Relating to affirmative defenses for entities using cybersecurity programs

Sponsored by the House Economic Growth and Technology Committee

Topics:Courts & civil law Technology & privacy

Same legislation: SSB 1095, HSB 154, SF 495

Write your legislators about itWhat changed before it passed

Official bill page Lobbyist declarations One-pager to print

Where it is now

Done: IntroducedFebruary 9, 2023
Done: SubcommitteeFebruary 9, 2023
Done: House committeeFebruary 28, 2023
Done: Passes the HouseMarch 15, 202397–0
Done: Senate committeeMarch 30, 2023
Done: Passes the SenateApril 19, 202350–0
Done: To the GovernorMay 3, 2023
Done: Signed into lawMay 3, 2023

Signed into law What’s a funnel?

What’s in it

AI summary Companies that use specific, industry-standard cybersecurity programs to protect private information can defend themselves in court if they suffer a data breach. To qualify, these businesses must constantly check for threats, estimate potential losses, and tell people how to protect themselves if a breach happens. This protection applies to lawsuits claiming the company failed to use proper security controls, but it does not allow individuals to start new types of lawsuits or class actions.¹

Read the official explanation

This bill creates affirmative defenses for entities using cybersecurity programs. The bill provides that a covered entity seeking an affirmative defense must use a cybersecurity program for the protection of personal information and restricted information and the cybersecurity program must reasonably conform to an industry-recognized cybersecurity framework. A cybersecurity program must continually evaluate and mitigate reasonably anticipated threats, periodically evaluate the maximum probable loss attainable from a data breach, and communicate to affected parties the risk posed and actions the affected parties could take to reduce damages if a data breach has occurred. The scale and scope of a cybersecurity program is appropriate if the cost to operate the program is no less than the covered entity’s maximum probable loss value. A covered entity that satisfies these requirements and that reasonably conforms to an industry-recognized cybersecurity framework is entitled to an affirmative defense to a tort claim that alleges that the failure to implement reasonable information security controls resulted in a data breach concerning personal information or restricted information. The bill details industry-recognized cybersecurity frameworks that the covered entity may follow and reasonably comply with in order to qualify for the affirmative defense. The bill does not provide a private right of action, including a class action.

Changed since by amendments S-3155, H-1071; see Amendments.

Full bill text · What changed before it passed²

House subcommittee

Named February 9, 2023 (as HSB 154). On February 21, 2023 it recommended passage. Vote Total: 3-0.

Three legislators hear a bill first and recommend what the committee should do; it’s the best time to weigh in. How to take part

Iowa Code it changes

Creates§554G.1 §554G.2 §554G.3 §554G.4

How the Code works³

Lobbying

4 for · 2 against · 42 undecided · Who →

Family tree

Tried before

HSB 555Cleared committee89th GA HF 2302Passed a chamber89th GA

Study bill

SSB 1095Renumbered HSB 154Renumbered

90th General Assembly

HF 553Became lawfrom HSB 154 SF 495Didn’t advancefrom SSB 1095

Earlier and later bills are matched by wording or an identical title.

Tried before

This idea has been filed in an earlier General Assembly. None became law, though one got through a chamber.

HF 2302 Relating to affirmative defenses for entities using cybersecurity programs
89th General Assembly · Passed House · same title
Passed a chamber
HSB 555 HSB 555
89th General Assembly · Approved by committee · nearly identical
Cleared committee

Matched by wording or an identical title.