Bill > HF2700

This bill modifies the Minnesota Consumer Data Privacy Act to classify consumer health data as a form of "sensitive data," which requires additional protections. Specifically, it expands the definition of sensitive data to explicitly include "health data," defined as personal data identifying a consumer's past, present, or future mental or physical health status, including diagnoses, treatments, biometric data, genetic information, and specific geolocation data that could indicate seeking healthcare. The bill also introduces new restrictions on the use of "geofences" (technology that creates virtual boundaries around physical locations) around healthcare providers, prohibiting their use to track individuals seeking care, collect health data, or send targeted health-related advertisements. Furthermore, it strengthens consent requirements for processing and sharing sensitive data, mandating that consent for sharing sensitive data must be separate from consent for processing health data and clearly disclose the categories of data, purpose of sharing, and entities involved. The bill also clarifies that entities complying with the Children's Online Privacy Protection Act (COPPA) are considered compliant with parental consent requirements for processing data of known children. Finally, it outlines enforcement mechanisms for violations, including a warning letter process for the Attorney General before initiating legal action, and establishes civil penalties for violations, while explicitly stating there is no private right of action for consumers to sue under this act.

Business and Industry, Justice

https://www.revisor.mn.gov/bills/bill.php?b=House&f=HF2700&ssn=0&y=2025