Minnesota Statutes Trade Regulations, Consumer Protection (Ch. 324-341) § 325M.12. Scope; exclusions

(1) during a calendar year, controls or processes personal data of 100,000 consumers or more, excluding personal data controlled or processed solely for the purpose of completing a payment transaction; or

(2) derives over 25 percent of gross revenue from the sale of personal data and processes or controls personal data of 25,000 consumers or more.

(1) a government entity, as defined bysection 13.02, subdivision 7a;

(2) a federally recognized Indian tribe;

(3) information that meets the definition of:

(4) information that is derived from any of the health care-related information listed in clause (3), but that has been deidentified in accordance with the requirements for deidentification set forth inCode of Federal Regulations, title 45, part 164;

(5) information originating from, and intermingled to be indistinguishable with, any of the health care-related information listed in clause (3) that is maintained by:

(6) information that is:

(7) information used only for public health activities and purposes, as described underCode of Federal Regulations, title 45, part 164.512;

(8) an activity involving the collection, maintenance, disclosure, sale, communication, or use of any personal data bearing on a consumer's credit worthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living by a consumer reporting agency, as defined inUnited States Code, title 15, section 1681a(f), by a furnisher of information, as set forth inUnited States Code, title 15, section 1681s-2, who provides information for use in a consumer report, as defined inUnited States Code, title 15, section 1681a(d), and by a user of a consumer report, as set forth inUnited States Code, title 15, section 1681b, except that information is only excluded under this paragraph to the extent that the activity involving the collection, maintenance, disclosure, sale, communication, or use of the information by the agency, furnisher, or user is subject to regulation under the federal Fair Credit Reporting Act,United States Code, title 15, sections 1681to1681x, and the information is not collected, maintained, used, communicated, disclosed, or sold except as authorized by the Fair Credit Reporting Act;

(9) personal data collected, processed, sold, or disclosed pursuant to the federal Gramm-Leach-Bliley Act,Public Law 106-102, and implementing regulations, if the collection, processing, sale, or disclosure is in compliance with that law;

(10) personal data collected, processed, sold, or disclosed pursuant to the federal Driver's Privacy Protection Act of 1994,United States Code, title 18, sections 2721to2725, if the collection, processing, sale, or disclosure is in compliance with that law;

(11) personal data regulated by the federal Family Educational Rights and Privacy Act,United States Code, title 20, section 1232g, and implementing regulations;

(12) personal data collected, processed, sold, or disclosed pursuant to the federal Farm Credit Act of 1971, as amended,United States Code, title 12, sections 2001to2279cc, and implementing regulations,Code of Federal Regulations, title 12, part 600, if the collection, processing, sale, or disclosure is in compliance with that law;

(13) data collected or maintained:

(14) personal data collected, processed, sold, or disclosed pursuant to the Minnesota Insurance Fair Information Reporting Act insections 72A.49to72A.505;

(15) data collected, processed, sold, or disclosed as part of a payment-only credit, check, or cash transaction where no data about consumers, as defined insection 325M.11, are retained;

(16) a state or federally chartered bank or credit union, or an affiliate or subsidiary that is principally engaged in financial activities, as described inUnited States Code, title 12, section 1843(k);

(17) information that originates from, or is intermingled so as to be indistinguishable from, information described in clause (8) and that a person licensed under chapter 56 collects, processes, uses, or maintains in the same manner as is required under the laws and regulations specified in clause (8);

(18) an insurance company, as defined insection 60A.02, subdivision 4, an insurance producer, as defined insection 60K.31, subdivision 6, a third-party administrator of self-insurance, or an affiliate or subsidiary of any entity identified in this clause that is principally engaged in financial activities, as described inUnited States Code, title 12, section 1843(k), except that this clause does not apply to a person that, alone or in combination with another person, establishes and maintains a self-insurance program that does not otherwise engage in the business of entering into policies of insurance;

(19) a small business, as defined by the United States Small Business Administration underCode of Federal Regulations, title 13, part 121, except that a small business identified in this clause is subject tosection 325M.17;

(20) a nonprofit organization that is established to detect and prevent fraudulent acts in connection with insurance; and

(21) an air carrier subject to the federal Airline Deregulation Act,Public Law 95-504, only to the extent that an air carrier collects personal data related to prices, routes, or services and only to the extent that the provisions of the Airline Deregulation Act preempt the requirements ofsections 325M.10to325M.21.