Minnesota consumers have new protections for sensitive data they provide to nonbank financial companies, including personal and financial information, through a new data security law championed by the Minnesota Department of Commerce that goes into effect Aug. 1, 2024.  

Cybersecurity events have increased over recent years, such as when computer hackers gain unauthorized access to an organization’s confidential consumer data. The new Minnesota data security law applies to mortgage, money services, and consumer finance nonbanks licensed by the Commerce Department to operate in Minnesota. The law requires companies to do three things:  

• Develop and put in place a cybersecurity program to help protect against and manage through unwarranted cybersecurity events.  
• Implement a plan to promptly respond to and recover from a cybersecurity event. 
• Promptly notify Commerce about cybersecurity events affecting 500 or more consumers.  

Additional information about the data security law.   

Minnesota is the first state to pass three model acts designed to provide consumer protections  

In addition to the new cybersecurity law, Minnesota also passed two additional consumer protection laws, created by the Conference of State Bank Supervisors: the Money Transmission Modernization Model Act (replacing Minnesota's previous outdated act) and the Nonbank Mortgage Service Prudential Standards Model Act.  Minnesota is the first state in the U.S. to pass all three full versions of the Conference of State Bank Supervisors Model Acts for nonbank financial services to provide consumer protections.  

“These three laws ensure Minnesota has state laws with modernized standards to provide consumer protections in the areas of money transmission and mortgage services,” said Commerce Commissioner Grace Arnold.    

“We applaud Commissioner Arnold and the Commerce Department team for their work with the Minnesota Legislature to establish comprehensive data security for the nonbank financial institutions that operate in the state,” said CSBS President and CEO Brandon Milhorn. “Data security and consumer protections are top priorities for state financial regulators.” 

The Minnesota Department of Commerce licenses and supervises more than 1,500 nonbank financial service companies across 19 different programs, including money services businesses, mortgage companies, consumer finance providers, payday lenders, and student loan services.  

What is a nonbank?  

A nonbank is a company that offers financial services without holding money deposits. Among the larger nonbank companies that may be well-known to Minnesota consumers are Rocket Mortgage, Toyota Motor Credit, and PayPal, which also owns Venmo.  See the animated video What is a Non-Bank? produced by the CSBS.   

Minnesota Department of Commerce Enforcement    

The Minnesota Department of Commerce works to assist and protect consumers, and to ensure a strong, fair marketplace. Minnesota consumers and businesses can contact Commerce’s Enforcement Division about concerns or complaints regarding nonbanks:  

• File a complaint online  
• Email or call: consumer.protection@state.mn.us | 651-539-1600.   
• Verify whether a nonbank company is licensed to do business in Minnesota: License Lookup. 
• Search Commerce Actions and Regulatory Documents to view past enforcement actions. 

Connect with the Minnesota Commerce Department  
Get updates and news from the Minnesota Department of Commerce by following Commerce at mn.gov/commerce or @MNCommerce on social media.

MEDIA CONTACT:   

Mo Schriner
Director of Communications
Mo.Schriner@state.mn.us