HF4475

Purpose

This bill aims to strengthen consumer data privacy in Minnesota by requiring certain privacy notices to be clearly labeled and more transparent. It seeks to ensure consumers understand what personal data is collected, how it is used, who it is shared with, and what rights they have to control their data.

Main Provisions

• Privacy notice content and accessibility

  • Controllers must provide a clear, accessible privacy notice that includes:
  • The categories of personal data processed
  • The purposes for processing those categories
  • The rights available to consumers (as described in section 325M.14) and how to exercise them, including how to appeal a controller’s action
  • The categories of personal data the controller sells or shares with third parties, and the categories of third parties involved
  • The controller’s contact information and how to reach it
  • The controller’s retention policies for personal data
  • The date the privacy notice was last updated
  • If the controller sells data to third parties, processes data for targeted advertising, or uses profiling that leads to decisions with legal or similarly significant effects on a consumer, the privacy notice must disclose this and provide a clearly accessible opt-out mechanism outside the privacy notice (e.g., a labeled link such as “Your OptOut Rights” or “Your Privacy Rights” that enables the opt-out).

• Language, accessibility, and format requirements

  • The privacy notice must be available in every language in which the controller provides the product or service or conducts related activities.
  • It must be reasonably accessible to and usable by individuals with disabilities.
  • The notice must be posted online via a conspicuous hyperlink on the controller’s homepage (labeled “privacy”) or on a mobile app store page. If the controller maintains a mobile app, a link to the privacy notice must also be in the app settings or a similarly visible location. If there is no website, the notice must be provided through a method the controller regularly uses to interact with consumers (including mail).

• Timing and updates

  • When a controller makes a material change to the privacy notice or practices, the controller must notify affected consumers about the changes, specifically for prospectively collected data, and give a reasonable opportunity to withdraw consent to any further materially different collection, processing, or transfer of previously collected data under the new policy.
  • The controller must take reasonable electronic steps to provide notification, considering available technology and the relationship with the consumer.

• General vs. Minnesota-specific notices

  • If a controller’s general privacy notice already contains all required information, the controller is not required to provide a separate Minnesota-specific privacy notice or section.

• Title requirement for certain disclosures

  • If the controller sells data to third parties, uses data for targeted advertising, or engages in profiling that produces legal or similarly significant effects on a consumer, the privacy notice must be clearly and conspicuously titled as a “surveillance notice.”

Significant Changes to Existing Law

• Incorporates a comprehensive set of transparency and accessibility requirements into Minnesota Statutes, modifying section 325M.16, subdivision 1.
• Adds explicit labeling and visibility requirements (including the “surveillance notice” title) for certain data processing activities.
• Expands language accessibility, disability accessibility, and cross-language publication requirements.
• Introduces an external opt-out mechanism for certain data uses (outside the privacy notice) with clearly labeled options.
• Requires detailed disclosures about data categories, purposes, sharing, retention, and updates, as well as a clear process to exercise rights and appeal actions.

Potential Practical Effects

• Greater transparency and consumer control over personal data.
• Increased obligations for businesses to maintain multilingual, accessible, and regularly updated privacy notices.
• More prominent opt-out mechanisms for sensitive data uses like targeted advertising and profiling.
• Businesses may need to implement new labeling, update privacy notices, and improve notice delivery methods (including app store and app settings).

Relevant Terms - privacy notice - surveillance notice - categories of personal data - purposes for processing - rights (section 325M.14) - opt out - sale - shares with third parties - third parties - contact information - retention policies - last updated - language requirements - accessibility - disability - material change - withdraw consent - prospectively collected data - materially different collection, processing, or transfer - Your OptOut Rights - Your Privacy Rights - Minnesota Statutes 2024 section 325M.16 subdivision 1 - general privacy notice - Minnesotan-specific privacy notice - conspicuous hyperlink - privacy on homepage - app store page - app settings link - surveillance notice label