Can I skip obtaining consent to disclose personal information for a business purpose in Minnesota? What are the requirements?

In Minnesota, obtaining consent to disclose personal information for a business purpose is generally required. However, there are certain conditions under which a new purpose for the collection of private or confidential data or a new use for private or confidential data can be authorized without obtaining consent. According to MNAC 1205.1400, the responsible authority shall authorize a new purpose for the collection of private or confidential data or a new use for private or confidential data under any one of the following conditions: if subsequent passage of federal or state legislation requires initiation of a new or different purpose or use pursuant to Minnesota Statutes, section 13.05, subdivision 4, clause (b), or the responsible authority, prior to initiation of the new or different purpose or use, complies with the provisions of either Minnesota Statutes, section 13.05, subdivision 4, clause (a), (c), or (d).

If the responsible authority seeks an individual’s informed consent to the release of private data to an insurer or the authorized representative of an insurer, the responsible authority shall comply with the provisions of Minnesota Statutes, section 13.05, subdivision 4, paragraph (d), clauses (1) to (7).

However, if the above conditions are not met, obtaining informed consent is required. According to MNAC 1205.1400, “Informed consent” means the data subject possesses and exercises sufficient mental capacity to make a decision which reflects an appreciation of the consequences of allowing the entity to initiate a new purpose or use of the data in question. The responsible authority shall not take any action to coerce any data subject to give an “informed consent.” All informed consents shall be given in writing. Prior to any signature being affixed to it by the data subject, such writing shall identify the consequences of the giving of informed consent. If the responsible authority makes reasonable efforts to obtain the informed consent of a data subject and if those efforts are not acknowledged in any way, the responsible authority shall interpret the silence of the data subject as the giving of an implied consent to the new or different purpose or use of the data.

Therefore, unless the conditions for authorization without consent are met, obtaining informed consent is required.

Jurisdiction

Minnesota

• Privacy