Relating to consumer data protection, making penalties applicable, and including effective date provisions

This bill relates to consumer data protection. The bill defines “controller” to mean a person that, alone or jointly with others, determines the purpose and means of processing personal data. The bill defines “process” or “processing” to mean any operation or set of operations performed, whether by manual or automated means, on personal data or on sets of personal data, such as the collection, use, storage, disclosure, analysis, deletion, or modification of personal data. The bill defines “processor” to mean a person that processes personal data on behalf of a controller. The bill defines “pseudonymous data” to mean personal data that cannot be attributed to a specific natural person without the use of additional information. The bill defines “targeted advertising” to mean displaying advertisements to a consumer where the advertisement is selected based on personal data obtained from that consumer’s activities over time and across nonaffiliated websites or online applications to predict such consumer’s preferences or interests, with exceptions. The bill provides that persons conducting business in the state or producing products or services targeted to Iowans that annually control or process personal data of over 99,999 consumers or control or process personal data of 25,000 consumers with percent of gross revenue from the sale of the personal data shall be subject to the provisions of the bill. The state and political subdivisions of the state, financial institutions or data subject to the Gramm-Leach-Bliley Act of 1999, certain organizations governed by rules by the department of human services, the department of health, certain federal governance laws and HIPAA, nonprofit organizations, higher learning institutions, and certain protected information and personal data collected under state or federal laws are exempt from provisions in the bill. The bill provides consumers have personal data rights that may be invoked at any time. Consumers or the parent of a child may submit a request to a controller for a copy of the controller’s information relating to personal data. The controller shall comply with such requests to confirm or deny whether the controller is processing the personal data, to delete or correct inaccuracies in personal data, to provide the consumer with a copy of their personal data, and to remove the consumer or child from personal data processing. The bill requires that controllers provide responses to defined personal data requests within days of a consumer initiating a request. Responses to personal data requests shall be provided to a consumer free of charge up to twice per year except where requests are overly burdensome or manifestly unfounded. A business may extend the deadline for good cause, including complexity, once by up to days after informing the consumer of the reason for the extension. The bill provides that controllers are not required to comply with requests where a controller is unable through commercially reasonable efforts to verify the identity of the consumer submitting the request. The bill requires that controllers permit consumers to access an appeals process and provide consumers with information regarding the appeals process in situations where a consumer’s request is denied. The bill provides that controllers shall limit the collection of personal data to the extent reasonably necessary. Controllers must disclose to the consumer the types of data being collected and obtain consent from the consumers regarding the collection of personal data and sensitive personal data processing. Controllers must securely store personal data of consumers through administrative, technical, and physical security practices. Controllers shall not discriminate against consumers that exercise consumer data rights as provided in the bill by denying a consumer goods or services, charging different prices, or providing lower quality goods. Contract provisions that require consumers to waive rights defined by the bill will be considered void and unenforceable. The bill provides that controllers give consumers reasonably accessible and clear privacy notices that inform consumers of the information regarding personal data transfer and purposes and the methods for consumers to exercise rights. The bill provides that controllers selling personal data to third parties or using targeted advertising must clearly disclose such activity and the right for the consumer to opt out of such sales or use. The bill requires a controller to create a method for private and secure processing of consumer requests. The bill requires processors and the assigns or subcontractors of processors to assist controllers in complying with duties created by the bill. The bill requires controllers to conduct assessments of processing activities regarding personal data. Data protection assessments shall consider benefits and risks regarding personal data processing to the controller, consumer, public, and other stakeholders among other factors identified by the bill.16 and require that a controller disclose relevant data protection assessment information and analyze the provided information for compliance with duties described by the bill. Other data protection assessments a controller has conducted may suffice for purposes of the bill if the assessments are reasonably similar. The bill includes personal data processing exemptions, including pseudonymous data and de-identified data as defined by the bill. The bill requires that controllers in possession of de-identified data take measures to ensure that the data remains de-identified, publicly commit to a de-identified maintenance process, and require agents and assigns to adhere to provisions of the bill. The bill identifies exceptions where controllers or processors are not required to comply with a consumer rights request pursuant to the bill. The bill requires controllers disclosing pseudonymous or de-identified data to exercise reasonable oversight, security, and breach mitigation measures. The bill provides that the bill shall not, beyond the degree reasonably necessary, restrict controller or processor abilities to improve business or function. Controllers or processors sharing personal data with third parties are not liable for the noncompliance of third parties if the controller or processor did not have personal knowledge of the violation or intent to commit a violation, nor is a third party liable for violations of a controller or processor. The bill provides that if a controller seeks an exemption, the controller bears the burden of demonstrating that the controller qualifies for the exemption and the exemption complies with the requirements in the bill. The bill shall not require a business, consumer, or other party to disclose trade secrets.16 (consumer frauds). Several types of remedies are available if a court finds that a person has committed an unlawful practice, including injunctive relief, disgorgement of moneys or property, and a civil penalty not to exceed $40,000 per violation. The bill takes effect January 1, 2024.