Relating to affirmative defenses for entities using cybersecurity programs

Sponsored by the Senate Technology (companion To Lsb 1265hv By Committee on Economic Growth and Technology) Committee

Topics:Technology & privacy

Same legislation: HF 553

Write your legislators about itWhat changed before it passed

Official bill page Lobbyist declarations One-pager to print

Where it is now

Done: IntroducedMarch 2, 2023
Skipped: SubcommitteeSkipped
Done: Senate committeeMarch 2, 2023
Done: Passes the SenateApril 19, 202350–0
Skipped: House committeeSkipped
Done: Passes the HouseMarch 15, 202397–0
Done: To the GovernorMay 3, 2023
Done: Signed into lawMay 3, 2023

HF 553 became law → The same legislation passed as HF 553, so this version was set aside. Go to HF 553 What’s a funnel?

What’s in it

This bill creates affirmative defenses for entities using cybersecurity programs. The bill provides that a covered entity seeking an affirmative defense must use a cybersecurity program for the protection of personal information and restricted information and the cybersecurity program must reasonably conform to an industry-recognized cybersecurity framework. A cybersecurity program must continually evaluate and mitigate reasonably anticipated threats, periodically evaluate the maximum probable loss attainable from a data breach, and communicate to affected parties the risk posed and actions the affected parties could take to reduce damages if a data breach has occurred.

Read the full explanation

The scale and scope of a cybersecurity program is appropriate if the cost to operate the program is no less than the covered entity’s maximum probable loss value. A covered entity that satisfies these requirements and that reasonably conforms to an industry-recognized cybersecurity framework is entitled to an affirmative defense to a tort claim that alleges that the failure to implement reasonable information security controls resulted in a data breach concerning personal information or restricted information. The bill details industry-recognized cybersecurity frameworks that the covered entity may follow and reasonably comply with in order to qualify for the affirmative defense. The bill does not provide a private right of action, including a class action.

From the explanation printed with the bill as introduced, written by the Legislative Services Agency. Amendments adopted later aren’t reflected. Full bill text · What changed before it passed

Iowa Code it changes

Creates§554G.1 §554G.2 §554G.3 §554G.4

Read from the bill as introduced. Each links to every bill touching that chapter of the Iowa Code. How the Code works

Lobbying

4 for · 0 against · 25 undecided · Who →

Family tree

Where this legislation came from and where it went: earlier tries, the versions it moved through this Assembly, and later bills built on it.

Tried before

HF 2302Passed a chamber89th GA

90th General Assembly

HF 553Became lawHouse companion SF 495Didn’t advanceSenate companion

Earlier and later bills are matched by wording or an identical title; check the text to be sure it’s the same idea.

Tried before

This idea has been filed in an earlier General Assembly. None became law, though one got through a chamber.

HF 2302 Relating to affirmative defenses for entities using cybersecurity programs
89th General Assembly · Passed House · same title
Passed a chamber

Matched by the wording of each bill’s explanation, or an identical title. Companion bills and renumbered versions of this bill aren’t listed; they’re the same bill.