Intended to create a framework for controlling and processing personal consumer data in Montana, the CDPA applies to any person conducting business in the state or who produces products or services targeted to state residents. This also only pertains to entities/individuals:

• processing personal data of at least 50,000 consumers; or
• controlling/processing personal data of at least 25,000 consumers and derives 25 percent of gross revenue from the sale of personal data.

Under the CDPA, consumers will be able to access personal data; correct inaccuracies; request data deletion; obtain copies and opt out of the sale of data.

Exempt from the terms of the CDPA is the "collection, maintenance, disclosure, sale, communication, or use of any personal information bearing on a consumer's credit worthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living by a consumer reporting agency, furnisher, or user that provides information for use in a consumer report and by a user of a consumer report, but only to the extent that the activity is regulated by and authorized under the Fair Credit Reporting Act, 15 U.S.C. 1681."

Other exemptions include:

• Nonprofit organizations
• Registered securities associations
• Financial institutions
• Data governed by the Gramm-Leach-Bliley Act
• Specific federal laws
• Covered entities governed by HIPAA

Private rights of action are prohibited by the CDPA; alternatively, the act grants the state attorney general exclusive enforcement authority. The attorney general is required to provide the data controller notice upon discovery of a potential CDPA violation. From that point, the data controller has 60 days to remedy the alleged violation before a suit can be filed.

Posted: June 12, 2023

All Rights Reserved © 2023 Business Information Group, Inc.
This document and/or presentation is provided as a service to our customers. Its contents are designed solely for informational purposes, and should not be inferred or understood as legal advice or binding case law, nor shared with any third parties. Persons in need of legal assistance should seek the advice of competent legal counsel. Although care has been taken in preparation of these materials, we cannot guarantee the accuracy, currency or completeness of the information contained within it. Anyone using this information does so at his or her own risk.