Material Applicability

The MCDPA's material scope is defined by the following factors:

• Number of Data Subjects
• Revenue-Based Applicability
• Sectoral Exceptions Regulated by Other Laws
• Government and Public Agency Exemption
• Nonprofit Organization Exemption
• Higher Education Institution Exemption
• Employment and Agency Relationship Exemption
• Benefit Administration Data
• Exemption for Specific Purposes of Processing

Number of Data Subjects

MCDPA Sec.3(1)(1):

"The provisions of [sections 1 through 12] apply to persons that [...] control or process the personal data of not less than 50,000 consumers, excluding personal data controlled or processed solely for the purpose of completing a payment transaction"

MCDPA Sec.3(1)(2):

"control or process the personal data of not less than 25,000 consumers and derive more than 25% of gross revenue from the sale of personal data"

The law establishes two thresholds:

• 50,000 consumers for general applicability
• 25,000 consumers when combined with revenue criteria

Revenue-Based Applicability

MCDPA Sec.3(1)(2):

"derive more than 25% of gross revenue from the sale of personal data"

This threshold applies to entities that:

• Process data of at least 25,000 consumers
• Generate over 25% of gross revenue from personal data sales

Exemptions

Government and Public Agency Exemption

MCDPA Sec.4(1)(a):

"[Sections 1 through 12] do not apply to any: body, authority, board, bureau, commission, district, or agency of this state or any political subdivision of this state"

Nonprofit Organization Exemption

MCDPA Sec.4(1)(b):

"[Sections 1 through 12] do not apply to any: nonprofit organization"

Higher Education Institution Exemption

MCDPA Sec.4(1)(c):

"[Sections 1 through 12] do not apply to any: institution of higher education"

Sectoral Exceptions

MCDPA Sec.4(1)(e):

"[Sections 1 through 12] do not apply to any: financial institution or an affiliate of a financial institution governed by [...] Title V of the Gramm-Leach-Bliley Act"

The law exempts entities regulated by:

• HIPAA
• GLBA
• FERPA
• Fair Credit Reporting Act
• Other federal sectoral laws

Territorial Applicability

The MCDPA's territorial scope is determined by:

• Doing Business in Jurisdiction
• Offering Goods and Services to Data Subjects in Jurisdiction

MCDPA Sec.3:

"The provisions of [sections 1 through 12] apply to persons that conduct business in this state or persons that produce products or services that are targeted to residents of this state"

The law applies to entities that either:

• Conduct business in Montana
• Target products or services to Montana residents