Minnesota Digital Choice Act

A bill for an act

relating to consumer protection; establishing the Minnesota Digital Choice Act;

establishing civil penalties; authorizing administrative rulemaking; proposing

coding for new law in Minnesota Statutes, chapter 325M.

BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF MINNESOTA:

Section 1.

new text begin

[325M.35] SOCIAL MEDIA DIGITAL CHOICE.

new text end

new text begin

Subdivision 1.

new text end

new text begin

Citation.

new text end

new text begin

This section may be cited as the "Minnesota Digital Choice

Act."

new text end

new text begin

Subd. 2.

new text end

new text begin

Definitions.

new text end

new text begin

(a) For purposes of this section, the following terms have the

meanings given.

new text end

new text begin

(b) "Open protocol" means a publicly available set of rules that:

new text end

new text begin

(1) enables interoperability and data exchange between social media platforms through

a shared data layer;

new text end

new text begin

(2) is not subject to licensing fees or patent restrictions; and

new text end

new text begin

(3) governs how a social media platform communicates and exchanges data with other

social media platforms.

new text end

new text begin

(c) "Personal data" means information that is linked or reasonably linkable to an identified

or identifiable natural person, including the natural person's social graph.

new text end

new text begin

(d) "Social graph" means data that represents a person's connections and interactions

within a social media platform. Social graph includes:

new text end

new text begin

(1) content the person generates;

new text end

new text begin

(2) the person's social connections with other users and entities;

new text end

new text begin

(3) the person's responses to other users' and entities' content, including comments,

reactions, mentions, reposts, shares, and other engagement;

new text end

new text begin

(4) the person's public profile;

new text end

new text begin

(5) metadata associated with an item identified in clauses (1) to (4); and

new text end

new text begin

(6) relational references sufficient to maintain the associations among data elements

described in clauses (1) to (4).

new text end

new text begin

Social graph does not include other users' and entities' content and responses, including

private messages, that the other users and entities have designated as private.

new text end

new text begin

(e) "Social media company" means an entity that owns or operates a social media

platform.

new text end

new text begin

(f) "Social media platform" has the meaning given in section 325M.31.

new text end

new text begin

(g) "User" has the meaning given in section 325M.31.

new text end

new text begin

Subd. 3.

new text end

new text begin

Data rights.

new text end

new text begin

(a) A user has a right to:

new text end

new text begin

(1) delete personal data that the social media company holds that was provided by or

obtained about the user; and

new text end

new text begin

(2) obtain from the social media company a copy of the user's personal data that the

social media company has processed. The user's personal data must be provided in a portable

and, to the extent technically feasible, readily usable format that allows the user to transmit

the data to another user without interference, where the processing is carried out by automated

means, provided the user is not required to reveal a trade secret.

new text end

new text begin

(b) A user may exercise the rights under this subdivision by submitting at any time a

request to a social media company specifying the rights the user elects to exercise.

new text end

new text begin

(c) A social media company must fulfill a user request to exercise the user's data rights

under this subdivision within five business days of the date the request is received.

new text end

new text begin

Subd. 4.

new text end

new text begin

Data interoperability requirements.

new text end

new text begin

(a) A social media company must

implement a transparent, third-party-accessible interoperability interface or interfaces that

allow a user to choose to:

new text end

new text begin

(1) share a common set of the user's current social graph or user-selected parts of the

user's social graph between the social media platforms the user designates; and

new text end

new text begin

(2) with the user's permission, enable third parties to access social graph data a user

creates and receive a notification when new or updated social graph data is available.

new text end

new text begin

(b) A social media company that receives personal data must reasonably secure any

personal data the social media company acquires.

new text end

new text begin

(c) In order to achieve interoperability under paragraph (a), clause (1), a social media

company must:

new text end

new text begin

(1) use an open protocol;

new text end

new text begin

(2) facilitate and maintain interoperability and continuous, real-time data sharing with

other social media platforms through an interoperability interface, based on reasonable

terms that do not discriminate between social media platforms;

new text end

new text begin

(3) establish reasonable and proportionate thresholds related to the frequency, nature,

and volume of requests. The social media company may assess a reasonable access fee for

requests that are beyond the reasonable and proportionate thresholds established under this

clause; and

new text end

new text begin

(4) disclose to other social media companies complete, accurate, and regularly updated

documentation describing access to the interoperability interface required under this section.

new text end

new text begin

(d) A social media company or third party is prohibited from collecting, using, or sharing

personal data obtained from other social media platforms through the interoperability

interface, except to protect the privacy and security of the information or maintain the

interoperability of services.

new text end

new text begin

(e) A social media company or third party is prohibited from sharing or receiving personal

data through the interoperability interface without the user's consent.

new text end

new text begin

(f) A social media company must adopt an accessible, prominent, and persistent method

for users to provide consent for data sharing with other social media platforms or third

parties through the interoperability interface. A social media company must implement the

user's instructions under this paragraph within five business days of the date the instructions

are received.

new text end

new text begin

(g) A social media company is not required to:

new text end

new text begin

(1) provide access to:

new text end

new text begin

(i) inferences, analyses, or derived data that the social media company has generated

internally about a user; or

new text end

new text begin

(ii) trade secrets, proprietary algorithms, ranking systems, or other internal operating

mechanisms; or

new text end

new text begin

(2) transmit data that:

new text end

new text begin

(i) is stored or structured in a proprietary format;

new text end

new text begin

(ii) does not have a reasonably available open, industry-standard format; and

new text end

new text begin

(iii) if transmitted, would disclose information described in paragraph (a).

new text end

new text begin

Subd. 5.

new text end

new text begin

Rulemaking; rebuttable presumption.

new text end

new text begin

(a) After completing an assessment,

the attorney general may adopt rules that identify open protocols the attorney general has

determined meet the requirements under subdivision 4.

new text end

new text begin

(b) A social media company that uses an open protocol identified in administrative rules

adopted by the attorney general under paragraph (a) is entitled to a rebuttable presumption

that the social media company provides access on reasonable terms that do not discriminate

between social media platforms.

new text end

new text begin

Subd. 6.

new text end

new text begin

Enforcement; penalties.

new text end

new text begin

(a) A social media company that violates this section

is subject to an injunction and liable for a civil penalty not to exceed $2,500 per affected

user. The civil penalty under this paragraph may be assessed and recovered only in a civil

action brought by the attorney general under section 8.31. If the state prevails in an action

to enforce this chapter, the court may, in addition to the penalties provided by this paragraph

or other remedies provided by law, determine and award to the state an amount that represents

the reasonable value of all or part of the state's litigation expenses incurred.

new text end

new text begin

(b) A penalty, fee, or expense recovered in an action brought under this section must be

deposited in an account in the special revenue fund and is appropriated to the attorney

general to offset costs incurred by the attorney general to enforce this section.

new text end

new text begin

(c) This section does not provide a private right of action under this section, section

8.31, or other law.

new text end