, primary website and email, a working link to a page describing how consumers can exercise rights under section 325M.14, and any other information the Attorney General considers relevant.

• Compliance with other data duties

  • If a data broker is also a controller or a processor under sections 325M.10 to 325M.21, they must comply with those sections in order to be registered.

• Administration and public access

  • Once registered, the Attorney General must approve the registration.
  • Registrations are valid until December 31 of the year in which approval occurs.
  • The Attorney General must publish information from all registered data brokers on a public website.

• Fees and funding

  • The Attorney General must set a registration fee sufficient to cover the costs of administering and enforcing the section.
  • A data broker registry account is created in the state’s special revenue fund; all registration fees go into this account and money is used to administer and enforce the section.

• Enforcement

  • The Attorney General may bring civil actions against data brokers who violate these provisions.
  • The procedures, penalties, and limitations for enforcement follow the existing framework in section 325M.20.

How This Changes Minnesota Law

• Introduces a new mandatory registration regime for data brokers, creating a public registry and explicit state oversight.
• Establishes a dedicated funding mechanism to support enforcement and administration.
• Ties registration to compliance with related data protection duties (controller/processor obligations) and to consumer rights disclosures (rights under section 325M.14).

Practical Implications

• Data brokers will need to assess whether they have a “direct relationship” with Minnesota consumers and determine if they sell data to third parties.
• Eligible data brokers must prepare and maintain a rights-disclosure page and ensure their contact information is accurate and publicly accessible.
• Consumers will gain visibility into who handles their data through the public registry and may have clearer channels to exercise certain rights.

Enforcement and Compliance Timeline

• Registration is valid yearly and must be renewed; the exact renewal timing aligns with the year of approval and December 31 deadline noted in the bill.
• Civil actions can be brought by the Attorney General for violations, using the existing penalties framework.

Relevant Terms - data broker - personal data - direct relationship - consumer rights (325M.14) - attorney general - registration - data broker registry - public registry / public website - registration fee - special revenue fund - data broker registry account - controller - processor - enforcement - civil penalties - 325M.10 to 325M.21 (existing related provisions) - 325M.12 (exclusions) - 325M.14 (rights) - 325M.20 (enforcement penalties)