Update Applicable to:

All employers in the state of Montana who control or process data of not less than 50,000 state residents, excluding personal data controlled or processed solely for purposes of completing a payment transaction.

What happened?

On April 21, 2023, the Montana legislature unanimously passed Republican Senator Zolnikov’s Senate Bill 384 (SB 384) , which introduces a consumer privacy bill with provisions that closely align with last year’s Connecticut Data Privacy Act (CTDPA)

What are the details?

SB 384 applies to persons that conduct business in Montana or that produce products or services that are targeted to Montana residents and that control or process the personal data of not less than 50,000 state residents, excluding personal data controlled or processed solely for purposes of completing a payment transaction. The 50,000-consumer threshold was lowered from 100,000 in a House committee amendment.

The lower threshold presumably was done because of Montana’s smaller population in comparison to the populations of other states that have passed bills. Montana’s population is approximately 1.1 million. Therefore, a 100,000-consumer threshold would have been approximately 9% of the state’s population, which is a much higher percentage than in other states.

Requirement to Recognize Universal Opt-Out Mechanisms

Montana is the first Republican-controlled legislature to pass a bill requiring controllers to recognize universal opt-out mechanisms to effectuate requests to opt-out of sales and for targeted advertising. The Montana bill aligns with the Connecticut law and will not require the Montana Attorney General’s office to engage in rulemaking such as occurred in Colorado this past year. This provision will go into effect on January 1, 2025.

Additional Children’s Privacy Protections

Montana’s bill provides additional privacy protections for children between the ages of 13 and 15. Controllers cannot process the personal data of a consumer for the purposes of targeted advertising or sell the consumer’s personal data without the consumer’s consent under circumstances in which a controller has actual knowledge that the consumer is at least 13 years of age but younger than 16 years of age. The California and Connecticut laws have similar provisions.

Broad Privacy Rights

The Montana bill aligns with the privacy rights provided in the CTDPA. Consequently, Montana becomes only the second state (after Connecticut) to statutorily provide its residents with the right to revoke their consent (Colorado did so through rulemaking). Montana’s bill also allows a state resident to request that a controller delete all personal data that the controller possesses about the consumer as opposed to just personal data that the controller collected directly from the consumer.

The Montana bill also does not require opt-out requests to be verified. In other words, a Montana resident will not have to prove their identity to opt out of the sale of their personal data, for targeted advertising, or for certain types of profiling. Only California and Connecticut have similar provisions.

Sunset on Right to Cure

The Montana bill is enforceable only by the state Attorney General’s office. It does not provide a private right of action. The Montana bill requires the Attorney General’s office to provide a notice of violation and opportunity to cure; however, the right to cure sunsets on April 1, 2026. Montana is the first Republican-controlled legislature to pass a privacy bill with a sunsetting right to cure.

Effective Date

If signed by the Governor, the Montana law will go into effect on October 1, 2024. That is fourteen months before January 1, 2026, effective date for the Indiana bill passed earlier this month and three months before the January 1, 2025, effective date for the Iowa bill passed in March.

For more information, please see the links below:

Senate Bill 384 (SB 384)

Article

What do employers need to do?

Employers should review the links provided above and be on the look out for any more news regarding this bill. Vensure will continue to provide more updates as more news has been received.

This communication is intended solely for the purpose of conveying information. The present post might incorporate hyperlinks directing readers to websites managed by third-party entities. The inclusion of any links within this communication is meant to serve as points of reference and could encompass opinion articles from various law firms, articles from HR associations, official websites, news releases, and documents of government agencies, and other relevant third-party sources. Vensure has no authority over these external websites and bears no responsibility for their content. Furthermore, Vensure does not endorse the materials present on these websites. The contents of this communication should not be interpreted as legal advice or as a legal standpoint concerning specific facts or scenarios. Nor should it be deemed an exhaustive compilation of facts potentially pertinent to federal, state, or local laws. It is strongly advised that employers solicit legal guidance from an employment attorney when undertaking actions in response to any legal updates provided. This is due to the possibility of future alterations occurring in federal, state, and local laws, regulations, as well as the directives and guidelines issued by governing agencies. These changes may transpire at any given time, potentially rendering certain portions of the content within this update void or inaccurate.