Minnesotans will have more privacy protections for their online data under a new law set to take effect on Thursday.
The Consumer Data Privacy Act will give people in the state the right to opt out of businesses tracking personal data like names, email addresses or location history for use in targeted marketing. Traits like ethnicity and sexuality also are covered by the law.
The law grants consumers the right to obtain personal data held by a company and a list of other companies that bought the information. Consumers also can ask businesses to delete data or request that the business edit inaccuracies.
A growing number of states have introduced consumer information protection laws as data collection has become increasingly pervasive.
Generating data
Targeted advertisements based on a phone’s location or a user’s shopping history are just one facet of personal data collection. Newer cars and even some home appliances — like dishwashers and refrigerators — now connect to the internet, potentially giving outsiders information about a person’s habits.
A typical person generates about 1.7 gigabytes of data a day — the equivalent of 2,000 photos on a phone, said Minnesota Attorney General Keith Ellison. It can come from everything from fitness apps to social media browsing.
“We cannot and should not just think that violations and invasions of our privacy are just the way it is in this modern time,” Ellison said as he briefed reporters on the law Monday at the state Capitol. “We have a right to our privacy, and we have to protect it.”
Businesses have to comply with the law if they control or process the personal information of 100,000 or more Minnesota residents or if they earn more than 25% of their revenue from the sale of personal data and handle 25,000 consumers’ data.
For the first six months the law is in effect, businesses will have 30 days to correct violations after notification by the attorney general.
‘If you’re not paying anything for the product, you are the product’
Minnesota is now one of 19 states to adopt a consumer data privacy law.
While some companies are critical of what they call a patchwork of privacy laws, bill sponsor Rep. Steve Elkins, DFL-Bloomington, said the lack of federal action on the issue demanded action from the states.
Elkins, who has worked for the past 25 years in data management, said free applications — like weather apps — often harvest data from users such as location history and sell it to third parties.
“There’s an adage in the software industry,” he said. “If you’re not paying anything for the product, you are the product.”
Supporters say it will help empower consumers to question data-driven decision-making by businesses on jobs, housing and insurance, similar to how they can request data on their credit scores.
Protections under the law
Minnesota’s law has some advantages over others, including the right to question a company’s decision to deny a service, Elkins said.
For example, a property company will not be able to deny a tenant’s rental application and refuse to disclose data that may have helped them arrive at that decision merely because it is “proprietary.”
Other protections include a requirement for businesses to get permission from a parent or guardian before selling information of consumers under the age of 16. Consumers can question the results of automated decisions made about their data. Businesses have 45 days to respond to requests for information.
Data on a consumer’s ethnicity, race, religion, health, sexuality and genetic information also is protected under the new law.
Opt-out requirement
Some online platforms already give users the option to opt out of data sharing for targeted advertisements, including the search engine DuckDuckGo and the browser Mozilla Firefox, Elkins said. When the personal data law takes effect on Thursday, there will be a universal opt-out requirement.
Companies like Apple and Microsoft are generally in favor of third-party data selling restrictions, and most resistance comes from data broker companies, Elkins said. In 2019, a state lobbyist for Microsoft approached Elkins about sponsoring a data privacy bill.
To help acquaint Minnesotans with the new consumer protections, the attorney general’s office has launched a new website: privacymn.com.
Materials include drafts of letters consumers can use to assert their rights and guidance on how to report violations of the new law. It also offers guidance on how to set up opt-out mechanisms.
Complaints can be filed with the attorney general at 651-296-3353.
Related Articles
State Patrol planning third-party review for Capitol security assessment
Divided government means high stakes for Woodbury special election
Man with mental health issues found naked in Minnesota Capitol, raising new security concerns
Minnesota lawmakers can draw additional state funds for security costs
State Sen. Nicole Mitchell resigns from office after felony convictions
Leave a Reply