Bill > SF2940

This bill modifies the Minnesota Data Privacy Act to expand protections for consumer health data by making it a form of sensitive data with additional safeguards. Specifically, the bill adds comprehensive definitions for health data and geofencing, and introduces new requirements for processing and selling sensitive data. The legislation defines health data broadly, including information about medical conditions, treatments, health-related purchases, bodily functions, diagnostic testing, and even derived or inferred data about a consumer's health status. The bill prohibits implementing geofences around healthcare facilities to track or collect health data without consent and requires explicit, separate authorizations for processing or selling sensitive health information. Controllers must obtain specific, written consent that clearly explains what data will be processed, how it will be used, and provide consumers the ability to withdraw consent. The bill also expands enforcement powers for the Attorney General, allowing penalties of up to $7,500 per violation and extending enforcement to entities that are not traditional controllers or processors. The new provisions will become effective on July 31, 2025, with a delayed compliance date for postsecondary institutions until July 31, 2029.

Business and Industry

https://www.revisor.mn.gov/bills/bill.php?b=Senate&f=SF2940&ssn=0&y=2025