Read the full stored bill text
A bill for an act
relating to consumer protection; requiring data brokers to register with the attorney
general; establishing an account; providing for enforcement and civil penalties;
appropriating money; proposing coding for new law in Minnesota Statutes, chapter
325M.
BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF MINNESOTA:
Section 1.
new text begin
[325M.22] DATA BROKER REGISTRY.
new text end
new text begin
Subdivision 1.
new text end
new text begin
Definitions.
new text end
new text begin
(a) The definitions in section 325M.11 apply to this section
and the terms defined in this subdivision have the meanings given.
new text end
new text begin
(b) "Data broker" means a person who knowingly sells to a third party the personal data
of a consumer with whom the person does not have a direct relationship. Data broker includes
a person who has a direct relationship with a consumer but also sells personal information
about the consumer that the person did not directly collect from the consumer.
new text end
new text begin
(c) "Direct relationship" means a consumer intentionally interacts with a person to obtain
information about, access, purchase, use, or request the person's products or services within
the preceding three years. Direct relationship does not include a situation where the purpose
of a person's engagement with a person is (1) to exercise a right described under section
325M.14, or (2) for the person to verify the consumer's identity.
new text end
new text begin
Subd. 2.
new text end
new text begin
Exclusions.
new text end
new text begin
This section does not apply to a person or entity that is subject to
an exclusion under section 325M.12, subdivision 2.
new text end
new text begin
Subd. 3.
new text end
new text begin
Registration required.
new text end
new text begin
(a) A data broker is prohibited from collecting or selling
a consumer's personal data unless the data broker has a current registration approved by the
attorney general.
new text end
new text begin
(b) To register with the attorney general, a data broker must:
new text end
new text begin
(1) pay the registration fee established by the attorney general under subdivision 5; and
new text end
new text begin
(2) submit the following information in the form and manner specified by the attorney
general:
new text end
new text begin
(i) the data broker's name;
new text end
new text begin
(ii) the data broker's street address and telephone number;
new text end
new text begin
(iii) the data broker's primary website and electronic mail address;
new text end
new text begin
(iv) a valid and operating link to the data broker's website that details how consumers
may exercise the rights under section 325M.14 with respect to the data broker; and
new text end
new text begin
(v) other information the attorney general considers relevant for registration.
new text end
new text begin
(c) A data broker who is also a controller or a processor under sections 325M.10 to
325M.21 must comply with sections 325M.10 to 325M.21 in order to be registered under
this section.
new text end
new text begin
Subd. 4.
new text end
new text begin
Administration; public website.
new text end
new text begin
(a) If a data broker complies with the
registration requirements in subdivision 3, the attorney general must approve the registration.
A registration under this section is valid until December 31 of the year in which the attorney
general approves the registration.
new text end
new text begin
(b) The attorney general must make the information submitted by all registered data
brokers under subdivision 3 available to the public on a website maintained by the attorney
general.
new text end
new text begin
Subd. 5.
new text end
new text begin
Fees; special revenue fund account created.
new text end
new text begin
(a) The attorney general must
establish a fee for data broker registration under this section in an amount sufficient to pay
the costs incurred to administer and enforce this section. The determination of the fee amount
under this paragraph is not subject to chapter 14, including section 14.386.
new text end
new text begin
(b) A data broker registry account is established in the special revenue fund. All fees
recovered by the attorney general must be deposited in the data broker registry account.
Money in the data broker registry account is appropriated to the attorney general to pay the
costs incurred to administer and enforce this section.
new text end
new text begin
Subd. 6.
new text end
new text begin
Enforcement.
new text end
new text begin
The attorney general may bring a civil action against a data
broker who violates this section under section 325M.20. The procedures, penalties, and
limitations in section 325M.20 apply to an action by the attorney general against a data
broker under this section.
new text end
new text begin
EFFECTIVE DATE.
new text end
new text begin
This section is effective July 31, 2027.
new text end