Montana Consumer Data Privacy Act (MCDPA)

The Montana Consumer Data Privacy Act (MCDPA) became effective October 1, 2024.  It is designed to safeguard consumer data and enhance privacy rights for residents of Montana. The following is a summary of its key components:

• Consumer Rights

1. Right to Access: Consumers can request access to their personal data held by businesses.
2. Right to Correction: Consumers can request corrections to inaccurate personal data.
3. Right to Deletion: Consumers can request the deletion of their personal data under certain conditions.
4. Right to Data Portability: Consumers can obtain a copy of their personal data in a portable format.
5. Right to Opt-Out: Consumers can opt out of the processing of their data for targeted advertising and the sale of their data.

•  Business Obligations

1. 1. Transparency Requirements: Businesses must provide clear and accessible privacy notices detailing their data practices, including what data is collected, how it’s used, and third-party sharing.
   2. Data Minimization: Businesses are encouraged to limit data collection to what is necessary for their purposes.
   3. Security Measures: Companies must implement reasonable security practices to protect consumer data from unauthorized access or breaches.
   4. Compliance Mechanisms: Businesses are required to establish mechanisms for consumers to easily exercise their rights, including designated contact points for privacy inquiries.

• Scope and Applicability

1. 1. The act applies to businesses that:
      1. Control or process personal data of at least 100,000 consumers, or
      2.  Derive over 25% of their gross revenue from the sale of personal data and control or process the data of at least 25,000 consumers.
      3.  It covers both in-state businesses and those located out of state that handle the personal data of Montana residents.

• Enforcement and Penalties

1. 1. Enforcement Authority: The Montana Attorney General is responsible for enforcing the act. They can investigate complaints, issue fines, and seek injunctions against non-compliant businesses.
   2. Consumer Action: Consumers may also seek civil action against businesses that violate their rights, potentially resulting in damages.

• Exceptions

1. 1. The act includes certain exceptions, such as for data regulated by other federal laws (e.g., HIPAA for health data) and for certain non-profits and governmental entities.

• Conclusion

The MCDPA represents a significant step toward enhancing consumer data privacy in Montana, aiming to provide residents with greater control over their personal information and holding businesses accountable for their data practices. As data privacy continues to evolve, the MCDPA reflects growing public demand for transparency and protection in the digital landscape.

Mitchell Roth

mroth@rothjackson.com