What are the profiling rights under Minnesota's Consumer Data Privacy Act?

Most US state privacy laws let a consumer opt out of profiling. Minnesota went further and gave them a right to argue with the outcome.

The right, in the statute's own terms

Section 325M.14, subdivision 1(g) applies where a consumer's personal data is profiled in furtherance of decisions that produce legal effects concerning a consumer or similarly significant effects concerning a consumer. Where that is the case, the consumer has:

The right to question the result of the profiling. The right to be informed of the reason that the profiling resulted in the decision. The right, if feasible, to be informed of what actions the consumer might have taken to secure a different decision and the actions that the consumer might take to secure a different decision in the future. The right to review the consumer's personal data used in the profiling.

And then the part that carries the most operational weight: if the decision is determined to have been based upon inaccurate personal data, taking into account the nature of the personal data and the purposes of the processing, the consumer has the right to have the data corrected and the profiling decision reevaluated based upon the corrected data.

Why that last clause is the hard one

Correcting inaccurate data is a familiar obligation; nearly every state privacy law has a right to correct. Reevaluating a past decision on the corrected data is a different kind of requirement, because it reaches into a system that has usually already moved on.

If your model scored an applicant six months ago and the score rested on a wrong input, Minnesota does not treat fixing the input as the end of the matter. The decision itself has to be run again. In practice that means you need to be able to reconstruct which model version and which inputs produced a specific historical decision, which is a retention and lineage problem rather than a privacy-notice problem.

Which decisions are in scope

Only profiling in furtherance of decisions producing legal effects or similarly significant effects. Ordinary personalization, recommendation ranking, and marketing segmentation do not usually meet that bar. Credit, insurance, housing, employment, education, and access to essential services usually do.

The distinction matters because the subdivision 1(g) package is expensive to support. Scoping it to the decisions that actually qualify is the difference between a workable process and an unworkable one.

The separate opt-out right

Subdivision 1(f) gives consumers the right to opt out of processing for targeted advertising, the sale of personal data, or profiling in furtherance of automated decisions producing legal or similarly significant effects.

So Minnesota runs two rights in parallel. A consumer can stop future profiling under 1(f), or contest a decision already made under 1(g). Building only the opt-out leaves the second one unanswered.

Deadlines and appeals

Subdivision 4(e) requires the controller to inform the consumer of action taken within 45 days of receipt, extendable once by 45 additional days where reasonably necessary, provided the controller tells the consumer of the extension and the reason within the first 45 days.

If you refuse, subdivision 5 requires an internal appeal process that is conspicuously available. You must answer an appeal within 45 days, extendable by 60 more where reasonably necessary. When you respond, you must give a written explanation and clearly and prominently tell the consumer how to file a complaint with the Office of the Attorney General.

One requirement in subdivision 5(d) is easy to miss and specific to Minnesota: the controller must maintain records of all appeals and the controller's responses for at least 24 months, and on written request by the attorney general as part of an investigation, compile and provide a copy of those records.

Next step

Profiling rights only bite if the Minnesota Act reaches you, and that is a threshold question before it is a systems question. The free 2-minute Obligation Scan checks which US state privacy laws apply to your business and what each one requires. See the Minnesota Consumer Data Privacy Act overview for applicability, and GDPR Article 22 for how the EU handles automated decisions.