The Montana MTCDPA states that Montana residents have the right to request deletion of their data from data brokers, and that the data broker company must respond without undue delay and within 45 days at the latest. The data broker may extend their response time by 45 days when reasonably necessary, and must provide a reason in their notification to the individual within the initial 45 day window. If the data broker company refuses to delete the data, they must provide a reason and provide a process to appeal the decision. The data broker must respond to any appeal within 60 days, if they deny the appeal, they must provide information enabling the consumer to contact the Attorney General to submit a complaint.

Montana Resident Sample Email:

Dear [company name],

I am submitting a request for implementation of the following rights under Section 5(1)c of the Montana MTCDPA which grant Montana residents certain rights in relation to protection of their personal data information:

1) To obtain erasure (deletion) of personal data (information) without undue delay;
2) To withdraw any consent given to the processing of personal data (information);
3) To object to processing of personal data (information) concerning the below individual, including but not limited to profiling and direct marketing.

I can be identified by my details below:

Name:
Address:
E-mail address:

Please confirm your compliance with the request without undue delay and in any event within 45 (forty five) days of receipt of this request.

Thank you,

CONSUMER DATA PRIVACY ACT

Section 5. Consumer personal data — opt-out — compliance — appeals. (1) A consumer must
have the right to:
(a) confirm whether a controller is processing the consumer’s personal data and access the
consumer’s personal data, unless such confirmation or access would require the controller to reveal a trade
secret;
(b) correct inaccuracies in the consumer’s personal data, considering the nature of the personal data and the purposes of the processing of the consumer’s personal data;
(c) delete personal data about the consumer;
(d) obtain a copy of the consumer’s personal data previously provided by the consumer to the
controller in a portable and, to the extent technically feasible, readily usable format that allows the consumer to
transmit the personal data to another controller without hindrance when the processing is carried out by
automated means, provided the controller is not required to reveal any trade secret; and
(e) opt out of the processing of the consumer’s personal data for the purposes of:
(i) targeted advertising;
(ii) the sale of the consumer’s personal data, except as provided in [section 7(2)]; or
(iii) profiling in furtherance of solely automated decisions that produce legal or similarly significant
effects concerning the consumer.
(2) A consumer may exercise rights under this section by a secure and reliable means established
by the controller and described to the consumer in the controller’s privacy notice.