Minnesota Consumer Data Privacy Act (“MCDPA”)
Information for Consumers   •   Information for Businesses   •   Frequently Asked Questions   •   File a Complaint

• You have a right to request a list of third parties to whom your data was sold.

• You have a right to opt-out, or say “no” to a business selling your data, using your data for profiling, or using targeted advertising with your data.

• You have a right to obtain a copy of the personal and sensitive data a business has about you.

• You have a right to know what information a business has collected about you.

• You have a right to correct inaccuracies in the data a business has collected about you.

• You have a right to delete personal and sensitive information that it has collected about you.

• You have the right to question profiling and automated decisions that affect you.

• Right to Lists

  A consumer may request and obtain a list of specific third parties to which an entity has disclosed the consumer’s personal data. If information is not kept based on sales of specific consumers’ data, the requesting consumer has the right to a list of third parties to which any consumers’ personal data has been sold.

  This may be important if you’re concerned that a company has sold your data without your knowledge or consent. Your data may be sold and re-used for a variety of purposes, including credit reporting, background checks, or digital marketing. However, once you’ve received the list of third parties, you can request to opt out of these sales or request they delete or correct your information. You can also use the list of third parties you obtain to then approach those third parties for their lists of entities to which they have sold your data.

  I want to make a request for sales information.

  I want to file a complaint about an entity that failed to provide me with sales information about my personal data.

• Right to Opt Out

  You may opt out of the processing of your personal data for the purposes of: (1) targeted advertising; (2) the sale of personal data; or (3) profiling in furtherance of automated decisions that produce legal effects (or similarly significant effects) concerning a consumer. You can also exercise your right to a universal opt-out system, such as a third-party service that submits opt-out requests to companies on your behalf.

  Automated decisions could include those facilitated by Artificial Intelligence (AI), algorithmic systems, or other computer systems that affect your employment, housing, education, financial services, or other consequential services and economic opportunities in your life.

  I want to make an opt-out request.

  I want to file a complaint about an entity that does not allow me to opt out of the processing of my personal data.

• Right to Copy

  You may obtain personal data about yourself, that you previously provided to a controller. The requested data must be supplied to you in a portable, and to the extent technically feasible, readily usable format that allows you to easily transmit the data somewhere else.

  This may be important if you want to switch between online platforms and bring your account data or contacts with you.

  I want to make a request for easy transfer of my personal data.

  I want to file a complaint about an entity failing to provide my data in an easily-transferrable format, or about an entity that has failed to adequately automate the transfer process.

• Right to Know

  The Act gives you the right to confirm whether an entity is processing your data, and gives you the right to access the categories of personal data and the purposes for which the categories of personal data are processed.

  This may be important if you do not want your data processed for certain purposes. For example, you may not want your health or financial information used in digital marketing or targeted advertising. You can submit a request to delete the data if you are not comfortable with how a company is using your data.

  I want to know about a company’s processing of my personal data.

  I want to file a complaint about an entity ignoring my request to know about its processing of my personal data.

• Right to Edit

  The Act gives you the right to correct inaccurate personal data concerning yourself, taking into account the nature of the data and the purposes for which the data is being used.

  I want to make a request for correction of my personal data.

  I want to file a complaint about an entity failing to correct inaccurate personal data.

• Right to Delete

  You may require that your personal data be deleted. This means the company must destroy the information so it cannot be retrieved or used in the future.

  I want to make a request for deletion of my personal data.

  I want to file a complaint about an entity failing to delete my personal data.

• Right to Question Profiling Decisions

  Many companies use personal data to “profile” consumers, which means using your data to analyze or predict personal aspects about you. A company might use profiling to make an automated decision that adversely affects you, such as a decision about your employment, housing, education, healthcare, or other consequential services and opportunities. You have various rights:

  • If your data is used for a decision that produces legal effects (or similarly significant effects), you have the right to “question” or contest the decision.
  • You also have the right to be informed of the reason that the profiling of your personal data resulted in the decision.
  • If feasible, you have the right to be informed of what actions you might have taken to secure a different decision, and what actions you might take to secure a different decision in the future.
  • More, you have the right to review the personal data that was used in the profiling. If the decision is determined to have been based on inaccurate information, you have the right to have the information corrected and the profiling decision reevaluated.

  For example, you might be worried that a company used your personal data to reject your application for housing or another service. You could submit a request to better understand how the company reached its decision. If you find out that the company used incorrect information—like an outdated credit report—you have the right to be reevaluated under the MCDPA.

  I want information about the profiling of my personal data by an entity.

  I want to file a complaint about an entity that was not transparent with me about its profiling of my personal data.

• Right to Informed and Unrestricted Choice

  Companies are prohibited from manipulating or deceiving you about your data rights. Companies also cannot pressure you into providing your data or accepting data processing. If you feel that you were pressured or manipulated into sharing your data, you can file a complaint with the AGO.

• Right to be Free from Discrimination

  Companies are prohibited from processing your personal data in a manner that would unlawfully discriminate against you with regard to your access to housing, employment, credit, or education. This means that a company cannot process your personal data on the basis of race, religion, sexual orientation or other protected classes for these unlawful discriminatory purposes. Companies also cannot use your personal data to unlawfully discriminate against you with respect to the offering or provision of goods, services, or accommodations of any place of public accommodation. If you are concerned that a company processed your personal data for such discriminatory purposes, you can file a complaint with the AGO.

The Official Website of Office of Minnesota Attorney General Keith Ellison

The Minnesota Attorney General's Office values diversity and is an equal opportunity employer.