Minnesota Becomes 18th State to Pass Data Privacy Law
In what could be one of the final state-level privacy regulations passed in 2024, Minnesota has passed the Minnesota Consumer Data Privacy Act. The law is based on the typical WPA/Virginia model, although there are several major modifications and additions that make it, alongside Maryland, one of the most noteworthy laws in the country.
For consumers, Minnesotans have the strongest list of data rights in the country as of now, including rights like being able to see which third parties a controller has shared the specific consumer’s data with and protections against discriminatory data processing behavior only seen in a few states, as well as the brand new right to review and challenge the result of a decision made with profiling technology.
Businesses and nonprofits (which are not exempt) have unique new requirements as well, including never-before-seen disclosure demands for every data subject request received, ensuring data retention limits are in place, and maintaining an active data inventory.
While data mapping to establish a data inventory has long been a best practice for compliance, Minnesota becomes the first state to make it a requirement, which should spur any company not using a continuous data mapping solution to start doing so before the law enters into effect on July 31, 2025.
For a more detailed breakdown of the law and complete business requirements, click here.
