Commerce finance and policy law focuses on cannabis, consumer data privacy protections

The 2023 law legalizing adult-use recreational cannabis in Minnesota has been updated.

Changes in a 2024 law fine-tune the legal and inter-governmental relationships among medicinal cannabis (legalized in 2014), hemp-derived THC edibles and other products (legalized in 2022), adult recreational cannabis (legalized in 2023) and the different regulatory structures governing each substance.

It also appropriates $5.53 million in fiscal year 2025 to the Office of Cannabis Management, $5.5 million to the Department of Health, and smaller amounts to other state agencies, offices, and departments with cannabis-related responsibilities.

The new law contains language establishing the Minnesota Consumer Data Privacy Act, which regulates businesses’ use of personal data on individuals. It also gives Minnesotans various rights regarding their personal data.

Finally, the law has a few policy provisions in commerce and consumer protection law.

Sponsored by Rep. Zack Stephenson (DFL-Coon Rapids) and Sen. Lindsey Port (DFL-Burnsville), the law takes effect July 1, 2024, unless otherwise noted.

HF4757*/SF4782/CH121

Appropriations

Among funding called for in the law is $5.5 million to the Department of Health for substance use treatment, recovery, and prevention grants; $2.8 million to operate the state’s medical cannabis program; and $2.73 million to the Office of Cannabis Management for enforcement purposes and operating a product testing lab and a reference lab. These appropriations are offset by reductions in appropriations made in the law that passed in 2023 so that there is no increase in the total amount being appropriated.

The Department of Commerce will receive $28,000 in fiscal year 2025 and $75,000 annually beginning in fiscal year 2026 to oversee the licensing of a scrap metal license sales, a new mandate for the department established in the law.

The attorney general’s office gets $941,000 in fiscal year 2026 and $701,000 in fiscal year 2027 to enforce provisions in the Minnesota Consumer Data Privacy Act. (Art. 2, Secs. 1, 3-5)

Cannabis policy

The 2023 recreational cannabis law allows up to eight cannabis plants in a single residence without a license. That has been increased to 16 plants for medical cannabis patients by allowing a designated caregiver registered with the Office of Cannabis Management to cultivate up to eight cannabis plants on behalf of a patient.

Many of the cannabis policy provisions outline how the Office of Cannabis Management will carry out its duties to regulate retail cannabis sales and cannabis cultivation, including issuing business licenses for these operations.

The 2023 law specifies that “social equity applicants” — people harmed by over-prosecution of cannabis laws in the past — receive preferential treatment in licensing, including receiving preapproval for various types of cannabis licenses. The 2024 law amends the definition of “social equity applicants” to: include all military veterans, not just those who lost honorable status due to an offense involving the possession or sale of cannabis or marijuana; adjust the definition of “emerging farmers ”; and add clarity on how to identify high-poverty areas . This section took effect May 25, 2024.

The new law establishes the maximum number of preapproval licenses that are available to social equity applicants: cannabis microbusiness, 100; cannabis testing facility, 50; cannabis retailer, 38; cannabis mezzobusiness, 25; cannabis wholesaler, 20, cannabis transporter, 20; cannabis cultivator, 13; cannabis delivery service, 10; and cannabis manufacturer, 6.

The law requires the Office of Cannabis Management to begin accepting applications for a pre-approval license lottery for social equity applicants no later than July 24. Others will have to wait until 2025. A second set of caps on cultivator, manufacturer, retailer, and mezzobusiness licenses applies when licenses become available to all applicants. Those caps will be in place until July 1, 2026. Applicants are not required to identify or have acquired any property on which a cannabis business will operate as part of the initial application stage.

A lottery system replaces a merit-based application system that was in the 2023 law and will be implemented if there are too many applicants for licenses. It will not apply to cities or counties seeking to establish, own, or operate a single municipal cannabis store; these must be given retail licenses by Office of Cannabis Management.

Other policy changes include:

• making medicinal cannabis available for any medical condition approved by a patient’s licensed health care practitioner;

• making changes in testing procedures to measure THC levels in employees;

• prohibiting the sale of lower-potency hemp edibles to an obviously intoxicated person;

• permitting products having only hemp-derived cannabinoids to be sent out of state for testing; and

• prohibiting selling cannabis products in packaging with images that appeal to minors, such as toys or candy. (Art. 2, Secs. 13, 26-31, 71, 97, 108, 122, 125, 148)

Commerce and consumer policy

Among the commerce and consumer policy provisions, the law will increase the amount of money insurers doing business in Minnesota must annually contribute to the state’s insurance fraud prevention account; require lenders wanting to offer student loans to Minnesota residents to first register with the Department of Commerce; prohibit a manufacturer from directly or indirectly restricting, prohibiting, or otherwise interfering with the delivery of a covered outpatient drug to a pharmacy; give patients more rights when health insurance coverage is denied and require licenses for scrap metal license sales. (Art. 4, Secs. 1-6)

Minnesota Consumer Data Privacy Act

The law regulates businesses’ use of personal data on individuals and gives Minnesotans various rights regarding their personal data. Additionally, covered businesses must comply with new data privacy and information security requirements.

It includes definitions of both “consumer” and “controller,” and specifies the legal entities affected by the act, while excluding government entities and American Indian tribes. Processing of personal data already subject to heightened privacy regulation at the federal level is excluded.

Minnesota consumers will be given seven rights regarding their personal data:

• to know and access personal data processed by a controller;

• to correct inaccurate personal data;

• to delete personal data;

• to obtain a copy of the consumer’s personal data;

• to opt out of the processing of personal data for purposes of targeted advertising, the sale of personal data, or profiling that has certain significant consequences;

• a right to review, understand, question, and correct how personal data has been profiled; and

• a right to obtain a list of the specific third parties to which a controller has disclosed the consumer’s personal data.

The law requires controllers to limit the collection of personal data to what is adequate, relevant, and reasonably necessary in relation to the purposes for which the data are processed, which must be disclosed to the consumer. A controller must document and maintain a description of the policies and procedures the controller has adopted to comply with the act.

The attorney general is empowered to enforce the act and may bring a civil action against a controller or processor for alleged violations.

Any controller or processor found to have violated this act is subject to an injunction and liable for a civil penalty of not more than $7,500 for each violation.

Minnesota Consumer Data Privacy Act provisions take effect July 31, 2025, except postsecondary institutions regulated by the Office of Higher Education are not required to comply until July 31, 2029. (Art. 5, Secs. 4, 8, 10, 12)

HF4757* / SF4782 / CH121