Minnesota Consumer Data Privacy Act 325M.15: 325M.15(c) to (e): oversight of deidentified and pseudonymous data and no reidentification

The Act does not require reidentifying deidentified data or associating requests with data a controller cannot reasonably link, and the access, correction, deletion, portability and third-party-list rights do not apply to pseudonymous data whose identifying information is kept separately under effective controls. A controller using pseudonymous or deidentified data must exercise reasonable oversight of compliance with the contractual commitments attached to it and address breaches of them; processors and third parties must not attempt to identify the subjects of deidentified or pseudonymous data without the controller's express authority, and no one may attempt to identify the subjects of data collected with only pseudonymous identifiers.