Relating to consumer data protection, providing civil penalties, and including effective date provisions

The bill defines “process” or “processing” to mean any operation or set of operations performed, whether by manual or automated means, on personal data or on sets of personal data, such as the collection, use, storage, disclosure, analysis, deletion, or modification of personal data. The bill defines “processor” to mean a person that processes personal data on behalf of a controller. The bill defines “pseudonymous data” to mean personal data that cannot be attributed to a specific natural person without the use of additional information. The bill defines “publicly available information” to mean information that is lawfully made available to the general public through certain records or information that a business has reasonable basis to believe is lawfully made available under certain conditions. The bill defines “targeted advertising” to mean displaying advertisements to a consumer where the advertisement is selected based on personal data obtained from that consumer’s activities over time and across nonaffiliated websites or online applications to predict such consumer’s preferences or interests, with exceptions. The bill defines “third party” to mean a natural or legal person, public authority, agency, or body other than the consumer, controller, processor, or an affiliate of the processor or the controller. The bill contains other defined terms. The bill provides that persons conducting business in the state or producing products or services targeted to Iowans that annually control or process personal data of over 99,999 consumers or control or process personal data of 25,000 consumers with percent of gross revenue derived from the sale of the personal data shall be subject to the provisions of the bill. The state and political subdivisions of the state, financial institutions or data subject to the Gramm-Leach-Bliley Act of 1999, certain organizations governed by rules by the department of human services, the department of health, certain federal governance laws and the federal Health Insurance Portability and Accountability Act, nonprofit organizations, higher learning institutions, and certain protected information and personal data collected under state or federal laws are exempt from provisions in the bill. The bill provides consumers have personal data rights that may be invoked at any time. Consumers or the parent of a child may submit a request to a controller for a copy of the controller’s information relating to personal data. The controller shall comply with such requests to confirm or deny whether the controller is processing the personal data, to delete or correct inaccuracies in personal data, to provide the consumer with a copy of their personal data, and to remove the consumer or child from personal data processing. The bill requires that controllers provide responses to defined personal data requests within days of a consumer initiating a request. Responses to personal data requests shall be provided to a consumer free of charge up to twice per year except where requests are overly burdensome or manifestly unfounded. A business may extend the deadline for good cause, including complexity, once by up to days after informing the consumer of the reason for the extension. The bill provides that controllers are not required to comply with requests where a controller is unable through commercially reasonable efforts to verify the identity of the consumer submitting the request. The bill requires that controllers permit consumers to access an appeals process and provide consumers with information regarding the appeals process in situations where a consumer’s request is denied. The bill provides that controllers shall limit the collection of personal data to the extent reasonably necessary. Controllers must disclose to the consumer the types of data being collected and obtain consent from the consumers regarding the collection of personal data and sensitive personal data processing. Controllers must securely store personal data of consumers through administrative, technical, and physical security practices. Controllers shall not discriminate against consumers that exercise consumer data rights as provided in the bill by denying a consumer goods or services, charging different prices, or providing lower quality goods with exceptions. Contract provisions that require consumers to waive rights defined by the bill will be considered void and unenforceable. The bill provides that controllers give consumers reasonably accessible and clear privacy notices that inform consumers of the information regarding personal data transfer and purposes and the methods for consumers to exercise rights. The bill provides that controllers selling personal data to third parties or using targeted advertising must clearly disclose such activity and the right for the consumer to opt out of such sales or use. The bill requires a controller to create a method for private and secure processing of consumer requests. The bill requires processors and the assigns or subcontractors of processors to assist controllers in complying with duties created by the bill. The bill requires controllers to conduct assessments of processing activities regarding certain personal data. Data protection assessments shall consider benefits and risks regarding personal data processing to the controller, consumer, public, and other stakeholders among other factors identified by the bill. The bill provides that the attorney general may request an investigation and require that a controller disclose relevant data protection assessment information and analyze the provided information for compliance with duties described by the bill. Other data protection assessments a controller has conducted may suffice for purposes of the bill if the assessments are reasonably similar. The bill includes personal data processing exemptions, including pseudonymous data and de-identified data as defined by the bill. The bill requires that controllers in possession of de-identified data take measures to ensure that the data remains de-identified, publicly commit to a de-identified maintenance process, and require agents and assigns to adhere to provisions of the bill. The bill identifies exceptions where controllers or processors are not required to comply with a consumer rights request pursuant to the bill. The bill requires controllers disclosing pseudonymous or de-identified data to exercise reasonable oversight of contractual commitments regarding such data. The bill provides that the bill shall not restrict controller or processor abilities to improve business or function. Controllers or processors sharing personal data with third parties are not liable for the noncompliance of third parties if the controller or processor did not have personal knowledge of the violation or intent to commit a violation, nor is a third party liable for violations of a controller or processor. The bill provides that if a controller seeks certain exemptions, the controller bears the burden of demonstrating that the controller qualifies for the exemption and the exemption complies with the requirements in the bill. The bill shall not require a business, consumer, or other party to disclose trade secrets. The bill provides that the attorney general shall investigate controllers and processors upon reasonable cause for violations of provisions of the bill. The attorney general shall provide days’ notice to a controller or processor including the reason for which the entity is subject to an investigation and permit the entity to cure the defect prior to filing a civil action. A controller or processor found to be in violation of provisions of the bill is subject to a civil penalty of up to $7,500 per violation.16C. The attorney general shall recover reasonable expenses for expenses related to the investigation. The bill takes effect January 1, 2024.