Attorney explains what businesses need to know about data privacy law

Listen to this article

In May, Gov. Tim Walz signed the Minnesota Consumer Data Privacy Act (MNCDPA) into law, making it the nation’s 19th comprehensive data privacy law. Lisa Ellingson, attorney at Winthrop & Weinstine, explains what this means for Minnesota businesses.

Consumer data is information that is collected about individuals who purchase goods or services, and it is used by businesses to better understand customers, personalize marketing, and improve products and services. It includes such things as demographic information, behavioral data, and transaction histories. While this information can be used to improve customers’ experiences, customers have expressed significant concerns about how this data is being used and handled.

The United States does not have a national comprehensive data privacy law. California passed the first comprehensive consumer privacy legislation in the United States. Since then, states have taken steps to pass their own laws. Minnesota’s law will take effect on July 31, 2025.

As far as what Minnesota business owners need to do to get ready, Ellingson says that there are two buckets: those who are not in compliance and those familiar with consumer data privacy laws.

If consumer data privacy laws are brand new to a business, Ellingson says that there are many steps it needs to take. The first and most important, Ellingson explains, is awareness that the law will go into effect and what the scope of it is.

Each business should identify a person who has primary responsibility for compliance with the law, such as a chief privacy officer, she said. The law applies to those who either conduct business in Minnesota or produce products or services that are targeted to Minnesota residents. Those who do not comply can face civil penalties of up to $7,500 per violation, as well as reasonable attorney’s fees.

Businesses should understand the exclusions. State and federally chartered banks or credit unions, government entities, Indian tribes, as well as insurance companies, are excluded. Certain data, such as protected health information as defined by HIPAA, personal data regulated by the Family Educational Rights and Privacy Act (FERPA), and personal data processed pursuant to the Gramm-Leach-Bliley Act (GLBA) are excluded.

Newly affected business owners must also figure out how they are collecting, using, and disclosing personal information in their businesses, something referred to as data mapping. “Businesses need to get a handle on the consumer data that they have, why they have it, and who they share it with,” Ellingson advised. “And that, in and of itself, can be a huge task if you haven’t done it yet.”

“Companies are not always completely aware of every single way that they are using data, but now it does matter in order to make sure you have the right disclosures,” Ellingson added.

Ellingson says that business should use this time before the law goes into effect to create or update the necessary privacy notices, such as a website privacy policy. Businesses should also have processes in place to respond to consumer privacy requests. Additionally, businesses should have a system in place to document what the business is doing to comply with the law.

Then there are those Minnesota business owners doing business in other states with consumer data privacy laws already on the books. Ellingson, who notes that the MNCDPA is very similar in many respects to the laws that are out there, says that these business owners will have an advantage, as they are already in compliance. However, there are some notable differences here in Minnesota.

“One of the things that’s kind of interesting is that there is a provision about profiling to make decisions about consumers, and this is something where people would maybe use AI for this decision,” Ellingson explains. “The Minnesota law actually gives consumers the right to object to or contest the results of those decisions.”

Ellingson used the example of a profiling tool or AI used to sort through applications at an apartment rental company. “If the application gets denied, under the Minnesota law the renter or a potential renter can come back and contest that decision and ask about it,” Ellingson said.

Minnesota consumers have a right to question results of profiling, including being informed of the reason that profiling resulted in a decision. They are also permitted to review the data that was used in the profiling and correct any inaccurate data for reevaluation.

Consequently, Ellingson said, it is important that, if your business is using profiling to make decisions with significant effects on individuals, to be aware that the MNCDPA grants those individuals additional rights, such as the right to opt-out of the profiling and the right to contest decisions made as a result of the profiling.

Additionally, Ellingson says that business owners need to keep their eyes open for changes on the horizon—even though the law has not gone into effect yet. Potentially, the act will become applicable to many more entities. Currently, the law exempts many businesses. However, in Texas, Ellingson explained, the consumer data privacy law basically applies to everyone other than small businesses. This is something, according to Ellingson, that may apply to Minnesota as the law is tweaked.

“That would really expand the number of businesses that this would apply to,” Ellingson said.